emdash 1.0.1 → 1.2.0

package/src/astro/routes/api/media/upload-url.ts

@@ -18,7 +18,7 @@ import { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from "#api/handlers/me
 import { isParseError, parseBody } from "#api/parse.js";
 import { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from "#api/schemas.js";
 import { MediaRepository } from "#db/repositories/media.js";
-import { matchesMimeAllowlist, normalizeMime } from "#media/mime.js";
+import { matchesMimeAllowlist, normalizeMime, resolveUploadMimeType } from "#media/mime.js";
 
 export const prerender = false;
 
@@ -73,9 +73,37 @@ export const POST: APIRoute = async ({ request, locals }) => {
 				500,
 			);
 		}
-		const body = await parseBody(request, mediaUploadUrlBody(maxSize));
+		const uploadSchema = mediaUploadUrlBody(maxSize);
+		const body = await parseBody(request, uploadSchema);
 		if (isParseError(body)) return body;
-		const normalizedContentType = normalizeMime(body.contentType);
+
+		let beforeUploadFile = {
+			name: body.filename,
+			type: body.contentType,
+			size: body.size,
+		};
+		if (emdash.hooks?.hasHooks("media:beforeUpload")) {
+			const hookResult = await emdash.hooks.runMediaBeforeUpload(beforeUploadFile);
+			const metadata = uploadSchema.safeParse({
+				filename: hookResult.file?.name,
+				contentType: hookResult.file?.type,
+				size: body.size,
+			});
+			if (!metadata.success) {
+				return apiError("VALIDATION_ERROR", "Invalid media:beforeUpload result", 400);
+			}
+			// Hooks change metadata, but the client still uploads the original bytes.
+			beforeUploadFile = {
+				name: metadata.data.filename,
+				type: metadata.data.contentType,
+				size: body.size,
+			};
+		}
+
+		// Clients that don't recognise an extension may send an empty or generic
+		// content type; fall back to the filename extension before allowlisting.
+		const mimeType = resolveUploadMimeType(beforeUploadFile.name, beforeUploadFile.type);
+		const normalizedContentType = normalizeMime(mimeType);
 
 		// Validate content type (field-aware widening)
 		const fieldAllowlist = body.fieldId
@@ -83,7 +111,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			: null;
 		const allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];
 
-		if (!matchesMimeAllowlist(body.contentType, allowlist)) {
+		if (!matchesMimeAllowlist(mimeType, allowlist)) {
 			return apiError("INVALID_TYPE", "File type not allowed", 400);
 		}
 
@@ -103,8 +131,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			}
 		}
 		const filename = body.ensureUniqueFilename
-			? await repo.findAvailableFilename(body.filename)
-			: body.filename;
+			? await repo.findAvailableFilename(beforeUploadFile.name)
+			: beforeUploadFile.name;
 
 		// Generate unique storage key
 		const id = ulid();
@@ -115,7 +143,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		try {
 			signedUrl = await emdash.storage.getSignedUploadUrl({
 				key: storageKey,
-				contentType: body.contentType,
+				contentType: mimeType,
 				size: body.size,
 				expiresIn: 3600,
 			});

package/src/astro/routes/api/media.ts

@@ -22,10 +22,11 @@ import {
 	mediaListQuery,
 	mediaUploadDeduplicateForm,
 	mediaUploadEnsureUniqueFilenameForm,
+	mediaUploadMetadataForm,
 } from "#api/schemas.js";
 import { MediaRepository } from "#db/repositories/media.js";
 import { enrichImageMetadata } from "#media/enrich.js";
-import { matchesMimeAllowlist, normalizeMime } from "#media/mime.js";
+import { matchesMimeAllowlist, resolveUploadMimeType } from "#media/mime.js";
 import { computeContentHash } from "#utils/hash.js";
 
 import type { MediaItem } from "../../types.js";
@@ -178,6 +179,18 @@ export const POST: APIRoute = async ({ request, locals }) => {
 				folderId = folderResult.data;
 			}
 		}
+		const metadataResult = mediaUploadMetadataForm.safeParse({
+			alt: formData.get("alt") ?? undefined,
+			caption: formData.get("caption") ?? undefined,
+		});
+		if (!metadataResult.success) {
+			return apiError("VALIDATION_ERROR", "Invalid request data", 400, {
+				issues: metadataResult.error.issues.map((issue) => ({
+					path: issue.path.join("."),
+					message: issue.message,
+				})),
+			});
+		}
 
 		// Validate file type — widen the allowlist when a field-specific list is configured
 		const fieldIdEntry = formData.get("fieldId");
@@ -187,7 +200,11 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const fieldAllowlist = fieldId ? await resolveFieldAllowlist(emdash.db, fieldId) : null;
 		const allowlist = fieldAllowlist ?? [...GLOBAL_UPLOAD_ALLOWLIST];
 
-		if (!matchesMimeAllowlist(file.type, allowlist)) {
+		// Browsers that don't know a format (e.g. `.jxl`) may send an empty or
+		// generic type; fall back to the extension map so allowed uploads aren't
+		// rejected just because the client can't identify them.
+		const mimeType = resolveUploadMimeType(file.name, file.type);
+		if (!mimeType || !matchesMimeAllowlist(mimeType, allowlist)) {
 			return apiError("INVALID_TYPE", "File type not allowed", 400);
 		}
 
@@ -226,7 +243,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		await emdash.storage.upload({
 			key: storageKey,
 			body: buffer,
-			contentType: file.type,
+			contentType: mimeType,
 		});
 
 		// Get image dimensions from form data (sent by client)
@@ -242,7 +259,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		// (avoids OOM on large originals on memory-constrained runtimes).
 		const thumbnailEntry = formData.get("thumbnail");
 		const thumbnail = thumbnailEntry instanceof File ? thumbnailEntry : null;
-		const enriched = await enrichImageMetadata(buffer, file.type, {
+		const enriched = await enrichImageMetadata(buffer, mimeType, {
 			knownDimensions: width != null && height != null ? { width, height } : undefined,
 			placeholder: thumbnail
 				? { bytes: new Uint8Array(await thumbnail.arrayBuffer()), contentType: thumbnail.type }
@@ -252,8 +269,10 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		// Create media record
 		const result = await emdash.handleMediaCreate({
 			filename,
-			mimeType: normalizeMime(file.type),
+			mimeType,
 			size: file.size,
+			alt: metadataResult.data.alt,
+			caption: metadataResult.data.caption,
 			// Client dimensions win over server header dimensions: the browser's
 			// naturalWidth/Height apply EXIF orientation, while image-size reports
 			// raw (pre-orientation) header dims — swapped for 90°/270° JPEGs.

package/src/astro/routes/api/schema/index.ts

@@ -57,7 +57,7 @@ export const GET: APIRoute = async ({ request, locals }) => {
 			const header = `// Generated by EmDash CLI
 // Do not edit manually - run \`emdash types\` to regenerate
 
-import type { PortableTextBlock } from "emdash";
+import type { BylineSummary, ContentBylineCredit, TaxonomyTerm, PortableTextBlock } from "emdash";
 
 `;
 

package/src/astro/routes/api/settings/domain-notify.ts

@@ -0,0 +1,76 @@
+/**
+ * POST /_emdash/api/settings/domain/notify
+ *
+ * Emails every active user except the sender that the site now lives at
+ * its chosen address (the configured `siteUrl`, otherwise the Site URL),
+ * with a link to the sign-in page there. The email carries no sign-in token.
+ * Sites that sign in through an external provider are refused.
+ */
+
+import { getDomainMoveEmailStrings } from "@emdash-cms/admin/locales/emails";
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { resolveEmailLocale } from "#api/email-locale.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleDomainMoveNotice } from "#api/handlers/domain-move-notice.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { getAuthMode } from "#auth/mode.js";
+import { checkRateLimit } from "#auth/rate-limit.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!user) return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	const denied = requirePerm(user, "users:manage");
+	if (denied) return denied;
+	if (locals.tokenScopes !== undefined) {
+		return apiError("FORBIDDEN", "Emailing users requires a signed-in session", 403);
+	}
+	if (getAuthMode(emdash.config).type !== "passkey") {
+		return apiError("NOT_SUPPORTED", "Users sign in through an external provider", 400);
+	}
+
+	if (!emdash.email?.isAvailable()) {
+		return apiError(
+			"EMAIL_NOT_CONFIGURED",
+			"No email provider is configured. Install and activate an email provider plugin.",
+			503,
+		);
+	}
+
+	try {
+		const origin = await getChosenSiteOrigin(emdash.db, emdash.config);
+		if (!origin) {
+			return apiError("NO_SITE_URL", "Set a Site URL before emailing users about it", 409);
+		}
+
+		const rateLimit = await checkRateLimit(emdash.db, "site", "settings/domain/notify", 3, 3600);
+		if (!rateLimit.allowed) {
+			return apiError("RATE_LIMITED", "Users were emailed recently. Try again later.", 429);
+		}
+
+		const options = new OptionsRepository(emdash.db);
+		const siteOptions = await options.getMany<string>(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") || "EmDash";
+		const locale = resolveEmailLocale(siteOptions.get("emdash:locale"), request);
+		const email = emdash.email;
+
+		const result = await handleDomainMoveNotice(emdash.db, {
+			origin,
+			strings: await getDomainMoveEmailStrings(locale, siteName, new URL(origin).host),
+			locale,
+			senderId: user.id,
+			send: (message) => email.send(message, "system"),
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to email users", "DOMAIN_MOVE_NOTICE_ERROR");
+	}
+};

package/src/astro/routes/api/settings/domain.ts

@@ -0,0 +1,63 @@
+/**
+ * Site domain endpoint
+ *
+ * GET  /_emdash/api/settings/domain - The site URL set by the deployment
+ *      configuration, if any, which takes precedence over the Site URL for
+ *      links in emails and plugins, and `siteOrigin`, the origin sign-in
+ *      handover links to (null until a Site URL or `siteUrl` is set).
+ * POST /_emdash/api/settings/domain - Verify a new domain and store it as the
+ *      Site URL.
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
+import { handleSiteDomainChange } from "#api/handlers/site-domain.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { getConfiguredOrigin } from "#api/public-url.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { siteSettingsTag } from "#cache/chrome-tags.js";
+
+export const prerender = false;
+
+const siteDomainBody = z.object({ domain: z.string().min(1).max(253) });
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:read");
+	if (denied) return denied;
+
+	try {
+		const siteOrigin = (await getChosenSiteOrigin(emdash.db, emdash.config)) ?? null;
+		return apiSuccess({ configuredUrl: getConfiguredOrigin(emdash.config) ?? null, siteOrigin });
+	} catch (error) {
+		return handleError(error, "Failed to read the site domain", "SITE_DOMAIN_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals, cache }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, siteDomainBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleSiteDomainChange(emdash.db, body.domain);
+		if (result.success && cache?.enabled) await cache.invalidate({ tags: [siteSettingsTag()] });
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to change the site domain", "SITE_DOMAIN_ERROR");
+	}
+};

package/src/astro/routes/api/setup/index.ts

@@ -17,6 +17,7 @@ import { OptionsRepository } from "#db/repositories/options.js";
 import { applySeedWithinBudget, type SeedApplyBudget } from "#seed/apply.js";
 import { loadSeed } from "#seed/load.js";
 import { validateSeed } from "#seed/validate.js";
+import { setSiteSettings } from "#settings/index.js";
 
 /**
  * What one setup request may spend on the seed before the rest continues in
@@ -54,8 +55,20 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 		const configuredSiteUrl = getConfiguredOrigin(emdash.config);
 		const loopbackHost =
 			url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-		const siteUrl =
-			configuredSiteUrl ?? (import.meta.env.DEV && loopbackHost ? url.origin : undefined);
+		// On Cloudflare's network a Worker only receives requests for hostnames bound
+		// to it, each with an edge TLS certificate. `astro dev` runs in workerd
+		// without that guarantee, so development keeps the loopback-only rule.
+		const onCloudflareWorkers =
+			typeof navigator !== "undefined" &&
+			typeof navigator.userAgent === "string" &&
+			navigator.userAgent.includes("Cloudflare-Workers");
+		let requestOrigin: string | undefined;
+		if (import.meta.env.DEV) {
+			if (loopbackHost) requestOrigin = url.origin;
+		} else if (onCloudflareWorkers) {
+			requestOrigin = `https://${url.hostname}`;
+		}
+		const siteUrl = configuredSiteUrl ?? requestOrigin;
 		if (!siteUrl) {
 			return apiError(
 				"SITE_URL_REQUIRED",
@@ -101,6 +114,12 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 		}
 		const { result, complete: seedComplete, progress: seedProgress } = seeded;
 
+		if (seedComplete) {
+			// The seed only fills settings that are still unset, and the runtime
+			// has usually auto-seeded the template's title and tagline already.
+			await setSiteSettings({ title: body.title, tagline: body.tagline }, emdash.db);
+		}
+
 		// Store setup state
 		// In external auth mode, mark setup complete immediately (first user to login becomes admin)
 		// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)

package/src/astro/routes/api/site/domain-proof.ts

@@ -0,0 +1,28 @@
+/**
+ * Domain proof endpoint
+ *
+ * POST /_emdash/api/site/domain-proof - Returns the token of a domain check in
+ * progress, so the site can confirm that a new domain serves it. POST keeps
+ * the read on the primary database, where the token was just written, rather
+ * than a read replica.
+ */
+
+import type { APIRoute } from "astro";
+
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleDomainProof } from "#api/handlers/site-domain.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		return unwrapResult(await handleDomainProof(emdash.db));
+	} catch (error) {
+		return handleError(error, "Failed to read domain proof", "DOMAIN_PROOF_ERROR");
+	}
+};

package/src/astro/routes/sitemap-[collection].xml.ts

@@ -1,7 +1,8 @@
 /**
  * Per-collection sitemap endpoint
  *
- * GET /sitemap-{collection}.xml - Sitemap for a single content collection.
+ * GET /sitemap-{collection}.xml - First page of a single collection's sitemap.
+ * GET /sitemap-{collection}-{n}.xml - Page n (2 and up) of that sitemap.
  *
  * Uses the collection's url_pattern to build URLs. Falls back to
  * /{collection}/{slug} when no pattern is configured.
@@ -26,6 +27,7 @@ import { getSiteSettingsWithDb } from "#settings/index.js";
 import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
 import { resolveLocalizedContentRoutePath } from "../../i18n/resolve.js";
 import { buildSeoImageUrl } from "../../seo/media-url.js";
+import { parseCollectionSitemapName } from "../../seo/sitemap-name.js";
 
 export const prerender = false;
 
@@ -38,9 +40,19 @@ const APOS_RE = /'/g;
 
 export const GET: APIRoute = async ({ params, locals, url }) => {
 	const { emdash } = locals;
-	const collectionSlug = params.collection;
 
-	if (!emdash?.db || !collectionSlug) {
+	// The middleware skips runtime setup for names no collection can have, so
+	// this check must run before the configuration check below.
+	const parsed = params.collection ? parseCollectionSitemapName(params.collection) : null;
+	if (!parsed) {
+		return new Response("<!-- Sitemap not found -->", {
+			status: 404,
+			headers: { "Content-Type": "application/xml" },
+		});
+	}
+	const { collection: collectionSlug, page } = parsed;
+
+	if (!emdash?.db) {
 		return new Response("<!-- EmDash not configured -->", {
 			status: 500,
 			headers: { "Content-Type": "application/xml" },
@@ -54,7 +66,7 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			"",
 		);
 
-		const result = await handleSitemapData(emdash.db, collectionSlug);
+		const result = await handleSitemapData(emdash.db, collectionSlug, { page });
 
 		if (!result.success || !result.data) {
 			return new Response("<!-- Failed to generate sitemap -->", {
@@ -89,6 +101,17 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				ungrouped.push(entry);
 			}
 		}
+		// Translations listed on other pages still count as alternates here.
+		const alternatesByGroup = new Map<string, Entry[]>();
+		const all = [...col.entries, ...col.translations].toSorted((a, b) =>
+			a.id < b.id ? -1 : a.id > b.id ? 1 : 0,
+		);
+		for (const entry of all) {
+			if (!i18nEnabled || !entry.translationGroup) continue;
+			const list = alternatesByGroup.get(entry.translationGroup);
+			if (list) list.push(entry);
+			else alternatesByGroup.set(entry.translationGroup, [entry]);
+		}
 
 		// Resolve every URL up-front so we can reference sibling URLs
 		// while emitting hreflang alternates without re-resolving.
@@ -159,8 +182,7 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				}
 
 				// x-default: prefer the default-locale sibling, otherwise
-				// the first sibling with a routable URL. Stable order:
-				// rows arrive sorted by updated_at DESC from the handler.
+				// the first sibling with a routable URL (siblings are sorted by ID).
 				const defaultSibling =
 					i18nConfig && alternateEntries.find((s) => s.locale === i18nConfig.defaultLocale);
 				let xDefaultLoc: string | null = null;
@@ -186,9 +208,10 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			lines.push("  </url>");
 		};
 
-		for (const siblings of groups.values()) {
+		for (const [group, siblings] of groups) {
+			const alternates = alternatesByGroup.get(group) ?? siblings;
 			for (const entry of siblings) {
-				await writeUrl(entry, siblings);
+				await writeUrl(entry, alternates);
 			}
 		}
 		for (const entry of ungrouped) {

package/src/astro/routes/sitemap.xml.ts

@@ -1,16 +1,17 @@
 /**
  * Sitemap index endpoint
  *
- * GET /sitemap.xml - Sitemap index listing one sitemap per collection.
+ * GET /sitemap.xml - Sitemap index listing the child sitemaps.
  *
- * Each collection with published, indexable content gets its own
- * child sitemap at /sitemap-{collection}.xml. The index includes
- * a <lastmod> per child derived from the most recently updated entry.
+ * Each collection with published, indexable content gets a child sitemap
+ * at /sitemap-{collection}.xml, continued at /sitemap-{collection}-{n}.xml
+ * once it exceeds one page. The index includes a <lastmod> per child
+ * derived from the most recently updated entry on that page.
  */
 
 import type { APIRoute } from "astro";
 
-import { handleSitemapData } from "#api/handlers/seo.js";
+import { handleSitemapIndexData } from "#api/handlers/seo.js";
 import { getPublicOrigin } from "#api/public-url.js";
 import { getSiteSettingsWithDb } from "#settings/index.js";
 
@@ -40,7 +41,7 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			"",
 		);
 
-		const result = await handleSitemapData(emdash.db);
+		const result = await handleSitemapIndexData(emdash.db);
 
 		if (!result.success || !result.data) {
 			return new Response("<!-- Failed to generate sitemap -->", {
@@ -49,18 +50,19 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			});
 		}
 
-		const { collections } = result.data;
+		const { sitemaps } = result.data;
 
 		const lines: string[] = [
 			'<?xml version="1.0" encoding="UTF-8"?>',
 			'<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
 		];
 
-		for (const col of collections) {
-			const loc = `${siteUrl}/sitemap-${encodeURIComponent(col.collection)}.xml`;
+		for (const sitemap of sitemaps) {
+			const suffix = sitemap.page === 1 ? "" : `-${sitemap.page}`;
+			const loc = `${siteUrl}/sitemap-${encodeURIComponent(sitemap.collection)}${suffix}.xml`;
 			lines.push("  <sitemap>");
 			lines.push(`    <loc>${escapeXml(loc)}</loc>`);
-			lines.push(`    <lastmod>${escapeXml(col.lastmod)}</lastmod>`);
+			lines.push(`    <lastmod>${escapeXml(sitemap.lastmod)}</lastmod>`);
 			lines.push("  </sitemap>");
 		}
 

package/src/astro/types.ts

@@ -83,6 +83,8 @@ export interface ManifestCollection {
 			id?: string;
 			/** Validation config for the field (e.g. `allowedMimeTypes` for file/image fields, subFields for repeater). */
 			validation?: Record<string, unknown>;
+			/** Value a new entry starts with in the admin editor. */
+			defaultValue?: unknown;
 		}
 	>;
 }
@@ -107,6 +109,7 @@ export interface ManifestPlugin {
 		path: string;
 		label?: string;
 		icon?: string;
+		group?: string;
 	}>;
 	dashboardWidgets?: Array<{
 		id: string;
@@ -163,6 +166,12 @@ export interface EmDashManifest {
 	 * authentication is handled externally.
 	 */
 	authMode: ManifestAuthMode;
+	/**
+	 * Whether the external auth provider replaces user names on every
+	 * authenticated request (`syncName` is not `false`). The admin shows the
+	 * name as managed by the identity provider instead of editable.
+	 */
+	providerManagedName?: boolean;
 	/**
 	 * Whether self-signup is enabled (at least one allowed domain is active).
 	 * Used by the login page to conditionally show the "Sign up" link.
@@ -288,6 +297,7 @@ export interface EmDashHandlers {
 		collection: string,
 		params: {
 			cursor?: string;
+			page?: number;
 			limit?: number;
 			status?: string;
 			orderBy?: string;
@@ -375,7 +385,7 @@ export interface EmDashHandlers {
 	// Trash handlers
 	handleContentListTrashed: (
 		collection: string,
-		params?: { cursor?: string; limit?: number; locale?: string },
+		params?: { cursor?: string; page?: number; limit?: number; locale?: string },
 	) => Promise<HandlerResponse>;
 
 	handleContentRestore: (collection: string, id: string) => Promise<HandlerResponse>;
@@ -469,6 +479,8 @@ export interface EmDashHandlers {
 		size?: number;
 		width?: number;
 		height?: number;
+		alt?: string;
+		caption?: string;
 		storageKey: string;
 		contentHash?: string;
 		blurhash?: string;

package/src/auth/providers/microsoft-admin.tsx

@@ -0,0 +1,31 @@
+/**
+ * Microsoft OAuth Admin Components
+ *
+ * LoginButton for the login page, rendered via the auth provider virtual module.
+ */
+
+import { LinkButton } from "@cloudflare/kumo";
+import * as React from "react";
+
+function MicrosoftIcon({ className }: { className?: string }) {
+	return (
+		<svg className={className} viewBox="0 0 24 24">
+			<path fill="#F25022" d="M1 1h10.5v10.5H1z" />
+			<path fill="#7FBA00" d="M12.5 1H23v10.5H12.5z" />
+			<path fill="#00A4EF" d="M1 12.5h10.5V23H1z" />
+			<path fill="#FFB900" d="M12.5 12.5H23V23H12.5z" />
+		</svg>
+	);
+}
+
+export function LoginButton({ inviteToken }: { inviteToken?: string } = {}) {
+	const href = inviteToken
+		? `/_emdash/api/auth/oauth/microsoft?invite=${encodeURIComponent(inviteToken)}`
+		: "/_emdash/api/auth/oauth/microsoft";
+	return (
+		<LinkButton href={href} variant="outline" className="w-full justify-center">
+			<MicrosoftIcon className="h-5 w-5" />
+			<span>Microsoft</span>
+		</LinkButton>
+	);
+}

package/src/auth/providers/microsoft.ts

@@ -0,0 +1,47 @@
+/**
+ * Microsoft OAuth Auth Provider
+ *
+ * Returns an AuthProviderDescriptor for Microsoft Entra ID login.
+ * Credentials are read from environment variables at runtime.
+ *
+ * @example
+ * ```ts
+ * import { microsoft } from "emdash/auth/providers/microsoft";
+ *
+ * emdash({
+ *   authProviders: [microsoft()],
+ * })
+ * ```
+ */
+
+import type { AuthProviderDescriptor } from "../types.js";
+
+export interface MicrosoftProviderOptions {
+	/**
+	 * Whether sign-in email addresses count as verified, which EmDash requires
+	 * before it links an existing user, accepts an invite, or allows
+	 * self-signup. By default, only accounts that sign in through a configured
+	 * directory (tenant) ID count as verified, and only for an address in the
+	 * domain of their sign-in name or confirmed by the `xms_edov` claim;
+	 * accounts homed in another directory or identity provider, such as
+	 * guests, and sign-ins through `common`, `organizations` or `consumers`
+	 * do not.
+	 */
+	emailVerified?: boolean;
+}
+
+/**
+ * Configure Microsoft Entra ID as an auth provider.
+ *
+ * Requires `EMDASH_OAUTH_MICROSOFT_CLIENT_ID`, `EMDASH_OAUTH_MICROSOFT_CLIENT_SECRET`
+ * and `EMDASH_OAUTH_MICROSOFT_TENANT_ID` (or `MICROSOFT_CLIENT_ID` /
+ * `MICROSOFT_CLIENT_SECRET` / `MICROSOFT_TENANT_ID`) environment variables.
+ */
+export function microsoft(options: MicrosoftProviderOptions = {}): AuthProviderDescriptor {
+	return {
+		id: "microsoft",
+		label: "Microsoft",
+		config: options,
+		adminEntry: "emdash/auth/providers/microsoft-admin",
+	};
+}