emdash 0.8.0 → 0.9.0

package/src/database/migrations/035_bounded_404_log.ts

@@ -1,6 +1,8 @@
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { columnExists } from "../dialect-helpers.js";
+
 /**
  * Migration: Bounded 404 logging
  *
@@ -19,16 +21,22 @@ import { sql } from "kysely";
  */
 
 export async function up(db: Kysely<unknown>): Promise<void> {
+	const hitsExists = await columnExists(db, "_emdash_404_log", "hits");
+
 	// 1. Add columns.
-	await db.schema
-		.alterTable("_emdash_404_log")
-		.addColumn("hits", "integer", (col) => col.notNull().defaultTo(1))
-		.execute();
+	if (!hitsExists) {
+		await db.schema
+			.alterTable("_emdash_404_log")
+			.addColumn("hits", "integer", (col) => col.notNull().defaultTo(1))
+			.execute();
+	}
 
 	// SQLite won't accept a non-constant default when adding a NOT NULL column
 	// to a table with existing rows, so backfill in two steps: add nullable,
 	// populate, then rely on the application layer / future inserts to set it.
-	await db.schema.alterTable("_emdash_404_log").addColumn("last_seen_at", "text").execute();
+	if (!(await columnExists(db, "_emdash_404_log", "last_seen_at"))) {
+		await db.schema.alterTable("_emdash_404_log").addColumn("last_seen_at", "text").execute();
+	}
 
 	// Backfill last_seen_at from created_at for existing rows.
 	await sql`
@@ -44,68 +52,77 @@ export async function up(db: Kysely<unknown>): Promise<void> {
 	//    (3.25+, 2018) and Postgres. The previous GROUP BY approach was
 	//    accepted by SQLite but invalid on Postgres because `id` wasn't in
 	//    the GROUP BY or wrapped in an aggregate.
-	await sql`
-		WITH ranked AS (
-			SELECT
-				id,
-				path,
-				ROW_NUMBER() OVER (
-					PARTITION BY path
-					ORDER BY created_at DESC, id DESC
-				) AS rn,
-				COUNT(*) OVER (PARTITION BY path) AS path_count,
-				MAX(created_at) OVER (PARTITION BY path) AS latest_created_at
-			FROM _emdash_404_log
-		)
-		UPDATE _emdash_404_log
-		SET
-			hits = (SELECT path_count FROM ranked WHERE ranked.id = _emdash_404_log.id),
-			last_seen_at = (SELECT latest_created_at FROM ranked WHERE ranked.id = _emdash_404_log.id)
-		WHERE id IN (SELECT id FROM ranked WHERE rn = 1)
-	`.execute(db);
-
-	// Delete the non-keepers (every row except the freshest per path).
-	await sql`
-		DELETE FROM _emdash_404_log
-		WHERE id IN (
-			SELECT id FROM (
+	if (!hitsExists) {
+		await sql`
+			WITH ranked AS (
 				SELECT
 					id,
+					path,
 					ROW_NUMBER() OVER (
 						PARTITION BY path
 						ORDER BY created_at DESC, id DESC
-					) AS rn
+					) AS rn,
+					COUNT(*) OVER (PARTITION BY path) AS path_count,
+					MAX(created_at) OVER (PARTITION BY path) AS latest_created_at
 				FROM _emdash_404_log
-			) AS ranked
-			WHERE rn > 1
-		)
-	`.execute(db);
+			)
+			UPDATE _emdash_404_log
+			SET
+				hits = (SELECT path_count FROM ranked WHERE ranked.id = _emdash_404_log.id),
+				last_seen_at = (SELECT latest_created_at FROM ranked WHERE ranked.id = _emdash_404_log.id)
+			WHERE id IN (SELECT id FROM ranked WHERE rn = 1)
+		`.execute(db);
+
+		// Delete the non-keepers (every row except the freshest per path).
+		await sql`
+			DELETE FROM _emdash_404_log
+			WHERE id IN (
+				SELECT id FROM (
+					SELECT
+						id,
+						ROW_NUMBER() OVER (
+							PARTITION BY path
+							ORDER BY created_at DESC, id DESC
+						) AS rn
+					FROM _emdash_404_log
+				) AS ranked
+				WHERE rn > 1
+			)
+		`.execute(db);
+	}
 
 	// 3. Add unique index on path for upsert semantics.
 	await db.schema
 		.createIndex("idx_404_log_path_unique")
+		.ifNotExists()
 		.on("_emdash_404_log")
 		.column("path")
 		.unique()
 		.execute();
 
 	// Drop the old non-unique index; the unique one covers the same lookups.
-	await db.schema.dropIndex("idx_404_log_path").execute();
+	await db.schema.dropIndex("idx_404_log_path").ifExists().execute();
 
 	// 4. Index on last_seen_at for eviction ordering.
 	await db.schema
 		.createIndex("idx_404_log_last_seen")
+		.ifNotExists()
 		.on("_emdash_404_log")
 		.column("last_seen_at")
 		.execute();
 }
 
 export async function down(db: Kysely<unknown>): Promise<void> {
-	await db.schema.dropIndex("idx_404_log_last_seen").execute();
-	await db.schema.dropIndex("idx_404_log_path_unique").execute();
+	await db.schema.dropIndex("idx_404_log_last_seen").ifExists().execute();
+	await db.schema.dropIndex("idx_404_log_path_unique").ifExists().execute();
 
 	// Restore the original non-unique path index.
-	await db.schema.createIndex("idx_404_log_path").on("_emdash_404_log").column("path").execute();
+	await db.schema
+		.createIndex("idx_404_log_path")
+		.ifNotExists()
+		.on("_emdash_404_log")
+		.column("path")
+		.execute();
 
 	await db.schema.alterTable("_emdash_404_log").dropColumn("last_seen_at").execute();
 	await db.schema.alterTable("_emdash_404_log").dropColumn("hits").execute();

package/src/database/migrations/runner.ts

@@ -123,29 +123,156 @@ export async function getMigrationStatus(db: Kysely<Database>): Promise<Migratio
 	return { applied, pending };
 }
 
+/** Pattern for escaping special regex characters. Matches the shared helper in `database/repositories/content.ts`. */
+const REGEX_ESCAPE_PATTERN = /[.*+?^${}()|[\]\\]/g;
+
+/** Escape special regex characters so a string can be embedded literally in `new RegExp()`. */
+function escapeRegExp(value: string): string {
+	return value.replace(REGEX_ESCAPE_PATTERN, "\\$&");
+}
+
 /**
- * Run all pending migrations.
+ * Pattern used to detect the concurrent-migration race. The Kysely
+ * `SqliteAdapter.acquireMigrationLock` is a no-op (inherited by `kysely-d1`
+ * and our `EmDashD1Dialect`), so two isolates running migrations against the
+ * same database can both attempt `INSERT INTO _emdash_migrations` for the
+ * same migration name. The losing insert fails with a UNIQUE constraint
+ * error, which is benign: the other isolate is applying the same schema.
  *
- * Includes a fast-path: if the migration table already exists and contains
- * exactly MIGRATION_COUNT rows, all migrations have been applied and we can
- * skip the Kysely Migrator entirely. This avoids the expensive
- * `pragma_table_info` introspection that Kysely runs for every table in the
- * database (twice!) just to check if the migration tables exist.
- * On D1 with ~57 tables, that's ~116 queries saved per init.
+ * We match on the table name (not the full error text) because different
+ * SQLite drivers phrase the message differently
+ * (`UNIQUE constraint failed: _emdash_migrations.name` for better-sqlite3,
+ * `D1_ERROR: UNIQUE constraint failed: _emdash_migrations.name: SQLITE_CONSTRAINT`
+ * for D1, etc.). The pattern is built from `MIGRATION_TABLE` so a rename
+ * cannot silently disable race detection.
  */
-export async function runMigrations(db: Kysely<Database>): Promise<{ applied: string[] }> {
-	// Fast path: check if all migrations are already applied.
-	// A single cheap query vs the Migrator's full schema introspection.
+const MIGRATION_RACE_PATTERN = new RegExp(
+	`UNIQUE constraint failed: ${escapeRegExp(MIGRATION_TABLE)}\\.name`,
+	"i",
+);
+
+/** How long to wait for a concurrent migrator to finish before giving up. */
+const MIGRATION_RACE_WAIT_MS = 10_000;
+/** Polling interval while waiting for a concurrent migrator. */
+const MIGRATION_RACE_POLL_MS = 100;
+
+/**
+ * Pattern used to detect "table does not exist" errors across the dialects
+ * EmDash supports. The phrasing differs by driver:
+ *
+ *   - better-sqlite3: `no such table: _emdash_migrations`
+ *   - D1:             `D1_ERROR: no such table: _emdash_migrations: SQLITE_ERROR`
+ *   - PostgreSQL:     `relation "_emdash_migrations" does not exist`
+ *                     (also occasionally `table "_emdash_migrations" does not exist`)
+ *
+ * We deliberately match on the migration table name (rather than using the
+ * generic `isMissingTableError` helper) so an unexpected missing-table error
+ * naming a different table — implausible today since
+ * `getAppliedMigrationCount` only references `MIGRATION_TABLE`, but cheap
+ * insurance against future edits — is not silently swallowed. The pattern is
+ * built from `MIGRATION_TABLE` so a rename cannot drift.
+ */
+const MIGRATION_TABLE_MISSING_PATTERN = new RegExp(
+	`(?:no such table:\\s*${escapeRegExp(MIGRATION_TABLE)}\\b` +
+		`|(?:relation|table)\\s+"?${escapeRegExp(MIGRATION_TABLE)}"?\\s+does(?:n't| not) exist\\b)`,
+	"i",
+);
+
+/**
+ * Read the count of applied migrations.
+ *
+ * Returns `null` only when the migration table does not exist yet (which is
+ * the normal state on a fresh database before the first migration runs).
+ * Any other error is rethrown so callers — particularly
+ * `waitForConcurrentMigrator` — don't silently mask connection failures,
+ * permission errors, or other unexpected driver problems behind a 10s wait
+ * and a bogus "we're done" verdict.
+ */
+async function getAppliedMigrationCount(db: Kysely<Database>): Promise<number | null> {
 	try {
 		const result = await sql<{ count: number }>`
 			SELECT COUNT(*) as count FROM ${sql.ref(MIGRATION_TABLE)}
 		`.execute(db);
-		if (result.rows[0]?.count === MIGRATION_COUNT) {
-			return { applied: [] };
+		return Number(result.rows[0]?.count ?? 0);
+	} catch (error) {
+		if (MIGRATION_TABLE_MISSING_PATTERN.test(deepErrorMessage(error))) {
+			return null;
+		}
+		throw error;
+	}
+}
+
+/**
+ * Wait for a concurrent migrator to finish applying all migrations.
+ *
+ * Resolves to `true` once the migration table contains at least
+ * `MIGRATION_COUNT` rows (i.e. every migration this build knows about has
+ * been recorded), `false` if the deadline elapses first. We use `>=` rather
+ * than `===` so that an old isolate observing a database that has already
+ * been migrated by a newer build still treats the wait as settled instead
+ * of timing out.
+ */
+async function waitForConcurrentMigrator(db: Kysely<Database>): Promise<boolean> {
+	const deadline = Date.now() + MIGRATION_RACE_WAIT_MS;
+	while (Date.now() < deadline) {
+		const count = await getAppliedMigrationCount(db);
+		if (count !== null && count >= MIGRATION_COUNT) {
+			return true;
+		}
+		await new Promise((resolve) => setTimeout(resolve, MIGRATION_RACE_POLL_MS));
+	}
+	const finalCount = await getAppliedMigrationCount(db);
+	return finalCount !== null && finalCount >= MIGRATION_COUNT;
+}
+
+/** Extract the deepest error message available from a thrown value. */
+function deepErrorMessage(error: unknown): string {
+	if (error instanceof Error) {
+		const own = error.message ?? "";
+		if (error.cause) {
+			const causeMsg = deepErrorMessage(error.cause);
+			return own ? `${own}: ${causeMsg}` : causeMsg;
 		}
+		return own;
+	}
+	if (typeof error === "string") return error;
+	try {
+		return JSON.stringify(error);
 	} catch {
-		// Table doesn't exist yet (first run). Fall through to the Migrator
-		// which will create it.
+		return String(error);
+	}
+}
+
+/**
+ * Run all pending migrations.
+ *
+ * Includes a fast-path: if the migration table already exists and contains
+ * at least MIGRATION_COUNT rows, all migrations this build knows about have
+ * been applied and we can skip the Kysely Migrator entirely. This avoids
+ * the expensive `pragma_table_info` introspection that Kysely runs for
+ * every table in the database (twice!) just to check if the migration
+ * tables exist. On D1 with ~57 tables, that's ~116 queries saved per init.
+ *
+ * Concurrent-migration safety: the Kysely Migrator's `acquireMigrationLock`
+ * is a no-op for SQLite (and therefore D1), so two callers running this
+ * concurrently against the same database will both try to apply pending
+ * migrations. SQLite serializes the writes, but the loser still surfaces a
+ * `UNIQUE constraint failed: _emdash_migrations.name` error. We treat that
+ * specific error as benign: another caller is already applying the same
+ * schema. We wait for the concurrent migrator to finish, then return
+ * success. This matches the user-observable expectation that running
+ * migrations twice in a row is a no-op.
+ */
+export async function runMigrations(db: Kysely<Database>): Promise<{ applied: string[] }> {
+	// Fast path: check if all migrations are already applied.
+	// A single cheap query vs the Migrator's full schema introspection.
+	// We use `>=` rather than `===` so a database with extra rows from a
+	// newer build (e.g. mid-deploy old isolate, or downgrade) still skips
+	// the migrator instead of falling through to the race-recovery path
+	// unnecessarily.
+	const initialCount = await getAppliedMigrationCount(db);
+	if (initialCount !== null && initialCount >= MIGRATION_COUNT) {
+		return { applied: [] };
 	}
 
 	const migrator = new Migrator({
@@ -160,17 +287,23 @@ export async function runMigrations(db: Kysely<Database>): Promise<{ applied: st
 	const applied = results?.filter((r) => r.status === "Success").map((r) => r.migrationName) ?? [];
 
 	if (error) {
-		// Kysely sometimes wraps errors with an empty message. Check cause and
-		// failed migration results for the real error.
-		let msg = error instanceof Error ? error.message : JSON.stringify(error);
-		if (!msg && error instanceof Error && error.cause) {
-			msg = error.cause instanceof Error ? error.cause.message : JSON.stringify(error.cause);
-		}
+		// Walk error.cause to get the underlying driver message — Kysely
+		// often wraps with an empty top-level message.
+		const msg = deepErrorMessage(error);
 		const failedMigration = results?.find((r) => r.status === "Error");
-		if (failedMigration) {
-			msg = `${msg || "unknown error"} (migration: ${failedMigration.migrationName})`;
+
+		// Concurrent-migration race: another caller is applying (or just
+		// applied) the same migration. Wait for it to finish, then verify
+		// the schema is fully migrated and treat as success.
+		if (MIGRATION_RACE_PATTERN.test(msg)) {
+			const settled = await waitForConcurrentMigrator(db);
+			if (settled) {
+				return { applied };
+			}
 		}
-		throw new Error(`Migration failed: ${msg}`);
+
+		const failedSuffix = failedMigration ? ` (migration: ${failedMigration.migrationName})` : "";
+		throw new Error(`Migration failed: ${msg || "unknown error"}${failedSuffix}`);
 	}
 
 	return { applied };

package/src/database/repositories/content.ts

@@ -917,8 +917,14 @@ export class ContentRepository {
 	 * Syncs the draft revision's data into the content table columns so the
 	 * content table always reflects the published version.
 	 * If no draft revision exists, creates one from current data and publishes it.
+	 *
+	 * `publishedAt` (optional) overrides the publication timestamp. If omitted,
+	 * the existing `published_at` is preserved (idempotent re-publish keeps the
+	 * original date) and falls back to the current time on first publish. Pass
+	 * an explicit value to backdate a publish (e.g. when migrating content from
+	 * another CMS).
 	 */
-	async publish(type: string, id: string): Promise<ContentItem> {
+	async publish(type: string, id: string, publishedAt?: string): Promise<ContentItem> {
 		const tableName = getTableName(type);
 		const now = new Date().toISOString();
 
@@ -956,17 +962,35 @@ export class ContentRepository {
 			}
 		}
 
-		await sql`
-			UPDATE ${sql.ref(tableName)}
-			SET live_revision_id = ${revisionToPublish},
-				draft_revision_id = NULL,
-				status = 'published',
-				scheduled_at = NULL,
-				published_at = COALESCE(published_at, ${now}),
-				updated_at = ${now}
-			WHERE id = ${id}
-			AND deleted_at IS NULL
-		`.execute(this.db);
+		if (publishedAt !== undefined) {
+			// Caller supplied an explicit timestamp, so we overwrite published_at
+			// directly (used to backdate a publish, e.g. for content migrations).
+			await sql`
+				UPDATE ${sql.ref(tableName)}
+				SET live_revision_id = ${revisionToPublish},
+					draft_revision_id = NULL,
+					status = 'published',
+					scheduled_at = NULL,
+					published_at = ${publishedAt},
+					updated_at = ${now}
+				WHERE id = ${id}
+				AND deleted_at IS NULL
+			`.execute(this.db);
+		} else {
+			// No timestamp supplied — preserve existing published_at on
+			// idempotent re-publish, fall back to `now` on first publish.
+			await sql`
+				UPDATE ${sql.ref(tableName)}
+				SET live_revision_id = ${revisionToPublish},
+					draft_revision_id = NULL,
+					status = 'published',
+					scheduled_at = NULL,
+					published_at = COALESCE(published_at, ${now}),
+					updated_at = ${now}
+				WHERE id = ${id}
+				AND deleted_at IS NULL
+			`.execute(this.db);
+		}
 
 		const updated = await this.findById(type, id);
 		if (!updated) {

package/src/database/repositories/redirect.ts

@@ -28,6 +28,9 @@ export const REFERRER_MAX_LENGTH = 512;
 /** Max stored length for the `User-Agent` header — truncated on insert. */
 export const USER_AGENT_MAX_LENGTH = 256;
 
+/** Pattern to escape LIKE wildcards: %, _, and backslash */
+const LIKE_ESCAPE_RE = /[\\%_]/g;
+
 /**
  * Truncate a header-derived string to `max` chars, preserving `null`/`undefined`
  * as `null`. Empty strings stay empty (the caller decides whether to coerce).
@@ -162,9 +165,15 @@ export class RedirectRepository {
 			.limit(limit + 1);
 
 		if (opts.search) {
-			const term = `%${opts.search}%`;
+			// Escape LIKE wildcards in the search term to prevent injection.
+			// Must include ESCAPE clause for SQLite to recognize backslash as escape char.
+			const escaped = opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\${c}`);
+			const term = `%${escaped}%`;
 			query = query.where((eb) =>
-				eb.or([eb("source", "like", term), eb("destination", "like", term)]),
+				eb.or([
+					sql<boolean>`source LIKE ${term} ESCAPE '\\'`,
+					sql<boolean>`destination LIKE ${term} ESCAPE '\\'`,
+				]),
 			);
 		}
 
@@ -502,7 +511,9 @@ export class RedirectRepository {
 			.limit(limit + 1);
 
 		if (opts.search) {
-			query = query.where("path", "like", `%${opts.search}%`);
+			const escaped = opts.search.replace(LIKE_ESCAPE_RE, (c) => `\\${c}`);
+			const term = `%${escaped}%`;
+			query = query.where(sql<boolean>`path LIKE ${term} ESCAPE '\\'`);
 		}
 
 		if (opts.cursor) {

package/src/database/repositories/taxonomy.ts

@@ -289,6 +289,32 @@ export class TaxonomyRepository {
 		return Number(result?.count || 0);
 	}
 
+	/**
+	 * Batch count entries for multiple taxonomy term IDs.
+	 * Chunks the query at SQL_BATCH_SIZE to stay below D1's bind-parameter limit.
+	 * Returns a Map from term ID to count.
+	 */
+	async countEntriesForTerms(termIds: string[]): Promise<Map<string, number>> {
+		if (termIds.length === 0) return new Map();
+
+		const { chunks, SQL_BATCH_SIZE } = await import("../../utils/chunks.js");
+
+		const counts = new Map<string, number>();
+		for (const chunk of chunks(termIds, SQL_BATCH_SIZE)) {
+			const rows = await this.db
+				.selectFrom("content_taxonomies")
+				.select(["taxonomy_id", (eb) => eb.fn.count("entry_id").as("count")])
+				.where("taxonomy_id", "in", chunk)
+				.groupBy("taxonomy_id")
+				.execute();
+
+			for (const row of rows) {
+				counts.set(row.taxonomy_id, Number(row.count || 0));
+			}
+		}
+		return counts;
+	}
+
 	/**
 	 * Convert database row to Taxonomy object
 	 */

package/src/db/libsql.ts

@@ -5,6 +5,7 @@
  * Loaded at runtime via virtual module.
  */
 
+import { LibsqlDialect } from "@libsql/kysely-libsql";
 import type { Dialect } from "kysely";
 
 import type { LibsqlConfig } from "./adapters.js";
@@ -13,9 +14,6 @@ import type { LibsqlConfig } from "./adapters.js";
  * Create a libSQL dialect from config
  */
 export function createDialect(config: LibsqlConfig): Dialect {
-	// Dynamic import to avoid loading @libsql/kysely-libsql at config time
-	const { LibsqlDialect } = require("@libsql/kysely-libsql");
-
 	return new LibsqlDialect({
 		url: config.url,
 		authToken: config.authToken,

package/src/db/sqlite.ts

@@ -5,7 +5,8 @@
  * Loaded at runtime via virtual module.
  */
 
-import type { Dialect } from "kysely";
+import BetterSqlite3 from "better-sqlite3";
+import { type Dialect, SqliteDialect } from "kysely";
 
 import type { SqliteConfig } from "./adapters.js";
 
@@ -13,10 +14,6 @@ import type { SqliteConfig } from "./adapters.js";
  * Create a SQLite dialect from config
  */
 export function createDialect(config: SqliteConfig): Dialect {
-	// Dynamic import to avoid loading better-sqlite3 at config time
-	const BetterSqlite3 = require("better-sqlite3");
-	const { SqliteDialect } = require("kysely");
-
 	// Parse URL to get file path
 	const url = config.url;
 	const filePath = url.startsWith("file:") ? url.slice(5) : url;