emdash 1.1.0 → 1.2.0

package/src/astro/routes/api/media/file/[...key].ts

@@ -1,14 +1,20 @@
 /**
  * Serve uploaded media files
  *
- * GET /_emdash/api/media/file/:key - Serve file from storage
+ * GET /_emdash/api/media/file/:key - Serve file from storage, or a byte range of it
  */
 
 import type { APIRoute } from "astro";
 
 import { apiError, handleError } from "#api/error.js";
-import { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL } from "#media/image-endpoint.js";
-
+import {
+	IMMUTABLE_IMAGE_CACHE,
+	MUTABLE_MEDIA_CACHE_CONTROL,
+	isNotModified,
+	validatorHeaders,
+} from "#media/image-endpoint.js";
+
+import { parseRangeHeader, resolveByteRange } from "../../../../../storage/range.js";
 import { isRefusedStorageKey } from "../../../../../transfer/staging/keys.js";
 
 export const prerender = false;
@@ -55,7 +61,7 @@ const SAFE_INLINE_TYPES = new Set([
 	"audio/ogg",
 ]);
 
-export const GET: APIRoute = async ({ params, locals }) => {
+export const GET: APIRoute = async ({ params, locals, request, cache }) => {
 	const { key } = params;
 	const { emdash } = locals;
 
@@ -75,24 +81,55 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	}
 
 	try {
-		const result = await emdash.storage.download(key);
+		// Range requests that include If-Range are served as whole-file responses
+		// because this route does not compare If-Range validators.
+		const range = request.headers.has("If-Range")
+			? null
+			: parseRangeHeader(request.headers.get("Range"));
+		// The route cache keys entries by URL alone, so a cached partial
+		// response would be served to requests for the whole file.
+		if (range && cache?.enabled) cache.set(false);
+		const result = range
+			? await emdash.storage.download(key, { range })
+			: await emdash.storage.download(key);
+		const served = range ? result.range : undefined;
+
+		// Adapters return the whole file for a range they don't serve, including
+		// one past the end. A size of 0 may be unknown, so it rules nothing out.
+		if (range && !served && result.size > 0 && !resolveByteRange(range, result.size)) {
+			await result.body.cancel().catch(() => undefined);
+			const response = apiError("RANGE_NOT_SATISFIABLE", "Range not satisfiable", 416);
+			response.headers.set("Content-Range", `bytes */${result.size}`);
+			return response;
+		}
+
+		const cacheControl = result.contentType.startsWith("image/")
+			? MUTABLE_MEDIA_CACHE_CONTROL
+			: IMMUTABLE_IMAGE_CACHE;
+
+		if (isNotModified(request, result.size, result.lastModified)) {
+			return new Response(null, {
+				status: 304,
+				headers: {
+					"Content-Type": result.contentType,
+					"Cache-Control": cacheControl,
+					...validatorHeaders(result.size, result.lastModified),
+				},
+			});
+		}
 
 		const headers: Record<string, string> = {
 			"Content-Type": result.contentType,
-			"Cache-Control": result.contentType.startsWith("image/")
-				? MUTABLE_MEDIA_CACHE_CONTROL
-				: IMMUTABLE_IMAGE_CACHE,
+			"Cache-Control": cacheControl,
+			"Accept-Ranges": "bytes",
 			"X-Content-Type-Options": "nosniff",
 			// Sandbox CSP on all user-uploaded content — prevents script execution
 			// even for SVGs navigated to directly or content types that support scripting.
 			"Content-Security-Policy":
 				"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'",
+			...validatorHeaders(result.size, result.lastModified),
 		};
 
-		if (result.size) {
-			headers["Content-Length"] = String(result.size);
-		}
-
 		// Safe image/media types can render inline; everything else (SVG, PDF,
 		// HTML, JS, etc.) must be downloaded to prevent stored XSS.
 		if (SAFE_INLINE_TYPES.has(result.contentType)) {
@@ -101,6 +138,17 @@ export const GET: APIRoute = async ({ params, locals }) => {
 			headers["Content-Disposition"] = "attachment";
 		}
 
+		if (served) {
+			const end = served.offset + served.length - 1;
+			headers["Content-Range"] = `bytes ${served.offset}-${end}/${result.size}`;
+			headers["Content-Length"] = String(served.length);
+			return new Response(result.body, { status: 206, headers });
+		}
+
+		if (result.size) {
+			headers["Content-Length"] = String(result.size);
+		}
+
 		return new Response(result.body, { status: 200, headers });
 	} catch (error) {
 		// Check if it's a "not found" error

package/src/astro/routes/api/media/upload-url.ts

@@ -73,12 +73,36 @@ export const POST: APIRoute = async ({ request, locals }) => {
 				500,
 			);
 		}
-		const body = await parseBody(request, mediaUploadUrlBody(maxSize));
+		const uploadSchema = mediaUploadUrlBody(maxSize);
+		const body = await parseBody(request, uploadSchema);
 		if (isParseError(body)) return body;
 
+		let beforeUploadFile = {
+			name: body.filename,
+			type: body.contentType,
+			size: body.size,
+		};
+		if (emdash.hooks?.hasHooks("media:beforeUpload")) {
+			const hookResult = await emdash.hooks.runMediaBeforeUpload(beforeUploadFile);
+			const metadata = uploadSchema.safeParse({
+				filename: hookResult.file?.name,
+				contentType: hookResult.file?.type,
+				size: body.size,
+			});
+			if (!metadata.success) {
+				return apiError("VALIDATION_ERROR", "Invalid media:beforeUpload result", 400);
+			}
+			// Hooks change metadata, but the client still uploads the original bytes.
+			beforeUploadFile = {
+				name: metadata.data.filename,
+				type: metadata.data.contentType,
+				size: body.size,
+			};
+		}
+
 		// Clients that don't recognise an extension may send an empty or generic
 		// content type; fall back to the filename extension before allowlisting.
-		const mimeType = resolveUploadMimeType(body.filename, body.contentType);
+		const mimeType = resolveUploadMimeType(beforeUploadFile.name, beforeUploadFile.type);
 		const normalizedContentType = normalizeMime(mimeType);
 
 		// Validate content type (field-aware widening)
@@ -107,8 +131,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			}
 		}
 		const filename = body.ensureUniqueFilename
-			? await repo.findAvailableFilename(body.filename)
-			: body.filename;
+			? await repo.findAvailableFilename(beforeUploadFile.name)
+			: beforeUploadFile.name;
 
 		// Generate unique storage key
 		const id = ulid();

package/src/astro/routes/api/media.ts

@@ -22,6 +22,7 @@ import {
 	mediaListQuery,
 	mediaUploadDeduplicateForm,
 	mediaUploadEnsureUniqueFilenameForm,
+	mediaUploadMetadataForm,
 } from "#api/schemas.js";
 import { MediaRepository } from "#db/repositories/media.js";
 import { enrichImageMetadata } from "#media/enrich.js";
@@ -178,6 +179,18 @@ export const POST: APIRoute = async ({ request, locals }) => {
 				folderId = folderResult.data;
 			}
 		}
+		const metadataResult = mediaUploadMetadataForm.safeParse({
+			alt: formData.get("alt") ?? undefined,
+			caption: formData.get("caption") ?? undefined,
+		});
+		if (!metadataResult.success) {
+			return apiError("VALIDATION_ERROR", "Invalid request data", 400, {
+				issues: metadataResult.error.issues.map((issue) => ({
+					path: issue.path.join("."),
+					message: issue.message,
+				})),
+			});
+		}
 
 		// Validate file type — widen the allowlist when a field-specific list is configured
 		const fieldIdEntry = formData.get("fieldId");
@@ -258,6 +271,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			filename,
 			mimeType,
 			size: file.size,
+			alt: metadataResult.data.alt,
+			caption: metadataResult.data.caption,
 			// Client dimensions win over server header dimensions: the browser's
 			// naturalWidth/Height apply EXIF orientation, while image-size reports
 			// raw (pre-orientation) header dims — swapped for 90°/270° JPEGs.

package/src/astro/routes/api/schema/index.ts

@@ -57,7 +57,7 @@ export const GET: APIRoute = async ({ request, locals }) => {
 			const header = `// Generated by EmDash CLI
 // Do not edit manually - run \`emdash types\` to regenerate
 
-import type { PortableTextBlock } from "emdash";
+import type { BylineSummary, ContentBylineCredit, TaxonomyTerm, PortableTextBlock } from "emdash";
 
 `;
 

package/src/astro/routes/api/settings/domain-notify.ts

@@ -0,0 +1,76 @@
+/**
+ * POST /_emdash/api/settings/domain/notify
+ *
+ * Emails every active user except the sender that the site now lives at
+ * its chosen address (the configured `siteUrl`, otherwise the Site URL),
+ * with a link to the sign-in page there. The email carries no sign-in token.
+ * Sites that sign in through an external provider are refused.
+ */
+
+import { getDomainMoveEmailStrings } from "@emdash-cms/admin/locales/emails";
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { resolveEmailLocale } from "#api/email-locale.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleDomainMoveNotice } from "#api/handlers/domain-move-notice.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { getAuthMode } from "#auth/mode.js";
+import { checkRateLimit } from "#auth/rate-limit.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!user) return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	const denied = requirePerm(user, "users:manage");
+	if (denied) return denied;
+	if (locals.tokenScopes !== undefined) {
+		return apiError("FORBIDDEN", "Emailing users requires a signed-in session", 403);
+	}
+	if (getAuthMode(emdash.config).type !== "passkey") {
+		return apiError("NOT_SUPPORTED", "Users sign in through an external provider", 400);
+	}
+
+	if (!emdash.email?.isAvailable()) {
+		return apiError(
+			"EMAIL_NOT_CONFIGURED",
+			"No email provider is configured. Install and activate an email provider plugin.",
+			503,
+		);
+	}
+
+	try {
+		const origin = await getChosenSiteOrigin(emdash.db, emdash.config);
+		if (!origin) {
+			return apiError("NO_SITE_URL", "Set a Site URL before emailing users about it", 409);
+		}
+
+		const rateLimit = await checkRateLimit(emdash.db, "site", "settings/domain/notify", 3, 3600);
+		if (!rateLimit.allowed) {
+			return apiError("RATE_LIMITED", "Users were emailed recently. Try again later.", 429);
+		}
+
+		const options = new OptionsRepository(emdash.db);
+		const siteOptions = await options.getMany<string>(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") || "EmDash";
+		const locale = resolveEmailLocale(siteOptions.get("emdash:locale"), request);
+		const email = emdash.email;
+
+		const result = await handleDomainMoveNotice(emdash.db, {
+			origin,
+			strings: await getDomainMoveEmailStrings(locale, siteName, new URL(origin).host),
+			locale,
+			senderId: user.id,
+			send: (message) => email.send(message, "system"),
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to email users", "DOMAIN_MOVE_NOTICE_ERROR");
+	}
+};

package/src/astro/routes/api/settings/domain.ts

@@ -0,0 +1,63 @@
+/**
+ * Site domain endpoint
+ *
+ * GET  /_emdash/api/settings/domain - The site URL set by the deployment
+ *      configuration, if any, which takes precedence over the Site URL for
+ *      links in emails and plugins, and `siteOrigin`, the origin sign-in
+ *      handover links to (null until a Site URL or `siteUrl` is set).
+ * POST /_emdash/api/settings/domain - Verify a new domain and store it as the
+ *      Site URL.
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
+import { handleSiteDomainChange } from "#api/handlers/site-domain.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { getConfiguredOrigin } from "#api/public-url.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { siteSettingsTag } from "#cache/chrome-tags.js";
+
+export const prerender = false;
+
+const siteDomainBody = z.object({ domain: z.string().min(1).max(253) });
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:read");
+	if (denied) return denied;
+
+	try {
+		const siteOrigin = (await getChosenSiteOrigin(emdash.db, emdash.config)) ?? null;
+		return apiSuccess({ configuredUrl: getConfiguredOrigin(emdash.config) ?? null, siteOrigin });
+	} catch (error) {
+		return handleError(error, "Failed to read the site domain", "SITE_DOMAIN_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals, cache }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, siteDomainBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleSiteDomainChange(emdash.db, body.domain);
+		if (result.success && cache?.enabled) await cache.invalidate({ tags: [siteSettingsTag()] });
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to change the site domain", "SITE_DOMAIN_ERROR");
+	}
+};

package/src/astro/routes/api/setup/index.ts

@@ -17,6 +17,7 @@ import { OptionsRepository } from "#db/repositories/options.js";
 import { applySeedWithinBudget, type SeedApplyBudget } from "#seed/apply.js";
 import { loadSeed } from "#seed/load.js";
 import { validateSeed } from "#seed/validate.js";
+import { setSiteSettings } from "#settings/index.js";
 
 /**
  * What one setup request may spend on the seed before the rest continues in
@@ -113,6 +114,12 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 		}
 		const { result, complete: seedComplete, progress: seedProgress } = seeded;
 
+		if (seedComplete) {
+			// The seed only fills settings that are still unset, and the runtime
+			// has usually auto-seeded the template's title and tagline already.
+			await setSiteSettings({ title: body.title, tagline: body.tagline }, emdash.db);
+		}
+
 		// Store setup state
 		// In external auth mode, mark setup complete immediately (first user to login becomes admin)
 		// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)

package/src/astro/routes/api/site/domain-proof.ts

@@ -0,0 +1,28 @@
+/**
+ * Domain proof endpoint
+ *
+ * POST /_emdash/api/site/domain-proof - Returns the token of a domain check in
+ * progress, so the site can confirm that a new domain serves it. POST keeps
+ * the read on the primary database, where the token was just written, rather
+ * than a read replica.
+ */
+
+import type { APIRoute } from "astro";
+
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleDomainProof } from "#api/handlers/site-domain.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		return unwrapResult(await handleDomainProof(emdash.db));
+	} catch (error) {
+		return handleError(error, "Failed to read domain proof", "DOMAIN_PROOF_ERROR");
+	}
+};

package/src/astro/routes/sitemap-[collection].xml.ts

@@ -1,7 +1,8 @@
 /**
  * Per-collection sitemap endpoint
  *
- * GET /sitemap-{collection}.xml - Sitemap for a single content collection.
+ * GET /sitemap-{collection}.xml - First page of a single collection's sitemap.
+ * GET /sitemap-{collection}-{n}.xml - Page n (2 and up) of that sitemap.
  *
  * Uses the collection's url_pattern to build URLs. Falls back to
  * /{collection}/{slug} when no pattern is configured.
@@ -26,6 +27,7 @@ import { getSiteSettingsWithDb } from "#settings/index.js";
 import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
 import { resolveLocalizedContentRoutePath } from "../../i18n/resolve.js";
 import { buildSeoImageUrl } from "../../seo/media-url.js";
+import { parseCollectionSitemapName } from "../../seo/sitemap-name.js";
 
 export const prerender = false;
 
@@ -38,9 +40,19 @@ const APOS_RE = /'/g;
 
 export const GET: APIRoute = async ({ params, locals, url }) => {
 	const { emdash } = locals;
-	const collectionSlug = params.collection;
 
-	if (!emdash?.db || !collectionSlug) {
+	// The middleware skips runtime setup for names no collection can have, so
+	// this check must run before the configuration check below.
+	const parsed = params.collection ? parseCollectionSitemapName(params.collection) : null;
+	if (!parsed) {
+		return new Response("<!-- Sitemap not found -->", {
+			status: 404,
+			headers: { "Content-Type": "application/xml" },
+		});
+	}
+	const { collection: collectionSlug, page } = parsed;
+
+	if (!emdash?.db) {
 		return new Response("<!-- EmDash not configured -->", {
 			status: 500,
 			headers: { "Content-Type": "application/xml" },
@@ -54,7 +66,7 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			"",
 		);
 
-		const result = await handleSitemapData(emdash.db, collectionSlug);
+		const result = await handleSitemapData(emdash.db, collectionSlug, { page });
 
 		if (!result.success || !result.data) {
 			return new Response("<!-- Failed to generate sitemap -->", {
@@ -89,6 +101,17 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				ungrouped.push(entry);
 			}
 		}
+		// Translations listed on other pages still count as alternates here.
+		const alternatesByGroup = new Map<string, Entry[]>();
+		const all = [...col.entries, ...col.translations].toSorted((a, b) =>
+			a.id < b.id ? -1 : a.id > b.id ? 1 : 0,
+		);
+		for (const entry of all) {
+			if (!i18nEnabled || !entry.translationGroup) continue;
+			const list = alternatesByGroup.get(entry.translationGroup);
+			if (list) list.push(entry);
+			else alternatesByGroup.set(entry.translationGroup, [entry]);
+		}
 
 		// Resolve every URL up-front so we can reference sibling URLs
 		// while emitting hreflang alternates without re-resolving.
@@ -159,8 +182,7 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				}
 
 				// x-default: prefer the default-locale sibling, otherwise
-				// the first sibling with a routable URL. Stable order:
-				// rows arrive sorted by updated_at DESC from the handler.
+				// the first sibling with a routable URL (siblings are sorted by ID).
 				const defaultSibling =
 					i18nConfig && alternateEntries.find((s) => s.locale === i18nConfig.defaultLocale);
 				let xDefaultLoc: string | null = null;
@@ -186,9 +208,10 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			lines.push("  </url>");
 		};
 
-		for (const siblings of groups.values()) {
+		for (const [group, siblings] of groups) {
+			const alternates = alternatesByGroup.get(group) ?? siblings;
 			for (const entry of siblings) {
-				await writeUrl(entry, siblings);
+				await writeUrl(entry, alternates);
 			}
 		}
 		for (const entry of ungrouped) {

package/src/astro/routes/sitemap.xml.ts

@@ -1,16 +1,17 @@
 /**
  * Sitemap index endpoint
  *
- * GET /sitemap.xml - Sitemap index listing one sitemap per collection.
+ * GET /sitemap.xml - Sitemap index listing the child sitemaps.
  *
- * Each collection with published, indexable content gets its own
- * child sitemap at /sitemap-{collection}.xml. The index includes
- * a <lastmod> per child derived from the most recently updated entry.
+ * Each collection with published, indexable content gets a child sitemap
+ * at /sitemap-{collection}.xml, continued at /sitemap-{collection}-{n}.xml
+ * once it exceeds one page. The index includes a <lastmod> per child
+ * derived from the most recently updated entry on that page.
  */
 
 import type { APIRoute } from "astro";
 
-import { handleSitemapData } from "#api/handlers/seo.js";
+import { handleSitemapIndexData } from "#api/handlers/seo.js";
 import { getPublicOrigin } from "#api/public-url.js";
 import { getSiteSettingsWithDb } from "#settings/index.js";
 
@@ -40,7 +41,7 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			"",
 		);
 
-		const result = await handleSitemapData(emdash.db);
+		const result = await handleSitemapIndexData(emdash.db);
 
 		if (!result.success || !result.data) {
 			return new Response("<!-- Failed to generate sitemap -->", {
@@ -49,18 +50,19 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			});
 		}
 
-		const { collections } = result.data;
+		const { sitemaps } = result.data;
 
 		const lines: string[] = [
 			'<?xml version="1.0" encoding="UTF-8"?>',
 			'<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
 		];
 
-		for (const col of collections) {
-			const loc = `${siteUrl}/sitemap-${encodeURIComponent(col.collection)}.xml`;
+		for (const sitemap of sitemaps) {
+			const suffix = sitemap.page === 1 ? "" : `-${sitemap.page}`;
+			const loc = `${siteUrl}/sitemap-${encodeURIComponent(sitemap.collection)}${suffix}.xml`;
 			lines.push("  <sitemap>");
 			lines.push(`    <loc>${escapeXml(loc)}</loc>`);
-			lines.push(`    <lastmod>${escapeXml(col.lastmod)}</lastmod>`);
+			lines.push(`    <lastmod>${escapeXml(sitemap.lastmod)}</lastmod>`);
 			lines.push("  </sitemap>");
 		}
 

package/src/astro/types.ts

@@ -83,6 +83,8 @@ export interface ManifestCollection {
 			id?: string;
 			/** Validation config for the field (e.g. `allowedMimeTypes` for file/image fields, subFields for repeater). */
 			validation?: Record<string, unknown>;
+			/** Value a new entry starts with in the admin editor. */
+			defaultValue?: unknown;
 		}
 	>;
 }
@@ -107,6 +109,7 @@ export interface ManifestPlugin {
 		path: string;
 		label?: string;
 		icon?: string;
+		group?: string;
 	}>;
 	dashboardWidgets?: Array<{
 		id: string;
@@ -163,6 +166,12 @@ export interface EmDashManifest {
 	 * authentication is handled externally.
 	 */
 	authMode: ManifestAuthMode;
+	/**
+	 * Whether the external auth provider replaces user names on every
+	 * authenticated request (`syncName` is not `false`). The admin shows the
+	 * name as managed by the identity provider instead of editable.
+	 */
+	providerManagedName?: boolean;
 	/**
 	 * Whether self-signup is enabled (at least one allowed domain is active).
 	 * Used by the login page to conditionally show the "Sign up" link.
@@ -288,6 +297,7 @@ export interface EmDashHandlers {
 		collection: string,
 		params: {
 			cursor?: string;
+			page?: number;
 			limit?: number;
 			status?: string;
 			orderBy?: string;
@@ -375,7 +385,7 @@ export interface EmDashHandlers {
 	// Trash handlers
 	handleContentListTrashed: (
 		collection: string,
-		params?: { cursor?: string; limit?: number; locale?: string },
+		params?: { cursor?: string; page?: number; limit?: number; locale?: string },
 	) => Promise<HandlerResponse>;
 
 	handleContentRestore: (collection: string, id: string) => Promise<HandlerResponse>;
@@ -469,6 +479,8 @@ export interface EmDashHandlers {
 		size?: number;
 		width?: number;
 		height?: number;
+		alt?: string;
+		caption?: string;
 		storageKey: string;
 		contentHash?: string;
 		blurhash?: string;