emdash 1.3.0 → 1.4.0

package/src/api/handlers/dashboard.ts

@@ -47,8 +47,10 @@ export interface RecentItem {
 
 export interface DashboardStats {
 	collections: CollectionStats[];
-	mediaCount: number;
-	userCount: number;
+	/** Omitted for callers without `media:read`. */
+	mediaCount?: number;
+	/** Omitted for callers without `users:read`. */
+	userCount?: number;
 	recentItems: RecentItem[];
 	schedulerHealth: SchedulerHealth;
 	policyRejectedScheduled: number;
@@ -65,11 +67,16 @@ const POLICY_REJECTION_PREVIEW_LIMIT = 20;
  *
  * Without `includeDrafts` (callers lacking `content:read_drafts`), only
  * published entries are counted or listed, and scheduled-publication policy
- * rejections are omitted.
+ * rejections are omitted. Without `includeMediaCount` / `includeUserCount`,
+ * `mediaCount` / `userCount` are omitted.
  */
 export async function handleDashboardStats(
 	db: Kysely<Database>,
-	{ includeDrafts }: { includeDrafts: boolean },
+	{
+		includeDrafts,
+		includeMediaCount,
+		includeUserCount,
+	}: { includeDrafts: boolean; includeMediaCount: boolean; includeUserCount: boolean },
 	now = new Date(),
 ): Promise<ApiResult<DashboardStats>> {
 	try {
@@ -119,8 +126,8 @@ export async function handleDashboardStats(
 			policyRejectedScheduled,
 			versionedPolicyRejectionOptions,
 		] = await Promise.all([
-			mediaRepo.count(),
-			userRepo.count(),
+			includeMediaCount ? mediaRepo.count() : undefined,
+			includeUserCount ? userRepo.count() : undefined,
 			getSchedulerHealth(db, now),
 			includeDrafts ? optionsRepo.countByPrefix(SCHEDULED_POLICY_REJECTION_PREFIX) : 0,
 			includeDrafts

package/src/api/handlers/device-flow.ts

@@ -15,6 +15,7 @@ import { generateCodeVerifier } from "arctic";
 import type { Kysely, Selectable } from "kysely";
 
 import {
+	ACCESS_TOKEN_TTL_SECONDS,
 	generatePrefixedToken,
 	hashApiToken,
 	isValidScope,
@@ -42,9 +43,6 @@ const SLOW_DOWN_INCREMENT = 5;
 /** Maximum slow_down interval cap (seconds) */
 const MAX_SLOW_DOWN_INTERVAL = 60;
 
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
-
 /** Refresh token TTL: 90 days */
 const REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
 

package/src/api/handlers/menus.ts

@@ -15,6 +15,7 @@ import type { Kysely } from "kysely";
 
 import {
 	MenuGoneError,
+	MenuItemParentError,
 	MenuRepository,
 	type CreateMenuItemInput as CreateMenuItemRepoInput,
 	type Menu,
@@ -25,7 +26,7 @@ import {
 	type UpdateMenuItemInput as UpdateMenuItemRepoInput,
 } from "../../database/repositories/menu.js";
 import type { Database } from "../../database/types.js";
-import { getI18nConfig, resolveConfiguredLocale } from "../../i18n/config.js";
+import { getI18nConfig, getLocaleRank, resolveConfiguredLocale } from "../../i18n/config.js";
 import type { ApiResult } from "../types.js";
 
 // Re-export entity types so route files and tests can import them from the
@@ -100,16 +101,20 @@ async function resolveMenu(
 			},
 		};
 	}
-	if (matches.length > 1) {
+	const canonicalLocales = new Set(matches.map((match) => resolveConfiguredLocale(match.locale)));
+	if (locale === undefined && canonicalLocales.size > 1) {
 		return {
 			success: false,
-			error: ambiguousMenuLocaleError(
-				name,
-				matches.map((m) => m.locale),
-			).error,
+			error: ambiguousMenuLocaleError(name, [...canonicalLocales]).error,
 		};
 	}
-	return { success: true, menu: matches[0] };
+	const preferredLocale = locale ?? resolveConfiguredLocale(matches[0].locale);
+	const menu = matches.toSorted(
+		(a, b) =>
+			getLocaleRank(a.locale, preferredLocale) - getLocaleRank(b.locale, preferredLocale) ||
+			a.id.localeCompare(b.id),
+	)[0];
+	return { success: true, menu };
 }
 
 // ---------------------------------------------------------------------------
@@ -369,7 +374,10 @@ export async function handleMenuItemCreate(
 
 		const item = await repo.createItem(resolved.menu.id, resolved.menu.locale, input);
 		return { success: true, data: item };
-	} catch {
+	} catch (error) {
+		if (error instanceof MenuItemParentError) {
+			return { success: false, error: { code: "VALIDATION_ERROR", message: error.message } };
+		}
 		return {
 			success: false,
 			error: { code: "MENU_ITEM_CREATE_ERROR", message: "Failed to create menu item" },
@@ -400,7 +408,10 @@ export async function handleMenuItemUpdate(
 			};
 		}
 		return { success: true, data: updated };
-	} catch {
+	} catch (error) {
+		if (error instanceof MenuItemParentError) {
+			return { success: false, error: { code: "VALIDATION_ERROR", message: error.message } };
+		}
 		return {
 			success: false,
 			error: { code: "MENU_ITEM_UPDATE_ERROR", message: "Failed to update menu item" },
@@ -488,9 +499,9 @@ export async function handleMenuSetItems(
 		const { itemCount } = await repo.setItems(resolved.menu.id, resolved.menu.locale, items);
 		return { success: true, data: { name: menuName, itemCount } };
 	} catch (error) {
-		// `MenuGoneError` is thrown from inside the repository transaction
-		// when the menu was deleted concurrently between `resolveMenu` and the
-		// setItems write. Returning NOT_FOUND mirrors the original handler's
+		// `MenuGoneError` is thrown by the repository when the menu was
+		// deleted concurrently between `resolveMenu` and the setItems
+		// write. Returning NOT_FOUND mirrors the original handler's
 		// in-transaction `notFoundSentinel` branch and keeps the response
 		// shape stable for REST/MCP callers.
 		if (error instanceof MenuGoneError) {
@@ -528,7 +539,10 @@ export async function handleMenuItemReorder(
 
 		const updated = await repo.reorderItems(resolved.menu.id, items);
 		return { success: true, data: updated };
-	} catch {
+	} catch (error) {
+		if (error instanceof MenuItemParentError) {
+			return { success: false, error: { code: "VALIDATION_ERROR", message: error.message } };
+		}
 		return {
 			success: false,
 			error: { code: "MENU_REORDER_ERROR", message: "Failed to reorder menu items" },

package/src/api/handlers/oauth-authorization.ts

@@ -14,6 +14,7 @@ import { generateCodeVerifier } from "arctic";
 import type { Kysely } from "kysely";
 
 import {
+	ACCESS_TOKEN_TTL_SECONDS,
 	generatePrefixedToken,
 	hashApiToken,
 	isValidScope,
@@ -33,9 +34,6 @@ import { lookupUserRoleAndStatus } from "./oauth-user-lookup.js";
 /** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */
 const AUTH_CODE_TTL_SECONDS = 10 * 60;
 
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
-
 /** Refresh token TTL: 90 days */
 const REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
 

package/src/api/handlers/relations.ts

@@ -13,6 +13,7 @@ import { InvalidCursorError } from "../../database/repositories/types.js";
 import type { ContentItem } from "../../database/repositories/types.js";
 import { withTransaction } from "../../database/transaction.js";
 import type { Database } from "../../database/types.js";
+import { getLocaleCandidates, getLocaleRank } from "../../i18n/config.js";
 import { invalidateCollectionCache } from "../../object-cache/index.js";
 import {
 	pageStagedGroups,
@@ -378,7 +379,20 @@ async function resolveRelation(
  * `locale` so callers never mistake a fallback for the requested locale.
  */
 function pickVariant(items: ContentItem[], locale: string | null): ContentItem | undefined {
-	return items.find((i) => i.locale === locale) ?? items[0];
+	if (locale === null) return items[0];
+
+	const candidates = getLocaleCandidates(locale);
+	let best: ContentItem | undefined;
+	let bestRank = candidates.length;
+	for (const item of items) {
+		if (item.locale === null) continue;
+		const rank = getLocaleRank(item.locale, locale);
+		if (rank < bestRank) {
+			best = item;
+			bestRank = rank;
+		}
+	}
+	return best ?? items[0];
 }
 
 /**

package/src/api/handlers/taxonomies.ts

@@ -24,7 +24,8 @@ import {
 import { TaxonomyRepository, type SiblingPosition } from "../../database/repositories/taxonomy.js";
 import { withTransaction } from "../../database/transaction.js";
 import type { Database, TaxonomyDefTable } from "../../database/types.js";
-import { getI18nConfig, resolveConfiguredLocale } from "../../i18n/config.js";
+import { getI18nConfig, getLocaleChainRank, resolveConfiguredLocale } from "../../i18n/config.js";
+import { localeMatches } from "../../i18n/query.js";
 import { invalidateTaxonomyDefsCache, invalidateTermCache } from "../../taxonomies/index.js";
 import { fetchVisibleTermCounts } from "../../taxonomies/term-counts.js";
 import type { ApiResult } from "../types.js";
@@ -181,9 +182,11 @@ async function requireTaxonomyDef(
 	name: string,
 	locale?: string,
 ): Promise<TaxonomyDefLookup> {
-	let query = selectTaxonomyDefs(db).where("d.name", "=", name);
-	if (locale !== undefined) query = query.where("d.locale", "=", locale);
-	const def = await query.orderBy("d.locale", "asc").orderBy("d.id", "asc").executeTakeFirst();
+	const def = await selectTaxonomyDefs(db, locale)
+		.where("d.name", "=", name)
+		.orderBy("d.locale", "asc")
+		.orderBy("d.id", "asc")
+		.executeTakeFirst();
 	return def ? { success: true, def } : taxonomyDefNotFound(name, locale);
 }
 
@@ -196,16 +199,19 @@ async function requireTaxonomyDefWithFallback(
 	name: string,
 	locale?: string,
 ): Promise<TaxonomyDefLookup> {
-	const defs = await selectTaxonomyDefs(db)
-		.where("d.name", "=", name)
-		.orderBy("d.locale", "asc")
-		.orderBy("d.id", "asc")
-		.execute();
+	const defs = await selectTaxonomyDefs(db).where("d.name", "=", name).execute();
 	const defaultLocale = getI18nConfig()?.defaultLocale;
-	const def =
-		(locale ? defs.find((candidate) => candidate.locale === locale) : undefined) ??
-		(defaultLocale ? defs.find((candidate) => candidate.locale === defaultLocale) : undefined) ??
-		defs[0];
+	const chain = locale
+		? [locale, ...(defaultLocale && defaultLocale !== locale ? [defaultLocale] : [])]
+		: defaultLocale
+			? [defaultLocale]
+			: [];
+	const def = defs.toSorted(
+		(a, b) =>
+			getLocaleChainRank(a.locale, chain) - getLocaleChainRank(b.locale, chain) ||
+			a.locale.localeCompare(b.locale) ||
+			a.id.localeCompare(b.id),
+	)[0];
 	return def ? { success: true, def } : taxonomyDefNotFound(name, locale);
 }
 
@@ -298,8 +304,7 @@ export async function handleTaxonomyList(
 ): Promise<ApiResult<TaxonomyListResponse>> {
 	try {
 		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
-		let query = selectTaxonomyDefs(db);
-		if (locale !== undefined) query = query.where("d.locale", "=", locale);
+		const query = selectTaxonomyDefs(db, locale);
 		const [rows, collectionRows] = await Promise.all([
 			query.execute(),
 			db.selectFrom("_emdash_collections").select("slug").execute(),
@@ -418,7 +423,7 @@ export async function handleTaxonomyCreate(
 			.selectFrom("_emdash_taxonomy_defs")
 			.select("id")
 			.where("name", "=", input.name)
-			.where("locale", "=", locale)
+			.where(localeMatches("locale", locale))
 			.executeTakeFirst();
 		if (existing) {
 			return {
@@ -1019,7 +1024,12 @@ export async function handleTermCreate(
 			}
 			selfGroup = source.translationGroup ?? source.id;
 			const translations = await repo.findTranslations(selfGroup);
-			if (translations.some((translation) => translation.locale === locale)) {
+			if (
+				translations.some(
+					(translation) =>
+						resolveConfiguredLocale(translation.locale) === resolveConfiguredLocale(locale),
+				)
+			) {
 				return {
 					success: false,
 					error: {

package/src/astro/image-endpoint.ts

@@ -82,15 +82,26 @@ export const GET: APIRoute = async (ctx) => {
 	const service = await getConfiguredImageService();
 	if (!("transform" in service)) return genericGET(ctx);
 
+	// An unread download retains its storage connection even for a bodyless response.
+	let unusedBody: ReadableStream<Uint8Array> | undefined;
 	try {
 		const source = await storage.download(key);
+		unusedBody = source.body;
 
 		// Only raster images are transformable; serve anything else unchanged.
 		if (!source.contentType.startsWith("image/")) {
 			if (isNotModified(ctx.request, source.size, source.lastModified)) {
 				return notModifiedResponse(source.contentType, source.size, source.lastModified);
 			}
-			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
+			const response = streamOriginal(
+				source.body,
+				source.contentType,
+				source.size,
+				source.lastModified,
+			);
+			if (ctx.request.method === "HEAD") return new Response(null, response);
+			unusedBody = undefined;
+			return response;
 		}
 
 		const transform = await service.parseURL(url, imageConfig);
@@ -98,7 +109,15 @@ export const GET: APIRoute = async (ctx) => {
 			if (isNotModified(ctx.request, source.size, source.lastModified)) {
 				return notModifiedResponse(source.contentType, source.size, source.lastModified);
 			}
-			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
+			const response = streamOriginal(
+				source.body,
+				source.contentType,
+				source.size,
+				source.lastModified,
+			);
+			if (ctx.request.method === "HEAD") return new Response(null, response);
+			unusedBody = undefined;
+			return response;
 		}
 
 		const fingerprint = getTransformFingerprint(url.searchParams);
@@ -122,5 +141,7 @@ export const GET: APIRoute = async (ctx) => {
 		if (isNotFound(error)) return new Response("Not Found", { status: 404 });
 		console.error("[emdash] image transform failed:", error);
 		return new Response("Internal Server Error", { status: 500 });
+	} finally {
+		if (unusedBody && !unusedBody.locked) await unusedBody.cancel().catch(() => undefined);
 	}
 };

package/src/astro/integration/admin-nav.ts

@@ -0,0 +1,52 @@
+/**
+ * Built-in admin navigation entries that `admin.hiddenNavItems` can hide.
+ */
+export const HIDEABLE_ADMIN_NAV_ITEMS = [
+	"calendar",
+	"media",
+	"comments",
+	"menus",
+	"redirects",
+	"widgets",
+	"sections",
+	"bylines",
+	"import",
+] as const;
+
+export type HideableAdminNavItem = (typeof HIDEABLE_ADMIN_NAV_ITEMS)[number];
+
+const HIDEABLE = new Set<string>(HIDEABLE_ADMIN_NAV_ITEMS);
+
+function isHideableAdminNavItem(entry: unknown): entry is HideableAdminNavItem {
+	return typeof entry === "string" && HIDEABLE.has(entry);
+}
+
+/**
+ * Validate a user-supplied `admin.hiddenNavItems` list. Duplicates are
+ * dropped. Throws, naming every unrecognized entry and listing the valid
+ * names, if any entry is not a hideable navigation item.
+ */
+export function resolveHiddenNavItems(requested: unknown): HideableAdminNavItem[] {
+	if (!Array.isArray(requested)) {
+		throw new Error("`admin.hiddenNavItems` must be an array of navigation item names.");
+	}
+	const entries: unknown[] = requested;
+	const resolved = new Set<HideableAdminNavItem>();
+	const unknownEntries: string[] = [];
+	for (const entry of entries) {
+		if (isHideableAdminNavItem(entry)) {
+			resolved.add(entry);
+		} else {
+			unknownEntries.push(String(JSON.stringify(entry)));
+		}
+	}
+
+	if (unknownEntries.length > 0) {
+		throw new Error(
+			`Unknown navigation item${unknownEntries.length === 1 ? "" : "s"} in \`admin.hiddenNavItems\`: ` +
+				`${unknownEntries.join(", ")}. Valid names: ${HIDEABLE_ADMIN_NAV_ITEMS.join(", ")}.`,
+		);
+	}
+
+	return [...resolved];
+}

package/src/astro/integration/index.ts

@@ -38,6 +38,7 @@ import {
 import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
 import { readAdminLocaleManifest, resolveAdminLocales } from "./admin-locales.js";
+import { resolveHiddenNavItems } from "./admin-nav.js";
 import { loadDevEnv } from "./dev-env.js";
 import { startDevSchedulerBridge } from "./dev-scheduler-bridge.js";
 import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
@@ -592,6 +593,12 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			locales: resolveAdminLocales(config.admin.locales, Object.keys(manifest)),
 		};
 	}
+	if (config.admin?.hiddenNavItems !== undefined) {
+		resolvedConfig.admin = {
+			...resolvedConfig.admin,
+			hiddenNavItems: resolveHiddenNavItems(config.admin.hiddenNavItems),
+		};
+	}
 
 	// Resolved plugins (populated at build time by importing entrypoints)
 	let _resolvedPlugins: ResolvedPlugin[] = [];

package/src/astro/integration/runtime.ts

@@ -25,6 +25,7 @@ import type {
 } from "../../plugins/types.js";
 import type { RegistryConfigOption } from "../../registry/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
+import type { HideableAdminNavItem } from "./admin-nav.js";
 
 export type { RegistryConfig, RegistryConfigOption } from "../../registry/types.js";
 
@@ -668,6 +669,19 @@ export interface EmDashConfig {
 		 * ```
 		 */
 		locales?: string[];
+		/**
+		 * Built-in sidebar and command palette entries to hide, for sites that
+		 * don't use those features. The pages stay reachable by URL. Unknown
+		 * names fail the build.
+		 *
+		 * @example
+		 * ```ts
+		 * emdash({
+		 *   admin: { hiddenNavItems: ["comments", "redirects", "widgets"] },
+		 * })
+		 * ```
+		 */
+		hiddenNavItems?: HideableAdminNavItem[];
 	};
 
 	/**

package/src/astro/integration/shims/use-sync-external-store-with-selector.js

@@ -69,3 +69,5 @@ export function useSyncExternalStoreWithSelector(
 	React.useDebugValue(value);
 	return value;
 }
+
+export default { useSyncExternalStoreWithSelector };

package/src/astro/integration/shims/use-sync-external-store.js

@@ -1 +1,4 @@
-export { useSyncExternalStore } from "react";
+import { useSyncExternalStore } from "react";
+
+export { useSyncExternalStore };
+export default { useSyncExternalStore };

package/src/astro/integration/vite-config.ts

@@ -408,6 +408,9 @@ export function createViteConfig(
 	command: "dev" | "build" | "preview" | "sync",
 ): NonNullable<AstroConfig["vite"]> {
 	const adminDistPath = resolveAdminDist();
+	const adminRequire = createRequire(resolve(adminDistPath, "index.js"));
+	const adminLinguiReactPath = dirname(adminRequire.resolve("@lingui/react/package.json"));
+	const adminLinguiCorePath = dirname(adminRequire.resolve("@lingui/core/package.json"));
 	const cloudflare = isCloudflareAdapter(options.astroConfig);
 	const isDev = command === "dev";
 	const projectRoot = fileURLToPath(options.astroConfig.root);
@@ -440,15 +443,20 @@ export function createViteConfig(
 		},
 		resolve: {
 			dedupe: ["@emdash-cms/admin", "react", "react-dom"],
-			// Array form so more-specific entries are checked first.
-			// The styles.css alias must come before the package alias, otherwise
-			// Vite's prefix matching on "@emdash-cms/admin" would resolve
-			// "@emdash-cms/admin/styles.css" through the source directory.
-			// Regex (not string) so the `?url` variant — admin.astro imports the
-			// stylesheet as `?url` to keep it out of the page CSS graph — also
-			// resolves to dist; a string `find` only matches on a `/` or end
-			// boundary, so `styles.css?url` would slip through to the source alias.
+			// Admin and auth providers must share Lingui's React context. In pnpm
+			// installs, resolving each package from its importer can otherwise load
+			// separate copies even when the versions match.
 			alias: [
+				{ find: "@lingui/react", replacement: adminLinguiReactPath },
+				{ find: "@lingui/core", replacement: adminLinguiCorePath },
+				// Array form so more-specific entries are checked first. The styles.css
+				// alias must come before the package alias, otherwise Vite's prefix
+				// matching on "@emdash-cms/admin" would resolve
+				// "@emdash-cms/admin/styles.css" through the source directory.
+				// Regex (not string) so the `?url` variant — admin.astro imports the
+				// stylesheet as `?url` to keep it out of the page CSS graph — also
+				// resolves to dist; a string `find` only matches on a `/` or end
+				// boundary, so `styles.css?url` would slip through to the source alias.
 				{ find: ADMIN_STYLES_ALIAS, replacement: resolve(adminDistPath, "styles.css") },
 				{ find: "@emdash-cms/admin", replacement: useSource ? adminSourcePath : adminDistPath },
 				// `use-sync-external-store/shim` is a React <18 polyfill that ships

package/src/astro/middleware/auth.ts

@@ -633,9 +633,16 @@ async function handleExternalAuth(
 		locals.user = user;
 
 		// Persist to session so public pages can identify the user
-		// (external auth headers are only verified on /_emdash routes)
+		// (external auth headers are only verified on /_emdash routes).
+		// Astro marks the session dirty on every set(), and a dirty session is
+		// written to the store at the end of the request. Skip the set when the
+		// stored id already matches, or each request costs a session-store write
+		// (a KV put on Cloudflare, which also rate-limits writes to one key).
 		const { session } = context;
-		session?.set("user", { id: user.id });
+		if (session) {
+			const sessionUser = await resolveSessionUser(session);
+			if (sessionUser?.id !== user.id) session.set("user", { id: user.id });
+		}
 
 		return next();
 	} catch (error) {