emdash 1.2.0 → 1.3.0

package/src/migrations/direct-executor.ts

@@ -1,6 +1,10 @@
 import { type Dialect, Kysely } from "kysely";
 
-import { clearMigrationLock, readMigrationLock } from "../database/migration-lock.js";
+import {
+	armMigrationLockTakeOver,
+	clearMigrationLock,
+	readMigrationLock,
+} from "../database/migration-lock.js";
 import {
 	getExactMigrationStatus,
 	runMigrations,
@@ -45,25 +49,47 @@ function createReport(
 	return report;
 }
 
-async function releaseLock(db: Kysely<Database>, lockId: string | undefined): Promise<void> {
+function confirmedLockId(lockId: string | undefined): number {
 	if (!lockId || !LOCK_ID_PATTERN.test(lockId)) {
-		throw new Error("Releasing the migration lock requires the lock id reported by status.");
+		throw new Error("The migration lock id must be the one reported by status.");
 	}
-	const lock = Number(lockId);
-	// Read before writing: on Postgres the lock column is a 32-bit integer that
-	// a lock id does not fit, and no Postgres lock is ever held in it.
-	const heldSince = await readMigrationLock(db);
-	if (heldSince === lock && (await clearMigrationLock(db, lock))) return;
-	const current = heldSince === lock ? await readMigrationLock(db) : heldSince;
+	return Number(lockId);
+}
+
+function lockMismatchError(current: number | null): Error {
 	// No lock ids here: the CLI's redaction can rewrite digits that match an
 	// environment value.
-	throw new Error(
+	return new Error(
 		current === null
 			? "The migration lock is not held."
-			: "The migration lock has a different id now. Check the status again before releasing it.",
+			: "The migration lock has a different id now. Check the status again.",
 	);
 }
 
+async function releaseLock(db: Kysely<Database>, lockId: string | undefined): Promise<void> {
+	const lock = confirmedLockId(lockId);
+	// Read before writing: on Postgres the lock column is a 32-bit integer that
+	// a lock id does not fit, and no Postgres lock is ever held in it.
+	const heldSince = await readMigrationLock(db);
+	if (heldSince === lock && (await clearMigrationLock(db, lock))) return;
+	throw lockMismatchError(heldSince === lock ? await readMigrationLock(db) : heldSince);
+}
+
+async function takeOverLock(
+	db: Kysely<Database>,
+	lockId: string | undefined,
+	pending: boolean,
+): Promise<void> {
+	const lock = confirmedLockId(lockId);
+	// With nothing pending no run takes the lock, so releasing it is enough.
+	if (!pending) return releaseLock(db, lockId);
+	const heldSince = await readMigrationLock(db);
+	if (heldSince !== lock) throw lockMismatchError(heldSince);
+	// No run on this database takes the lock in its row, so nothing can claim
+	// it between the release and this run.
+	if (!armMigrationLockTakeOver(db, lock)) await releaseLock(db, lockId);
+}
+
 async function verifyRequest(request: MigrationRequest): Promise<void> {
 	const identity = await getCoreMigrationIdentity();
 	if (
@@ -95,6 +121,9 @@ async function executeRequest(
 			`Cannot apply migrations with unknown applied migrations: ${initialStatus.unknownApplied.join(", ")}`,
 		);
 	}
+	if (request.action === "take-over-lock") {
+		await takeOverLock(db, request.lockId, initialStatus.pending.length > 0);
+	}
 	if (initialStatus.pending.length === 0) {
 		return createReport(target, initialStatus, []);
 	}
@@ -133,7 +162,8 @@ export function createDirectMigrationExecutor(
 			if (
 				request.action !== "check" &&
 				request.action !== "apply" &&
-				request.action !== "release-lock"
+				request.action !== "release-lock" &&
+				request.action !== "take-over-lock"
 			) {
 				throw new Error("Unsupported migration action.");
 			}

package/src/migrations/protocol.ts

@@ -1,6 +1,6 @@
 import type { I18nConfig } from "../i18n/config.js";
 
-export type MigrationAction = "check" | "apply" | "release-lock";
+export type MigrationAction = "check" | "apply" | "release-lock" | "take-over-lock";
 
 export interface MigrationRequest {
 	action: MigrationAction;
@@ -9,7 +9,11 @@ export interface MigrationRequest {
 		emdashVersion: string;
 		migrationSetFingerprint: string;
 	};
-	/** For `release-lock`: the lock id a `check` reported. Another lock is left alone. */
+	/**
+	 * For `release-lock` and `take-over-lock`: the lock id a `check` reported.
+	 * Another lock is left alone. `take-over-lock` applies pending migrations
+	 * under that lock without freeing it first.
+	 */
 	lockId?: string;
 }
 

package/src/plugins/adapt-sandbox-entry.ts

@@ -13,6 +13,7 @@
 import { z } from "zod";
 
 import type { PluginDescriptor } from "../astro/integration/runtime.js";
+import { safeJsonSchemaToZod } from "../mcp/json-schema.js";
 import type { RouteEntry, RouteHandler, SandboxedPlugin } from "../plugin-types.js";
 import { PLUGIN_CAPABILITIES, HOOK_NAMES } from "./manifest-schema.js";
 import { sanitizeHeadersForSandbox } from "./request-meta.js";
@@ -355,7 +356,10 @@ export function adaptSandboxEntry(
 				// `emdash-plugin build` removes `mcp` from the runtime module and
 				// ships the tools in the descriptor instead.
 				...Object.fromEntries(
-					(descriptor.mcp?.tools ?? []).map((tool) => [tool.name, toolFromManifest(tool)]),
+					(descriptor.mcp?.tools ?? []).map((tool) => [
+						tool.name,
+						toolFromManifest(tool, pluginId),
+					]),
 				),
 				...Object.fromEntries(
 					Object.entries(definition.mcp?.tools ?? {}).map(([name, tool]) => [
@@ -380,21 +384,27 @@ export function adaptSandboxEntry(
  * on first use: turning JSON Schema back into Zod takes milliseconds per
  * tool, and this adapter runs on every cold start, public requests included.
  */
-function toolFromManifest(tool: ManifestMcpTool): PluginMcpToolDefinition {
+function toolFromManifest(tool: ManifestMcpTool, pluginId: string): PluginMcpToolDefinition {
 	let input: z.ZodType | undefined;
-	let output: z.ZodType | undefined;
+	let output: z.ZodType | null | undefined;
 	return {
 		description: tool.description,
 		route: tool.route,
 		destructive: tool.destructive,
 		get input() {
-			input ??= z.fromJSONSchema({ ...tool.inputSchema });
+			input ??=
+				safeJsonSchemaToZod({ ...tool.inputSchema }, `${pluginId}/${tool.name}`, "input") ??
+				z.record(z.string(), z.unknown());
 			return input;
 		},
 		get output() {
 			if (!tool.outputSchema) return undefined;
-			output ??= z.fromJSONSchema({ ...tool.outputSchema });
-			return output;
+			if (output === undefined) {
+				output =
+					safeJsonSchemaToZod({ ...tool.outputSchema }, `${pluginId}/${tool.name}`, "output") ??
+					null;
+			}
+			return output ?? undefined;
 		},
 	};
 }

package/src/plugins/state.ts

@@ -298,14 +298,11 @@ export class PluginStateRepository {
 }
 
 /**
- * Internal: map a `_plugin_state` row to the public `PluginState` shape.
- *
- * Kept at module scope so the three select paths (`get`, `getAll`,
- * `getMarketplacePlugins`, `getRegistryPlugins`) stay byte-identical in
- * their handling of nullable columns -- adding a new column to the table
- * means changing this function and nothing else.
+ * Map a `_plugin_state` row to the public `PluginState` shape. Every read
+ * path uses this, so adding a column to the table means changing this
+ * function and nothing else.
  */
-interface PluginStateRow {
+export interface PluginStateRow {
 	plugin_id: string;
 	status: string;
 	version: string;
@@ -322,7 +319,7 @@ interface PluginStateRow {
 	mcp_tools_consent: string | null;
 }
 
-function rowToPluginState(row: PluginStateRow): PluginState {
+export function rowToPluginState(row: PluginStateRow): PluginState {
 	return {
 		pluginId: row.plugin_id,
 		status: toPluginStatus(row.status),

package/src/query.ts

@@ -426,19 +426,57 @@ export function getEditMeta(value: unknown): EditFieldMeta | undefined {
 	return undefined;
 }
 
+/** Slugs of a collection's Portable Text fields; empty when they can't be read. */
+function getPortableTextFieldSlugs(collection: string): Promise<ReadonlySet<string>> {
+	return requestCached(`portable-text-fields:${collection}`, async () => {
+		try {
+			const { getDb } = await import("./loader.js");
+			const db = await getDb();
+			const rows = await db
+				.selectFrom("_emdash_fields as f")
+				.innerJoin("_emdash_collections as c", "c.id", "f.collection_id")
+				.select("f.slug")
+				.where("c.slug", "=", collection)
+				.where("f.type", "=", "portableText")
+				.execute();
+			return new Set(rows.map((row) => row.slug));
+		} catch (error) {
+			if (!isMissingTableError(error)) {
+				const msg = error instanceof Error ? error.message : String(error);
+				console.warn("[emdash] Failed to load Portable Text fields:", msg);
+			}
+			return new Set<string>();
+		}
+	});
+}
+
 /**
  * Tag PT-like arrays in entry data with edit metadata (non-enumerable).
  * A PT array is identified by: is an array, first element has _type property.
+ * An empty one is identified by its field being in `portableTextFields`, and
+ * a missing or blank one becomes an empty array, so the page can still render
+ * an editor for it.
  */
-function tagEditableFields(data: Record<string, unknown>, collection: string, id: string): void {
+function tagEditableFields(
+	data: Record<string, unknown>,
+	collection: string,
+	id: string,
+	portableTextFields: ReadonlySet<string> = new Set(),
+): void {
+	for (const field of portableTextFields) {
+		const value = data[field];
+		if (value == null || (typeof value === "string" && !value.trim())) {
+			data[field] = [];
+		}
+	}
 	for (const [field, value] of Object.entries(data)) {
-		if (
-			Array.isArray(value) &&
-			value.length > 0 &&
-			value[0] &&
-			typeof value[0] === "object" &&
-			"_type" in value[0]
-		) {
+		if (!Array.isArray(value)) continue;
+		const first: unknown = value[0];
+		const isPortableText =
+			value.length === 0
+				? portableTextFields.has(field)
+				: typeof first === "object" && first !== null && "_type" in first;
+		if (isPortableText) {
 			Object.defineProperty(value, EMDASH_EDIT, {
 				value: { collection, id, field } satisfies EditFieldMeta,
 				enumerable: false,
@@ -939,10 +977,12 @@ async function getEmDashCollectionUncached<T extends string, D = InferCollection
 	const hasMoreResult = requestedLimit != null && requestedLimit > 0 ? hasMore : undefined;
 
 	const isEditMode = ctx?.editMode ?? false;
+	const portableTextFields =
+		isEditMode && pageEntries.length > 0 ? await getPortableTextFieldSlugs(type) : undefined;
 	const entriesWithEdit = pageEntries.map((entry: ContentEntry<D>) => {
 		const dbId = entryDatabaseId(entry);
 		if (isEditMode) {
-			tagEditableFields(entryData(entry), type, dbId);
+			tagEditableFields(entryData(entry), type, dbId, portableTextFields);
 		}
 		if (!canExposeRevisionMetadata(entry, type)) {
 			stripRevisionMetadata(entry);
@@ -1159,12 +1199,13 @@ async function resolveEmDashEntry<T extends string, D = InferCollectionData<T>>(
 	// Resolve locale: explicit option > ALS context > undefined (no filter)
 	const requestedLocale = options?.locale ?? ctx?.locale;
 	const references = options?.references;
+	const portableTextFields = isEditMode ? await getPortableTextFieldSlugs(type) : undefined;
 
 	/** Wrap a raw Astro entry with edit proxy, tagging editable fields if needed */
 	function wrapEntry(raw: ContentEntry<D>): ContentEntry<D> {
 		const dbId = entryDatabaseId(raw);
 		if (isEditMode) {
-			tagEditableFields(entryData(raw), type, dbId);
+			tagEditableFields(entryData(raw), type, dbId, portableTextFields);
 		}
 		return {
 			...raw,

package/src/redirects/cache.ts

@@ -9,7 +9,8 @@
  * A cold isolate loads the rules from its source and waits for them. Once
  * warm, requests never wait: an expired cache keeps serving while one
  * background revalidation asks the source whether the loaded version is still
- * current and reloads only when it is not.
+ * current and reloads only when it is not. A caller that must not act on stale
+ * rules asks for them to be verified, and waits for that check.
  *
  * This module deliberately has NO Astro imports so it can be safely imported
  * from handlers, seed, CLI, and tests without dragging in `astro:middleware`.
@@ -147,9 +148,40 @@ function revalidateInBackground(source: RedirectSource, cached: CachedRedirects)
 	});
 }
 
-export async function loadCachedRedirects(source: RedirectSource): Promise<CachedRedirects> {
+export interface LoadCachedRedirectsOptions {
+	/**
+	 * Confirm the cached rules are current before returning them, reloading
+	 * them when they are not, instead of revalidating in the background. If the
+	 * check fails, the cached rules are returned.
+	 */
+	verify?: boolean;
+}
+
+export async function loadCachedRedirects(
+	source: RedirectSource,
+	options: LoadCachedRedirectsOptions = {},
+): Promise<CachedRedirects> {
+	let verify = options.verify === true;
 	for (let attempt = 0; attempt < REDIRECT_CACHE_MAX_REFRESH_ATTEMPTS; attempt++) {
 		const cached = cacheState.redirects;
+		if (cached && verify) {
+			verify = false;
+			let current: boolean;
+			try {
+				current = cached.version !== null && (await source.isCurrent(cached.version));
+			} catch (error) {
+				console.error("[emdash:redirects] checking redirects are current failed:", error);
+				return cached;
+			}
+			if (current) {
+				if (cacheState.redirects === cached) {
+					cacheState.expiresAt = Date.now() + REDIRECT_CACHE_TTL_MS;
+				}
+				return cached;
+			}
+			if (cacheState.redirects === cached) invalidateRedirectCache();
+			continue;
+		}
 		if (cached) {
 			if (Date.now() >= cacheState.expiresAt) revalidateInBackground(source, cached);
 			return cached;

package/src/schema/block-values.ts

@@ -141,6 +141,21 @@ function existingByKey(value: unknown, path: string): Map<string, Record<string,
 	return result;
 }
 
+function inferredBlockType(
+	field: Field,
+	block: Record<string, unknown>,
+	previous: Record<string, unknown> | undefined,
+	options: BlockWriteOptions,
+): unknown {
+	const allowedTypes = field.validation?.allowedTypes ?? [];
+	return block._type === undefined &&
+		!options.restoreBlocks &&
+		allowedTypes.length === 1 &&
+		(!previous || previous._type === allowedTypes[0])
+		? allowedTypes[0]
+		: block._type;
+}
+
 function normalizeBlockArray(
 	field: Field,
 	value: unknown,
@@ -174,7 +189,9 @@ function normalizeBlockArray(
 	return value.map((rawBlock, index) => {
 		const blockPath = `${path}[${index}]`;
 		if (!isRecord(rawBlock)) validationError(blockPath, "must be an object");
-		if (typeof rawBlock._type !== "string" || rawBlock._type.length === 0) {
+		const previous = typeof rawBlock._key === "string" ? existing.get(rawBlock._key) : undefined;
+		const blockTypeSlug = inferredBlockType(field, rawBlock, previous, options);
+		if (typeof blockTypeSlug !== "string" || blockTypeSlug.length === 0) {
 			validationError(`${blockPath}._type`, "must be a block type slug");
 		}
 		if (
@@ -192,19 +209,18 @@ function normalizeBlockArray(
 			validationError(`${blockPath}._key`, "must be a non-empty string");
 		}
 
-		const previous = typeof rawBlock._key === "string" ? existing.get(rawBlock._key) : undefined;
-		const type = types.get(rawBlock._type);
-		if (!type) unsupported(`${blockPath}._type`, `block type "${rawBlock._type}" is unavailable`);
+		const type = types.get(blockTypeSlug);
+		if (!type) unsupported(`${blockPath}._type`, `block type "${blockTypeSlug}" is unavailable`);
 		if (previous) {
-			if (previous._type !== rawBlock._type) {
+			if (previous._type !== blockTypeSlug) {
 				validationError(`${blockPath}._type`, "cannot change an existing block's type");
 			}
 		} else if (
-			!allowed.has(rawBlock._type) &&
-			!(options.restoreBlocks && retired.has(rawBlock._type))
+			!allowed.has(blockTypeSlug) &&
+			!(options.restoreBlocks && retired.has(blockTypeSlug))
 		) {
-			const reason = retired.has(rawBlock._type) ? "is retired" : "is not allowed by this field";
-			validationError(`${blockPath}._type`, `block type "${rawBlock._type}" ${reason}`);
+			const reason = retired.has(blockTypeSlug) ? "is retired" : "is not allowed by this field";
+			validationError(`${blockPath}._type`, `block type "${blockTypeSlug}" ${reason}`);
 		}
 
 		let version: number;
@@ -234,7 +250,7 @@ function normalizeBlockArray(
 		const definition = versionFor(type, version, `${blockPath}._version`);
 		const normalized: Record<string, unknown> = {
 			...rawBlock,
-			_type: rawBlock._type,
+			_type: blockTypeSlug,
 			_version: version,
 			_key: key,
 		};
@@ -258,7 +274,7 @@ function normalizeBlockArray(
 		}
 		return {
 			...normalized,
-			_type: rawBlock._type,
+			_type: blockTypeSlug,
 			_version: version,
 			_key: key,
 		};
@@ -274,16 +290,24 @@ export async function normalizeBlocksData(
 	partial = true,
 	resolvedTypes?: ResolvedBlockTypes,
 ): Promise<Record<string, unknown>> {
-	const blockFields = collection.fields.filter(
-		(field) => field.type === "blocks" && (!partial || Object.hasOwn(data, field.slug)),
-	);
-	if (blockFields.length === 0) return data;
-	const types = resolvedTypes ?? (await resolveBlockTypes(db));
 	const normalized = { ...data };
+	const blockFields: Field[] = [];
+	for (const field of collection.fields) {
+		if (field.type !== "blocks") continue;
+		// Left in place, an undefined value would replace the stored blocks in the
+		// draft merge and reach the column write as NULL.
+		if (partial && data[field.slug] === undefined) {
+			delete normalized[field.slug];
+		} else {
+			blockFields.push(field);
+		}
+	}
+	if (blockFields.length === 0) return normalized;
+	const types = resolvedTypes ?? (await resolveBlockTypes(db));
 	for (const field of blockFields) {
 		normalized[field.slug] = normalizeBlockArray(
 			field,
-			Object.hasOwn(data, field.slug) ? data[field.slug] : [],
+			data[field.slug] === undefined ? [] : data[field.slug],
 			existingData[field.slug],
 			types,
 			options,
@@ -291,3 +315,42 @@ export async function normalizeBlocksData(
 	}
 	return normalized;
 }
+
+/**
+ * Fill in the `_type` an ordinary write infers for blocks that omit it, so
+ * `content:beforeSave` hooks see the type the block will be stored with.
+ * `loadExistingData` is only called when some block omits `_type`.
+ */
+export async function inferBlockTypes(
+	collection: CollectionWithFields,
+	data: Record<string, unknown>,
+	loadExistingData: () => Promise<Record<string, unknown> | undefined>,
+): Promise<Record<string, unknown>> {
+	const untyped = collection.fields.flatMap((field) => {
+		const value = data[field.slug];
+		return field.type === "blocks" &&
+			Array.isArray(value) &&
+			value.some((block) => isRecord(block) && block._type === undefined)
+			? [{ field, value }]
+			: [];
+	});
+	if (untyped.length === 0) return data;
+	const existingData = (await loadExistingData()) ?? {};
+	const inferred = { ...data };
+	for (const { field, value } of untyped) {
+		const stored = existingData[field.slug];
+		inferred[field.slug] = value.map((block: unknown) => {
+			if (!isRecord(block)) return block;
+			const previous =
+				Array.isArray(stored) && typeof block._key === "string"
+					? stored.find(
+							(candidate: unknown): candidate is Record<string, unknown> =>
+								isRecord(candidate) && candidate._key === block._key,
+						)
+					: undefined;
+			const type = inferredBlockType(field, block, previous, {});
+			return type === block._type ? block : { ...block, _type: type };
+		});
+	}
+	return inferred;
+}

package/src/schema/registry.ts

@@ -10,6 +10,7 @@ import { sql } from "kysely";
 import { ulid } from "ulidx";
 
 import { refreshDevTypes } from "../astro/dev-typegen.js";
+import { deleteSharedCollectionRecords } from "../database/collection-cleanup.js";
 import {
 	columnExists,
 	currentTimestamp,
@@ -1211,11 +1212,18 @@ export class SchemaRegistry {
 				const ftsManager = new FTSManager(trx);
 				await ftsManager.dropFtsTable(slug);
 
-				// Drop the content table
+				// Drop the content table first: ec_* rows hold foreign keys to
+				// revisions.id, so the content table must go before revisions can
+				// be removed.
 				const tableName = this.getTableName(slug);
 				await sql`DROP TABLE IF EXISTS ${sql.ref(tableName)}`.execute(trx);
 				contentTableDropped = true;
 
+				// Remove shared-table records that are keyed by collection slug.
+				// Dropping the content table or deleting the collection row does not
+				// cascade to these, so they have to be cleared explicitly.
+				await deleteSharedCollectionRecords(trx, slug);
+
 				// Delete the collection record (fields will cascade)
 				await trx.deleteFrom("_emdash_collections").where("id", "=", existing.id).execute();
 			});

package/src/search/query.ts

@@ -63,7 +63,9 @@ function decodeSearchOffset(cursor: string): number {
 
 /** Pattern to split on whitespace for query term extraction */
 const WHITESPACE_SPLIT_PATTERN = /\s+/;
-const FTS_OPERATORS_PATTERN = /\b(AND|OR|NOT|NEAR)\b/i;
+// FTS5 operators are uppercase-only; a case-insensitive match would treat
+// ordinary words as syntax and skip the safe quoting path below.
+const FTS_OPERATORS_PATTERN = /\b(AND|OR|NOT|NEAR)\b/;
 const DOUBLE_QUOTE_PATTERN = /"/g;
 
 /**

package/src/seed/apply.ts

@@ -50,6 +50,7 @@ import { invalidateSiteSettingsCache, setSiteSettings } from "../settings/index.
 import type { SiteSettings } from "../settings/types.js";
 import type { Storage } from "../storage/types.js";
 import { chunks, SQL_BATCH_SIZE } from "../utils/chunks.js";
+import { computeContentHash } from "../utils/hash.js";
 import type {
 	SeedFile,
 	SeedField,
@@ -206,8 +207,9 @@ export interface SeedApplyProgress {
  * the platform's. A call that stops returns `complete: false`; applying the
  * same seed again continues with the first item not yet created. A call
  * creates at least one item before it stops, so repeated calls finish. A
- * `$media` URL used by entries in different calls is downloaded and stored
- * again, as a new media row, in each of those calls. Requires
+ * `$media` URL used by entries in different calls is still downloaded each time
+ * so its content hash can be computed, but the resulting media row is reused
+ * when an existing ready row has the same hash. Requires
  * `onConflict: "skip"`.
  */
 export async function applySeedWithinBudget(
@@ -2324,7 +2326,7 @@ async function resolveMedia(
 			filename: filename ?? undefined,
 		};
 		ctx.mediaCache.set(url, mediaValue);
-		result.media.created++;
+		result.media.skipped++;
 		return mediaValue;
 	}
 
@@ -2359,15 +2361,37 @@ async function resolveMedia(
 		const contentType = response.headers.get("content-type") || "application/octet-stream";
 		const ext = getExtensionFromContentType(contentType) || getExtensionFromUrl(url) || ".bin";
 
+		// Get the body as buffer
+		const arrayBuffer = await response.arrayBuffer();
+		const body = new Uint8Array(arrayBuffer);
+
+		// Deduplicate by content hash so re-running a seed does not mint a
+		// fresh media row for a file that already exists in the library.
+		const contentHash = await computeContentHash(body);
+		const mediaRepo = new MediaRepository(ctx.db);
+		const existing = await mediaRepo.findByContentHash(contentHash);
+		if (existing) {
+			const mediaValue: MediaValue = {
+				provider: "local",
+				id: existing.id,
+				alt: alt ?? existing.alt ?? undefined,
+				width: existing.width ?? undefined,
+				height: existing.height ?? undefined,
+				mimeType: existing.mimeType,
+				filename: existing.filename,
+				meta: { storageKey: existing.storageKey },
+			};
+			ctx.mediaCache.set(url, mediaValue);
+			result.media.skipped++;
+			console.log(`  ✅ Reused: ${existing.filename}`);
+			return mediaValue;
+		}
+
 		// Generate filename and storage key
 		const storageId = ulid();
 		const finalFilename = filename || generateFilename(url, ext);
 		const storageKey = `${storageId}${ext}`;
 
-		// Get the body as buffer
-		const arrayBuffer = await response.arrayBuffer();
-		const body = new Uint8Array(arrayBuffer);
-
 		// Get image dimensions if it's an image
 		let width: number | undefined;
 		let height: number | undefined;
@@ -2385,7 +2409,6 @@ async function resolveMedia(
 		});
 
 		// Create media record
-		const mediaRepo = new MediaRepository(ctx.db);
 		const media = await mediaRepo.create({
 			filename: finalFilename,
 			mimeType: contentType,
@@ -2395,6 +2418,7 @@ async function resolveMedia(
 			alt,
 			caption,
 			storageKey,
+			contentHash,
 			status: "ready",
 		});
 

package/src/settings/index.ts

@@ -24,6 +24,8 @@ import {
 } from "../plugins/settings.js";
 import type { CacheHint } from "../query.js";
 import { peekRequestCache, requestCached } from "../request-cache.js";
+import { bumpRunningExportWriteEpochs } from "../transfer/fence.js";
+import { isMissingTableError } from "../utils/db-errors.js";
 
 /** Object-cache namespace for site settings. */
 const SETTINGS_CACHE_NAMESPACE = "settings";
@@ -375,6 +377,10 @@ export async function setSiteSettings(
 		else updates[`${SETTINGS_PREFIX}${key}`] = value;
 	}
 
+	if (Object.keys(updates).length === 0 && deletions.length === 0 && nestedPatches.length === 0) {
+		return;
+	}
+
 	try {
 		await withTransaction(db, async (trx) => {
 			const transactionOptions = new OptionsRepository(trx);
@@ -391,6 +397,20 @@ export async function setSiteSettings(
 				if (Object.keys(next).length === 0) await transactionOptions.delete(optionName);
 				else await transactionOptions.set(optionName, next);
 			}
+
+			// A running export detects writes to tables without updated_at via
+			// the operation's write_epoch. Record that bump in the same
+			// transaction so the settings update is not accepted unless the
+			// export fence can see it. When the transfer system has not been
+			// installed yet (pre-migration, or a minimal seed fixture), there
+			// is no running export to notify, so the absence of its table is
+			// not a reason to reject the settings update.
+			try {
+				await bumpRunningExportWriteEpochs(trx);
+			} catch (error) {
+				if (isMissingTableError(error)) return;
+				throw error;
+			}
 		});
 	} finally {
 		invalidateSiteSettingsCache();

package/src/settings/types.ts

@@ -44,6 +44,8 @@ export interface SeoSettings {
 	defaultOgImage?: MediaReference;
 	/** Custom robots.txt content. If unset, a default is generated. */
 	robotsTxt?: string;
+	/** Add rules to robots.txt that ask AI crawlers not to use the site for training. */
+	disallowAiTraining?: boolean;
 	/** Google Search Console verification meta tag content */
 	googleVerification?: string;
 	/** Bing Webmaster Tools verification meta tag content */