emdash 1.2.0 → 1.3.0

package/src/astro/routes/api/widget-areas/[name].ts

@@ -10,6 +10,7 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
@@ -84,7 +85,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 		// Delete area (widgets cascade)
 		await db.deleteFrom("_emdash_widget_areas").where("id", "=", area.id).execute();
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess({ deleted: true });
 	} catch (error) {
 		return handleError(error, "Failed to delete widget area", "WIDGET_AREA_DELETE_ERROR");

package/src/astro/routes/api/widget-areas/index.ts

@@ -13,6 +13,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { createWidgetAreaBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
@@ -96,7 +97,7 @@ export const POST: APIRoute = async ({ request, locals, cache }) => {
 			.where("id", "=", id)
 			.executeTakeFirstOrThrow();
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(area.name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(area.name)]);
 		return apiSuccess(area, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create widget area", "WIDGET_AREA_CREATE_ERROR");

package/src/astro/routes/robots.txt.ts

@@ -5,7 +5,8 @@
  *
  * If a custom robots.txt is configured in SEO settings, that is returned.
  * Otherwise generates a default that allows all crawlers and references
- * the sitemap.
+ * the sitemap. When `seo.disallowAiTraining` is set, either version gets
+ * rules asking AI training crawlers to stay away.
  */
 
 import type { APIRoute } from "astro";
@@ -17,6 +18,31 @@ export const prerender = false;
 
 const TRAILING_SLASH_RE = /\/$/;
 
+/** AI training crawlers and opt-out tokens, as listed in Cloudflare's managed robots.txt. */
+const AI_TRAINING_CRAWLERS = [
+	"Amazonbot",
+	"Applebot-Extended",
+	"Bytespider",
+	"CCBot",
+	"ClaudeBot",
+	"Google-Extended",
+	"GPTBot",
+	"meta-externalagent",
+];
+
+/**
+ * `Content-Signal` is not a rule, so the empty `Disallow:` is what closes the
+ * `*` group; without a rule, crawlers merge it with the next group and apply
+ * `Disallow: /` to everyone.
+ */
+const AI_TRAINING_RULES = [
+	"# Disallow AI training",
+	"User-agent: *",
+	"Content-Signal: search=yes, ai-train=no",
+	"Disallow:",
+	...AI_TRAINING_CRAWLERS.flatMap((agent) => ["", `User-agent: ${agent}`, "Disallow: /"]),
+].join("\n");
+
 export const GET: APIRoute = async ({ locals, url }) => {
 	const { emdash } = locals;
 
@@ -35,11 +61,15 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			"",
 		);
 		const sitemapUrl = `${siteUrl}/sitemap.xml`;
+		const disallowAiTraining = settings.seo?.disallowAiTraining === true;
 
 		// Use custom robots.txt if configured
 		if (settings.seo?.robotsTxt) {
-			// Append sitemap directive if not already present
 			let content = settings.seo.robotsTxt;
+			if (disallowAiTraining) {
+				content = `${content.trimEnd()}\n\n${AI_TRAINING_RULES}\n`;
+			}
+			// Append sitemap directive if not already present
 			if (!content.toLowerCase().includes("sitemap:")) {
 				content = `${content.trimEnd()}\n\nSitemap: ${sitemapUrl}\n`;
 			}
@@ -61,6 +91,7 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			"# Disallow admin and API routes",
 			"Disallow: /_emdash/",
 			"",
+			...(disallowAiTraining ? [AI_TRAINING_RULES, ""] : []),
 			`Sitemap: ${sitemapUrl}`,
 			"",
 		].join("\n");

package/src/astro/types.ts

@@ -9,6 +9,7 @@ import type { Element } from "@emdash-cms/blocks";
 import type { Kysely } from "kysely";
 
 import type { ContentFieldFilters } from "../content-list-query.js";
+import type { ContentSeoInput } from "../database/repositories/types.js";
 import type {
 	PluginEditorExtensionDispatch,
 	ResolvedPluginEditorExtension,
@@ -343,6 +344,7 @@ export interface EmDashHandlers {
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
 			locale?: string;
 			translationOf?: string;
+			seo?: ContentSeoInput;
 			taxonomies?: Record<string, string[]>;
 			references?: Record<string, string[]>;
 			createdAt?: string | null;
@@ -563,7 +565,14 @@ export interface EmDashHandlers {
 		request: Request,
 	) => Promise<HandlerResponse>;
 
-	// Plugin route metadata (for auth/caching decisions before dispatch)
+	// Public-only plugin route metadata for SSR page components.
+	// Public routes return their meta. Private and unknown routes return null.
+	// Present on both anonymous and signed-in locals so the result does not
+	// change when a visitor logs in.
+	getPublicPluginRouteMeta: (pluginId: string, path: string) => RouteMeta | null;
+
+	// Plugin route metadata (for auth/caching decisions before dispatch).
+	// Signed-in locals only. Private routes return `{ public: false }`.
 	getPluginRouteMeta: (pluginId: string, path: string) => RouteMeta | null;
 	getEnabledPluginMcpTools: () => Promise<
 		Array<{

package/src/auth/types.ts

@@ -19,7 +19,7 @@ export interface AuthResult {
 	email: string;
 	/** User's display name */
 	name: string;
-	/** Resolved role level (e.g., 50 for Admin, 30 for Editor) */
+	/** Resolved role level (e.g., 50 for Admin, 40 for Editor, 30 for Author) */
 	role: number;
 	/** Provider-specific subject ID */
 	subject?: string;
@@ -186,7 +186,7 @@ export interface ExternalAuthConfig {
 
 	/**
 	 * Role level for users not matching any group in roleMapping
-	 * @default 30 (Editor)
+	 * @default 30 (Author, who can publish their own content)
 	 */
 	defaultRole?: number;
 
@@ -212,8 +212,8 @@ export interface ExternalAuthConfig {
 	 * ```ts
 	 * roleMapping: {
 	 *   "Admins": 50,        // Admin
-	 *   "Developers": 40,    // Developer
-	 *   "Content Team": 30,  // Editor
+	 *   "Editors": 40,       // Editor
+	 *   "Content Team": 30,  // Author
 	 * }
 	 * ```
 	 */

package/src/cache/redirect-paths.ts

@@ -0,0 +1,56 @@
+/**
+ * Cache invalidation specs for redirect source paths.
+ *
+ * The Cloudflare adapter tags cached pages by request pathname
+ * (`astro-path:<pathname>`). When a redirect is written, purging the source
+ * path (and its trailing-slash variant) clears any stale cached page at that
+ * location so the redirect middleware runs on the next request.
+ */
+
+export interface CachePathSpec {
+	path: string;
+}
+
+interface CacheLike {
+	enabled?: boolean;
+	invalidate(spec: CachePathSpec): Promise<unknown>;
+}
+
+function toggledTrailingSlash(path: string): string | null {
+	if (path.length <= 1) return null;
+	return path.endsWith("/") ? path.slice(0, -1) : `${path}/`;
+}
+
+/**
+ * Build cache-invalidation specs for one or more redirect source paths.
+ * Returns each path with and without a trailing slash, deduplicated.
+ */
+export function redirectSourceCachePaths(...sources: string[]): CachePathSpec[] {
+	const paths = new Set<string>();
+	for (const source of sources) {
+		if (!source) continue;
+		paths.add(source);
+		const alt = toggledTrailingSlash(source);
+		if (alt) paths.add(alt);
+	}
+	return Array.from(paths, (path) => ({ path }));
+}
+
+/**
+ * Invalidate the edge cache for one or more redirect source paths.
+ * Failures are logged but not thrown: the redirect mutation has already
+ * been committed and should still return a successful response.
+ */
+export async function invalidateRedirectSourcePaths(
+	cache: CacheLike | undefined,
+	...sources: string[]
+): Promise<void> {
+	if (!cache?.enabled) return;
+	for (const spec of redirectSourceCachePaths(...sources)) {
+		try {
+			await cache.invalidate(spec);
+		} catch (error) {
+			console.error(`[redirects] Failed to invalidate cache for ${spec.path}:`, error);
+		}
+	}
+}

package/src/cache/route-cache.ts

@@ -0,0 +1,22 @@
+import type { APIContext } from "astro";
+
+type RouteCache = Pick<APIContext["cache"], "enabled" | "invalidate">;
+
+/**
+ * Purge `tags` from Astro's route cache when a cache provider is configured.
+ *
+ * Never throws: callers run it after a committed write, and a rejected purge
+ * must not fail that write. The pages stay cached until a later purge or their
+ * `maxAge`.
+ */
+export async function invalidateRouteCache(
+	cache: RouteCache | undefined,
+	tags: string[],
+): Promise<void> {
+	if (!cache?.enabled) return;
+	try {
+		await cache.invalidate({ tags });
+	} catch (error) {
+		console.error(`[cache] Failed to invalidate route cache tags ${tags.join(", ")}:`, error);
+	}
+}

package/src/cli/commands/import/wordpress.ts

@@ -16,6 +16,7 @@ import pc from "picocolors";
 import { slugify } from "#utils/slugify.js";
 
 import { validateExternalUrl, ssrfSafeFetch } from "../../../import/ssrf.js";
+import { INTERNAL_POST_TYPES, isInternalPostType } from "../../../import/utils.js";
 import { parseWxr, type WxrData, type WxrPost, type WxrAttachment } from "../../wxr/parser.js";
 
 // Regex patterns for WordPress import
@@ -385,20 +386,7 @@ function generateMigrationConfig(wxr: WxrData, analysis: ContentAnalysis): Migra
 
 	// Map post types to collections
 	for (const [type, count] of analysis.postTypes) {
-		// Skip internal types (see INTERNAL_POST_TYPES in utils.ts)
-		const skip = [
-			"revision",
-			"nav_menu_item",
-			"custom_css",
-			"customize_changeset",
-			"oembed_cache",
-			"wp_global_styles",
-			"wp_navigation",
-			"wp_template",
-			"wp_template_part",
-			"attachment", // Handled separately as media
-			"wp_block", // Handled separately as sections (reusable blocks)
-		].includes(type);
+		const skip = isInternalPostType(type);
 
 		collections[type] = {
 			collection: mapPostTypeToCollection(type),
@@ -425,19 +413,7 @@ function generateMigrationConfig(wxr: WxrData, analysis: ContentAnalysis): Migra
 		},
 		collections,
 		fields,
-		skipPostTypes: [
-			"revision",
-			"nav_menu_item",
-			"custom_css",
-			"customize_changeset",
-			"oembed_cache",
-			"wp_global_styles",
-			"wp_navigation",
-			"wp_template",
-			"wp_template_part",
-			"attachment",
-			"wp_block",
-		],
+		skipPostTypes: [...INTERNAL_POST_TYPES],
 		skipMetaKeys: ["_edit_last", "_edit_lock", "_pingme", "_encloseme"],
 	};
 }

package/src/cli/commands/login.ts

@@ -23,6 +23,7 @@ import {
 	resolveCustomHeaders,
 	runCloudflaredLogin,
 } from "../../client/cf-access.js";
+import { connectionArgs, resolveBaseUrl } from "../client-factory.js";
 import {
 	getCredentials,
 	removeCredentials,
@@ -409,42 +410,27 @@ export const whoamiCommand = defineCommand({
 		name: "whoami",
 		description: "Show current user and auth method",
 	},
-	args: {
-		url: {
-			type: "string",
-			alias: "u",
-			description: "EmDash instance URL",
-			default: "http://localhost:4321",
-		},
-		token: {
-			type: "string",
-			alias: "t",
-			description: "Auth token",
-		},
-		json: {
-			type: "boolean",
-			description: "Output as JSON",
-		},
-	},
+	args: { ...connectionArgs },
 	async run({ args }) {
 		configureOutputMode(args);
-		const baseUrl = args.url || "http://localhost:4321";
+		const baseUrl = resolveBaseUrl(args);
 
 		// Resolve token: --token flag > EMDASH_TOKEN env > stored credentials
 		let token = args.token || process.env["EMDASH_TOKEN"];
 		let authMethod = token ? "token" : "none";
-		let storedHeaders: Record<string, string> = {};
+		const cred = token ? null : getCredentials(baseUrl);
+		const headerFetch = createHeaderAwareFetch({
+			...cred?.customHeaders,
+			...resolveCustomHeaders(),
+		});
 
 		if (!token) {
-			const cred = getCredentials(baseUrl);
 			if (cred) {
 				token = cred.accessToken;
 				authMethod = "stored";
-				storedHeaders = cred.customHeaders ?? {};
 
 				// Check if expired
 				if (new Date(cred.expiresAt) < new Date()) {
-					const headerFetch = createHeaderAwareFetch(storedHeaders);
 					// Try to refresh
 					try {
 						const refreshRes = await headerFetch(
@@ -490,40 +476,46 @@ export const whoamiCommand = defineCommand({
 			const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
 			if (isLocal) {
 				authMethod = "dev-bypass";
-				consola.info(`Auth method: ${pc.cyan("dev-bypass")}`);
-				consola.info("No stored credentials. Client will use dev bypass for localhost.");
-				return;
+			} else {
+				consola.error("Not logged in. Run: emdash login");
+				process.exit(2);
 			}
-
-			consola.error("Not logged in. Run: emdash login");
-			process.exit(2);
 		}
 
-		const headerFetch = createHeaderAwareFetch(storedHeaders);
-
 		try {
-			const meRes = await headerFetch(new URL("/_emdash/api/auth/me", baseUrl), {
-				headers: { Authorization: `Bearer ${token}` },
-			});
+			const meRes = token
+				? await headerFetch(new URL("/_emdash/api/auth/me", baseUrl), {
+						headers: { Authorization: `Bearer ${token}` },
+					})
+				: await headerFetch(new URL("/_emdash/api/auth/dev-bypass", baseUrl), {
+						redirect: "manual",
+					});
 
 			if (!meRes.ok) {
-				if (meRes.status === 401) {
+				if (token && meRes.status === 401) {
 					consola.error("Token is invalid or expired. Run: emdash login");
 					process.exit(1);
 				}
+				if (!token && meRes.status === 403) {
+					consola.error("The dev bypass only works under `astro dev`. Run: emdash login");
+					process.exit(1);
+				}
+				if (!token && meRes.status === 404) {
+					consola.error("The dev bypass is not available on this site. Run: emdash login");
+					process.exit(1);
+				}
 				consola.error(`Failed to fetch user info: ${meRes.status}`);
 				process.exit(1);
 			}
 
-			const raw = (await meRes.json()) as {
-				data: {
-					id: string;
-					email: string;
-					name: string | null;
-					role: number;
-				};
-			};
-			const me = raw.data;
+			interface Me {
+				id: string;
+				email: string;
+				name: string | null;
+				role: number;
+			}
+			const raw = (await meRes.json()) as { data: Me | { user: Me } };
+			const me = "user" in raw.data ? raw.data.user : raw.data;
 
 			const roleNames: Record<number, string> = {
 				10: "subscriber",

package/src/cli/commands/migrate.ts

@@ -52,6 +52,7 @@ export interface MigrateCommandOptions extends MigrationTargetOverrides {
 	json?: boolean;
 	expectedTargetFingerprint?: string;
 	releaseLock?: string;
+	takeOverLock?: string;
 }
 
 export interface MigrateCommandDependencies {
@@ -242,6 +243,16 @@ function validateOptions(options: MigrateCommandOptions): void {
 			throw new MigrateCommandError("--release-lock requires the lock id shown by --status.");
 		}
 	}
+	if (options.takeOverLock !== undefined) {
+		if (options.check || options.status || options.releaseLock !== undefined) {
+			throw new MigrateCommandError(
+				"--take-over-lock cannot be used with --check, --status, or --release-lock.",
+			);
+		}
+		if (!LOCK_ID_PATTERN.test(options.takeOverLock)) {
+			throw new MigrateCommandError("--take-over-lock requires the lock id shown by --status.");
+		}
+	}
 	if (
 		options.expectedTargetFingerprint &&
 		!FINGERPRINT_PATTERN.test(options.expectedTargetFingerprint)
@@ -515,12 +526,15 @@ export async function runMigrateCommand(
 			);
 
 			const releasing = options.releaseLock !== undefined;
+			const takingOver = options.takeOverLock !== undefined;
 			const applying = !options.check && !options.status && !releasing;
 			if (applying || releasing) {
-				const operation = releasing ? "lock release" : "apply";
+				const operation = releasing ? "lock release" : takingOver ? "lock take-over" : "apply";
 				const question = releasing
 					? `Release migration lock ${options.releaseLock} on ${target.label}? Release it only when no migration is running.`
-					: `Apply EmDash migrations to ${target.label}?`;
+					: takingOver
+						? `Take over migration lock ${options.takeOverLock} on ${target.label} and apply EmDash migrations? Take it over only when no migration is running.`
+						: `Apply EmDash migrations to ${target.label}?`;
 				if (options.expectedTargetFingerprint) {
 					if (options.expectedTargetFingerprint !== target.fingerprint) {
 						dependencies.writeStderr("Expected target fingerprint does not match the target.");
@@ -534,7 +548,13 @@ export async function runMigrateCommand(
 					exitCode = MIGRATE_EXIT_CODES.confirmation;
 					return exitCode;
 				} else if (!(await dependencies.confirm(question))) {
-					dependencies.writeStderr(releasing ? "Lock release cancelled." : "Migration cancelled.");
+					dependencies.writeStderr(
+						releasing
+							? "Lock release cancelled."
+							: takingOver
+								? "Lock take-over cancelled."
+								: "Migration cancelled.",
+					);
 					exitCode = MIGRATE_EXIT_CODES.confirmation;
 					return exitCode;
 				}
@@ -549,6 +569,10 @@ export async function runMigrateCommand(
 				},
 			};
 			if (applying) request.action = "apply";
+			if (takingOver) {
+				request.action = "take-over-lock";
+				request.lockId = options.takeOverLock;
+			}
 			if (releasing) {
 				request.action = "release-lock";
 				request.lockId = options.releaseLock;
@@ -563,6 +587,8 @@ export async function runMigrateCommand(
 				dependencies.writeStdout(JSON.stringify(report));
 			} else {
 				if (releasing) dependencies.writeStdout(`Released migration lock ${options.releaseLock}.`);
+				if (takingOver)
+					dependencies.writeStdout(`Took over migration lock ${options.takeOverLock}.`);
 				printHumanReport(report, dependencies.writeStdout);
 			}
 			exitCode = reportExitCode(options, report);
@@ -604,12 +630,17 @@ export const migrateCommand = defineCommand({
 		json: { type: "boolean", description: "Print the stable JSON report" },
 		"expected-target-fingerprint": {
 			type: "string",
-			description: "Required target fingerprint for noninteractive apply or lock release",
+			description:
+				"Required target fingerprint for noninteractive apply, lock release, or take-over",
 		},
 		"release-lock": {
 			type: "string",
 			description: "Release the migration lock with the id shown by --status",
 		},
+		"take-over-lock": {
+			type: "string",
+			description: "Apply migrations, taking over the migration lock with the id shown by --status",
+		},
 		database: { type: "string", description: "Override the SQLite database path" },
 		"database-url-env": {
 			type: "string",
@@ -630,6 +661,7 @@ export const migrateCommand = defineCommand({
 			json: args.json,
 			expectedTargetFingerprint: args["expected-target-fingerprint"],
 			releaseLock: args["release-lock"],
+			takeOverLock: args["take-over-lock"],
 			database: args.database,
 			databaseUrlEnv: args["database-url-env"],
 			d1: args.d1,

package/src/cli/commands/seed.ts

@@ -17,6 +17,7 @@ import { claimExplicitSeedOwnership } from "../../seed/ownership.js";
 import type { SeedFile, SeedApplyOptions } from "../../seed/types.js";
 import { validateSeed } from "../../seed/validate.js";
 import { LocalStorage } from "../../storage/local.js";
+import type { Storage } from "../../storage/types.js";
 
 interface PackageJson {
 	name?: string;
@@ -128,6 +129,12 @@ export const seedCommand = defineCommand({
 			description: "Base URL for media files",
 			default: "/_emdash/api/media/file",
 		},
+		"skip-media": {
+			type: "boolean",
+			description:
+				"Resolve $media references to external URLs instead of downloading and storing files",
+			default: false,
+		},
 	},
 	async run({ args }) {
 		const cwd = resolve(args.cwd);
@@ -200,14 +207,16 @@ export const seedCommand = defineCommand({
 			process.exit(1);
 		}
 
-		// Set up storage for $media resolution
-		const uploadsDir = resolve(cwd, args["uploads-dir"]);
-		await mkdir(uploadsDir, { recursive: true });
-
-		const storage = new LocalStorage({
-			directory: uploadsDir,
-			baseUrl: args["media-base-url"],
-		});
+		// Set up storage for $media resolution unless media handling is skipped
+		let storage: Storage | undefined;
+		if (!args["skip-media"]) {
+			const uploadsDir = resolve(cwd, args["uploads-dir"]);
+			await mkdir(uploadsDir, { recursive: true });
+			storage = new LocalStorage({
+				directory: uploadsDir,
+				baseUrl: args["media-base-url"],
+			});
+		}
 
 		// Prepare apply options
 		const onConflictRaw = args["on-conflict"];
@@ -222,6 +231,7 @@ export const seedCommand = defineCommand({
 			includeContent: args.content,
 			onConflict: onConflictRaw,
 			storage,
+			skipMediaDownload: args["skip-media"],
 		};
 
 		// Apply seed

package/src/cli/wxr/parser.ts

@@ -863,8 +863,8 @@ export function parseWxrString(xml: string): Promise<WxrData> {
 			const tag = tagName.toLowerCase();
 			const text = currentText.trim();
 
-			// Site metadata
-			if (currentPath.length === 2 && currentPath[0] === "rss") {
+			// Site metadata: the closing tag is still on the path (rss > channel > tag)
+			if (currentPath.length === 3 && currentPath[1] === "channel") {
 				switch (tag) {
 					case "title":
 						data.site.title = text;

package/src/client/index.ts

@@ -652,7 +652,12 @@ export class EmDashClient {
 		if (col.fields) {
 			this.fieldSchemaCache.set(
 				slug,
-				col.fields.map((f) => ({ slug: f.slug, type: f.type, blockTypes: f.blockTypes })),
+				col.fields.map((field) => ({
+					slug: field.slug,
+					type: field.type,
+					blockTypes: field.blockTypes,
+					validation: field.validation,
+				})),
 			);
 		}
 		return col;
@@ -1648,7 +1653,12 @@ export class EmDashClient {
 
 		try {
 			const col = await this.collection(collection);
-			cached = col.fields.map((f) => ({ slug: f.slug, type: f.type, blockTypes: f.blockTypes }));
+			cached = col.fields.map((field) => ({
+				slug: field.slug,
+				type: field.type,
+				blockTypes: field.blockTypes,
+				validation: field.validation,
+			}));
 			this.fieldSchemaCache.set(collection, cached);
 			return cached;
 		} catch {