emdash 0.8.0 → 0.10.0

package/src/menus/index.ts

@@ -1,7 +1,11 @@
 /**
- * Navigation menu runtime functions
+ * Navigation menu runtime functions.
  *
- * These are called from templates to query menus and resolve URLs.
+ * These are called from templates to query menus and resolve URLs. All queries
+ * are locale-aware: when a locale is configured (or passed explicitly) items
+ * are filtered to that locale, and menu item references resolve against the
+ * referenced content's translation_group so the URL points at the right
+ * per-locale row.
  */
 
 import type { Kysely } from "kysely";
@@ -9,50 +13,61 @@ import { sql } from "kysely";
 
 import type { Database } from "../database/types.js";
 import { validateIdentifier } from "../database/validate.js";
+import { resolveLocale, resolveLocaleChain } from "../i18n/resolve.js";
 import { getDb } from "../loader.js";
 import { requestCached } from "../request-cache.js";
 import { sanitizeHref } from "../utils/url.js";
 import type { Menu, MenuItem, MenuItemRow } from "./types.js";
 
+export interface MenuQueryOptions {
+	/** Override the locale used for the lookup. When omitted, the locale comes
+	 * from the request context or the configured defaultLocale. */
+	locale?: string;
+}
+
 /**
- * Get menu by name with resolved URLs
+ * Get a menu by name with resolved URLs.
  *
  * @example
  * ```ts
- * import { getMenu } from "emdash";
- *
  * const menu = await getMenu("primary");
- * if (menu) {
- *   console.log(menu.items); // Array of MenuItem with resolved URLs
- * }
+ * const menuEs = await getMenu("primary", { locale: "es" });
  * ```
  */
-export function getMenu(name: string): Promise<Menu | null> {
-	return requestCached(`menu:${name}`, async () => {
+export function getMenu(name: string, options: MenuQueryOptions = {}): Promise<Menu | null> {
+	const locale = resolveLocale(options.locale);
+	return requestCached(`menu:${name}:${locale ?? "*"}`, async () => {
 		const db = await getDb();
-		return getMenuWithDb(name, db);
+		return getMenuWithDb(name, db, { locale });
 	});
 }
 
 /**
- * Get menu by name with resolved URLs (with explicit db)
- *
- * @internal Use `getMenu()` in templates. This variant is for admin routes
- * that already have a database handle.
+ * Get menu by name with resolved URLs (with explicit db). Internal helper for
+ * admin routes that already have a database handle.
  */
-export async function getMenuWithDb(name: string, db: Kysely<Database>): Promise<Menu | null> {
-	// Get menu
-	const menuRow = await db
-		.selectFrom("_emdash_menus")
-		.selectAll()
-		.where("name", "=", name)
-		.executeTakeFirst();
-
-	if (!menuRow) {
-		return null;
+export async function getMenuWithDb(
+	name: string,
+	db: Kysely<Database>,
+	options: MenuQueryOptions = {},
+): Promise<Menu | null> {
+	const chain = resolveLocaleChain(options.locale);
+
+	const selectMenu = () => db.selectFrom("_emdash_menus").selectAll().where("name", "=", name);
+
+	let menuRow: Awaited<ReturnType<ReturnType<typeof selectMenu>["executeTakeFirst"]>>;
+	if (chain.length === 0) {
+		menuRow = await selectMenu().orderBy("locale", "asc").executeTakeFirst();
+	} else {
+		menuRow = undefined;
+		for (const locale of chain) {
+			menuRow = await selectMenu().where("locale", "=", locale).executeTakeFirst();
+			if (menuRow) break;
+		}
 	}
 
-	// Get all menu items
+	if (!menuRow) return null;
+
 	const itemRows = await db
 		.selectFrom("_emdash_menu_items")
 		.selectAll()
@@ -61,31 +76,27 @@ export async function getMenuWithDb(name: string, db: Kysely<Database>): Promise
 		.orderBy("sort_order", "asc")
 		.execute();
 
-	// Resolve URLs and build tree
-	const items = await buildMenuTree(itemRows, db);
+	const items = await buildMenuTree(itemRows, db, menuRow.locale);
 
 	return {
 		id: menuRow.id,
 		name: menuRow.name,
 		label: menuRow.label,
 		items,
+		locale: menuRow.locale,
+		translationGroup: menuRow.translation_group,
 	};
 }
 
 /**
- * Get all menus (without items - for admin list)
- *
- * @example
- * ```ts
- * import { getMenus } from "emdash";
- *
- * const menus = await getMenus();
- * console.log(menus); // [{ id, name, label }]
- * ```
+ * Get all menus (without items, locale-filtered — for admin list / site nav
+ * summaries). When no locale is configured, returns menus across all locales.
  */
-export async function getMenus(): Promise<Array<{ id: string; name: string; label: string }>> {
+export async function getMenus(
+	options: MenuQueryOptions = {},
+): Promise<Array<{ id: string; name: string; label: string; locale: string }>> {
 	const db = await getDb();
-	return getMenusWithDb(db);
+	return getMenusWithDb(db, options);
 }
 
 /**
@@ -96,26 +107,30 @@ export async function getMenus(): Promise<Array<{ id: string; name: string; labe
  */
 export async function getMenusWithDb(
 	db: Kysely<Database>,
-): Promise<Array<{ id: string; name: string; label: string }>> {
-	const rows = await db
+	options: MenuQueryOptions = {},
+): Promise<Array<{ id: string; name: string; label: string; locale: string }>> {
+	const locale = resolveLocale(options.locale);
+	let query = db
 		.selectFrom("_emdash_menus")
-		.select(["id", "name", "label"])
-		.orderBy("name", "asc")
-		.execute();
-
-	return rows;
+		.select(["id", "name", "label", "locale"])
+		.orderBy("name", "asc");
+	if (locale !== undefined) query = query.where("locale", "=", locale);
+	return query.execute();
 }
 
 /**
- * Build hierarchical menu tree from flat array of items
+ * Build a hierarchical menu tree from a flat list of items. Items are
+ * resolved against the given `locale` so references land on the right
+ * per-locale content rows.
  */
-async function buildMenuTree(items: MenuItemRow[], db: Kysely<Database>): Promise<MenuItem[]> {
-	// Pre-load URL patterns for all collections referenced in this menu
+async function buildMenuTree(
+	items: MenuItemRow[],
+	db: Kysely<Database>,
+	locale: string,
+): Promise<MenuItem[]> {
 	const collectionSlugs = new Set<string>();
 	for (const item of items) {
-		if (item.reference_collection) {
-			collectionSlugs.add(item.reference_collection);
-		}
+		if (item.reference_collection) collectionSlugs.add(item.reference_collection);
 		if (item.type === "page" || item.type === "post") {
 			collectionSlugs.add(item.reference_collection || `${item.type}s`);
 		}
@@ -128,41 +143,28 @@ async function buildMenuTree(items: MenuItemRow[], db: Kysely<Database>): Promis
 			.select(["slug", "url_pattern"])
 			.where("slug", "in", [...collectionSlugs])
 			.execute();
-		for (const row of rows) {
-			urlPatterns.set(row.slug, row.url_pattern);
-		}
+		for (const row of rows) urlPatterns.set(row.slug, row.url_pattern);
 	}
 
-	// Resolve all URLs first
 	const resolvedItems = await Promise.all(
-		items.map((item) => resolveMenuItem(item, db, urlPatterns)),
+		items.map((item) => resolveMenuItem(item, db, urlPatterns, locale)),
 	);
+	const validItems = resolvedItems.filter((item): item is MenuItem => item !== null);
 
-	// Filter out items that couldn't be resolved (e.g., deleted content)
-	const validItems = resolvedItems.filter((item) => item !== null);
-
-	// Build tree structure
 	const itemMap = new Map<string, MenuItem & { children: MenuItem[] }>();
 	const rootItems: MenuItem[] = [];
 
-	// First pass: create all items
 	for (const item of validItems) {
 		itemMap.set(item.id, { ...item, children: [] });
 	}
 
-	// Second pass: build parent-child relationships
 	for (const item of items) {
 		const menuItem = itemMap.get(item.id);
 		if (!menuItem) continue;
-
 		if (item.parent_id) {
 			const parent = itemMap.get(item.parent_id);
-			if (parent) {
-				parent.children.push(menuItem);
-			} else {
-				// Parent not found, treat as root
-				rootItems.push(menuItem);
-			}
+			if (parent) parent.children.push(menuItem);
+			else rootItems.push(menuItem);
 		} else {
 			rootItems.push(menuItem);
 		}
@@ -172,14 +174,15 @@ async function buildMenuTree(items: MenuItemRow[], db: Kysely<Database>): Promis
 }
 
 /**
- * Resolve a single menu item's URL
- *
- * Returns null if the referenced content no longer exists (item should be skipped)
+ * Resolve a single menu item's URL. `reference_id` is a translation_group
+ * (migration 036 remapped all existing references); we join it against
+ * the per-locale ec_* row or per-locale taxonomy row.
  */
 async function resolveMenuItem(
 	item: MenuItemRow,
 	db: Kysely<Database>,
 	urlPatterns: Map<string, string | null>,
+	locale: string,
 ): Promise<MenuItem | null> {
 	let url: string | null;
 
@@ -192,24 +195,18 @@ async function resolveMenuItem(
 			case "page":
 			case "post":
 				url = await resolveContentUrl(
-					// Default to plural collection name (pages/posts) if not specified
 					item.reference_collection || `${item.type}s`,
 					item.reference_id,
 					db,
 					urlPatterns,
+					locale,
 				);
-				// Skip items where content no longer exists
-				if (url === null) {
-					return null;
-				}
+				if (url === null) return null;
 				break;
 
 			case "taxonomy":
-				url = await resolveTaxonomyUrl(item.reference_id, db);
-				// Skip items where taxonomy no longer exists
-				if (url === null) {
-					return null;
-				}
+				url = await resolveTaxonomyUrl(item.reference_id, db, locale);
+				if (url === null) return null;
 				break;
 
 			case "collection":
@@ -223,16 +220,14 @@ async function resolveMenuItem(
 						item.reference_id,
 						db,
 						urlPatterns,
+						locale,
 					);
-					if (url === null) {
-						return null;
-					}
+					if (url === null) return null;
 				} else {
 					url = "#";
 				}
 		}
 	} catch (error) {
-		// If resolution fails, skip this item
 		console.error(`Failed to resolve menu item ${item.id}:`, error);
 		return null;
 	}
@@ -244,7 +239,7 @@ async function resolveMenuItem(
 		target: item.target || undefined,
 		titleAttr: item.title_attr || undefined,
 		cssClasses: item.css_classes || undefined,
-		children: [], // Will be populated by buildMenuTree
+		children: [],
 	};
 }
 
@@ -261,72 +256,96 @@ function interpolateUrlPattern(pattern: string, slug: string, id: string): strin
 }
 
 /**
- * Resolve URL for a content entry (page/post)
- *
- * Uses the collection's url_pattern if set, otherwise falls back to /{collection}/{slug}.
- * Returns null if content not found (item should be skipped).
+ * Resolve the URL for a content reference. `referenceGroup` is the content
+ * row's translation_group; we look up the row in the requested locale
+ * (falling back to the source if no translation exists so the menu link is
+ * still clickable).
  */
 async function resolveContentUrl(
 	collection: string,
-	entryId: string | null,
+	referenceGroup: string | null,
 	db: Kysely<Database>,
 	urlPatterns: Map<string, string | null>,
+	locale: string,
 ): Promise<string | null> {
-	if (!entryId) {
-		return null;
-	}
+	if (!referenceGroup) return null;
 
 	try {
-		// Validate collection name before interpolating into table reference
 		validateIdentifier(collection, "menu item collection");
 
-		// Dynamic content tables (ec_*) aren't in the Database type, so use sql
-		const result = await sql<{ slug: string }>`
-			SELECT slug FROM ${sql.ref(`ec_${collection}`)} WHERE id = ${entryId} LIMIT 1
+		// Try the requested locale first, then any locale (deterministic).
+		let result = await sql<{ id: string; slug: string }>`
+			SELECT id, slug FROM ${sql.ref(`ec_${collection}`)}
+			WHERE translation_group = ${referenceGroup} AND locale = ${locale}
+			LIMIT 1
 		`.execute(db);
-
-		const row = result.rows[0];
-		if (row) {
-			const pattern = urlPatterns.get(collection);
-			if (pattern) {
-				return interpolateUrlPattern(pattern, row.slug, entryId);
-			}
-			return `/${collection}/${row.slug}`;
+		let row = result.rows[0];
+		if (!row) {
+			result = await sql<{ id: string; slug: string }>`
+				SELECT id, slug FROM ${sql.ref(`ec_${collection}`)}
+				WHERE translation_group = ${referenceGroup}
+				ORDER BY locale ASC LIMIT 1
+			`.execute(db);
+			row = result.rows[0];
 		}
+		if (!row) {
+			// Legacy rows whose reference_id still points at an id directly
+			// (defensive — migration 036 normalised these, but a row inserted
+			// between migrations could predate the remap).
+			const legacy = await sql<{ id: string; slug: string }>`
+				SELECT id, slug FROM ${sql.ref(`ec_${collection}`)}
+				WHERE id = ${referenceGroup} LIMIT 1
+			`.execute(db);
+			row = legacy.rows[0];
+		}
+		if (!row) return null;
 
-		// Content not found, skip item
-		return null;
+		const pattern = urlPatterns.get(collection);
+		if (pattern) return interpolateUrlPattern(pattern, row.slug, row.id);
+		return `/${collection}/${row.slug}`;
 	} catch (error) {
-		// Table might not exist or query failed
-		console.error(`Failed to resolve content URL for ${collection}/${entryId}:`, error);
+		console.error(`Failed to resolve content URL for ${collection}/${referenceGroup}:`, error);
 		return null;
 	}
 }
 
 /**
- * Resolve URL for a taxonomy term
- *
- * Returns null if taxonomy not found (item should be skipped)
+ * Resolve URL for a taxonomy term reference. `referenceGroup` is the term's
+ * translation_group; we pick the row in the active locale (or fall back).
  */
 async function resolveTaxonomyUrl(
-	taxonomyId: string | null,
+	referenceGroup: string | null,
 	db: Kysely<Database>,
+	locale: string,
 ): Promise<string | null> {
-	if (!taxonomyId) {
-		return null;
-	}
+	if (!referenceGroup) return null;
 
-	const taxonomy = await db
+	let taxonomy = await db
 		.selectFrom("taxonomies")
 		.select(["name", "slug"])
-		.where("id", "=", taxonomyId)
+		.where("translation_group", "=", referenceGroup)
+		.where("locale", "=", locale)
 		.executeTakeFirst();
 
 	if (!taxonomy) {
-		// Taxonomy not found, skip item
-		return null;
+		taxonomy = await db
+			.selectFrom("taxonomies")
+			.select(["name", "slug"])
+			.where("translation_group", "=", referenceGroup)
+			.orderBy("locale", "asc")
+			.executeTakeFirst();
 	}
 
-	// Use taxonomy name as base (e.g., "categories" or "tags")
+	if (!taxonomy) {
+		// Legacy: id-based reference that predates the migration remap.
+		taxonomy = await db
+			.selectFrom("taxonomies")
+			.select(["name", "slug"])
+			.where("id", "=", referenceGroup)
+			.executeTakeFirst();
+	}
+
+	if (!taxonomy) return null;
+
 	return `/${taxonomy.name}/${taxonomy.slug}`;
 }

package/src/menus/types.ts

@@ -24,6 +24,8 @@ export interface Menu {
 	name: string;
 	label: string;
 	items: MenuItem[];
+	locale: string;
+	translationGroup: string | null;
 }
 
 /**
@@ -36,13 +38,15 @@ export interface MenuItemRow {
 	sort_order: number;
 	type: MenuItemType;
 	reference_collection: string | null;
-	reference_id: string | null;
+	reference_id: string | null; // translation_group of referenced content/term
 	custom_url: string | null;
 	label: string;
 	title_attr: string | null;
 	target: string | null;
 	css_classes: string | null;
 	created_at: string;
+	locale: string;
+	translation_group: string | null;
 }
 
 /**
@@ -54,6 +58,8 @@ export interface MenuRow {
 	label: string;
 	created_at: string;
 	updated_at: string;
+	locale: string;
+	translation_group: string | null;
 }
 
 /**
@@ -62,6 +68,11 @@ export interface MenuRow {
 export interface CreateMenuItemInput {
 	type: MenuItemType;
 	label: string;
+	/**
+	 * Identifier of the referenced entity. For `reference_collection` items it is
+	 * the content's translation_group (locale-agnostic); for `taxonomy` items it
+	 * is the term's translation_group.
+	 */
 	referenceCollection?: string;
 	referenceId?: string;
 	customUrl?: string;
@@ -91,6 +102,9 @@ export interface UpdateMenuItemInput {
 export interface CreateMenuInput {
 	name: string;
 	label: string;
+	locale?: string;
+	/** When set, links the new menu into an existing translation_group. */
+	translationOf?: string;
 }
 
 /**

package/src/page/site-identity.ts

@@ -0,0 +1,58 @@
+/**
+ * Site identity head injection.
+ *
+ * Emits first-party `<head>` tags sourced from the user-configured Site
+ * Identity. These are rendered alongside, but separate from, the plugin
+ * contribution pipeline (`page/metadata.ts`) because:
+ *
+ * - Site identity is first-party, not plugin-supplied. The contribution
+ *   pipeline's `isSafeHref` allowlist rejects same-origin paths like
+ *   `/_emdash/api/media/file/...` (which is correct for sandboxed plugin
+ *   contributions, but blocks our own favicon URLs).
+ * - The data shape is fixed and small. Routing it through a generic
+ *   deduper buys nothing.
+ *
+ * Currently emits only `<link rel="icon">`. Other site-identity tags
+ * (`apple-touch-icon`, `theme-color`, `application-name`) need their own
+ * configurable fields in `SiteSettings` before they ship; emitting them
+ * automatically from the favicon would produce broken icons on iOS for
+ * SVG favicons or blurry home-screen icons when the favicon is a small
+ * PNG. Tracked separately.
+ *
+ * Templates that previously emitted their own `<link rel="icon">` are
+ * getting their lines dropped in the same change that introduced this
+ * helper.
+ */
+
+import type { MediaReference } from "../settings/types.js";
+import { escapeHtmlAttr } from "./metadata.js";
+
+/**
+ * Subset of site settings consumed by `renderSiteIdentity`. Kept narrow
+ * so callers don't have to fetch fields they don't use.
+ */
+export interface SiteIdentityInput {
+	favicon?: MediaReference;
+}
+
+/**
+ * Build the `<head>` HTML for site identity tags. Returns an empty string
+ * when no identity fields are configured.
+ */
+export function renderSiteIdentity(input: SiteIdentityInput | undefined): string {
+	if (!input) return "";
+
+	const parts: string[] = [];
+
+	const favicon = input.favicon;
+	if (favicon?.url) {
+		let tag = `<link rel="icon" href="${escapeHtmlAttr(favicon.url)}"`;
+		if (favicon.contentType) {
+			tag += ` type="${escapeHtmlAttr(favicon.contentType)}"`;
+		}
+		tag += ">";
+		parts.push(tag);
+	}
+
+	return parts.join("\n");
+}

package/src/plugins/adapt-sandbox-entry.ts

@@ -12,6 +12,7 @@
 
 import type { PluginDescriptor } from "../astro/integration/runtime.js";
 import { PLUGIN_CAPABILITIES, HOOK_NAMES } from "./manifest-schema.js";
+import { normalizeCapabilities } from "./types.js";
 import type {
 	StandardPluginDefinition,
 	StandardHookEntry,
@@ -147,7 +148,10 @@ export function adaptSandboxEntry(
 	}
 
 	// Build capabilities from descriptor.
-	// Validate against the known set (same as defineNativePlugin).
+	// Validate against the known set (same as defineNativePlugin). Both
+	// current and deprecated names are accepted; deprecated names are
+	// silently normalized to current names below so the runtime only ever
+	// sees the canonical form.
 	const rawCapabilities = descriptor.capabilities ?? [];
 	for (const cap of rawCapabilities) {
 		if (!VALID_CAPABILITIES_SET.has(cap)) {
@@ -157,20 +161,28 @@ export function adaptSandboxEntry(
 			);
 		}
 	}
-	// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- validated against VALID_CAPABILITIES_SET above; descriptor uses string[] for flexibility
-	const capabilities = [...rawCapabilities] as PluginCapability[];
+
+	// Silent normalization: rewrite deprecated names to current names.
+	// Safe assertion — `normalizeCapabilities` only emits validated input
+	// plus current names from the rename map, all of which are in the union.
+	// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- validated above; normalizeCapabilities only returns capabilities from the union
+	const capabilities = normalizeCapabilities(rawCapabilities) as PluginCapability[];
 	const allowedHosts = descriptor.allowedHosts ?? [];
 
 	// Capability implications: broader capabilities imply narrower ones
-	// (mirrors the normalization in define-plugin.ts for native format)
-	if (capabilities.includes("write:content") && !capabilities.includes("read:content")) {
-		capabilities.push("read:content");
+	// (mirrors the normalization in define-plugin.ts for native format).
+	// Operates on canonical names only.
+	if (capabilities.includes("content:write") && !capabilities.includes("content:read")) {
+		capabilities.push("content:read");
 	}
-	if (capabilities.includes("write:media") && !capabilities.includes("read:media")) {
-		capabilities.push("read:media");
+	if (capabilities.includes("media:write") && !capabilities.includes("media:read")) {
+		capabilities.push("media:read");
 	}
-	if (capabilities.includes("network:fetch:any") && !capabilities.includes("network:fetch")) {
-		capabilities.push("network:fetch");
+	if (
+		capabilities.includes("network:request:unrestricted") &&
+		!capabilities.includes("network:request")
+	) {
+		capabilities.push("network:request");
 	}
 
 	// Build storage config from descriptor.

package/src/plugins/context.ts

@@ -647,14 +647,14 @@ export function createUnrestrictedHttpAccess(pluginId: string): HttpAccess {
 }
 
 /**
- * Create blocked HTTP access (for plugins without network:fetch capability)
+ * Create blocked HTTP access (for plugins without network:request capability)
  */
 export function createBlockedHttpAccess(pluginId: string): HttpAccess {
 	return {
 		async fetch(): Promise<never> {
 			throw new Error(
-				`Plugin "${pluginId}" does not have the "network:fetch" capability. ` +
-					`Add "network:fetch" to the plugin's capabilities to enable HTTP requests.`,
+				`Plugin "${pluginId}" does not have the "network:request" capability. ` +
+					`Add "network:request" to the plugin's capabilities to enable HTTP requests.`,
 			);
 		},
 	};
@@ -902,32 +902,35 @@ export class PluginContextFactory {
 		const storage = createStorageAccess(this.db, plugin.id, plugin.storage);
 
 		// Capability-gated: content
+		// Note: capabilities reach this point already normalized to the
+		// canonical names by definePlugin / adaptSandboxEntry. Deprecated
+		// names ("read:content", "write:content") never appear here.
 		let content: ContentAccess | ContentAccessWithWrite | undefined;
-		if (capabilities.has("write:content")) {
+		if (capabilities.has("content:write")) {
 			content = createContentAccessWithWrite(this.db);
-		} else if (capabilities.has("read:content")) {
+		} else if (capabilities.has("content:read")) {
 			content = createContentAccess(this.db);
 		}
 
 		// Capability-gated: media
 		let media: MediaAccess | MediaAccessWithWrite | undefined;
-		if (capabilities.has("write:media") && this.getUploadUrl) {
+		if (capabilities.has("media:write") && this.getUploadUrl) {
 			media = createMediaAccessWithWrite(this.db, this.getUploadUrl, this.storage);
-		} else if (capabilities.has("read:media")) {
+		} else if (capabilities.has("media:read")) {
 			media = createMediaAccess(this.db);
 		}
 
 		// Capability-gated: http
 		let http: HttpAccess | undefined;
-		if (capabilities.has("network:fetch:any")) {
+		if (capabilities.has("network:request:unrestricted")) {
 			http = createUnrestrictedHttpAccess(plugin.id);
-		} else if (capabilities.has("network:fetch")) {
+		} else if (capabilities.has("network:request")) {
 			http = createHttpAccess(plugin.id, plugin.allowedHosts);
 		}
 
 		// Capability-gated: users
 		let users: UserAccess | undefined;
-		if (capabilities.has("read:users")) {
+		if (capabilities.has("users:read")) {
 			users = createUserAccess(this.db);
 		}