emdash 0.7.0 → 0.9.0

package/src/database/repositories/plugin-storage.ts

@@ -226,14 +226,12 @@ export class PluginStorageRepository<T = unknown> implements StorageCollection<T
 			query = query.where(({ eb }) => eb(sql.join(whereSqlParts, sql.raw("")), "=", sql.raw("1")));
 		}
 
-		// Handle cursor-based pagination
+		// Handle cursor-based pagination — throws on invalid cursor.
 		if (cursor) {
 			const decoded = decodeCursor(cursor);
-			if (decoded) {
-				query = query.where(({ eb }) =>
-					eb(sql`(created_at, id)`, ">", sql`(${decoded.orderValue}, ${decoded.id})`),
-				);
-			}
+			query = query.where(({ eb }) =>
+				eb(sql`(created_at, id)`, ">", sql`(${decoded.orderValue}, ${decoded.id})`),
+			);
 		}
 
 		// Build ORDER BY using sql template

package/src/database/repositories/redirect.ts

@@ -28,6 +28,9 @@ export const REFERRER_MAX_LENGTH = 512;
 /** Max stored length for the `User-Agent` header — truncated on insert. */
 export const USER_AGENT_MAX_LENGTH = 256;
 
+/** Pattern to escape LIKE wildcards: %, _, and backslash */
+const LIKE_ESCAPE_RE = /[\\%_]/g;
+
 /**
  * Truncate a header-derived string to `max` chars, preserving `null`/`undefined`
  * as `null`. Empty strings stay empty (the caller decides whether to coerce).
@@ -162,9 +165,15 @@ export class RedirectRepository {
 			.limit(limit + 1);
 
 		if (opts.search) {
-			const term = `%${opts.search}%`;
+			// Escape LIKE wildcards in the search term to prevent injection.
+			// Must include ESCAPE clause for SQLite to recognize backslash as escape char.
+			const escaped = opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\${c}`);
+			const term = `%${escaped}%`;
 			query = query.where((eb) =>
-				eb.or([eb("source", "like", term), eb("destination", "like", term)]),
+				eb.or([
+					sql<boolean>`source LIKE ${term} ESCAPE '\\'`,
+					sql<boolean>`destination LIKE ${term} ESCAPE '\\'`,
+				]),
 			);
 		}
 
@@ -182,14 +191,12 @@ export class RedirectRepository {
 
 		if (opts.cursor) {
 			const decoded = decodeCursor(opts.cursor);
-			if (decoded) {
-				query = query.where((eb) =>
-					eb.or([
-						eb("created_at", "<", decoded.orderValue),
-						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
-					]),
-				);
-			}
+			query = query.where((eb) =>
+				eb.or([
+					eb("created_at", "<", decoded.orderValue),
+					eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+				]),
+			);
 		}
 
 		const rows = await query.execute();
@@ -504,19 +511,19 @@ export class RedirectRepository {
 			.limit(limit + 1);
 
 		if (opts.search) {
-			query = query.where("path", "like", `%${opts.search}%`);
+			const escaped = opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\${c}`);
+			const term = `%${escaped}%`;
+			query = query.where(sql<boolean>`path LIKE ${term} ESCAPE '\\'`);
 		}
 
 		if (opts.cursor) {
 			const decoded = decodeCursor(opts.cursor);
-			if (decoded) {
-				query = query.where((eb) =>
-					eb.or([
-						eb("created_at", "<", decoded.orderValue),
-						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
-					]),
-				);
-			}
+			query = query.where((eb) =>
+				eb.or([
+					eb("created_at", "<", decoded.orderValue),
+					eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+				]),
+			);
 		}
 
 		const rows = await query.execute();

package/src/database/repositories/taxonomy.ts

@@ -41,12 +41,15 @@ export class TaxonomyRepository {
 	async create(input: CreateTaxonomyInput): Promise<Taxonomy> {
 		const id = ulid();
 
+		// Empty-string parentId is coerced to null defensively. Higher layers
+		// also normalize this — see handleTermCreate / handleTermUpdate.
+		const parentId = input.parentId === undefined || input.parentId === "" ? null : input.parentId;
 		const row: TaxonomyTable = {
 			id,
 			name: input.name,
 			slug: input.slug,
 			label: input.label,
-			parent_id: input.parentId ?? null,
+			parent_id: parentId,
 			data: input.data ? JSON.stringify(input.data) : null,
 		};
 
@@ -90,11 +93,15 @@ export class TaxonomyRepository {
 	 * Get all terms for a taxonomy (e.g., all categories)
 	 */
 	async findByName(name: string, options: { parentId?: string | null } = {}): Promise<Taxonomy[]> {
+		// `id asc` is a stable tiebreaker for terms that share a label.
+		// Without it the SQL ordering is implementation-defined when labels
+		// match, which breaks keyset pagination over `(label, id)`.
 		let query = this.db
 			.selectFrom("taxonomies")
 			.selectAll()
 			.where("name", "=", name)
-			.orderBy("label", "asc");
+			.orderBy("label", "asc")
+			.orderBy("id", "asc");
 
 		if (options.parentId !== undefined) {
 			if (options.parentId === null) {
@@ -117,6 +124,7 @@ export class TaxonomyRepository {
 			.selectAll()
 			.where("parent_id", "=", parentId)
 			.orderBy("label", "asc")
+			.orderBy("id", "asc")
 			.execute();
 
 		return rows.map((row) => this.rowToTaxonomy(row));
@@ -132,7 +140,10 @@ export class TaxonomyRepository {
 		const updates: Partial<TaxonomyTable> = {};
 		if (input.slug !== undefined) updates.slug = input.slug;
 		if (input.label !== undefined) updates.label = input.label;
-		if (input.parentId !== undefined) updates.parent_id = input.parentId;
+		if (input.parentId !== undefined) {
+			// Defense in depth: empty-string parentId means null (no parent).
+			updates.parent_id = input.parentId === "" ? null : input.parentId;
+		}
 		if (input.data !== undefined) updates.data = JSON.stringify(input.data);
 
 		if (Object.keys(updates).length > 0) {
@@ -278,6 +289,32 @@ export class TaxonomyRepository {
 		return Number(result?.count || 0);
 	}
 
+	/**
+	 * Batch count entries for multiple taxonomy term IDs.
+	 * Chunks the query at SQL_BATCH_SIZE to stay below D1's bind-parameter limit.
+	 * Returns a Map from term ID to count.
+	 */
+	async countEntriesForTerms(termIds: string[]): Promise<Map<string, number>> {
+		if (termIds.length === 0) return new Map();
+
+		const { chunks, SQL_BATCH_SIZE } = await import("../../utils/chunks.js");
+
+		const counts = new Map<string, number>();
+		for (const chunk of chunks(termIds, SQL_BATCH_SIZE)) {
+			const rows = await this.db
+				.selectFrom("content_taxonomies")
+				.select(["taxonomy_id", (eb) => eb.fn.count("entry_id").as("count")])
+				.where("taxonomy_id", "in", chunk)
+				.groupBy("taxonomy_id")
+				.execute();
+
+			for (const row of rows) {
+				counts.set(row.taxonomy_id, Number(row.count || 0));
+			}
+		}
+		return counts;
+	}
+
 	/**
 	 * Convert database row to Taxonomy object
 	 */

package/src/database/repositories/types.ts

@@ -1,5 +1,15 @@
 import { encodeBase64, decodeBase64 } from "../../utils/base64.js";
 
+/**
+ * Hard cap on cursor length. Cursors we issue are short JSON-in-base64
+ * blobs; a real cursor is well under 200 chars. This guards against
+ * malicious callers passing megabyte-sized strings to force the base64
+ * decoder to allocate (decodeBase64 is O(N) in input size). The MCP and
+ * REST schemas also clamp at 2048 — this 4096 cap is a defense-in-depth
+ * floor inside the repository helpers.
+ */
+const MAX_CURSOR_LENGTH = 4096;
+
 export interface CreateContentInput {
 	type: string;
 	slug?: string | null;
@@ -87,17 +97,45 @@ export function encodeCursor(orderValue: string, id: string): string {
 	return encodeBase64(JSON.stringify({ orderValue, id }));
 }
 
-/** Decode a cursor to order value + id. Returns null if invalid. */
-export function decodeCursor(cursor: string): { orderValue: string; id: string } | null {
+/**
+ * Thrown when a pagination cursor cannot be decoded.
+ *
+ * Repository callers should let this propagate; handler catch blocks
+ * map it to a structured `INVALID_CURSOR` error so client pagination
+ * bugs surface immediately rather than silently re-fetching the first
+ * page.
+ */
+export class InvalidCursorError extends Error {
+	constructor(cursor: string) {
+		const display = cursor.length > 50 ? `${cursor.slice(0, 47)}...` : cursor;
+		super(`Invalid pagination cursor: ${display}`);
+		this.name = "InvalidCursorError";
+	}
+}
+
+/**
+ * Decode a cursor to order value + id.
+ *
+ * Throws `InvalidCursorError` if the cursor is empty, not valid base64,
+ * not valid JSON, or doesn't contain string `orderValue` and `id` fields.
+ */
+export function decodeCursor(cursor: string): { orderValue: string; id: string } {
+	if (!cursor) throw new InvalidCursorError(cursor);
+	if (cursor.length > MAX_CURSOR_LENGTH) throw new InvalidCursorError(cursor);
+	let parsed: unknown;
 	try {
-		const parsed = JSON.parse(decodeBase64(cursor));
-		if (typeof parsed.orderValue === "string" && typeof parsed.id === "string") {
-			return parsed;
-		}
-		return null;
+		parsed = JSON.parse(decodeBase64(cursor));
 	} catch {
-		return null;
+		throw new InvalidCursorError(cursor);
+	}
+	if (parsed === null || typeof parsed !== "object") {
+		throw new InvalidCursorError(cursor);
+	}
+	const candidate = parsed as { orderValue?: unknown; id?: unknown };
+	if (typeof candidate.orderValue !== "string" || typeof candidate.id !== "string") {
+		throw new InvalidCursorError(cursor);
 	}
+	return { orderValue: candidate.orderValue, id: candidate.id };
 }
 
 export interface ContentItem {
@@ -121,6 +159,17 @@ export interface ContentItem {
 	translationGroup: string | null;
 	/** SEO metadata — only populated for collections with `has_seo` enabled */
 	seo?: ContentSeo;
+	/**
+	 * For collections that support `revisions`: when a draft revision exists,
+	 * `data` reflects the unsaved draft and `liveData` carries the currently-
+	 * published values. When no draft exists, `liveData` is undefined.
+	 *
+	 * Hydrated by `EmDashRuntime.hydrateDraftData()` — repositories themselves
+	 * never set this field; it's purely a runtime-overlay concept that gives
+	 * agents a clear picture of "draft vs. live" without re-fetching the
+	 * revision history.
+	 */
+	liveData?: Record<string, unknown>;
 }
 
 export class EmDashValidationError extends Error {

package/src/database/repositories/user.ts

@@ -123,14 +123,12 @@ export class UserRepository {
 
 		if (options.cursor) {
 			const decoded = decodeCursor(options.cursor);
-			if (decoded) {
-				query = query.where((eb) =>
-					eb.or([
-						eb("created_at", "<", decoded.orderValue),
-						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
-					]),
-				);
-			}
+			query = query.where((eb) =>
+				eb.or([
+					eb("created_at", "<", decoded.orderValue),
+					eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+				]),
+			);
 		}
 
 		const rows = await query.execute();

package/src/db/libsql.ts

@@ -5,6 +5,7 @@
  * Loaded at runtime via virtual module.
  */
 
+import { LibsqlDialect } from "@libsql/kysely-libsql";
 import type { Dialect } from "kysely";
 
 import type { LibsqlConfig } from "./adapters.js";
@@ -13,9 +14,6 @@ import type { LibsqlConfig } from "./adapters.js";
  * Create a libSQL dialect from config
  */
 export function createDialect(config: LibsqlConfig): Dialect {
-	// Dynamic import to avoid loading @libsql/kysely-libsql at config time
-	const { LibsqlDialect } = require("@libsql/kysely-libsql");
-
 	return new LibsqlDialect({
 		url: config.url,
 		authToken: config.authToken,

package/src/db/sqlite.ts

@@ -5,7 +5,8 @@
  * Loaded at runtime via virtual module.
  */
 
-import type { Dialect } from "kysely";
+import BetterSqlite3 from "better-sqlite3";
+import { type Dialect, SqliteDialect } from "kysely";
 
 import type { SqliteConfig } from "./adapters.js";
 
@@ -13,10 +14,6 @@ import type { SqliteConfig } from "./adapters.js";
  * Create a SQLite dialect from config
  */
 export function createDialect(config: SqliteConfig): Dialect {
-	// Dynamic import to avoid loading better-sqlite3 at config time
-	const BetterSqlite3 = require("better-sqlite3");
-	const { SqliteDialect } = require("kysely");
-
 	// Parse URL to get file path
 	const url = config.url;
 	const filePath = url.startsWith("file:") ? url.slice(5) : url;