emdash 1.3.1 → 1.4.0

package/src/api/handlers/content.ts

@@ -215,10 +215,13 @@ function decodeRevisionPrecondition(
 }
 
 /**
- * Extract a slug source (title or name) from content data.
+ * Extract a slug source from content data: the collection's `titleField` when
+ * it sets one and the entry has a value for it, otherwise `title`, then `name`.
  * Returns null if no suitable string field is found.
  */
-function getSlugSource(data: Record<string, unknown>): string | null {
+function getSlugSource(data: Record<string, unknown>, titleField?: string | null): string | null {
+	const configured = titleField ? data[titleField] : undefined;
+	if (typeof configured === "string" && configured.length > 0) return configured;
 	if (typeof data.title === "string" && data.title.length > 0) return data.title;
 	if (typeof data.name === "string" && data.name.length > 0) return data.name;
 	return null;
@@ -271,6 +274,20 @@ async function getCollectionPublishConfig(
 	});
 }
 
+async function getCollectionTitleField(
+	db: Kysely<Database>,
+	collection: string,
+): Promise<string | null> {
+	return requestCached(`collectionTitleField:${collection}`, async () => {
+		const row = await db
+			.selectFrom("_emdash_collections")
+			.select("title_field")
+			.where("slug", "=", collection)
+			.executeTakeFirst();
+		return row?.title_field ?? null;
+	});
+}
+
 function requireRoutablePublishSlug(routable: boolean, slug: string | null | undefined): void {
 	if (routable && !slug?.trim()) {
 		throw new EmDashValidationError("Cannot publish routable content without a slug");
@@ -636,7 +653,8 @@ export interface TrashedContentItem {
  * the `title`/`name` display fields when the collection actually defines them,
  * mirroring the admin's item-title resolution (titleField -> title -> name ->
  * slug), and includes every field explicitly marked searchable. Returning only
- * schema-backed columns avoids "no such column" errors.
+ * fields that have a column (a reference field bound to a relation has none)
+ * avoids "no such column" errors.
  */
 async function resolveSearchColumns(db: Kysely<Database>, collection: string): Promise<string[]> {
 	const row = await db
@@ -646,12 +664,13 @@ async function resolveSearchColumns(db: Kysely<Database>, collection: string): P
 		.executeTakeFirst();
 	if (!row) return ["slug"];
 
-	const fields = await db
+	const fieldRows = await db
 		.selectFrom("_emdash_fields")
-		.select(["slug", "searchable"])
+		.select(["slug", "searchable", "type", "validation"])
 		.where("collection_id", "=", row.id)
 		.orderBy("sort_order", "asc")
 		.execute();
+	const fields = fieldRows.filter((f) => !isStoragelessFieldRow(f));
 	const columns = new Set(["slug"]);
 	const fieldSlugs = new Set(fields.map((f) => f.slug));
 
@@ -1348,7 +1367,7 @@ export async function handleContentCreate(
 
 			let slug: string | null | undefined = body.slug;
 			if (!slug) {
-				const slugSource = getSlugSource(body.data);
+				const slugSource = getSlugSource(body.data, await getCollectionTitleField(trx, collection));
 				if (slugSource) {
 					slug = await repo.generateUniqueSlug(collection, slugSource, effectiveLocale);
 				}
@@ -1604,9 +1623,10 @@ export async function handleContentUpdate(
 			}
 		}
 
-		// Wrap content + SEO writes in a transaction for atomicity.
-		// The _rev check is inside the transaction so the read-then-write
-		// is atomic -- no concurrent write can slip between the check and update.
+		// Wrap content + SEO writes in a transaction for atomicity. The transaction
+		// does not keep a concurrent save out between the _rev check and the update
+		// (D1 has none, and Postgres reads without a lock), so the update repeats
+		// the check in its WHERE clause.
 		let redirectChanged = false;
 		const item = await withTransaction(db, async (trx) => {
 			const trxRepo = new ContentRepository(trx);
@@ -1678,15 +1698,20 @@ export async function handleContentUpdate(
 			// Collections without revisions save to the columns, and reads show any
 			// draft revision over them, so no draft pointer may outlive a save.
 			const { supportsRevisions } = await getCollectionPublishConfig(trx, collection);
-			const updated = await trxRepo.update(collection, resolvedId, {
-				data: body.data,
-				slug: body.slug,
-				locale: existing?.locale ?? body.locale,
-				status: body.status,
-				authorId: body.authorId,
-				publishedAt: body.publishedAt,
-				...(supportsRevisions ? {} : { draftRevisionId: null }),
-			});
+			const updated = await trxRepo.update(
+				collection,
+				resolvedId,
+				{
+					data: body.data,
+					slug: body.slug,
+					locale: existing?.locale ?? body.locale,
+					status: body.status,
+					authorId: body.authorId,
+					publishedAt: body.publishedAt,
+					...(supportsRevisions ? {} : { draftRevisionId: null }),
+				},
+				body._rev ? decodeRevisionPrecondition(body._rev) : undefined,
+			);
 
 			if (body.bylines !== undefined) {
 				const credits = await bylineRepo.setContentBylines(collection, resolvedId, body.bylines);
@@ -1783,6 +1808,12 @@ export async function handleContentUpdate(
 				error: { code: error.apiError.code, message: error.message },
 			};
 		}
+		if (error instanceof ContentMutationConflictError) {
+			return {
+				success: false,
+				error: { code: "CONFLICT", message: error.message },
+			};
+		}
 		if (isMissingTableError(error)) {
 			return {
 				success: false,

package/src/api/handlers/device-flow.ts

@@ -15,6 +15,7 @@ import { generateCodeVerifier } from "arctic";
 import type { Kysely, Selectable } from "kysely";
 
 import {
+	ACCESS_TOKEN_TTL_SECONDS,
 	generatePrefixedToken,
 	hashApiToken,
 	isValidScope,
@@ -42,9 +43,6 @@ const SLOW_DOWN_INCREMENT = 5;
 /** Maximum slow_down interval cap (seconds) */
 const MAX_SLOW_DOWN_INTERVAL = 60;
 
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
-
 /** Refresh token TTL: 90 days */
 const REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
 

package/src/api/handlers/menus.ts

@@ -499,9 +499,9 @@ export async function handleMenuSetItems(
 		const { itemCount } = await repo.setItems(resolved.menu.id, resolved.menu.locale, items);
 		return { success: true, data: { name: menuName, itemCount } };
 	} catch (error) {
-		// `MenuGoneError` is thrown from inside the repository transaction
-		// when the menu was deleted concurrently between `resolveMenu` and the
-		// setItems write. Returning NOT_FOUND mirrors the original handler's
+		// `MenuGoneError` is thrown by the repository when the menu was
+		// deleted concurrently between `resolveMenu` and the setItems
+		// write. Returning NOT_FOUND mirrors the original handler's
 		// in-transaction `notFoundSentinel` branch and keeps the response
 		// shape stable for REST/MCP callers.
 		if (error instanceof MenuGoneError) {

package/src/api/handlers/oauth-authorization.ts

@@ -14,6 +14,7 @@ import { generateCodeVerifier } from "arctic";
 import type { Kysely } from "kysely";
 
 import {
+	ACCESS_TOKEN_TTL_SECONDS,
 	generatePrefixedToken,
 	hashApiToken,
 	isValidScope,
@@ -33,9 +34,6 @@ import { lookupUserRoleAndStatus } from "./oauth-user-lookup.js";
 /** Authorization codes expire after 10 minutes (RFC 6749 §4.1.2 recommends short-lived) */
 const AUTH_CODE_TTL_SECONDS = 10 * 60;
 
-/** Access token TTL: 1 hour */
-const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
-
 /** Refresh token TTL: 90 days */
 const REFRESH_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;
 

package/src/astro/integration/admin-nav.ts

@@ -0,0 +1,52 @@
+/**
+ * Built-in admin navigation entries that `admin.hiddenNavItems` can hide.
+ */
+export const HIDEABLE_ADMIN_NAV_ITEMS = [
+	"calendar",
+	"media",
+	"comments",
+	"menus",
+	"redirects",
+	"widgets",
+	"sections",
+	"bylines",
+	"import",
+] as const;
+
+export type HideableAdminNavItem = (typeof HIDEABLE_ADMIN_NAV_ITEMS)[number];
+
+const HIDEABLE = new Set<string>(HIDEABLE_ADMIN_NAV_ITEMS);
+
+function isHideableAdminNavItem(entry: unknown): entry is HideableAdminNavItem {
+	return typeof entry === "string" && HIDEABLE.has(entry);
+}
+
+/**
+ * Validate a user-supplied `admin.hiddenNavItems` list. Duplicates are
+ * dropped. Throws, naming every unrecognized entry and listing the valid
+ * names, if any entry is not a hideable navigation item.
+ */
+export function resolveHiddenNavItems(requested: unknown): HideableAdminNavItem[] {
+	if (!Array.isArray(requested)) {
+		throw new Error("`admin.hiddenNavItems` must be an array of navigation item names.");
+	}
+	const entries: unknown[] = requested;
+	const resolved = new Set<HideableAdminNavItem>();
+	const unknownEntries: string[] = [];
+	for (const entry of entries) {
+		if (isHideableAdminNavItem(entry)) {
+			resolved.add(entry);
+		} else {
+			unknownEntries.push(String(JSON.stringify(entry)));
+		}
+	}
+
+	if (unknownEntries.length > 0) {
+		throw new Error(
+			`Unknown navigation item${unknownEntries.length === 1 ? "" : "s"} in \`admin.hiddenNavItems\`: ` +
+				`${unknownEntries.join(", ")}. Valid names: ${HIDEABLE_ADMIN_NAV_ITEMS.join(", ")}.`,
+		);
+	}
+
+	return [...resolved];
+}

package/src/astro/integration/index.ts

@@ -38,6 +38,7 @@ import {
 import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
 import { readAdminLocaleManifest, resolveAdminLocales } from "./admin-locales.js";
+import { resolveHiddenNavItems } from "./admin-nav.js";
 import { loadDevEnv } from "./dev-env.js";
 import { startDevSchedulerBridge } from "./dev-scheduler-bridge.js";
 import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
@@ -592,6 +593,12 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			locales: resolveAdminLocales(config.admin.locales, Object.keys(manifest)),
 		};
 	}
+	if (config.admin?.hiddenNavItems !== undefined) {
+		resolvedConfig.admin = {
+			...resolvedConfig.admin,
+			hiddenNavItems: resolveHiddenNavItems(config.admin.hiddenNavItems),
+		};
+	}
 
 	// Resolved plugins (populated at build time by importing entrypoints)
 	let _resolvedPlugins: ResolvedPlugin[] = [];

package/src/astro/integration/runtime.ts

@@ -25,6 +25,7 @@ import type {
 } from "../../plugins/types.js";
 import type { RegistryConfigOption } from "../../registry/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
+import type { HideableAdminNavItem } from "./admin-nav.js";
 
 export type { RegistryConfig, RegistryConfigOption } from "../../registry/types.js";
 
@@ -668,6 +669,19 @@ export interface EmDashConfig {
 		 * ```
 		 */
 		locales?: string[];
+		/**
+		 * Built-in sidebar and command palette entries to hide, for sites that
+		 * don't use those features. The pages stay reachable by URL. Unknown
+		 * names fail the build.
+		 *
+		 * @example
+		 * ```ts
+		 * emdash({
+		 *   admin: { hiddenNavItems: ["comments", "redirects", "widgets"] },
+		 * })
+		 * ```
+		 */
+		hiddenNavItems?: HideableAdminNavItem[];
 	};
 
 	/**

package/src/astro/integration/shims/use-sync-external-store-with-selector.js

@@ -69,3 +69,5 @@ export function useSyncExternalStoreWithSelector(
 	React.useDebugValue(value);
 	return value;
 }
+
+export default { useSyncExternalStoreWithSelector };

package/src/astro/integration/shims/use-sync-external-store.js

@@ -1 +1,4 @@
-export { useSyncExternalStore } from "react";
+import { useSyncExternalStore } from "react";
+
+export { useSyncExternalStore };
+export default { useSyncExternalStore };

package/src/astro/middleware/auth.ts

@@ -633,9 +633,16 @@ async function handleExternalAuth(
 		locals.user = user;
 
 		// Persist to session so public pages can identify the user
-		// (external auth headers are only verified on /_emdash routes)
+		// (external auth headers are only verified on /_emdash routes).
+		// Astro marks the session dirty on every set(), and a dirty session is
+		// written to the store at the end of the request. Skip the set when the
+		// stored id already matches, or each request costs a session-store write
+		// (a KV put on Cloudflare, which also rate-limits writes to one key).
 		const { session } = context;
-		session?.set("user", { id: user.id });
+		if (session) {
+			const sessionUser = await resolveSessionUser(session);
+			if (sessionUser?.id !== user.id) session.set("user", { id: user.id });
+		}
 
 		return next();
 	} catch (error) {

package/src/astro/routes/api/import/wordpress/analyze.ts

@@ -13,15 +13,16 @@ import mime from "mime/lite";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { isInternalPostType } from "#import/utils.js";
-import { RESERVED_COLLECTION_SLUGS } from "#schema/types.js";
+import {
+	isInternalPostType,
+	mapPostTypeToCollection,
+	sanitizeCollectionSlug as sanitizeSlug,
+} from "#import/utils.js";
 import type { EmDashHandlers } from "#types";
 
 export const prerender = false;
 
 const NUMERIC_PATTERN = /^-?\d+(\.\d+)?$/;
-const INVALID_SLUG_CHARS = /[^a-z0-9_]/g;
-const LEADING_NON_ALPHA = /^[^a-z]+/;
 
 /** Field compatibility status */
 export type FieldCompatibility =
@@ -441,31 +442,6 @@ function isInternalMetaKey(key: string): boolean {
 	return false;
 }
 
-function sanitizeSlug(slug: string): string {
-	const sanitized = slug
-		.toLowerCase()
-		.replace(INVALID_SLUG_CHARS, "_")
-		.replace(LEADING_NON_ALPHA, "");
-	if (!sanitized) return "imported";
-	if (RESERVED_COLLECTION_SLUGS.includes(sanitized)) return `wp_${sanitized}`;
-	return sanitized;
-}
-
-function mapPostTypeToCollection(postType: string): string {
-	const mapping: Record<string, string> = {
-		post: "posts",
-		page: "pages",
-		attachment: "media",
-		product: "products",
-		portfolio: "portfolio",
-		testimonial: "testimonials",
-		team: "team",
-		event: "events",
-		faq: "faqs",
-	};
-	return mapping[postType] || sanitizeSlug(postType);
-}
-
 function mapMetaKeyToField(key: string): string {
 	// SEO plugins
 	if (key === "_yoast_wpseo_title") return "seo_title";

package/src/astro/routes/api/import/wordpress-plugin/execute.ts

@@ -37,7 +37,7 @@ import {
 } from "#import/sources/wordpress-plugin.js";
 import { resolveAndValidateExternalUrl, SsrfError } from "#import/ssrf.js";
 import type { ImportConfig, ImportResult, NormalizedItem } from "#import/types.js";
-import { resolveImportByline, sanitizeFieldSlug } from "#import/utils.js";
+import { resolveImportByline, sanitizeCollectionSlug, sanitizeFieldSlug } from "#import/utils.js";
 import {
 	attachPostTaxonomies,
 	loadTaxonomyPlanFromDb,
@@ -665,7 +665,7 @@ export async function ensureCustomTaxonomyDefs(
 		const collections = (taxonomy.post_types ?? [])
 			.map((postType) => config.postTypeMappings[postType])
 			.filter((mapping) => mapping?.enabled)
-			.map((mapping) => mapping.collection);
+			.map((mapping) => sanitizeCollectionSlug(mapping.collection));
 
 		const result = await handleTaxonomyCreate(db, {
 			name: taxonomy.name,
@@ -868,7 +868,7 @@ export async function importContent(
 			continue;
 		}
 
-		const collection = mapping.collection;
+		const collection = sanitizeCollectionSlug(mapping.collection);
 
 		// Check if collection exists in manifest
 		if (!manifest?.collections[collection]) {

package/src/astro/routes/api/media/file/[...key].ts

@@ -7,6 +7,8 @@
 import type { APIRoute } from "astro";
 
 import { apiError, handleError } from "#api/error.js";
+import { MediaRepository } from "#db/repositories/media.js";
+import { contentDisposition } from "#media/content-disposition.js";
 import {
 	IMMUTABLE_IMAGE_CACHE,
 	MUTABLE_MEDIA_CACHE_CONTROL,
@@ -134,11 +136,23 @@ export const GET: APIRoute = async ({ params, locals, request, cache }) => {
 
 		// Safe image/media types can render inline; everything else (SVG, PDF,
 		// HTML, JS, etc.) must be downloaded to prevent stored XSS.
-		if (SAFE_INLINE_TYPES.has(result.contentType)) {
-			headers["Content-Disposition"] = "inline";
-		} else {
-			headers["Content-Disposition"] = "attachment";
+		const disposition = SAFE_INLINE_TYPES.has(result.contentType) ? "inline" : "attachment";
+
+		// Name the download after the uploaded filename. Without this the
+		// browser falls back to the last path segment of the URL -- the storage
+		// key -- and every downloaded document is named after its ULID.
+		// Skipped for inline types, where no filename is shown to anyone.
+		let filename: string | null = null;
+		if (disposition === "attachment") {
+			// A failed lookup must not fail the download: naming the file is a
+			// nicety, and media with no row is served under the bare disposition.
+			try {
+				filename = await new MediaRepository(emdash.db).findFilenameByStorageKey(key);
+			} catch {
+				filename = null;
+			}
 		}
+		headers["Content-Disposition"] = contentDisposition(disposition, filename);
 
 		const body = request.method === "HEAD" ? null : result.body;
 

package/src/astro/routes/api/oauth/token.ts

@@ -17,6 +17,7 @@ import type { APIRoute } from "astro";
 import { z } from "zod";
 
 import { apiError, handleError } from "#api/error.js";
+import { OAuthErrorCode } from "#api/errors.js";
 import { handleDeviceTokenExchange, handleTokenRefresh } from "#api/handlers/device-flow.js";
 import { handleAuthorizationCodeExchange } from "#api/handlers/oauth-authorization.js";
 
@@ -189,7 +190,10 @@ function oauthSuccess(data: unknown): Response {
 
 function oauthError(error: string, description: string, status: number): Response {
 	return Response.json(
-		{ error, error_description: description },
+		{
+			error: error === "INVALID_GRANT" ? OAuthErrorCode.INVALID_GRANT : error,
+			error_description: description,
+		},
 		{ status, headers: OAUTH_TOKEN_HEADERS },
 	);
 }

package/src/astro/routes/api/widget-areas/[name]/reorder.ts

@@ -12,6 +12,7 @@ import { isParseError, parseBody } from "#api/parse.js";
 import { reorderWidgetsBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
 import { invalidateRouteCache } from "#cache/route-cache.js";
+import { invalidateWidgetObjectCache } from "#widgets/index.js";
 
 export const prerender = false;
 
@@ -57,11 +58,16 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 		}
 
 		// Update sort_order for each widget
-		await Promise.all(
+		// Invalidating before every update settles would let a concurrent read
+		// cache a half-reordered area under the new epoch.
+		const results = await Promise.allSettled(
 			body.widgetIds.map((id, index) =>
 				db.updateTable("_emdash_widgets").set({ sort_order: index }).where("id", "=", id).execute(),
 			),
 		);
+		invalidateWidgetObjectCache();
+		const failed = results.find((result) => result.status === "rejected");
+		if (failed) throw failed.reason;
 
 		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess({ success: true });

package/src/astro/routes/api/widget-areas/[name]/widgets/[id].ts

@@ -13,7 +13,7 @@ import { isParseError, parseBody } from "#api/parse.js";
 import { updateWidgetBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
 import { invalidateRouteCache } from "#cache/route-cache.js";
-import { rowToWidget } from "#widgets/index.js";
+import { invalidateWidgetObjectCache, rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
 export const prerender = false;
@@ -73,6 +73,7 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 		}
 
 		await db.updateTable("_emdash_widgets").set(updates).where("id", "=", id).execute();
+		invalidateWidgetObjectCache();
 
 		const widget = await db
 			.selectFrom("_emdash_widgets")
@@ -126,6 +127,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 
 		await db.deleteFrom("_emdash_widgets").where("id", "=", id).execute();
 
+		invalidateWidgetObjectCache();
 		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess({ deleted: true });
 	} catch (error) {

package/src/astro/routes/api/widget-areas/[name]/widgets.ts

@@ -13,7 +13,7 @@ import { isParseError, parseBody } from "#api/parse.js";
 import { createWidgetBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
 import { invalidateRouteCache } from "#cache/route-cache.js";
-import { rowToWidget } from "#widgets/index.js";
+import { invalidateWidgetObjectCache, rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
 export const prerender = false;
@@ -70,6 +70,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 				component_props: body.componentProps ? JSON.stringify(body.componentProps) : null,
 			})
 			.execute();
+		invalidateWidgetObjectCache();
 
 		const widget = await db
 			.selectFrom("_emdash_widgets")

package/src/astro/routes/api/widget-areas/[name].ts

@@ -11,7 +11,7 @@ import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
 import { invalidateRouteCache } from "#cache/route-cache.js";
-import { rowToWidget } from "#widgets/index.js";
+import { invalidateWidgetObjectCache, rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
 export const prerender = false;
@@ -85,6 +85,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 		// Delete area (widgets cascade)
 		await db.deleteFrom("_emdash_widget_areas").where("id", "=", area.id).execute();
 
+		invalidateWidgetObjectCache();
 		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess({ deleted: true });
 	} catch (error) {

package/src/astro/routes/api/widget-areas/index.ts

@@ -14,7 +14,7 @@ import { isParseError, parseBody } from "#api/parse.js";
 import { createWidgetAreaBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
 import { invalidateRouteCache } from "#cache/route-cache.js";
-import { rowToWidget } from "#widgets/index.js";
+import { invalidateWidgetObjectCache, rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
 export const prerender = false;
@@ -90,6 +90,7 @@ export const POST: APIRoute = async ({ request, locals, cache }) => {
 				description: body.description ?? null,
 			})
 			.execute();
+		invalidateWidgetObjectCache();
 
 		const area = await db
 			.selectFrom("_emdash_widget_areas")

package/src/astro/types.ts

@@ -49,9 +49,9 @@ export interface ManifestCollection {
 	titleField?: string;
 	dateField?: string;
 	/**
-	 * Omit the auto-generated sidebar entry and dashboard quick action in the
-	 * admin. The collection is still listed in the manifest so its routes,
-	 * editor, and API keep working.
+	 * Omit the auto-generated sidebar entry, dashboard quick action, and
+	 * dashboard Content card row in the admin. The collection is still listed
+	 * in the manifest so its routes, editor, and API keep working.
 	 */
 	hidden?: boolean;
 	/** Phosphor icon name for the sidebar entry (kebab-case, e.g. `calendar-blank`). */
@@ -255,6 +255,7 @@ export interface EmDashManifest {
 		siteName?: string;
 		footerLabel?: string | false;
 		favicon?: string;
+		hiddenNavItems?: string[];
 	};
 }
 

package/src/auth/api-tokens.ts

@@ -25,3 +25,6 @@ export {
 	computeS256Challenge,
 	type ApiTokenScope,
 } from "@emdash-cms/auth";
+
+/** OAuth access token TTL: 1 hour */
+export const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;

package/src/cleanup.ts

@@ -12,6 +12,7 @@
 import { createKyselyAdapter, type AuthTables } from "@emdash-cms/auth/adapters/kysely";
 import type { Kysely } from "kysely";
 
+import { ACCESS_TOKEN_TTL_SECONDS } from "./auth/api-tokens.js";
 import { cleanupExpiredChallenges } from "./auth/challenge-store.js";
 import { MediaRepository } from "./database/repositories/media.js";
 import { RedirectRepository } from "./database/repositories/redirect.js";
@@ -28,6 +29,9 @@ import type { Storage } from "./storage/types.js";
 export interface CleanupResult {
 	challenges: number;
 	expiredTokens: number;
+	oauthTokens: number;
+	authorizationCodes: number;
+	deviceCodes: number;
 	pendingUploads: number;
 	pendingUploadFiles: number;
 	uploadAttempts: number;
@@ -42,6 +46,13 @@ export interface CleanupResult {
 const REVISION_KEEP_COUNT = 50;
 const REVISION_PRUNE_BATCH_SIZE = 10;
 
+/**
+ * Revoking a refresh token finds the access tokens issued from it through its
+ * row, and those can outlive it by one access token lifetime. A device code's
+ * row is what lets a client that is still polling get `expired_token`.
+ */
+const OAUTH_EXPIRY_GRACE_MS = ACCESS_TOKEN_TTL_SECONDS * 1000;
+
 /** Target cadence for full system cleanup. */
 export const SYSTEM_CLEANUP_INTERVAL_MS = 60 * 60 * 1000;
 
@@ -86,6 +97,9 @@ export async function runSystemCleanup(
 	const result: CleanupResult = {
 		challenges: -1,
 		expiredTokens: -1,
+		oauthTokens: -1,
+		authorizationCodes: -1,
+		deviceCodes: -1,
 		pendingUploads: -1,
 		pendingUploadFiles: -1,
 		uploadAttempts: -1,
@@ -162,6 +176,36 @@ export async function runSystemCleanup(
 		console.error("[cleanup] Failed to clean media upload attempts:", error);
 	}
 
+	const oauthCutoff = new Date(Date.now() - OAUTH_EXPIRY_GRACE_MS).toISOString();
+
+	try {
+		const deleted = await db
+			.deleteFrom("_emdash_oauth_tokens")
+			.where("expires_at", "<", oauthCutoff)
+			.executeTakeFirst();
+		result.oauthTokens = Number(deleted.numDeletedRows);
+	} catch (error) {
+		console.error("[cleanup] Failed to clean expired OAuth tokens:", error);
+	}
+
+	try {
+		const { cleanupExpiredAuthorizationCodes } =
+			await import("./api/handlers/oauth-authorization.js");
+		result.authorizationCodes = await cleanupExpiredAuthorizationCodes(db);
+	} catch (error) {
+		console.error("[cleanup] Failed to clean expired authorization codes:", error);
+	}
+
+	try {
+		const deleted = await db
+			.deleteFrom("_emdash_device_codes")
+			.where("expires_at", "<", oauthCutoff)
+			.executeTakeFirst();
+		result.deviceCodes = Number(deleted.numDeletedRows);
+	} catch (error) {
+		console.error("[cleanup] Failed to clean expired device codes:", error);
+	}
+
 	try {
 		result.revisionsPruned = await pruneQueuedRevisions(db);
 	} catch (error) {