emdash 1.1.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emdash",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Astro-native CMS with WordPress migration support",
   "type": "module",
   "main": "dist/index.mjs",
@@ -255,6 +255,7 @@
     "@modelcontextprotocol/sdk": "^1.26.0",
     "@oslojs/crypto": "^1.0.1",
     "@oslojs/encoding": "^1.1.0",
+    "@phosphor-icons/react": "^2.1.10",
     "@portabletext/toolkit": "^5.0.1",
     "@tiptap/core": "^3.20.0",
     "@tiptap/extension-code": "^3.20.0",
@@ -265,6 +266,8 @@
     "@tiptap/extension-link": "^3.20.0",
     "@tiptap/extension-list": "^3.20.0",
     "@tiptap/extension-placeholder": "^3.20.0",
+    "@tiptap/extension-subscript": "^3.20.0",
+    "@tiptap/extension-superscript": "^3.20.0",
     "@tiptap/extension-text-align": "^3.20.0",
     "@tiptap/extension-typography": "^3.20.0",
     "@tiptap/extension-underline": "^3.20.0",
@@ -295,14 +298,14 @@
     "upng-js": "^2.1.0",
     "zod": "4.5.4",
     "@atcute/client": "^5.0.0",
-    "@emdash-cms/admin": "1.1.0",
-    "@emdash-cms/auth": "1.1.0",
-    "@emdash-cms/plugin-types": "0.5.0",
-    "@emdash-cms/blocks": "1.1.0",
-    "@emdash-cms/gutenberg-to-portable-text": "1.1.0",
-    "@emdash-cms/registry-client": "0.7.0",
+    "@emdash-cms/admin": "1.3.0",
+    "@emdash-cms/auth": "1.3.0",
+    "@emdash-cms/gutenberg-to-portable-text": "1.3.0",
+    "@emdash-cms/blocks": "1.3.0",
+    "@emdash-cms/plugin-types": "0.6.0",
+    "@emdash-cms/registry-client": "0.7.1",
     "@emdash-cms/registry-lexicons": "0.7.0",
-    "@emdash-cms/registry-verification": "0.3.3"
+    "@emdash-cms/registry-verification": "0.3.4"
   },
   "optionalDependencies": {
     "@libsql/kysely-libsql": "^0.4.0",
@@ -323,10 +326,11 @@
   "devDependencies": {
     "@apidevtools/swagger-parser": "^12.1.0",
     "@arethetypeswrong/cli": "^0.18.2",
-    "@astrojs/react": "^6.0.5",
+    "@astrojs/react": "^7.0.0",
     "@cloudflare/vitest-plugin": "^1.0.0",
     "@types/pg": "^8.16.0",
     "@types/react": "19.2.14",
+    "@types/react-dom": "19.2.3",
     "@types/sanitize-html": "^2.16.0",
     "@types/sax": "^1.2.7",
     "@vitest/ui": "4.1.10",
@@ -339,7 +343,7 @@
     "vitest": "4.1.10",
     "zod-openapi": "^5.4.6",
     "@emdash-cms/atproto-test-utils": "0.0.0",
-    "@emdash-cms/registry-verification": "0.3.3"
+    "@emdash-cms/registry-verification": "0.3.4"
   },
   "repository": {
     "type": "git",
@@ -361,7 +365,7 @@
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch",
-    "typecheck": "tsgo --noEmit",
+    "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.components.json",
     "check": "publint && attw --pack --ignore-rules=cjs-resolves-to-esm --ignore-rules=no-resolution --ignore-rules=internal-resolution-error",
     "test": "vitest",
     "test:workerd": "vitest run --config vitest.workerd.config.ts",

package/src/api/authorize.ts

@@ -71,6 +71,48 @@ export function requireOwnerPerm(
 	return null;
 }
 
+/**
+ * How `user` may edit an entry: `"full"` through `content:edit_own` or
+ * `content:edit_any`, `"draft"` through `content:edit_own_drafts` only, or
+ * `null` when they can't edit it.
+ *
+ * A `"draft"` grant holds only while the entry is still a draft, so the caller
+ * must make its write fail if the entry changes after this check, for example
+ * by conditioning the update on the `_rev` it checked.
+ */
+export function entryEditAccess(
+	user: UserLike | null | undefined,
+	entry: { authorId: string; status: unknown },
+): "full" | "draft" | null {
+	if (canActOnOwn(user, entry.authorId, "content:edit_own", "content:edit_any")) return "full";
+	if (
+		entry.status === "draft" &&
+		canActOnOwn(user, entry.authorId, "content:edit_own_drafts", "content:edit_any")
+	) {
+		return "draft";
+	}
+	return null;
+}
+
+/**
+ * Check if user can edit an entry, including an owner editing their own draft
+ * through `content:edit_own_drafts`. Returns a 401/403 Response if not, or null
+ * if authorized. See {@link entryEditAccess} for what a draft-only grant requires
+ * of the caller.
+ */
+export function requireEntryEditPerm(
+	user: UserLike | null | undefined,
+	entry: { authorId: string; status: unknown },
+): Response | null {
+	if (!user) {
+		return apiError("UNAUTHORIZED", "Authentication required", 401);
+	}
+	if (!entryEditAccess(user, entry)) {
+		return apiError("FORBIDDEN", "Insufficient permissions", 403);
+	}
+	return null;
+}
+
 /**
  * Like {@link requirePerm}, but authorized when the user has any of
  * `permissions`.

package/src/api/errors.ts

@@ -28,6 +28,7 @@ export const ErrorCode = {
 	NOT_IMPLEMENTED: "NOT_IMPLEMENTED",
 	NOT_SUPPORTED: "NOT_SUPPORTED",
 	MISSING_PARAM: "MISSING_PARAM",
+	DOMAIN_CHECK_FAILED: "DOMAIN_CHECK_FAILED",
 	CSRF_REJECTED: "CSRF_REJECTED",
 
 	// Content
@@ -185,6 +186,9 @@ export const ErrorCode = {
 	SIGNUP_VERIFY_ERROR: "SIGNUP_VERIFY_ERROR",
 	SIGNUP_COMPLETE_ERROR: "SIGNUP_COMPLETE_ERROR",
 	RECOVERY_SEND_ERROR: "RECOVERY_SEND_ERROR",
+	MAGIC_LINK_VERIFY_ERROR: "MAGIC_LINK_VERIFY_ERROR",
+	NO_SITE_URL: "NO_SITE_URL",
+	SIGN_IN_HANDOVER_ERROR: "SIGN_IN_HANDOVER_ERROR",
 	USER_LIST_ERROR: "USER_LIST_ERROR",
 	USER_DETAIL_ERROR: "USER_DETAIL_ERROR",
 	USER_UPDATE_ERROR: "USER_UPDATE_ERROR",
@@ -360,6 +364,9 @@ export const ErrorCode = {
 	SETTINGS_UPDATE_ERROR: "SETTINGS_UPDATE_ERROR",
 	EMAIL_SETTINGS_READ_ERROR: "EMAIL_SETTINGS_READ_ERROR",
 	EMAIL_TEST_ERROR: "EMAIL_TEST_ERROR",
+	SITE_DOMAIN_ERROR: "SITE_DOMAIN_ERROR",
+	DOMAIN_PROOF_ERROR: "DOMAIN_PROOF_ERROR",
+	DOMAIN_MOVE_NOTICE_ERROR: "DOMAIN_MOVE_NOTICE_ERROR",
 
 	// Backups
 	BACKUP_SETTINGS_READ_ERROR: "BACKUP_SETTINGS_READ_ERROR",
@@ -513,6 +520,7 @@ export function mapErrorStatus(code: string | undefined): number {
 		case ErrorCode.CREDENTIAL_EXISTS:
 		case ErrorCode.EMAIL_IN_USE:
 		case ErrorCode.USER_EXISTS:
+		case ErrorCode.NO_SITE_URL:
 		case ErrorCode.PLUGIN_ID_CONFLICT:
 		case ErrorCode.ALREADY_INSTALLED:
 		case ErrorCode.ALREADY_CONFIGURED:
@@ -543,6 +551,7 @@ export function mapErrorStatus(code: string | undefined): number {
 		case ErrorCode.CHECKSUM_MISMATCH:
 		case ErrorCode.INVALID_BUNDLE:
 		case ErrorCode.BUNDLE_EXTRACT_FAILED:
+		case ErrorCode.DOMAIN_CHECK_FAILED:
 			return 422;
 
 		// 429 Too Many Requests

package/src/api/handlers/api-tokens.ts

@@ -9,6 +9,7 @@
 import type { Kysely } from "kysely";
 import { ulid } from "ulidx";
 
+import { after } from "../../after.js";
 import { hashApiToken, generatePrefixedToken } from "../../auth/api-tokens.js";
 import type { Database } from "../../database/types.js";
 import type { ApiResult } from "../types.js";
@@ -227,12 +228,17 @@ export async function resolveApiToken(
 		return null;
 	}
 
-	// Update last_used_at (fire-and-forget, don't block the request)
-	db.updateTable("_emdash_api_tokens")
-		.set({ last_used_at: new Date().toISOString() })
-		.where("id", "=", row.id)
-		.execute()
-		.catch(() => {}); // Non-critical, swallow errors
+	after(async () => {
+		try {
+			await db
+				.updateTable("_emdash_api_tokens")
+				.set({ last_used_at: new Date().toISOString() })
+				.where("id", "=", row.id)
+				.execute();
+		} catch (error) {
+			console.error("[api-tokens] failed to record token use:", error);
+		}
+	});
 
 	return {
 		userId: row.user_id,

package/src/api/handlers/content.ts

@@ -868,6 +868,23 @@ function resolveBylineFilter(
 	return { mode: "any", bylineIds, includeInferred, locale };
 }
 
+/**
+ * Rows to skip for a numbered page, or `null` when the page can't be served
+ * (combined with a cursor, or past the safe-integer range).
+ */
+function pageOffset(params: { page: number; limit: number; cursor?: string }): number | null {
+	const offset = (params.page - 1) * params.limit;
+	if (
+		params.cursor !== undefined ||
+		!Number.isSafeInteger(params.page) ||
+		params.page < 1 ||
+		!Number.isSafeInteger(offset)
+	) {
+		return null;
+	}
+	return offset;
+}
+
 /**
  * Create content list handler
  */
@@ -876,6 +893,7 @@ export async function handleContentList(
 	collection: string,
 	params: {
 		cursor?: string;
+		page?: number;
 		limit?: number;
 		status?: string;
 		orderBy?: string;
@@ -893,6 +911,18 @@ export async function handleContentList(
 	},
 ): Promise<ApiResult<ContentListResponse>> {
 	try {
+		const limit = Math.max(1, Math.min(params.limit || 50, 100));
+		const offset =
+			params.page === undefined
+				? undefined
+				: pageOffset({ page: params.page, limit, cursor: params.cursor });
+		if (offset === null) {
+			return {
+				success: false,
+				error: { code: "VALIDATION_ERROR", message: "Invalid content page" },
+			};
+		}
+
 		const repo = new ContentRepository(db);
 		const where: FindManyOptions["where"] = {};
 		if (params.status) where.status = params.status;
@@ -940,7 +970,8 @@ export async function handleContentList(
 
 		const result = await repo.findMany(collection, {
 			cursor: params.cursor,
-			limit: params.limit || 50,
+			offset,
+			limit,
 			where: Object.keys(where).length > 0 ? where : undefined,
 			orderBy: params.orderBy
 				? { field: params.orderBy, direction: params.order || "desc" }
@@ -2033,15 +2064,32 @@ export async function handleContentPermanentDelete(
 export async function handleContentListTrashed(
 	db: Kysely<Database>,
 	collection: string,
-	options: { limit?: number; cursor?: string; locale?: string } = {},
-): Promise<ApiResult<{ items: TrashedContentItem[]; nextCursor?: string }>> {
+	options: { limit?: number; cursor?: string; page?: number; locale?: string } = {},
+): Promise<ApiResult<{ items: TrashedContentItem[]; nextCursor?: string; total?: number }>> {
 	try {
+		const limit = Math.max(1, Math.min(options.limit || 50, 100));
+		const offset =
+			options.page === undefined
+				? undefined
+				: pageOffset({ page: options.page, limit, cursor: options.cursor });
+		if (offset === null) {
+			return {
+				success: false,
+				error: { code: "VALIDATION_ERROR", message: "Invalid content page" },
+			};
+		}
+
 		const repo = new ContentRepository(db);
-		const result = await repo.findTrashed(collection, {
-			limit: options.limit,
-			cursor: options.cursor,
-			where: { locale: options.locale },
-		});
+		const where = { locale: options.locale };
+		// Settled like findMany's count, so a rejection can't leave the other
+		// query holding a pooled connection.
+		const [rowsResult, countResult] = await Promise.allSettled([
+			repo.findTrashed(collection, { limit, cursor: options.cursor, offset, where }),
+			offset === undefined ? undefined : repo.countTrashed(collection, where),
+		]);
+		if (rowsResult.status === "rejected") throw rowsResult.reason;
+		if (countResult.status === "rejected") throw countResult.reason;
+		const result = rowsResult.value;
 
 		return {
 			success: true,
@@ -2061,6 +2109,7 @@ export async function handleContentListTrashed(
 					deletedAt: item.deletedAt,
 				})),
 				nextCursor: result.nextCursor,
+				total: countResult.value,
 			},
 		};
 	} catch (error) {

package/src/api/handlers/dashboard.ts

@@ -20,6 +20,7 @@ import {
 	type ScheduledPolicyRejection,
 	type VersionedScheduledPolicyRejection,
 } from "../../plugins/content-policy.js";
+import type { VersionedValue } from "../../plugins/types.js";
 import { getSchedulerHealth, type SchedulerHealth } from "../../scheduler-health.js";
 import type { ApiResult } from "../types.js";
 
@@ -61,9 +62,14 @@ const POLICY_REJECTION_PREVIEW_LIMIT = 20;
  *
  * Queries are intentionally lightweight — counts use indexed columns,
  * and recent items are capped at 10.
+ *
+ * Without `includeDrafts` (callers lacking `content:read_drafts`), only
+ * published entries are counted or listed, and scheduled-publication policy
+ * rejections are omitted.
  */
 export async function handleDashboardStats(
 	db: Kysely<Database>,
+	{ includeDrafts }: { includeDrafts: boolean },
 	now = new Date(),
 ): Promise<ApiResult<DashboardStats>> {
 	try {
@@ -79,6 +85,17 @@ export async function handleDashboardStats(
 		const collectionStats: CollectionStats[] = await Promise.all(
 			collections.map(async (col) => {
 				const stats = await contentRepo.getStats(col.slug, now);
+				if (!includeDrafts) {
+					return {
+						slug: col.slug,
+						label: col.label,
+						total: stats.published,
+						published: stats.published,
+						draft: 0,
+						scheduled: 0,
+						overdueScheduled: 0,
+					};
+				}
 				return {
 					slug: col.slug,
 					label: col.label,
@@ -105,20 +122,22 @@ export async function handleDashboardStats(
 			mediaRepo.count(),
 			userRepo.count(),
 			getSchedulerHealth(db, now),
-			optionsRepo.countByPrefix(SCHEDULED_POLICY_REJECTION_PREFIX),
-			optionsRepo.getVersionedByPrefix<ScheduledPolicyRejection>(
-				SCHEDULED_POLICY_REJECTION_PREFIX,
-				{
-					limit: POLICY_REJECTION_PREVIEW_LIMIT,
-				},
-			),
+			includeDrafts ? optionsRepo.countByPrefix(SCHEDULED_POLICY_REJECTION_PREFIX) : 0,
+			includeDrafts
+				? optionsRepo.getVersionedByPrefix<ScheduledPolicyRejection>(
+						SCHEDULED_POLICY_REJECTION_PREFIX,
+						{
+							limit: POLICY_REJECTION_PREVIEW_LIMIT,
+						},
+					)
+				: new Map<string, VersionedValue<ScheduledPolicyRejection>>(),
 		]);
 		const policyRejections = [...versionedPolicyRejectionOptions.values()]
 			.filter(({ value }) => isScheduledPolicyRejection(value))
 			.map(({ value, revision }) => ({ ...value, _rev: revision }));
 
-		// Recent items across all collections (last 10 updated, any status)
-		const recentItems = await fetchRecentItems(db, collections);
+		// Recent items across all collections (last 10 updated)
+		const recentItems = await fetchRecentItems(db, collections, includeDrafts);
 
 		return {
 			success: true,
@@ -165,10 +184,13 @@ interface RecentItemRow {
  * `title` is not a standard column — it's a user-defined field. We query
  * `_emdash_fields` to discover which collections have one and fall back
  * to `slug` (which is always present) otherwise.
+ *
+ * Without `includeDrafts`, only published entries are considered.
  */
 async function fetchRecentItems(
 	db: Kysely<Database>,
 	collections: Array<{ slug: string; label: string }>,
+	includeDrafts: boolean,
 ): Promise<RecentItem[]> {
 	if (collections.length === 0) return [];
 
@@ -181,6 +203,7 @@ async function fetchRecentItems(
 		.execute();
 
 	const collectionsWithTitle = new Set(titleFields.map((r) => r.collection_slug));
+	const statusFilter = includeDrafts ? sql`` : sql`AND status = 'published'`;
 
 	// Issue one query per collection in parallel, then merge in JS.
 	// A single UNION ALL across N collections trips D1's
@@ -208,7 +231,7 @@ async function fetchRecentItems(
 					updated_at,
 					author_id
 				FROM ${sql.ref(table)}
-				WHERE deleted_at IS NULL
+				WHERE deleted_at IS NULL ${statusFilter}
 				ORDER BY updated_at DESC
 				LIMIT 10
 			`.execute(db);

package/src/api/handlers/domain-move-notice.ts

@@ -0,0 +1,94 @@
+/**
+ * Tell users that the site moved to a new address.
+ */
+
+import { getLocaleDir } from "@emdash-cms/admin/locales/config";
+import type { DomainMoveEmailStrings } from "@emdash-cms/admin/locales/emails";
+import { escapeHtml, type EmailMessage } from "@emdash-cms/auth";
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+import type { ApiResult } from "../types.js";
+
+export interface DomainMoveNoticeOptions {
+	/** Origin users should sign in at, e.g. `https://example.com`. */
+	origin: string;
+	strings: DomainMoveEmailStrings;
+	locale: string;
+	/** The user sending the notice; they are not emailed. */
+	senderId: string;
+	send: (message: EmailMessage) => Promise<void>;
+}
+
+export function buildDomainMoveEmail(
+	to: string,
+	loginUrl: string,
+	strings: DomainMoveEmailStrings,
+	locale: string,
+): EmailMessage {
+	const url = escapeHtml(loginUrl);
+	return {
+		to,
+		subject: strings.subject,
+		text: `${strings.intro}\n\n${strings.instruction}\n\n${loginUrl}\n\n${strings.passkeyNote}`,
+		html: `
+<!DOCTYPE html>
+<html lang="${escapeHtml(locale)}" dir="${getLocaleDir(locale)}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.5; color: #333; max-width: 600px; margin: 0 auto; padding: 20px;">
+  <h1 style="font-size: 24px; margin-bottom: 20px;">${escapeHtml(strings.subject)}</h1>
+  <p>${escapeHtml(strings.intro)}</p>
+  <p>${escapeHtml(strings.instruction)}</p>
+  <p style="margin: 30px 0;">
+    <a href="${url}" style="background-color: #0066cc; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">${escapeHtml(strings.buttonLabel)}</a>
+  </p>
+  <p style="color: #666; font-size: 14px;">${escapeHtml(strings.passkeyNote)}</p>
+</body>
+</html>`,
+	};
+}
+
+/**
+ * Email every active user except the sender a link to the sign-in page at
+ * `origin`. The email carries no sign-in token. Sends one email per user,
+ * so a failed send for one address doesn't stop the others.
+ */
+export async function handleDomainMoveNotice(
+	db: Kysely<Database>,
+	options: DomainMoveNoticeOptions,
+): Promise<ApiResult<{ sent: number; failed: number }>> {
+	try {
+		const users = await db
+			.selectFrom("users")
+			.select("email")
+			.where("disabled", "=", 0)
+			.where("id", "!=", options.senderId)
+			.execute();
+
+		const loginUrl = new URL("/_emdash/admin/login", options.origin).toString();
+		let sent = 0;
+		let failed = 0;
+		for (const user of users) {
+			try {
+				// oxlint-disable-next-line no-await-in-loop -- one send at a time keeps email providers within their rate limits
+				await options.send(
+					buildDomainMoveEmail(user.email, loginUrl, options.strings, options.locale),
+				);
+				sent++;
+			} catch (error) {
+				failed++;
+				console.error("[domain-move-notice] send failed:", error);
+			}
+		}
+		return { success: true, data: { sent, failed } };
+	} catch (error) {
+		console.error("[domain-move-notice] failed:", error);
+		return {
+			success: false,
+			error: { code: "DOMAIN_MOVE_NOTICE_ERROR", message: "Failed to email users" },
+		};
+	}
+}

package/src/api/handlers/index.ts

@@ -147,9 +147,11 @@ export {
 // SEO handlers
 export {
 	handleSitemapData,
+	handleSitemapIndexData,
 	type SitemapCollectionData,
 	type SitemapContentEntry,
 	type SitemapDataResponse,
+	type SitemapIndexEntry,
 } from "./seo.js";
 
 // Plugin handlers

package/src/api/handlers/manifest.ts

@@ -353,6 +353,7 @@ function dbFieldDescriptor(
 		id: field.id,
 	};
 	if (field.unsupportedType) entry.unsupportedType = field.unsupportedType;
+	if (field.type === "integer") entry.integer = true;
 	if (field.blockTypes) entry.blockTypes = field.blockTypes;
 	if (field.blockTypeFingerprint) entry.blockTypeFingerprint = field.blockTypeFingerprint;
 
@@ -377,6 +378,11 @@ function dbFieldDescriptor(
 		entry.validation = validation;
 	}
 
+	// A bound reference is set through `references`; create refuses a value for it in `data`.
+	if (field.defaultValue !== undefined && !isStoragelessField(field)) {
+		entry.defaultValue = field.defaultValue;
+	}
+
 	return entry;
 }
 

package/src/api/handlers/media-usage.ts

@@ -410,7 +410,8 @@ function normalizeMediaUsageReferenceType(
 	if (
 		referenceType === "image_field" ||
 		referenceType === "file_field" ||
-		referenceType === "portable_text_image"
+		referenceType === "portable_text_image" ||
+		referenceType === "portable_text_video"
 	) {
 		return referenceType;
 	}

package/src/api/handlers/media.ts

@@ -146,6 +146,7 @@ export async function handleMediaCreate(
 		width?: number;
 		height?: number;
 		alt?: string;
+		caption?: string;
 		storageKey: string;
 		contentHash?: string;
 		blurhash?: string;

package/src/api/handlers/plugins.ts

@@ -41,6 +41,7 @@ export interface PluginInfo {
 	mcpToolsEnabled: boolean;
 	mcpTools: Array<{
 		name: string;
+		mcpName?: string;
 		description: string;
 		route: string;
 		permission: string;

package/src/api/handlers/revision.ts

@@ -6,7 +6,11 @@ import type { Kysely } from "kysely";
 
 import { after } from "../../after.js";
 import { ContentRepository } from "../../database/repositories/content.js";
-import { RevisionRepository, type Revision } from "../../database/repositories/revision.js";
+import {
+	RevisionRepository,
+	type Revision,
+	type RevisionWithAuthor,
+} from "../../database/repositories/revision.js";
 import { ContentMutationConflictError } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
 import { encodeRev } from "../rev.js";
@@ -19,7 +23,7 @@ import {
 } from "./staged-references.js";
 
 export interface RevisionListResponse {
-	items: Revision[];
+	items: RevisionWithAuthor[];
 	total: number;
 }