emdash 1.0.1 → 1.1.0

package/src/components/WebMcpSearch.astro

@@ -0,0 +1,80 @@
+---
+/**
+ * WebMcpSearch - Lets AI agents in the visitor's browser search the site
+ *
+ * Registers a read-only `search_site` tool through WebMCP
+ * (`document.modelContext`) in browsers that support it, and does nothing in
+ * others. The tool calls the public search API only when an agent uses it.
+ *
+ * ```astro
+ * ---
+ * import WebMcpSearch from "emdash/ui/webmcp-search";
+ * ---
+ * <WebMcpSearch collections={["posts", "pages"]} routeMap={{ posts: "/blog/:slug" }} />
+ * ```
+ */
+
+export interface Props {
+	/** Collections to search (defaults to all searchable collections) */
+	collections?: string[];
+	/**
+	 * Locale to restrict results to. Defaults to `Astro.currentLocale`.
+	 * Pass `null` to search across every locale.
+	 */
+	locale?: string | null;
+	/** Maximum results per search, from 1 to 100 (defaults to 10) */
+	limit?: number;
+	/** Per-collection URL templates, e.g. { posts: "/blog/:path" } */
+	routeMap?: Record<string, string>;
+}
+
+const {
+	collections,
+	locale = Astro.currentLocale ?? null,
+	limit = 10,
+	routeMap = {},
+} = Astro.props;
+
+const config = {
+	collections: collections?.join(",") ?? "",
+	locale: locale ?? "",
+	limit,
+	routeMap,
+};
+---
+
+<emdash-webmcp-search data-config={JSON.stringify(config)} hidden></emdash-webmcp-search>
+
+<script>
+	import {
+		registerSiteSearchTool,
+		resolveModelContext,
+		type SiteSearchToolConfig,
+		type WithModelContext,
+	} from "./webmcp-search.js";
+
+	class EmDashWebMcpSearch extends HTMLElement {
+		private controller: AbortController | null = null;
+
+		connectedCallback() {
+			const modelContext = resolveModelContext(
+				document as WithModelContext,
+				navigator as WithModelContext,
+			);
+			if (!modelContext) return;
+
+			const config = JSON.parse(this.dataset.config ?? "{}") as SiteSearchToolConfig;
+			this.controller = new AbortController();
+			registerSiteSearchTool(modelContext, config, location.origin, this.controller.signal);
+		}
+
+		disconnectedCallback() {
+			this.controller?.abort();
+			this.controller = null;
+		}
+	}
+
+	if (!customElements.get("emdash-webmcp-search")) {
+		customElements.define("emdash-webmcp-search", EmDashWebMcpSearch);
+	}
+</script>

package/src/components/index.ts

@@ -50,6 +50,7 @@ export { default as Gallery } from "./Gallery.astro";
 export { default as Columns } from "./Columns.astro";
 export { default as Break } from "./Break.astro";
 export { default as HtmlBlock } from "./HtmlBlock.astro";
+export { default as Iframe } from "./Iframe.astro";
 export { default as Table } from "./Table.astro";
 export { default as Button } from "./Button.astro";
 export { default as Buttons } from "./Buttons.astro";
@@ -76,6 +77,7 @@ import EmbedComponent from "./Embed.astro";
 import FileComponent from "./File.astro";
 import GalleryComponent from "./Gallery.astro";
 import HtmlBlockComponent from "./HtmlBlock.astro";
+import IframeComponent from "./Iframe.astro";
 // Pre-configured components object for PortableText
 import ImageComponent from "./Image.astro";
 import { emdashMarkComponents } from "./marks.js";
@@ -89,8 +91,8 @@ import TableComponent from "./Table.astro";
  * Includes renderers for:
  * - Block styles: paragraph, h1..h6, blockquote — with `textAlign` honoured
  *   as a WordPress-style `has-text-align-{value}` class (#1201)
- * - Block types: image, code, embed, gallery, columns, break, htmlBlock, table,
- *   button, buttons, cover, file, pullquote
+ * - Block types: image, code, embed, gallery, columns, break, htmlBlock, iframe,
+ *   table, button, buttons, cover, file, pullquote
  * - Marks: superscript, subscript, underline, strike-through, link
  */
 export const emdashComponents = {
@@ -107,6 +109,7 @@ export const emdashComponents = {
 		columns: ColumnsComponent,
 		break: BreakComponent,
 		htmlBlock: HtmlBlockComponent,
+		iframe: IframeComponent,
 		table: TableComponent,
 		button: ButtonComponent,
 		buttons: ButtonsComponent,

package/src/components/webmcp-search.ts

@@ -0,0 +1,142 @@
+import { buildLiveSearchResultUrl, type LiveSearchRouteMap } from "./live-search-routing.js";
+
+export interface SiteSearchToolConfig {
+	/** Comma-separated collection slugs, or `""` for every searchable collection. */
+	collections: string;
+	/** Locale to search, or `""` for every locale. */
+	locale: string;
+	/** Default and maximum number of results per call. */
+	limit: number;
+	routeMap: LiveSearchRouteMap;
+}
+
+interface ToolResult {
+	content: { type: "text"; text: string }[];
+	isError?: boolean;
+}
+
+interface WebMcpTool {
+	name: string;
+	description: string;
+	inputSchema: Record<string, unknown>;
+	annotations: { readOnlyHint: boolean; untrustedContentHint: boolean };
+	execute: (input: { query?: unknown; limit?: unknown }) => Promise<ToolResult>;
+}
+
+export interface ModelContextLike {
+	registerTool: (tool: WebMcpTool, options?: { signal?: AbortSignal }) => unknown;
+}
+
+export interface WithModelContext {
+	modelContext?: ModelContextLike;
+}
+
+interface SearchApiResult {
+	collection: string;
+	id: string;
+	slug: string | null;
+	title?: string;
+	snippet?: string;
+}
+
+const MARK_RE = /<\/?mark>/g;
+const MAX_LIMIT = 100;
+
+/** Turns a search snippet (escaped text with `<mark>` highlights) into plain text. */
+function snippetToText(snippet: string): string {
+	return snippet
+		.replace(MARK_RE, "")
+		.replaceAll("&lt;", "<")
+		.replaceAll("&gt;", ">")
+		.replaceAll("&quot;", '"')
+		.replaceAll("&#39;", "'")
+		.replaceAll("&amp;", "&");
+}
+
+function textResult(text: string, isError = false): ToolResult {
+	return { content: [{ type: "text", text }], ...(isError ? { isError } : {}) };
+}
+
+export function createSiteSearchTool(
+	config: SiteSearchToolConfig,
+	origin: string,
+	fetchImpl: typeof fetch = fetch,
+): WebMcpTool {
+	const maxLimit = Math.min(Math.max(Math.floor(config.limit) || 1, 1), MAX_LIMIT);
+	return {
+		name: "search_site",
+		description:
+			"Search this site's published content. Returns matching pages with their title, URL, and a text excerpt.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				query: { type: "string", description: "Words to search for" },
+				limit: {
+					type: "integer",
+					minimum: 1,
+					maximum: maxLimit,
+					description: `Maximum number of results (default ${maxLimit})`,
+				},
+			},
+			required: ["query"],
+		},
+		annotations: { readOnlyHint: true, untrustedContentHint: true },
+		async execute(input) {
+			const query = typeof input.query === "string" ? input.query.trim() : "";
+			if (!query) return textResult("Provide a search query.", true);
+			const requested = typeof input.limit === "number" ? Math.floor(input.limit) : maxLimit;
+			const limit = Math.min(Math.max(requested, 1), maxLimit);
+
+			const params = new URLSearchParams({ q: query, limit: String(limit) });
+			if (config.collections) params.set("collections", config.collections);
+			if (config.locale) params.set("locale", config.locale);
+
+			let body: { data?: { items?: SearchApiResult[] } };
+			try {
+				const response = await fetchImpl(`${origin}/_emdash/api/search?${params}`);
+				if (!response.ok) return textResult(`Search failed (HTTP ${response.status}).`, true);
+				body = await response.json();
+			} catch {
+				return textResult("Search failed.", true);
+			}
+			const results = (body.data?.items ?? []).map((item) => ({
+				title: item.title ?? item.slug ?? item.id,
+				url: new URL(buildLiveSearchResultUrl(item, config.routeMap), origin).href,
+				collection: item.collection,
+				...(item.snippet ? { excerpt: snippetToText(item.snippet) } : {}),
+			}));
+			return textResult(JSON.stringify(results));
+		},
+	};
+}
+
+function warnRegistrationFailed(error: unknown): void {
+	console.warn("[emdash] Could not register the WebMCP search tool:", error);
+}
+
+/** Returns the browser's WebMCP model context, preferring `document` over the deprecated `navigator` location. */
+export function resolveModelContext(
+	doc?: WithModelContext,
+	nav?: WithModelContext,
+): ModelContextLike | undefined {
+	return doc?.modelContext ?? nav?.modelContext;
+}
+
+/** Registers the site search tool when the browser supports WebMCP. */
+export function registerSiteSearchTool(
+	modelContext: ModelContextLike | undefined,
+	config: SiteSearchToolConfig,
+	origin: string,
+	signal?: AbortSignal,
+): boolean {
+	if (!modelContext) return false;
+	try {
+		Promise.resolve(
+			modelContext.registerTool(createSiteSearchTool(config, origin), { signal }),
+		).catch(warnRegistrationFailed);
+		return true;
+	} catch (error) {
+		warnRegistrationFailed(error);
+		return false;
+	}
+}

package/src/config/secrets.ts

@@ -34,6 +34,7 @@ import type { Kysely } from "kysely";
 
 import { after } from "../after.js";
 import { OptionsRepository } from "../database/repositories/options.js";
+import { isRequestScopedDb } from "../database/request-scoped.js";
 import type { Database } from "../database/types.js";
 import { decodeBase64url, encodeBase64url } from "../utils/base64.js";
 import {
@@ -382,17 +383,22 @@ export async function validateEncryptionKeyAtStartup(env?: SecretsEnv): Promise<
 }
 
 /**
- * Per-DB cache of resolved secrets, keyed by Kysely instance identity.
+ * Per-DB cache of resolved secrets. Request-scoped views of the configured
+ * database (see `database/request-scoped.ts`) share one entry; any other
+ * Kysely instance is keyed by its identity.
  *
  * The resolved values are stable for the lifetime of the deployment (env
  * vars don't change without a restart, and DB-stored values are written
  * once via `setIfAbsent`). Caching avoids one options-table read per
- * request on the hot paths (preview verification, comment hashing).
+ * request on the hot paths (preview verification, comment hashing). A
+ * deleted row is regenerated only by a process or isolate that has not
+ * cached the old value, so rotating a DB-stored secret needs a restart or
+ * redeploy.
  *
  * Lives on `globalThis` so module-duplication during SSR bundling can't
  * fragment the cache. See `request-context.ts` for the same pattern.
  *
- * Each db gets its own poison-immune single-flight cache (see
+ * Each entry is a poison-immune single-flight cache (see
  * `utils/single-flight-cache.ts`): the resolved *value* is cached, never an
  * in-flight promise, so a request cancelled mid-resolve can't strand later
  * preview/comment requests on the isolate.
@@ -405,9 +411,10 @@ const SECRETS_CACHE_KEY = Symbol.for("@emdash-cms/core/secrets-cache@2");
 
 interface SecretsCacheHolder {
 	cache: WeakMap<Kysely<Database>, SingleFlightCache<ResolvedSecrets>>;
+	requestScoped?: SingleFlightCache<ResolvedSecrets>;
 }
 
-function getSecretsCache(): WeakMap<Kysely<Database>, SingleFlightCache<ResolvedSecrets>> {
+function getSecretsCache(db: Kysely<Database>): SingleFlightCache<ResolvedSecrets> {
 	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern
 	const holder = globalThis as Record<symbol, SecretsCacheHolder | undefined>;
 	let entry = holder[SECRETS_CACHE_KEY];
@@ -415,7 +422,16 @@ function getSecretsCache(): WeakMap<Kysely<Database>, SingleFlightCache<Resolved
 		entry = { cache: new WeakMap() };
 		holder[SECRETS_CACHE_KEY] = entry;
 	}
-	return entry.cache;
+	if (isRequestScopedDb(db)) {
+		entry.requestScoped ??= createSingleFlightCache<ResolvedSecrets>();
+		return entry.requestScoped;
+	}
+	let cache = entry.cache.get(db);
+	if (!cache) {
+		cache = createSingleFlightCache<ResolvedSecrets>();
+		entry.cache.set(db, cache);
+	}
+	return cache;
 }
 
 /**
@@ -423,18 +439,14 @@ function getSecretsCache(): WeakMap<Kysely<Database>, SingleFlightCache<Resolved
  * paths (preview verification, comment IP hashing) so they don't reread
  * env / re-query options on every request.
  *
- * The cache is keyed by `Kysely` instance, so playground / per-DO / per-test
- * databases each get their own resolution. Concurrent cold callers coalesce
- * onto one resolution via the single-flight lock; a failed resolution
- * propagates to the caller and releases the lock so the next caller retries.
+ * Request-scoped views of the configured database share one resolution;
+ * playground / DO preview / per-test databases each get their own.
+ * Concurrent cold callers coalesce onto one resolution via the single-flight
+ * lock; a failed resolution propagates to the caller and releases the lock so
+ * the next caller retries.
  */
 export function resolveSecretsCached(db: Kysely<Database>): Promise<ResolvedSecrets> {
-	const caches = getSecretsCache();
-	let cache = caches.get(db);
-	if (!cache) {
-		cache = createSingleFlightCache<ResolvedSecrets>();
-		caches.set(db, cache);
-	}
+	const cache = getSecretsCache(db);
 	return singleFlightCached(cache, () => resolveSecrets({ db }), {
 		anchor: (promise) => after(() => promise),
 		ownerTimeoutMs: 30_000,

package/src/content/converters/portable-text-identity.ts

@@ -70,6 +70,7 @@ export const PortableTextIdentityExtension = Extension.create({
 					"blockquote",
 					"codeBlock",
 					"htmlBlock",
+					"iframeBlock",
 					"image",
 					"horizontalRule",
 					"gallery",

package/src/content/converters/portable-text-to-prosemirror.ts

@@ -4,6 +4,7 @@
  * Converts Portable Text to TipTap's ProseMirror JSON format for editing.
  */
 
+import { htmlBlockFields } from "@emdash-cms/admin/html-block";
 import {
 	UnsafePortableTextTableError,
 	portableTextTableToProseMirror,
@@ -38,6 +39,7 @@ import type {
 	PortableTextImageBlock,
 	PortableTextGalleryBlock,
 	PortableTextCodeBlock,
+	PortableTextIframeBlock,
 } from "./types.js";
 
 function generateKey(): string {
@@ -222,6 +224,35 @@ function isGalleryBlock(block: PortableTextBlock): block is PortableTextGalleryB
 	return block._type === "gallery" && "images" in block && Array.isArray(block.images);
 }
 
+const isString = (value: unknown) => typeof value === "string";
+const isFrameDimension = (value: unknown) =>
+	typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 10_000;
+
+const IFRAME_BLOCK_FIELDS = new Map<string, (value: unknown) => boolean>([
+	["_type", () => true],
+	["_key", () => true],
+	["src", isString],
+	["title", isString],
+	["width", isFrameDimension],
+	["height", isFrameDimension],
+	["allow", isString],
+	["allowFullscreen", (value) => typeof value === "boolean"],
+]);
+
+/**
+ * An `iframe` block with other fields, or with values of other types, belongs
+ * to a plugin and stays a generic block.
+ */
+function isIframeBlock(block: PortableTextBlock): block is PortableTextIframeBlock {
+	return (
+		block._type === "iframe" &&
+		typeof block.src === "string" &&
+		Object.entries(block).every(
+			([key, value]) => value === undefined || (IFRAME_BLOCK_FIELDS.get(key)?.(value) ?? false),
+		)
+	);
+}
+
 /**
  * Type guard for code blocks
  */
@@ -264,12 +295,15 @@ function convertBlock(
 		return convertCodeBlock(block, preserveIdentity);
 	}
 	if (block._type === "htmlBlock") {
-		const hb = block as PortableTextBlock & { html?: string };
 		return {
 			type: "htmlBlock",
-			attrs: identityAttrs({ html: hb.html || "" }, block._key, preserveIdentity),
+			attrs: identityAttrs({ ...htmlBlockFields(block) }, block._key, preserveIdentity),
 		};
 	}
+	if (isIframeBlock(block)) {
+		const { _type, _key, ...attrs } = block;
+		return { type: "iframeBlock", attrs: identityAttrs(attrs, _key, preserveIdentity) };
+	}
 	if (block._type === "break") {
 		return {
 			type: "horizontalRule",

package/src/content/converters/prosemirror-to-portable-text.ts

@@ -4,6 +4,7 @@
  * Converts TipTap's ProseMirror JSON format to Portable Text for storage.
  */
 
+import { htmlBlockFields } from "@emdash-cms/admin/html-block";
 import {
 	UnsafePortableTextTableError,
 	proseMirrorTableToPortableText,
@@ -35,6 +36,7 @@ import type {
 	PortableTextGalleryBlock,
 	PortableTextCodeBlock,
 	PortableTextHtmlBlock,
+	PortableTextIframeBlock,
 } from "./types.js";
 
 /**
@@ -113,6 +115,9 @@ function convertNode(
 		case "htmlBlock":
 			return convertHtmlBlock(node);
 
+		case "iframeBlock":
+			return convertIframeBlock(node);
+
 		case "image":
 			return convertImage(node);
 
@@ -351,14 +356,35 @@ function convertCodeBlock(node: ProseMirrorNode): PortableTextCodeBlock {
  * Convert HTML block to Portable Text
  */
 function convertHtmlBlock(node: ProseMirrorNode): PortableTextHtmlBlock {
-	const rawHtml = node.attrs?.html;
 	return {
 		_type: "htmlBlock",
 		_key: portableTextKeyFromAttrs(node.attrs) ?? generateKey(),
-		html: typeof rawHtml === "string" ? rawHtml : "",
+		...htmlBlockFields(node.attrs ?? {}),
 	};
 }
 
+/**
+ * Convert iframe block to Portable Text, writing optional fields only when set
+ */
+function convertIframeBlock(node: ProseMirrorNode): PortableTextIframeBlock {
+	const { src, title, width, height, allow, allowFullscreen } = node.attrs ?? {};
+	const block: PortableTextIframeBlock = {
+		_type: "iframe",
+		_key: portableTextKeyFromAttrs(node.attrs) ?? generateKey(),
+		src: typeof src === "string" ? src : "",
+	};
+	if (typeof title === "string" && title) block.title = title;
+	if (isFrameDimension(width)) block.width = width;
+	if (isFrameDimension(height)) block.height = height;
+	if (typeof allow === "string" && allow) block.allow = allow;
+	if (allowFullscreen === true) block.allowFullscreen = true;
+	return block;
+}
+
+function isFrameDimension(value: unknown): value is number {
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 10_000;
+}
+
 function imageDimension(value: unknown): number | undefined {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
 }

package/src/content/converters/types.ts

@@ -155,6 +155,29 @@ export interface PortableTextHtmlBlock {
 	_type: "htmlBlock";
 	_key: string;
 	html: string;
+	/** Styles for the isolated frame. Not used when the block renders inline. */
+	css?: string;
+	/** Script for the isolated frame. Not used when the block renders inline. */
+	js?: string;
+	/** Render in a sandboxed frame instead of as inline, sanitized HTML. */
+	isolated?: boolean;
+}
+
+/**
+ * Iframe block (a page from another site)
+ */
+export interface PortableTextIframeBlock {
+	_type: "iframe";
+	_key: string;
+	/** An absolute https URL. */
+	src: string;
+	title?: string;
+	/** Whole numbers from 1 to 10000. With both set, they give the aspect ratio. */
+	width?: number;
+	height?: number;
+	/** Permissions policy features for the embedded page. */
+	allow?: string;
+	allowFullscreen?: boolean;
 }
 
 /**
@@ -175,6 +198,7 @@ export type PortableTextBlock =
 	| PortableTextGalleryBlock
 	| PortableTextCodeBlock
 	| PortableTextHtmlBlock
+	| PortableTextIframeBlock
 	| PortableTextTableBlock
 	| PortableTextUnknownBlock;
 

package/src/database/content-datetime.ts

@@ -7,7 +7,7 @@ import {
 	type DatetimeFieldDescriptor,
 } from "../datetime-normalization.js";
 import { requestCached } from "../request-cache.js";
-import type { FieldType, RepeaterSubField } from "../schema/types.js";
+import { isStoragelessFieldRow, type FieldType, type RepeaterSubField } from "../schema/types.js";
 import { isSafeUrlFieldWriteValue } from "../utils/url.js";
 import { EmDashValidationError } from "./repositories/types.js";
 import type { Database } from "./types.js";
@@ -21,6 +21,7 @@ interface DatetimeContext {
 	timezone: string;
 	fields: DatetimeFieldDescriptor[];
 	urlFields: UrlFieldDescriptor[];
+	writableFieldSlugs: ReadonlySet<string>;
 }
 
 function repeaterSubFieldsOfType(validation: string | null, type: FieldType): string[] {
@@ -83,7 +84,6 @@ export class ContentDatetimeNormalizer {
 				.innerJoin("_emdash_collections as collection", "collection.id", "field.collection_id")
 				.select(["field.slug", "field.type", "field.validation"])
 				.where("collection.slug", "=", collection)
-				.where("field.type", "in", ["datetime", "repeater", "url"])
 				.execute(),
 			this.db
 				.selectFrom("options")
@@ -107,7 +107,7 @@ export class ContentDatetimeNormalizer {
 				fields.push({ slug: row.slug, type: "datetime" });
 			} else if (row.type === "url") {
 				urlFields.push({ slug: row.slug });
-			} else {
+			} else if (row.type === "repeater") {
 				fields.push({
 					slug: row.slug,
 					type: "repeater",
@@ -117,7 +117,14 @@ export class ContentDatetimeNormalizer {
 				if (urlSubFields.length > 0) urlFields.push({ slug: row.slug, urlSubFields });
 			}
 		}
-		return { timezone, fields, urlFields };
+		const writableFieldSlugs = new Set(
+			rows.filter((field) => !isStoragelessFieldRow(field)).map((field) => field.slug),
+		);
+		return { timezone, fields, urlFields, writableFieldSlugs };
+	}
+
+	async writableFieldSlugs(collection: string): Promise<ReadonlySet<string>> {
+		return (await this.context(collection)).writableFieldSlugs;
 	}
 
 	/**

package/src/database/migrations/090_redirect_enable_loop_guard.ts

@@ -0,0 +1,70 @@
+import { type Kysely, sql } from "kysely";
+
+import { isPostgres } from "../dialect-helpers.js";
+
+/**
+ * Rejects enabling a disabled redirect when its edge would close a loop.
+ * The loop guards from 081 only fire when source or destination changes.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	if (isPostgres(db)) {
+		await sql`
+			CREATE OR REPLACE FUNCTION emdash_redirect_validate_enable()
+			RETURNS trigger
+			LANGUAGE plpgsql
+			AS $$
+			BEGIN
+				PERFORM pg_advisory_xact_lock(1168624763);
+				IF EXISTS (
+					WITH RECURSIVE chain(source, destination) AS (
+						SELECT source, destination FROM _emdash_redirects
+						WHERE source = NEW.destination AND enabled = 1 AND id <> NEW.id
+						UNION
+						SELECT redirect.source, redirect.destination
+						FROM _emdash_redirects AS redirect
+						JOIN chain ON redirect.source = chain.destination
+						WHERE redirect.enabled = 1 AND redirect.id <> NEW.id
+					)
+					SELECT 1 FROM chain WHERE destination = NEW.source
+				) THEN
+					RAISE EXCEPTION 'redirect loop';
+				END IF;
+				RETURN NEW;
+			END;
+			$$
+		`.execute(db);
+		await sql`DROP TRIGGER IF EXISTS emdash_redirect_loop_enable ON _emdash_redirects`.execute(db);
+		await sql`
+			CREATE TRIGGER emdash_redirect_loop_enable
+			BEFORE UPDATE OF enabled ON _emdash_redirects
+			FOR EACH ROW
+			WHEN (NEW.enabled = 1 AND OLD.enabled IS DISTINCT FROM 1 AND NEW.destination <> '')
+			EXECUTE FUNCTION emdash_redirect_validate_enable()
+		`.execute(db);
+		return;
+	}
+
+	// No `CASE ... END;` inside trigger bodies: the D1 HTTP API used by
+	// `emdash migrate` ends the statement at an inner `END;`.
+	await sql`
+		CREATE TRIGGER IF NOT EXISTS emdash_redirect_loop_enable
+		BEFORE UPDATE OF enabled ON _emdash_redirects
+		WHEN NEW.enabled = 1 AND OLD.enabled IS NOT 1 AND NEW.destination <> ''
+		BEGIN
+			SELECT RAISE(ABORT, 'redirect loop') WHERE EXISTS (
+				WITH RECURSIVE chain(source, destination) AS (
+					SELECT source, destination FROM _emdash_redirects
+					WHERE source = NEW.destination AND enabled = 1 AND id <> NEW.id
+					UNION
+					SELECT redirect.source, redirect.destination
+					FROM _emdash_redirects AS redirect
+					JOIN chain ON redirect.source = chain.destination
+					WHERE redirect.enabled = 1 AND redirect.id <> NEW.id
+				)
+				SELECT 1 FROM chain WHERE destination = NEW.source
+			);
+		END
+	`.execute(db);
+}
+
+export async function down(_db: Kysely<unknown>): Promise<void> {}