emdash 1.0.1 → 1.2.0

package/src/auth/rate-limit.ts

@@ -1,18 +1,20 @@
 /**
- * Database-backed rate limiter for unauthenticated endpoints.
+ * Database-backed rate limiter.
  *
  * Uses a `_emdash_rate_limits` table with composite primary key (key, window).
  * Each call to `checkRateLimit` atomically upserts a counter and returns
  * whether the request is within the allowed limit.
  *
- * Key format: `{ip}:{endpoint}` — limits are per-IP, per-endpoint. Callers
- * may pass a salted IP hash instead of the raw address.
+ * Key format: `{subject}:{endpoint}` — limits are per-subject, per-endpoint.
+ * The subject is the client IP (or a salted IP hash) on unauthenticated
+ * endpoints, and the user ID on endpoints that require a session.
  * Window format: ISO timestamp truncated to the window size.
  */
 
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { after } from "../after.js";
 import { apiError } from "../api/error.js";
 import type { Database } from "../database/types.js";
 
@@ -32,11 +34,11 @@ export interface RateLimitResult {
 }
 
 /**
- * Check (and increment) the rate limit for a given IP + endpoint.
+ * Check (and increment) the rate limit for a given subject + endpoint.
  *
- * If `ip` is null (no trusted IP available), rate limiting is skipped
- * and the request is allowed. There's no meaningful key to rate limit
- * on when the IP is unknown.
+ * If `subject` is null (for example, no trusted IP available), rate limiting
+ * is skipped and the request is allowed. There's no meaningful key to rate
+ * limit on when the subject is unknown.
  *
  * Returns whether the request is allowed. The counter is always
  * incremented — even when the limit is exceeded — so that repeated
@@ -47,20 +49,19 @@ export interface RateLimitResult {
  */
 export async function checkRateLimit(
 	db: Kysely<Database>,
-	ip: string | null,
+	subject: string | null,
 	endpoint: string,
 	maxRequests: number,
 	windowSeconds: number,
 ): Promise<RateLimitResult> {
-	// No trusted IP — skip rate limiting entirely
-	if (!ip) {
+	if (!subject) {
 		return { allowed: true, count: 0, limit: maxRequests };
 	}
 
 	const windowStart = new Date(
 		Math.floor(Date.now() / (windowSeconds * 1000)) * windowSeconds * 1000,
 	).toISOString();
-	const key = `${ip}:${endpoint}`;
+	const key = `${subject}:${endpoint}`;
 
 	// Atomic upsert: insert or increment, return current count
 	const result = await sql<{ count: number }>`
@@ -75,8 +76,12 @@ export async function checkRateLimit(
 
 	// Piggyback cleanup: 1% chance per request to clean expired entries
 	if (Math.random() < 0.01) {
-		cleanupExpiredRateLimits(db).catch(() => {
-			// Swallow errors — cleanup is best-effort
+		after(async () => {
+			try {
+				await cleanupExpiredRateLimits(db);
+			} catch (error) {
+				console.error("[rate-limit] failed to delete expired entries:", error);
+			}
 		});
 	}
 

package/src/auth/types.ts

@@ -197,6 +197,13 @@ export interface ExternalAuthConfig {
 	 */
 	syncRoles?: boolean;
 
+	/**
+	 * Update user's name from the IdP on every authenticated request
+	 * When false, name is only set on first provisioning, so names edited in the admin are kept
+	 * @default true
+	 */
+	syncName?: boolean;
+
 	/**
 	 * Map IdP group names to EmDash role levels
 	 * First match wins if user is in multiple groups

package/src/aws-sdk.d.ts

@@ -25,6 +25,7 @@ declare module "@aws-sdk/client-s3" {
 		Body?: SdkStreamMixin;
 		ContentType?: string;
 		ContentLength?: number;
+		ContentRange?: string;
 		ETag?: string;
 		LastModified?: Date;
 	}
@@ -69,7 +70,7 @@ declare module "@aws-sdk/client-s3" {
 	}
 
 	export class GetObjectCommand {
-		constructor(input: { Bucket: string; Key: string });
+		constructor(input: { Bucket: string; Key: string; Range?: string });
 	}
 
 	export class DeleteObjectCommand {

package/src/cleanup.ts

@@ -42,6 +42,32 @@ export interface CleanupResult {
 const REVISION_KEEP_COUNT = 50;
 const REVISION_PRUNE_BATCH_SIZE = 10;
 
+/** Target cadence for full system cleanup. */
+export const SYSTEM_CLEANUP_INTERVAL_MS = 60 * 60 * 1000;
+
+/**
+ * Tolerance when comparing the last cleanup time to the interval. Allows
+ * a tick that fires slightly before the exact hour to still be treated as
+ * the hourly cleanup when the previous one ran at the start of the hour.
+ */
+const SYSTEM_CLEANUP_INTERVAL_TOLERANCE_MS = 5 * 60 * 1000;
+
+/**
+ * Decide whether the full system cleanup should run for this tick.
+ *
+ * Bookkeeping cleanup is expensive on serverless free tiers with tight CPU
+ * budgets, so it runs once per hour on the top of the hour. The per-minute
+ * path keeps only scheduled publishing, cron tasks, and the heartbeat.
+ */
+export function shouldRunSystemCleanup(currentTime: Date, lastRunAt?: Date | null): boolean {
+	if (currentTime.getUTCMinutes() !== 0) return false;
+	if (!lastRunAt) return true;
+	return (
+		currentTime.getTime() - lastRunAt.getTime() >=
+		SYSTEM_CLEANUP_INTERVAL_MS - SYSTEM_CLEANUP_INTERVAL_TOLERANCE_MS
+	);
+}
+
 /**
  * Run all system cleanup tasks.
  *

package/src/cli/commands/export-seed.ts

@@ -47,6 +47,7 @@ import type {
 	SeedBylineCredit,
 	SeedBlockType,
 } from "../../seed/types.js";
+import { classifySetting } from "../../transfer/format/settings.js";
 import { isMissingTableError } from "../../utils/db-errors.js";
 import { slugify } from "../../utils/slugify.js";
 
@@ -391,6 +392,7 @@ async function exportSettings(db: Kysely<Database>): Promise<SeedFile["settings"
 
 	const settings: Record<string, unknown> = {};
 	for (const [key, value] of allOptions) {
+		if (classifySetting(key) === "targetLocal") continue;
 		const settingKey = key.replace(SETTINGS_PREFIX, "");
 		settings[settingKey] = value;
 	}

package/src/cli/commands/seed.ts

@@ -107,10 +107,11 @@ export const seedCommand = defineCommand({
 			description: "Validate only, don't apply",
 			default: false,
 		},
-		"no-content": {
+		content: {
 			type: "boolean",
-			description: "Skip sample data (content entries, bylines, taxonomy terms)",
-			default: false,
+			description: "Include sample data (content entries, bylines, taxonomy terms)",
+			negativeDescription: "Skip sample data (content entries, bylines, taxonomy terms)",
+			default: true,
 		},
 		"on-conflict": {
 			type: "string",
@@ -218,7 +219,7 @@ export const seedCommand = defineCommand({
 		}
 
 		const options: SeedApplyOptions = {
-			includeContent: !args["no-content"],
+			includeContent: args.content,
 			onConflict: onConflictRaw,
 			storage,
 		};

package/src/client/index.ts

@@ -185,7 +185,12 @@ export interface MediaUsageOccurrenceDetail {
 	fieldSlug: string;
 	fieldPath: string;
 	occurrenceIndex: number;
-	referenceType: "image_field" | "file_field" | "portable_text_image" | "unknown";
+	referenceType:
+		| "image_field"
+		| "file_field"
+		| "portable_text_image"
+		| "portable_text_video"
+		| "unknown";
 }
 
 /** Indexed references from one visible content source */

package/src/comments/public-submission.ts

@@ -1,5 +1,6 @@
 import { sql, type Kysely } from "kysely";
 
+import { after } from "../after.js";
 import { apiError, apiSuccess, handleError } from "../api/error.js";
 import { hashIp } from "../api/handlers/comments.js";
 import { isParseError, parseBody } from "../api/parse.js";
@@ -174,17 +175,23 @@ export async function submitPublicComment(
 					: { status: "pending", reason: "Invalid moderation result" };
 			},
 			fireAfterCreate: (event) => {
-				void runtime.hooks
-					.runCommentAfterCreate(event)
-					.catch((error) =>
-						console.error(
-							"[comments] afterCreate error:",
-							error instanceof Error ? error.message : error,
+				// Deferred through after() so the host's waitUntil keeps the hooks
+				// alive: on Workers, work left running after the response is sent
+				// can be cancelled (sandboxed plugins never got past their first
+				// bridge call).
+				after(() =>
+					runtime.hooks
+						.runCommentAfterCreate(event)
+						.catch((error) =>
+							console.error(
+								"[comments] afterCreate error:",
+								error instanceof Error ? error.message : error,
+							),
 						),
-					);
+				);
 			},
 			fireAfterModerate: (event) => {
-				void runtime.hooks
+				return runtime.hooks
 					.runCommentAfterModerate(event)
 					.catch((error) =>
 						console.error(

package/src/comments/turnstile.ts

@@ -16,9 +16,14 @@ const SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverif
 /**
  * Resolve the configured Turnstile secret key, or `""` when Turnstile
  * enforcement is not configured.
+ *
+ * Reads `process.env` only: Vite replaces `import.meta.env` at build time,
+ * which would bake a build-machine secret into the bundle and hide a secret
+ * set on the deployment platform.
  */
 export function getTurnstileSecretKey(): string {
-	return import.meta.env.EMDASH_TURNSTILE_SECRET_KEY || import.meta.env.TURNSTILE_SECRET_KEY || "";
+	const env = typeof process !== "undefined" && process.env ? process.env : {};
+	return env.EMDASH_TURNSTILE_SECRET_KEY || env.TURNSTILE_SECRET_KEY || "";
 }
 
 /**

package/src/components/CommentForm.astro

@@ -29,6 +29,21 @@ interface Props {
 	 * without it the token is ignored.
 	 */
 	turnstileSiteKey?: string;
+	/**
+	 * Replaces the built-in English text, for example to translate the form.
+	 * `error` is shown instead of the server's English error message.
+	 */
+	labels?: {
+		name?: string;
+		email?: string;
+		comment?: string;
+		submit?: string;
+		submitting?: string;
+		published?: string;
+		pending?: string;
+		error?: string;
+		networkError?: string;
+	};
 }
 
 import { getCollectionInfo } from "../schema/query.js";
@@ -39,8 +54,21 @@ const {
 	parentId = null,
 	class: className,
 	turnstileSiteKey,
+	labels: customLabels = {},
 } = Astro.props;
 
+const labels = {
+	name: customLabels.name ?? "Name",
+	email: customLabels.email ?? "Email",
+	comment: customLabels.comment ?? "Comment",
+	submit: customLabels.submit ?? "Post Comment",
+	submitting: customLabels.submitting ?? "Submitting...",
+	published: customLabels.published ?? "Comment published",
+	pending: customLabels.pending ?? "Comment submitted for review",
+	error: customLabels.error,
+	networkError: customLabels.networkError ?? "Network error. Please try again.",
+};
+
 const enabled = (await getCollectionInfo(collection))?.commentsEnabled ?? false;
 const { user } = Astro.locals;
 const formId = `ec-comment-form-${parentId ?? "root"}`;
@@ -56,6 +84,7 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 			data-endpoint={endpoint}
 			data-user-name={user?.name ?? ""}
 			data-user-email={user?.email ?? ""}
+			data-labels={JSON.stringify(labels)}
 		>
 			{user ? (
 				<div class="ec-comment-user-info">
@@ -65,12 +94,12 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 			) : (
 				<div class="ec-comment-form-fields">
 					<label class="ec-comment-form-field">
-						<span>Name</span>
+						<span>{labels.name}</span>
 						<input type="text" name="authorName" required maxlength="100" />
 					</label>
 
 					<label class="ec-comment-form-field">
-						<span>Email</span>
+						<span>{labels.email}</span>
 						<input type="email" name="authorEmail" required />
 					</label>
 				</div>
@@ -93,7 +122,7 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 			</div>
 
 			<label class="ec-comment-form-field">
-				<span>Comment</span>
+				<span>{labels.comment}</span>
 				<textarea name="body" required maxlength="5000" rows="4" />
 			</label>
 
@@ -108,7 +137,7 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 			)}
 
 			<button type="submit" class="ec-comment-form-submit">
-				Post Comment
+				{labels.submit}
 			</button>
 
 			<div class="ec-comment-form-status" role="status" aria-live="polite" />
@@ -139,8 +168,17 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 		const statusEl = form.querySelector<HTMLElement>(".ec-comment-form-status");
 		if (!submitBtn || !statusEl) return;
 
+		const labels: {
+			submit: string;
+			submitting: string;
+			published: string;
+			pending: string;
+			error?: string;
+			networkError: string;
+		} = JSON.parse(form.dataset.labels ?? "{}");
+
 		submitBtn.disabled = true;
-		submitBtn.textContent = "Submitting...";
+		submitBtn.textContent = labels.submitting;
 		statusEl.textContent = "";
 		statusEl.className = "ec-comment-form-status";
 
@@ -180,7 +218,8 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 			const result = await res.json();
 
 			if (res.ok) {
-				statusEl.textContent = result.message || "Comment submitted!";
+				statusEl.textContent =
+					result.data?.status === "approved" ? labels.published : labels.pending;
 				statusEl.classList.add("ec-comment-form-success");
 				// Reset form fields (but not disabled pre-filled fields)
 				const textarea = form.querySelector<HTMLTextAreaElement>(
@@ -189,13 +228,14 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 				if (textarea) textarea.value = "";
 			} else {
 				statusEl.textContent =
+					labels.error ||
 					result.error?.message ||
 					result.message ||
 					"Failed to submit comment.";
 				statusEl.classList.add("ec-comment-form-error");
 			}
 		} catch {
-			statusEl.textContent = "Network error. Please try again.";
+			statusEl.textContent = labels.networkError;
 			statusEl.classList.add("ec-comment-form-error");
 		} finally {
 			// Reset Turnstile on success and failure alike (incl. network
@@ -205,7 +245,7 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 				window.turnstile.reset();
 			}
 			submitBtn.disabled = false;
-			submitBtn.textContent = "Post Comment";
+			submitBtn.textContent = labels.submit;
 		}
 	});
 </script>

package/src/components/Comments.astro

@@ -26,6 +26,16 @@ interface Props {
 	/** Order of top-level comments: chronological (default) or Wilson-ranked. */
 	sort?: "oldest" | "best";
 	class?: string;
+	/** Replaces the built-in English text, for example to translate the list. */
+	labels?: {
+		heading?: (count: number) => string;
+		member?: string;
+		like?: string;
+	};
+	/**
+	 * Locale for comment dates. Defaults to `Astro.currentLocale`, then `en-US`.
+	 */
+	locale?: string;
 }
 
 const {
@@ -35,8 +45,41 @@ const {
 	reactions = false,
 	sort = "oldest",
 	class: className,
+	labels: customLabels = {},
+	locale = Astro.currentLocale,
 } = Astro.props;
 
+const labels = {
+	heading:
+		customLabels.heading ??
+		((count: number) =>
+			count === 0 ? "No comments yet" : count === 1 ? "1 Comment" : `${count} Comments`),
+	member: customLabels.member ?? "Site member",
+	like: customLabels.like ?? "Like",
+};
+
+function resolveDateLocale(value: string | undefined): string {
+	if (!value) return "en-US";
+	try {
+		return Intl.DateTimeFormat.supportedLocalesOf(value)[0] ?? "en-US";
+	} catch {
+		return "en-US";
+	}
+}
+
+const dateFormat = new Intl.DateTimeFormat(resolveDateLocale(locale), {
+	year: "numeric",
+	month: "long",
+	day: "numeric",
+	hour: "numeric",
+	minute: "2-digit",
+});
+
+function formatDate(value: string): string {
+	const date = new Date(value);
+	return Number.isNaN(date.getTime()) ? value : dateFormat.format(date);
+}
+
 const collectionInfo = await getCollectionInfo(collection);
 const enabled = collectionInfo?.commentsEnabled ?? false;
 const { items, total } = enabled
@@ -135,13 +178,7 @@ const REACTION_SCRIPT = `
 			data-content-id={contentId}
 			{...(reactions ? { "data-ec-reactions": "" } : {})}
 		>
-			<h3 class="ec-comments-heading">
-				{total === 0
-					? "No comments yet"
-					: total === 1
-						? "1 Comment"
-						: `${total} Comments`}
-			</h3>
+			<h3 class="ec-comments-heading">{labels.heading(total)}</h3>
 
 			{items.length > 0 && (
 				<ol class="ec-comments-list">
@@ -156,19 +193,13 @@ const REACTION_SCRIPT = `
 									<span class="ec-comment-author">
 										{comment.authorName}
 										{comment.isRegisteredUser && (
-											<span class="ec-comment-badge" aria-label="Site member">
+											<span class="ec-comment-badge" aria-label={labels.member}>
 												&#x2713;
 											</span>
 										)}
 									</span>
 									<time class="ec-comment-date" datetime={comment.createdAt}>
-										{new Date(comment.createdAt).toLocaleDateString("en-US", {
-											year: "numeric",
-											month: "long",
-											day: "numeric",
-											hour: "numeric",
-											minute: "2-digit",
-										})}
+										{formatDate(comment.createdAt)}
 									</time>
 								</header>
 								<div
@@ -187,7 +218,7 @@ const REACTION_SCRIPT = `
 											<span class="ec-reaction-icon" aria-hidden="true">
 												&#x2661;
 											</span>
-											<span class="ec-reaction-label">Like</span>
+											<span class="ec-reaction-label">{labels.like}</span>
 											<span class="ec-reaction-count" data-ec-reaction-count>
 												{comment.reactions?.like ?? 0}
 											</span>
@@ -209,7 +240,7 @@ const REACTION_SCRIPT = `
 															{reply.isRegisteredUser && (
 																<span
 																	class="ec-comment-badge"
-																	aria-label="Site member"
+																	aria-label={labels.member}
 																>
 																	&#x2713;
 																</span>
@@ -219,16 +250,7 @@ const REACTION_SCRIPT = `
 															class="ec-comment-date"
 															datetime={reply.createdAt}
 														>
-															{new Date(reply.createdAt).toLocaleDateString(
-																"en-US",
-																{
-																	year: "numeric",
-																	month: "long",
-																	day: "numeric",
-																	hour: "numeric",
-																	minute: "2-digit",
-																}
-															)}
+															{formatDate(reply.createdAt)}
 														</time>
 													</header>
 													<div
@@ -245,7 +267,7 @@ const REACTION_SCRIPT = `
 																aria-pressed="false"
 															>
 																<span class="ec-reaction-icon" aria-hidden="true">&#x2661;</span>
-																<span class="ec-reaction-label">Like</span>
+																<span class="ec-reaction-label">{labels.like}</span>
 																<span class="ec-reaction-count" data-ec-reaction-count>{reply.reactions?.like ?? 0}</span>
 															</button>
 														</div>

package/src/components/EmDashImage.astro

@@ -30,7 +30,7 @@ import { buildRenderMediaUrl } from "../media/url.js";
 import {
 	buildResponsiveImage,
 	toAbsoluteMediaUrl,
-	RESPONSIVE_BREAKPOINTS,
+	responsiveWidths,
 } from "../media/responsive.js";
 import { getPublicOrigin } from "../api/public-url.js";
 import { focalPointToObjectPosition } from "../media/focal-point.js";
@@ -99,9 +99,10 @@ function buildLocalImageUrl(img: MediaValue): string {
 function generateSrcset(
 	getSrc: NonNullable<ImageEmbed["getSrc"]>,
 	maxWidth: number,
-	aspectRatio?: number
+	aspectRatio?: number,
+	originalWidth?: number
 ): string {
-	return RESPONSIVE_BREAKPOINTS.filter((w) => w <= maxWidth * 2) // Include up to 2x for retina
+	return responsiveWidths(maxWidth, originalWidth)
 		.map((w) => {
 			const h = aspectRatio ? Math.round(w / aspectRatio) : undefined;
 			return `${getSrc({ width: w, height: h })} ${w}w`;
@@ -147,6 +148,7 @@ async function resolveImage(img: MediaValue): Promise<ResolvedImage> {
 				src: absoluteSrc,
 				width: finalWidth,
 				height: finalHeight,
+				originalWidth: img.width,
 			});
 			if (optimized) {
 				src = optimized.src;
@@ -171,7 +173,7 @@ async function resolveImage(img: MediaValue): Promise<ResolvedImage> {
 					if (embed.getSrc) {
 						// Use image width, or default to 1200 for responsive images
 						const maxWidth = finalWidth || 1200;
-						srcset = generateSrcset(embed.getSrc, maxWidth, aspectRatio);
+						srcset = generateSrcset(embed.getSrc, maxWidth, aspectRatio, img.width);
 						sizes = finalWidth
 							? `(min-width: ${finalWidth}px) ${finalWidth}px, 100vw`
 							: "100vw";

package/src/components/Gallery.astro

@@ -15,7 +15,7 @@ import {
 	toAbsoluteMediaUrl,
 	gallerySizes,
 	GALLERY_DEFAULT_COLUMNS,
-	RESPONSIVE_BREAKPOINTS,
+	responsiveWidths,
 } from "../media/responsive.js";
 import { getPublicOrigin } from "../api/public-url.js";
 import { sanitizeGalleryImages } from "../content/converters/gallery.js";
@@ -64,8 +64,9 @@ function generateSrcset(
 	getSrc: NonNullable<ImageEmbed["getSrc"]>,
 	maxWidth: number,
 	aspectRatio?: number,
+	originalWidth?: number,
 ): string {
-	return RESPONSIVE_BREAKPOINTS.filter((w) => w <= maxWidth * 2)
+	return responsiveWidths(maxWidth, originalWidth)
 		.map((w) => {
 			const h = aspectRatio ? Math.round(w / aspectRatio) : undefined;
 			return `${getSrc({ width: w, height: h })} ${w}w`;
@@ -115,7 +116,7 @@ const resolvedImages = await Promise.all(
 
 						if (embed.getSrc) {
 							const maxWidth = width || 1200;
-							srcset = generateSrcset(embed.getSrc, maxWidth, aspectRatio);
+							srcset = generateSrcset(embed.getSrc, maxWidth, aspectRatio, width);
 							sizes = cellSizes;
 						}
 					}

package/src/components/HtmlBlock.astro

@@ -2,29 +2,40 @@
 /**
  * Portable Text HTML block component
  *
- * Renders raw HTML blocks that couldn't be converted to Portable Text.
- * Sanitizes HTML to prevent XSS attacks.
+ * Renders isolated blocks in a sandboxed frame with their CSS and JavaScript.
+ * Renders other blocks as inline HTML, sanitized to prevent XSS attacks.
  */
+import { htmlBlockFields } from "@emdash-cms/admin/html-block";
+
 import { sanitizeContent } from "../utils/sanitize.js";
+import HtmlBlockFrame from "./HtmlBlockFrame.astro";
 
 export interface Props {
 	node: {
 		_type: "htmlBlock";
 		_key: string;
 		html: string;
+		css?: string;
+		js?: string;
+		isolated?: boolean;
 	};
 }
 
 const { node } = Astro.props;
+const { html, css = "", js = "", isolated } = htmlBlockFields(node ?? {});
 
-if (!node?.html) {
+if (isolated ? !html.trim() && !css.trim() && !js.trim() : !html) {
 	return null;
 }
-
-const sanitized = sanitizeContent(node.html);
 ---
 
-<div class="emdash-html-block" set:html={sanitized} />
+{
+	isolated ? (
+		<HtmlBlockFrame html={html} css={css} js={js} />
+	) : (
+		<div class="emdash-html-block" set:html={sanitizeContent(html)} />
+	)
+}
 
 <style>
 	.emdash-html-block {