emdash 0.7.0 → 0.9.0

package/src/database/migrations/035_bounded_404_log.ts

@@ -1,6 +1,8 @@
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { columnExists } from "../dialect-helpers.js";
+
 /**
  * Migration: Bounded 404 logging
  *
@@ -19,16 +21,22 @@ import { sql } from "kysely";
  */
 
 export async function up(db: Kysely<unknown>): Promise<void> {
+	const hitsExists = await columnExists(db, "_emdash_404_log", "hits");
+
 	// 1. Add columns.
-	await db.schema
-		.alterTable("_emdash_404_log")
-		.addColumn("hits", "integer", (col) => col.notNull().defaultTo(1))
-		.execute();
+	if (!hitsExists) {
+		await db.schema
+			.alterTable("_emdash_404_log")
+			.addColumn("hits", "integer", (col) => col.notNull().defaultTo(1))
+			.execute();
+	}
 
 	// SQLite won't accept a non-constant default when adding a NOT NULL column
 	// to a table with existing rows, so backfill in two steps: add nullable,
 	// populate, then rely on the application layer / future inserts to set it.
-	await db.schema.alterTable("_emdash_404_log").addColumn("last_seen_at", "text").execute();
+	if (!(await columnExists(db, "_emdash_404_log", "last_seen_at"))) {
+		await db.schema.alterTable("_emdash_404_log").addColumn("last_seen_at", "text").execute();
+	}
 
 	// Backfill last_seen_at from created_at for existing rows.
 	await sql`
@@ -44,68 +52,77 @@ export async function up(db: Kysely<unknown>): Promise<void> {
 	//    (3.25+, 2018) and Postgres. The previous GROUP BY approach was
 	//    accepted by SQLite but invalid on Postgres because `id` wasn't in
 	//    the GROUP BY or wrapped in an aggregate.
-	await sql`
-		WITH ranked AS (
-			SELECT
-				id,
-				path,
-				ROW_NUMBER() OVER (
-					PARTITION BY path
-					ORDER BY created_at DESC, id DESC
-				) AS rn,
-				COUNT(*) OVER (PARTITION BY path) AS path_count,
-				MAX(created_at) OVER (PARTITION BY path) AS latest_created_at
-			FROM _emdash_404_log
-		)
-		UPDATE _emdash_404_log
-		SET
-			hits = (SELECT path_count FROM ranked WHERE ranked.id = _emdash_404_log.id),
-			last_seen_at = (SELECT latest_created_at FROM ranked WHERE ranked.id = _emdash_404_log.id)
-		WHERE id IN (SELECT id FROM ranked WHERE rn = 1)
-	`.execute(db);
-
-	// Delete the non-keepers (every row except the freshest per path).
-	await sql`
-		DELETE FROM _emdash_404_log
-		WHERE id IN (
-			SELECT id FROM (
+	if (!hitsExists) {
+		await sql`
+			WITH ranked AS (
 				SELECT
 					id,
+					path,
 					ROW_NUMBER() OVER (
 						PARTITION BY path
 						ORDER BY created_at DESC, id DESC
-					) AS rn
+					) AS rn,
+					COUNT(*) OVER (PARTITION BY path) AS path_count,
+					MAX(created_at) OVER (PARTITION BY path) AS latest_created_at
 				FROM _emdash_404_log
-			) AS ranked
-			WHERE rn > 1
-		)
-	`.execute(db);
+			)
+			UPDATE _emdash_404_log
+			SET
+				hits = (SELECT path_count FROM ranked WHERE ranked.id = _emdash_404_log.id),
+				last_seen_at = (SELECT latest_created_at FROM ranked WHERE ranked.id = _emdash_404_log.id)
+			WHERE id IN (SELECT id FROM ranked WHERE rn = 1)
+		`.execute(db);
+
+		// Delete the non-keepers (every row except the freshest per path).
+		await sql`
+			DELETE FROM _emdash_404_log
+			WHERE id IN (
+				SELECT id FROM (
+					SELECT
+						id,
+						ROW_NUMBER() OVER (
+							PARTITION BY path
+							ORDER BY created_at DESC, id DESC
+						) AS rn
+					FROM _emdash_404_log
+				) AS ranked
+				WHERE rn > 1
+			)
+		`.execute(db);
+	}
 
 	// 3. Add unique index on path for upsert semantics.
 	await db.schema
 		.createIndex("idx_404_log_path_unique")
+		.ifNotExists()
 		.on("_emdash_404_log")
 		.column("path")
 		.unique()
 		.execute();
 
 	// Drop the old non-unique index; the unique one covers the same lookups.
-	await db.schema.dropIndex("idx_404_log_path").execute();
+	await db.schema.dropIndex("idx_404_log_path").ifExists().execute();
 
 	// 4. Index on last_seen_at for eviction ordering.
 	await db.schema
 		.createIndex("idx_404_log_last_seen")
+		.ifNotExists()
 		.on("_emdash_404_log")
 		.column("last_seen_at")
 		.execute();
 }
 
 export async function down(db: Kysely<unknown>): Promise<void> {
-	await db.schema.dropIndex("idx_404_log_last_seen").execute();
-	await db.schema.dropIndex("idx_404_log_path_unique").execute();
+	await db.schema.dropIndex("idx_404_log_last_seen").ifExists().execute();
+	await db.schema.dropIndex("idx_404_log_path_unique").ifExists().execute();
 
 	// Restore the original non-unique path index.
-	await db.schema.createIndex("idx_404_log_path").on("_emdash_404_log").column("path").execute();
+	await db.schema
+		.createIndex("idx_404_log_path")
+		.ifNotExists()
+		.on("_emdash_404_log")
+		.column("path")
+		.execute();
 
 	await db.schema.alterTable("_emdash_404_log").dropColumn("last_seen_at").execute();
 	await db.schema.alterTable("_emdash_404_log").dropColumn("hits").execute();

package/src/database/migrations/runner.ts

@@ -123,29 +123,156 @@ export async function getMigrationStatus(db: Kysely<Database>): Promise<Migratio
 	return { applied, pending };
 }
 
+/** Pattern for escaping special regex characters. Matches the shared helper in `database/repositories/content.ts`. */
+const REGEX_ESCAPE_PATTERN = /[.*+?^${}()|[\]\\]/g;
+
+/** Escape special regex characters so a string can be embedded literally in `new RegExp()`. */
+function escapeRegExp(value: string): string {
+	return value.replace(REGEX_ESCAPE_PATTERN, "\\$&");
+}
+
 /**
- * Run all pending migrations.
+ * Pattern used to detect the concurrent-migration race. The Kysely
+ * `SqliteAdapter.acquireMigrationLock` is a no-op (inherited by `kysely-d1`
+ * and our `EmDashD1Dialect`), so two isolates running migrations against the
+ * same database can both attempt `INSERT INTO _emdash_migrations` for the
+ * same migration name. The losing insert fails with a UNIQUE constraint
+ * error, which is benign: the other isolate is applying the same schema.
  *
- * Includes a fast-path: if the migration table already exists and contains
- * exactly MIGRATION_COUNT rows, all migrations have been applied and we can
- * skip the Kysely Migrator entirely. This avoids the expensive
- * `pragma_table_info` introspection that Kysely runs for every table in the
- * database (twice!) just to check if the migration tables exist.
- * On D1 with ~57 tables, that's ~116 queries saved per init.
+ * We match on the table name (not the full error text) because different
+ * SQLite drivers phrase the message differently
+ * (`UNIQUE constraint failed: _emdash_migrations.name` for better-sqlite3,
+ * `D1_ERROR: UNIQUE constraint failed: _emdash_migrations.name: SQLITE_CONSTRAINT`
+ * for D1, etc.). The pattern is built from `MIGRATION_TABLE` so a rename
+ * cannot silently disable race detection.
  */
-export async function runMigrations(db: Kysely<Database>): Promise<{ applied: string[] }> {
-	// Fast path: check if all migrations are already applied.
-	// A single cheap query vs the Migrator's full schema introspection.
+const MIGRATION_RACE_PATTERN = new RegExp(
+	`UNIQUE constraint failed: ${escapeRegExp(MIGRATION_TABLE)}\\.name`,
+	"i",
+);
+
+/** How long to wait for a concurrent migrator to finish before giving up. */
+const MIGRATION_RACE_WAIT_MS = 10_000;
+/** Polling interval while waiting for a concurrent migrator. */
+const MIGRATION_RACE_POLL_MS = 100;
+
+/**
+ * Pattern used to detect "table does not exist" errors across the dialects
+ * EmDash supports. The phrasing differs by driver:
+ *
+ *   - better-sqlite3: `no such table: _emdash_migrations`
+ *   - D1:             `D1_ERROR: no such table: _emdash_migrations: SQLITE_ERROR`
+ *   - PostgreSQL:     `relation "_emdash_migrations" does not exist`
+ *                     (also occasionally `table "_emdash_migrations" does not exist`)
+ *
+ * We deliberately match on the migration table name (rather than using the
+ * generic `isMissingTableError` helper) so an unexpected missing-table error
+ * naming a different table — implausible today since
+ * `getAppliedMigrationCount` only references `MIGRATION_TABLE`, but cheap
+ * insurance against future edits — is not silently swallowed. The pattern is
+ * built from `MIGRATION_TABLE` so a rename cannot drift.
+ */
+const MIGRATION_TABLE_MISSING_PATTERN = new RegExp(
+	`(?:no such table:\\s*${escapeRegExp(MIGRATION_TABLE)}\\b` +
+		`|(?:relation|table)\\s+"?${escapeRegExp(MIGRATION_TABLE)}"?\\s+does(?:n't| not) exist\\b)`,
+	"i",
+);
+
+/**
+ * Read the count of applied migrations.
+ *
+ * Returns `null` only when the migration table does not exist yet (which is
+ * the normal state on a fresh database before the first migration runs).
+ * Any other error is rethrown so callers — particularly
+ * `waitForConcurrentMigrator` — don't silently mask connection failures,
+ * permission errors, or other unexpected driver problems behind a 10s wait
+ * and a bogus "we're done" verdict.
+ */
+async function getAppliedMigrationCount(db: Kysely<Database>): Promise<number | null> {
 	try {
 		const result = await sql<{ count: number }>`
 			SELECT COUNT(*) as count FROM ${sql.ref(MIGRATION_TABLE)}
 		`.execute(db);
-		if (result.rows[0]?.count === MIGRATION_COUNT) {
-			return { applied: [] };
+		return Number(result.rows[0]?.count ?? 0);
+	} catch (error) {
+		if (MIGRATION_TABLE_MISSING_PATTERN.test(deepErrorMessage(error))) {
+			return null;
+		}
+		throw error;
+	}
+}
+
+/**
+ * Wait for a concurrent migrator to finish applying all migrations.
+ *
+ * Resolves to `true` once the migration table contains at least
+ * `MIGRATION_COUNT` rows (i.e. every migration this build knows about has
+ * been recorded), `false` if the deadline elapses first. We use `>=` rather
+ * than `===` so that an old isolate observing a database that has already
+ * been migrated by a newer build still treats the wait as settled instead
+ * of timing out.
+ */
+async function waitForConcurrentMigrator(db: Kysely<Database>): Promise<boolean> {
+	const deadline = Date.now() + MIGRATION_RACE_WAIT_MS;
+	while (Date.now() < deadline) {
+		const count = await getAppliedMigrationCount(db);
+		if (count !== null && count >= MIGRATION_COUNT) {
+			return true;
+		}
+		await new Promise((resolve) => setTimeout(resolve, MIGRATION_RACE_POLL_MS));
+	}
+	const finalCount = await getAppliedMigrationCount(db);
+	return finalCount !== null && finalCount >= MIGRATION_COUNT;
+}
+
+/** Extract the deepest error message available from a thrown value. */
+function deepErrorMessage(error: unknown): string {
+	if (error instanceof Error) {
+		const own = error.message ?? "";
+		if (error.cause) {
+			const causeMsg = deepErrorMessage(error.cause);
+			return own ? `${own}: ${causeMsg}` : causeMsg;
 		}
+		return own;
+	}
+	if (typeof error === "string") return error;
+	try {
+		return JSON.stringify(error);
 	} catch {
-		// Table doesn't exist yet (first run). Fall through to the Migrator
-		// which will create it.
+		return String(error);
+	}
+}
+
+/**
+ * Run all pending migrations.
+ *
+ * Includes a fast-path: if the migration table already exists and contains
+ * at least MIGRATION_COUNT rows, all migrations this build knows about have
+ * been applied and we can skip the Kysely Migrator entirely. This avoids
+ * the expensive `pragma_table_info` introspection that Kysely runs for
+ * every table in the database (twice!) just to check if the migration
+ * tables exist. On D1 with ~57 tables, that's ~116 queries saved per init.
+ *
+ * Concurrent-migration safety: the Kysely Migrator's `acquireMigrationLock`
+ * is a no-op for SQLite (and therefore D1), so two callers running this
+ * concurrently against the same database will both try to apply pending
+ * migrations. SQLite serializes the writes, but the loser still surfaces a
+ * `UNIQUE constraint failed: _emdash_migrations.name` error. We treat that
+ * specific error as benign: another caller is already applying the same
+ * schema. We wait for the concurrent migrator to finish, then return
+ * success. This matches the user-observable expectation that running
+ * migrations twice in a row is a no-op.
+ */
+export async function runMigrations(db: Kysely<Database>): Promise<{ applied: string[] }> {
+	// Fast path: check if all migrations are already applied.
+	// A single cheap query vs the Migrator's full schema introspection.
+	// We use `>=` rather than `===` so a database with extra rows from a
+	// newer build (e.g. mid-deploy old isolate, or downgrade) still skips
+	// the migrator instead of falling through to the race-recovery path
+	// unnecessarily.
+	const initialCount = await getAppliedMigrationCount(db);
+	if (initialCount !== null && initialCount >= MIGRATION_COUNT) {
+		return { applied: [] };
 	}
 
 	const migrator = new Migrator({
@@ -160,17 +287,23 @@ export async function runMigrations(db: Kysely<Database>): Promise<{ applied: st
 	const applied = results?.filter((r) => r.status === "Success").map((r) => r.migrationName) ?? [];
 
 	if (error) {
-		// Kysely sometimes wraps errors with an empty message. Check cause and
-		// failed migration results for the real error.
-		let msg = error instanceof Error ? error.message : JSON.stringify(error);
-		if (!msg && error instanceof Error && error.cause) {
-			msg = error.cause instanceof Error ? error.cause.message : JSON.stringify(error.cause);
-		}
+		// Walk error.cause to get the underlying driver message — Kysely
+		// often wraps with an empty top-level message.
+		const msg = deepErrorMessage(error);
 		const failedMigration = results?.find((r) => r.status === "Error");
-		if (failedMigration) {
-			msg = `${msg || "unknown error"} (migration: ${failedMigration.migrationName})`;
+
+		// Concurrent-migration race: another caller is applying (or just
+		// applied) the same migration. Wait for it to finish, then verify
+		// the schema is fully migrated and treat as success.
+		if (MIGRATION_RACE_PATTERN.test(msg)) {
+			const settled = await waitForConcurrentMigrator(db);
+			if (settled) {
+				return { applied };
+			}
 		}
-		throw new Error(`Migration failed: ${msg}`);
+
+		const failedSuffix = failedMigration ? ` (migration: ${failedMigration.migrationName})` : "";
+		throw new Error(`Migration failed: ${msg || "unknown error"}${failedSuffix}`);
 	}
 
 	return { applied };

package/src/database/repositories/audit.ts

@@ -143,14 +143,12 @@ export class AuditRepository {
 
 		if (query.cursor) {
 			const decoded = decodeCursor(query.cursor);
-			if (decoded) {
-				q = q.where((eb) =>
-					eb.or([
-						eb("timestamp", "<", decoded.orderValue),
-						eb.and([eb("timestamp", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
-					]),
-				);
-			}
+			q = q.where((eb) =>
+				eb.or([
+					eb("timestamp", "<", decoded.orderValue),
+					eb.and([eb("timestamp", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+				]),
+			);
 		}
 
 		const rows = await q.execute();

package/src/database/repositories/byline.ts

@@ -123,14 +123,12 @@ export class BylineRepository {
 
 		if (options?.cursor) {
 			const decoded = decodeCursor(options.cursor);
-			if (decoded) {
-				query = query.where((eb) =>
-					eb.or([
-						eb("created_at", "<", decoded.orderValue),
-						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
-					]),
-				);
-			}
+			query = query.where((eb) =>
+				eb.or([
+					eb("created_at", "<", decoded.orderValue),
+					eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+				]),
+			);
 		}
 
 		const rows = await query.execute();

package/src/database/repositories/comment.ts

@@ -143,14 +143,12 @@ export class CommentRepository {
 		// Cursor pagination (ascending by created_at)
 		if (options.cursor) {
 			const decoded = decodeCursor(options.cursor);
-			if (decoded) {
-				query = query.where((eb: ExpressionBuilder<Database, "_emdash_comments">) =>
-					eb.or([
-						eb("created_at", ">", decoded.orderValue),
-						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", ">", decoded.id)]),
-					]),
-				);
-			}
+			query = query.where((eb: ExpressionBuilder<Database, "_emdash_comments">) =>
+				eb.or([
+					eb("created_at", ">", decoded.orderValue),
+					eb.and([eb("created_at", "=", decoded.orderValue), eb("id", ">", decoded.id)]),
+				]),
+			);
 		}
 
 		query = query
@@ -202,14 +200,12 @@ export class CommentRepository {
 		// Cursor pagination (descending by created_at)
 		if (options.cursor) {
 			const decoded = decodeCursor(options.cursor);
-			if (decoded) {
-				query = query.where((eb: ExpressionBuilder<Database, "_emdash_comments">) =>
-					eb.or([
-						eb("created_at", "<", decoded.orderValue),
-						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
-					]),
-				);
-			}
+			query = query.where((eb: ExpressionBuilder<Database, "_emdash_comments">) =>
+				eb.or([
+					eb("created_at", "<", decoded.orderValue),
+					eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+				]),
+			);
 		}
 
 		query = query

package/src/database/repositories/content.ts

@@ -489,27 +489,26 @@ export class ContentRepository {
 			query = query.where("locale" as any, "=", options.where.locale);
 		}
 
-		// Handle cursor pagination
+		// Handle cursor pagination — decodeCursor throws InvalidCursorError
+		// on malformed input; let it propagate so handlers surface a
+		// structured INVALID_CURSOR rather than silently returning page 1.
 		if (options.cursor) {
-			const decoded = decodeCursor(options.cursor);
-			if (decoded) {
-				const { orderValue, id: cursorId } = decoded;
-
-				if (safeOrderDirection === "DESC") {
-					query = query.where((eb) =>
-						eb.or([
-							eb(dbField as any, "<", orderValue),
-							eb.and([eb(dbField as any, "=", orderValue), eb("id", "<", cursorId)]),
-						]),
-					);
-				} else {
-					query = query.where((eb) =>
-						eb.or([
-							eb(dbField as any, ">", orderValue),
-							eb.and([eb(dbField as any, "=", orderValue), eb("id", ">", cursorId)]),
-						]),
-					);
-				}
+			const { orderValue, id: cursorId } = decodeCursor(options.cursor);
+
+			if (safeOrderDirection === "DESC") {
+				query = query.where((eb) =>
+					eb.or([
+						eb(dbField as any, "<", orderValue),
+						eb.and([eb(dbField as any, "=", orderValue), eb("id", "<", cursorId)]),
+					]),
+				);
+			} else {
+				query = query.where((eb) =>
+					eb.or([
+						eb(dbField as any, ">", orderValue),
+						eb.and([eb(dbField as any, "=", orderValue), eb("id", ">", cursorId)]),
+					]),
+				);
 			}
 		}
 
@@ -671,27 +670,24 @@ export class ContentRepository {
 			.selectAll()
 			.where("deleted_at" as never, "is not", null);
 
-		// Handle cursor pagination
+		// Handle cursor pagination — decodeCursor throws on invalid input.
 		if (options.cursor) {
-			const decoded = decodeCursor(options.cursor);
-			if (decoded) {
-				const { orderValue, id: cursorId } = decoded;
-
-				if (safeOrderDirection === "DESC") {
-					query = query.where((eb) =>
-						eb.or([
-							eb(dbField as any, "<", orderValue),
-							eb.and([eb(dbField as any, "=", orderValue), eb("id", "<", cursorId)]),
-						]),
-					);
-				} else {
-					query = query.where((eb) =>
-						eb.or([
-							eb(dbField as any, ">", orderValue),
-							eb.and([eb(dbField as any, "=", orderValue), eb("id", ">", cursorId)]),
-						]),
-					);
-				}
+			const { orderValue, id: cursorId } = decodeCursor(options.cursor);
+
+			if (safeOrderDirection === "DESC") {
+				query = query.where((eb) =>
+					eb.or([
+						eb(dbField as any, "<", orderValue),
+						eb.and([eb(dbField as any, "=", orderValue), eb("id", "<", cursorId)]),
+					]),
+				);
+			} else {
+				query = query.where((eb) =>
+					eb.or([
+						eb(dbField as any, ">", orderValue),
+						eb.and([eb(dbField as any, "=", orderValue), eb("id", ">", cursorId)]),
+					]),
+				);
 			}
 		}
 
@@ -921,8 +917,14 @@ export class ContentRepository {
 	 * Syncs the draft revision's data into the content table columns so the
 	 * content table always reflects the published version.
 	 * If no draft revision exists, creates one from current data and publishes it.
+	 *
+	 * `publishedAt` (optional) overrides the publication timestamp. If omitted,
+	 * the existing `published_at` is preserved (idempotent re-publish keeps the
+	 * original date) and falls back to the current time on first publish. Pass
+	 * an explicit value to backdate a publish (e.g. when migrating content from
+	 * another CMS).
 	 */
-	async publish(type: string, id: string): Promise<ContentItem> {
+	async publish(type: string, id: string, publishedAt?: string): Promise<ContentItem> {
 		const tableName = getTableName(type);
 		const now = new Date().toISOString();
 
@@ -960,17 +962,35 @@ export class ContentRepository {
 			}
 		}
 
-		await sql`
-			UPDATE ${sql.ref(tableName)}
-			SET live_revision_id = ${revisionToPublish},
-				draft_revision_id = NULL,
-				status = 'published',
-				scheduled_at = NULL,
-				published_at = COALESCE(published_at, ${now}),
-				updated_at = ${now}
-			WHERE id = ${id}
-			AND deleted_at IS NULL
-		`.execute(this.db);
+		if (publishedAt !== undefined) {
+			// Caller supplied an explicit timestamp, so we overwrite published_at
+			// directly (used to backdate a publish, e.g. for content migrations).
+			await sql`
+				UPDATE ${sql.ref(tableName)}
+				SET live_revision_id = ${revisionToPublish},
+					draft_revision_id = NULL,
+					status = 'published',
+					scheduled_at = NULL,
+					published_at = ${publishedAt},
+					updated_at = ${now}
+				WHERE id = ${id}
+				AND deleted_at IS NULL
+			`.execute(this.db);
+		} else {
+			// No timestamp supplied — preserve existing published_at on
+			// idempotent re-publish, fall back to `now` on first publish.
+			await sql`
+				UPDATE ${sql.ref(tableName)}
+				SET live_revision_id = ${revisionToPublish},
+					draft_revision_id = NULL,
+					status = 'published',
+					scheduled_at = NULL,
+					published_at = COALESCE(published_at, ${now}),
+					updated_at = ${now}
+				WHERE id = ${id}
+				AND deleted_at IS NULL
+			`.execute(this.db);
+		}
 
 		const updated = await this.findById(type, id);
 		if (!updated) {
@@ -1018,6 +1038,7 @@ export class ContentRepository {
 			UPDATE ${sql.ref(tableName)}
 			SET live_revision_id = NULL,
 				status = 'draft',
+				published_at = NULL,
 				updated_at = ${now}
 			WHERE id = ${id}
 			AND deleted_at IS NULL
@@ -1198,7 +1219,10 @@ export class ContentRepository {
 			scheduledAt: "scheduled_at",
 			deletedAt: "deleted_at",
 			title: "title",
+			name: "name",
 			slug: "slug",
+			status: "status",
+			locale: "locale",
 		};
 
 		const mapped = mapping[field];

package/src/database/repositories/index.ts

@@ -27,4 +27,4 @@ export { RedirectRepository } from "./redirect.js";
 export { BylineRepository } from "./byline.js";
 export type { CreateBylineInput, UpdateBylineInput, ContentBylineInput } from "./byline.js";
 export type * from "./types.js";
-export { EmDashValidationError, encodeCursor, decodeCursor } from "./types.js";
+export { EmDashValidationError, InvalidCursorError, encodeCursor, decodeCursor } from "./types.js";

package/src/database/repositories/media.ts

@@ -202,20 +202,17 @@ export class MediaRepository {
 			.orderBy("id", "desc")
 			.limit(limit + 1);
 
-		// Handle cursor-based pagination
+		// Handle cursor-based pagination — throws on invalid cursor.
 		if (options.cursor) {
-			const decoded = decodeCursor(options.cursor);
-			if (decoded) {
-				const { orderValue: createdAt, id: cursorId } = decoded;
-
-				// Keyset pagination: get items where (created_at, id) < cursor
-				query = query.where((eb) =>
-					eb.or([
-						eb("created_at", "<", createdAt),
-						eb.and([eb("created_at", "=", createdAt), eb("id", "<", cursorId)]),
-					]),
-				);
-			}
+			const { orderValue: createdAt, id: cursorId } = decodeCursor(options.cursor);
+
+			// Keyset pagination: get items where (created_at, id) < cursor
+			query = query.where((eb) =>
+				eb.or([
+					eb("created_at", "<", createdAt),
+					eb.and([eb("created_at", "=", createdAt), eb("id", "<", cursorId)]),
+				]),
+			);
 		}
 
 		if (options.mimeType) {