emdash 1.3.1 → 1.4.0

package/src/loader.ts

@@ -17,7 +17,11 @@ import { Kysely, type RawBuilder, sql, type Dialect } from "kysely";
 import { buildStatusCondition, isPostgres } from "./database/dialect-helpers.js";
 import { kyselyLogOption } from "./database/instrumentation.js";
 import { jsonTextValues } from "./database/json-recordset.js";
-import { selectTaxonomyDefs } from "./database/repositories/taxonomy-def.js";
+import {
+	parseTaxonomyCollections,
+	selectTaxonomyDefs,
+} from "./database/repositories/taxonomy-def.js";
+import type { BylineSummary, ContentBylineCredit } from "./database/repositories/types.js";
 import { decodeCursor, encodeCursor, InvalidCursorError } from "./database/repositories/types.js";
 import { validateIdentifier } from "./database/validate.js";
 import { getI18nConfig, getLocaleCandidates, type I18nConfig } from "./i18n/config.js";
@@ -36,6 +40,12 @@ import {
 	getMissingColumnIdentifier,
 	isMissingTableError,
 } from "./utils/db-errors.js";
+import {
+	createRevalidatingCache,
+	invalidateRevalidatingCache,
+	revalidatingCached,
+	type RevalidatingCache,
+} from "./utils/revalidating-cache.js";
 
 const FIELD_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
@@ -124,6 +134,13 @@ export const FOLDED_BYLINES = Symbol.for("emdash:foldedBylines");
  * via the byline query path on sites that never use bylines.
  */
 export const FOLDED_BYLINES_EXIST = Symbol.for("emdash:foldedBylinesExist");
+/**
+ * Marker for the folded author-fallback byline: the byline linked to the
+ * entry's `author_id` in the entry's locale, or `null` when there is none.
+ * Lets byline hydration resolve an entry with no explicit credit without the
+ * byline query path. Unset when the row's fold predates it.
+ */
+export const FOLDED_AUTHOR_BYLINE = Symbol.for("emdash:foldedAuthorByline");
 
 /**
  * Correlated JSON-array subqueries that fold taxonomy-term and byline hydration
@@ -188,7 +205,10 @@ function foldedHydrationSelects(db: Kysely<any>, type: string, outer: string) {
 			)
 		: sql.raw("json_object('roleLabel', cb.role_label, 'sortOrder', cb.sort_order, 'byline', ");
 	const credit = sql`${creditObj}${bylineInner})`;
-	const bylines = hasLocaleAliases
+	// The locale match differs with locale aliases: a row's locale may be any
+	// of its configured locale's codes, so both subqueries compare canonical
+	// locales and pick one byline per match, as the query path does.
+	const credits = hasLocaleAliases
 		? sql`(SELECT ${agg(credit)} FROM ${sql.ref("_emdash_content_bylines")} AS cb
 		${foldJoin} ${sql.ref("_emdash_bylines")} AS b ON b.id = (
 			SELECT candidate.id FROM _emdash_bylines AS candidate
@@ -197,8 +217,26 @@ function foldedHydrationSelects(db: Kysely<any>, type: string, outer: string) {
 			ORDER BY ${storedLocaleOrder("candidate.locale")}, candidate.id LIMIT 1
 		)
 		LEFT JOIN ${sql.ref("media")} AS m ON m.id = b.avatar_media_id
-		WHERE cb.collection_slug = ${type} AND cb.content_id = ${o}.id) AS ${sql.ref("_emdash_bylines")}`
-		: sql`(SELECT ${agg(credit)} FROM ${sql.ref("_emdash_content_bylines")} AS cb ${foldJoin} ${sql.ref("_emdash_bylines")} AS b ON b.translation_group = cb.byline_id LEFT JOIN ${sql.ref("media")} AS m ON m.id = b.avatar_media_id WHERE cb.collection_slug = ${type} AND cb.content_id = ${o}.id AND b.locale = ${o}.locale) AS ${sql.ref("_emdash_bylines")}`;
+		WHERE cb.collection_slug = ${type} AND cb.content_id = ${o}.id)`
+		: sql`(SELECT ${agg(credit)} FROM ${sql.ref("_emdash_content_bylines")} AS cb ${foldJoin} ${sql.ref("_emdash_bylines")} AS b ON b.translation_group = cb.byline_id LEFT JOIN ${sql.ref("media")} AS m ON m.id = b.avatar_media_id WHERE cb.collection_slug = ${type} AND cb.content_id = ${o}.id AND b.locale = ${o}.locale)`;
+	// The author fallback for an entry with no explicit credit: the byline
+	// linked to its author in its locale. Without aliases `(user_id, locale)`
+	// is unique, so this is one index probe per row and matches
+	// `findByUserIds` exactly; with them, the same canonical-locale match and
+	// ordering as the credits above picks one.
+	const author = hasLocaleAliases
+		? sql`(SELECT ${bylineInner} FROM ${sql.ref("_emdash_bylines")} AS b LEFT JOIN ${sql.ref("media")} AS m ON m.id = b.avatar_media_id
+		WHERE b.user_id = ${o}.author_id
+			AND ${canonicalLocaleColumn("b.locale")} = ${canonicalLocaleColumn(`${outer}.locale`)}
+		ORDER BY ${storedLocaleOrder("b.locale")}, b.id LIMIT 1)`
+		: sql`(SELECT ${bylineInner} FROM ${sql.ref("_emdash_bylines")} AS b LEFT JOIN ${sql.ref("media")} AS m ON m.id = b.avatar_media_id WHERE b.user_id = ${o}.author_id AND b.locale = ${o}.locale LIMIT 1)`;
+	// Both ride in one result column: D1 caps a result set at 100 columns and
+	// the entry read is budgeted to the column, so folding them together keeps
+	// its width unchanged. SQLite's `json()` keeps each subquery's JSON text
+	// from being nested as a string.
+	const bylines = pg
+		? sql`json_build_object('credits', ${credits}, 'author', ${author}) AS ${sql.ref("_emdash_bylines")}`
+		: sql`json_object('credits', json(${credits}), 'author', json(${author})) AS ${sql.ref("_emdash_bylines")}`;
 	// Uncorrelated existence probe (evaluated once per statement, not per row):
 	// 1 when `_emdash_bylines` has any row, NULL when empty. An empty table
 	// means an empty fold is authoritative — no credit in any locale, no
@@ -276,26 +314,36 @@ function expandFoldedSeo(row: Record<string, unknown>): void {
 	}
 }
 
-export function creditsFromFoldedBylines(folded: unknown[]) {
+/**
+ * A folded byline object as a `BylineSummary`. The fold's JSON keys are the
+ * `BylineSummary` keys (see `bylineInner` in {@link foldedHydrationSelects}).
+ */
+function foldedBylineSummary(raw: unknown): BylineSummary {
+	const byline = isPlainObject(raw) ? raw : {};
+	// Folded rows omit custom-field values.
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- keys set by the fold's SQL
+	return { ...byline, isGuest: Boolean(byline.isGuest), customFields: {} } as BylineSummary;
+}
+
+export function creditsFromFoldedBylines(folded: unknown[]): ContentBylineCredit[] {
 	return folded
 		.map((raw) => {
 			const credit = isPlainObject(raw) ? raw : {};
-			const byline = isPlainObject(credit.byline) ? credit.byline : {};
 			return {
 				roleLabel: typeof credit.roleLabel === "string" ? credit.roleLabel : null,
 				sortOrder: Number(credit.sortOrder ?? 0),
 				source: "explicit" as const,
-				byline: {
-					...byline,
-					isGuest: Boolean(byline.isGuest),
-					// Folded rows omit custom-field values.
-					customFields: {},
-				},
+				byline: foldedBylineSummary(credit.byline),
 			};
 		})
 		.toSorted((a, b) => a.sortOrder - b.sortOrder);
 }
 
+/** The inferred credit for a folded author-fallback byline. */
+export function creditFromFoldedAuthorByline(raw: Record<string, unknown>): ContentBylineCredit {
+	return { byline: foldedBylineSummary(raw), sortOrder: 0, roleLabel: null, source: "inferred" };
+}
+
 /**
  * Stash folded hydration JSON (non-enumerable) for the query.ts fast paths.
  * SQLite returns a JSON string (parse it); Postgres returns already-parsed JSON.
@@ -313,11 +361,26 @@ function stashFolded(data: Record<string, unknown>, row: Record<string, unknown>
 			} catch {
 				continue; // malformed: fall back to the query path
 			}
-		} else if (Array.isArray(raw)) {
+		} else if (Array.isArray(raw) || isPlainObject(raw)) {
 			value = raw; // Postgres json/jsonb already parsed by the driver
 		} else {
 			continue;
 		}
+		// The bylines column is `{ credits, author }` (see
+		// foldedHydrationSelects). A bare array is a fold without the author
+		// fallback; the marker stays unset and hydration treats it as unknown.
+		if (sym === FOLDED_BYLINES && isPlainObject(value)) {
+			const { credits, author } = value;
+			if (author === null || isPlainObject(author)) {
+				Object.defineProperty(data, FOLDED_AUTHOR_BYLINE, {
+					value: author,
+					enumerable: false,
+					configurable: true,
+				});
+			}
+			value = credits;
+		}
+		if (!Array.isArray(value)) continue;
 		Object.defineProperty(data, sym, { value, enumerable: false, configurable: true });
 	}
 	// Existence probe: 1 = table has rows, NULL = empty (both dialects). A row
@@ -379,87 +442,51 @@ function getTableName(type: string): string {
 	return `ec_${type}`;
 }
 
-/**
- * Cache for taxonomy names by collection (only used for the primary database).
- * Stored on globalThis so Vite SSR chunk duplication cannot create independent
- * caches. Skipped when a per-request DB override is active (e.g. preview mode)
- * because the override DB may have different taxonomies.
- */
-interface TaxonomyNamesHolder {
-	cache: Map<string, Set<string>> | null;
-}
+/** Taxonomy-to-collection mappings revalidated in the background after 30 seconds. */
+type TaxonomyNames = Map<string, Set<string>>;
 
-const TAXONOMY_NAMES_CACHE_KEY = Symbol.for("emdash:taxonomy-names");
+const TAXONOMY_NAMES_CACHE_KEY = Symbol.for("emdash:taxonomy-names:swr");
 const taxonomyNamesStore = globalThis as Record<symbol, unknown>;
-const taxonomyNamesHolder: TaxonomyNamesHolder =
-	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see taxonomies/index.ts)
-	(taxonomyNamesStore[TAXONOMY_NAMES_CACHE_KEY] as TaxonomyNamesHolder | undefined) ??
+const taxonomyNamesCache: RevalidatingCache<TaxonomyNames> =
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern
+	(taxonomyNamesStore[TAXONOMY_NAMES_CACHE_KEY] as RevalidatingCache<TaxonomyNames> | undefined) ??
 	(() => {
-		const holder: TaxonomyNamesHolder = { cache: null };
-		taxonomyNamesStore[TAXONOMY_NAMES_CACHE_KEY] = holder;
-		return holder;
+		const cache = createRevalidatingCache<TaxonomyNames>();
+		taxonomyNamesStore[TAXONOMY_NAMES_CACHE_KEY] = cache;
+		return cache;
 	})();
 
-function setTaxonomyNamesCache(cache: Map<string, Set<string>> | null): void {
-	taxonomyNamesHolder.cache = cache;
-}
-
-/**
- * Get taxonomy names attached to a collection (cached for the primary DB,
- * bypassed only when the per-request DB is an isolated instance — playground /
- * DO preview). Plain D1 Sessions routing shares schema with the singleton, so
- * the isolate-wide cache stays valid.
- */
-async function getTaxonomyNames(db: Kysely<Database>, collection: string): Promise<Set<string>> {
-	const hasIsolatedDb = getRequestContext()?.dbIsIsolated === true;
-
-	if (!hasIsolatedDb && taxonomyNamesHolder.cache) {
-		return taxonomyNamesHolder.cache.get(collection) ?? new Set();
-	}
-
+async function fetchTaxonomyNames(db: Kysely<Database>): Promise<TaxonomyNames> {
 	try {
 		const defs = await selectTaxonomyDefs(db).execute();
-		const namesByCollection = new Map<string, Set<string>>();
+		const namesByCollection: TaxonomyNames = new Map();
 		for (const def of defs) {
-			let collections: unknown;
-			try {
-				collections = JSON.parse(def.collections ?? "[]");
-			} catch {
-				continue;
-			}
-			if (!Array.isArray(collections)) continue;
-			for (const attachedCollection of collections) {
-				if (typeof attachedCollection !== "string") continue;
-				const names = namesByCollection.get(attachedCollection) ?? new Set<string>();
+			for (const collection of parseTaxonomyCollections(def.collections)) {
+				const names = namesByCollection.get(collection) ?? new Set<string>();
 				names.add(def.name);
-				namesByCollection.set(attachedCollection, names);
+				namesByCollection.set(collection, names);
 			}
 		}
-		if (!hasIsolatedDb) {
-			setTaxonomyNamesCache(namesByCollection);
-		}
-		return namesByCollection.get(collection) ?? new Set();
+		return namesByCollection;
 	} catch (error) {
 		if (!isMissingTableError(error) && !isMissingColumnError(error)) throw error;
-
-		const empty = new Set<string>();
-		if (!hasIsolatedDb) {
-			setTaxonomyNamesCache(new Map());
-		}
-		return empty;
+		return new Map();
 	}
 }
 
-/**
- * Reset the isolate-wide taxonomy-names cache.
- *
- * Called from `invalidateTaxonomyDefsCache()` so that creating or seeding a
- * taxonomy definition is reflected within the current isolate instead of
- * waiting for the isolate to recycle. Keeps this cache consistent with the
- * isolate-wide taxonomy-defs cache in `taxonomies/index.ts`.
- */
+async function getTaxonomyNames(db: Kysely<Database>, collection: string): Promise<Set<string>> {
+	const load = () => fetchTaxonomyNames(db);
+	const names = getRequestContext()?.dbIsIsolated
+		? await load()
+		: await revalidatingCached(taxonomyNamesCache, load, (error) => {
+				console.error("[emdash:loader] revalidating taxonomy names failed:", error);
+			});
+	return names.get(collection) ?? new Set();
+}
+
+/** Discard mappings after a local taxonomy-definition write. @internal */
 export function resetTaxonomyNamesCache(): void {
-	setTaxonomyNamesCache(null);
+	invalidateRevalidatingCache(taxonomyNamesCache);
 }
 
 /**
@@ -709,7 +736,6 @@ function revisionEntry(
 		data,
 		cacheHint: {
 			tags: [rowStr(row, "id")],
-			lastModified: row.updated_at ? new Date(rowStr(row, "updated_at")) : undefined,
 		},
 	};
 }
@@ -803,7 +829,6 @@ export async function loadEntriesByGroups(
 					data: mapRowToData(row, booleanFields),
 					cacheHint: {
 						tags: [rowStr(row, "id")],
-						lastModified: row.updated_at ? new Date(rowStr(row, "updated_at")) : undefined,
 					},
 				});
 			}
@@ -1675,8 +1700,8 @@ export async function getDb(): Promise<Kysely<Database>> {
 export async function loadPublishedDates(type: string, locale?: string) {
 	const tableName = getTableName(type);
 	const db = await getDb();
-	const result = await sql<{ published_at: string | null; updated_at: string | null }>`
-		SELECT published_at, updated_at FROM ${sql.ref(tableName)}
+	const result = await sql<{ published_at: string | null }>`
+		SELECT published_at FROM ${sql.ref(tableName)}
 		WHERE deleted_at IS NULL
 		AND ${buildStatusCondition(db, "published")}
 		${locale ? sql`AND ${localeMatches("locale", locale)}` : sql``}
@@ -2013,7 +2038,6 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, LoaderCollect
 						data,
 						cacheHint: {
 							tags: [rowStr(row, "id")],
-							lastModified: row.updated_at ? new Date(rowStr(row, "updated_at")) : undefined,
 						},
 					};
 				});
@@ -2025,23 +2049,11 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, LoaderCollect
 					nextCursor = encodeSortCursor(sortColumn, lastRow[sortColumn], String(lastRow.id));
 				}
 
-				// Collection-level cache hint uses the most recent updated_at
-				let collectionLastModified: Date | undefined;
-				for (const row of rows) {
-					if (row.updated_at) {
-						const d = new Date(rowStr(row, "updated_at"));
-						if (!collectionLastModified || d > collectionLastModified) {
-							collectionLastModified = d;
-						}
-					}
-				}
-
 				return {
 					entries,
 					nextCursor,
 					cacheHint: {
 						tags: [type],
-						lastModified: collectionLastModified,
 					},
 				};
 			} catch (error) {
@@ -2207,7 +2219,6 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, LoaderCollect
 					data: entryData,
 					cacheHint: {
 						tags: [rowStr(row, "id")],
-						lastModified: row.updated_at ? new Date(rowStr(row, "updated_at")) : undefined,
 					},
 				};
 			} catch (error) {

package/src/media/content-disposition.ts

@@ -0,0 +1,56 @@
+/**
+ * Content-Disposition header construction for media downloads.
+ *
+ * The public media file route serves every non-inline type as an attachment.
+ * Without a `filename` parameter the browser falls back to the last path
+ * segment of the URL -- the storage key -- so a downloaded PDF lands in the
+ * user's filesystem named after its ULID. These helpers build a header that
+ * names the file the way the editor uploaded it.
+ */
+
+/**
+ * Characters unsafe in a filename on one or more platforms, plus the quote and
+ * backslash that would otherwise break out of the quoted `filename=` value.
+ */
+// eslint-disable-next-line no-control-regex -- stripping control characters is the point
+const UNSAFE_FILENAME_CHARS = /[\x00-\x1F\x7F"\\/<>:|?*]/g;
+
+/** Anything outside printable ASCII, carried by `filename*` instead. */
+const NON_ASCII = /[^\x20-\x7E]/g;
+
+/**
+ * An ASCII-only, filesystem-safe rendering of `filename`, for the quoted
+ * `filename=` parameter that older clients read.
+ */
+export function toAsciiFilename(filename: string): string {
+	const cleaned = filename
+		.normalize("NFKD")
+		.replaceAll(UNSAFE_FILENAME_CHARS, "-")
+		.replaceAll(NON_ASCII, "")
+		.trim();
+	return cleaned.length > 0 ? cleaned : "download";
+}
+
+/**
+ * Build a `Content-Disposition` value.
+ *
+ * Emits both `filename` (ASCII, quoted) and RFC 5987 `filename*` (UTF-8
+ * percent-encoded) so a name with non-ASCII characters survives. Returns the
+ * bare disposition when no filename is known, which is the pre-existing
+ * behaviour for media with no database row.
+ */
+export function contentDisposition(
+	disposition: "inline" | "attachment",
+	filename?: string | null,
+): string {
+	if (!filename) return disposition;
+	const ascii = toAsciiFilename(filename);
+	// encodeURIComponent leaves ' ( ) * unescaped, but RFC 5987 attr-char does
+	// not allow them; a strict client would discard filename* and fall back to
+	// the ASCII name. Percent-encode them too.
+	const encoded = encodeURIComponent(filename).replace(
+		/['()*]/g,
+		(c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+	);
+	return `${disposition}; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}

package/src/media/normalize.ts

@@ -30,6 +30,7 @@ export function normalizeLegacyExternalMediaValue(value: MediaValue): MediaValue
  * Normalize a media field value into a consistent MediaValue shape.
  *
  * - `null`/`undefined` → `null`
+ * - Empty or whitespace-only string → `null`
  * - Bare URL string → `{ provider: "external", id: "", src: url }`
  * - Bare internal media URL → resolved via local provider's `get()`
  * - Bare local media ID → resolved via local provider's `get()`
@@ -43,6 +44,7 @@ export async function normalizeMediaValue(
 
 	// Bare string URL
 	if (typeof value === "string") {
+		if (value.trim() === "") return null;
 		return normalizeStringUrl(value, getProvider);
 	}
 

package/src/media/usage/content-fields.ts

@@ -4,6 +4,7 @@ import type { Database } from "../../database/types.js";
 import { validateIdentifier } from "../../database/validate.js";
 import { BlockTypeRegistry } from "../../schema/block-type-registry.js";
 import type { BlockType } from "../../schema/block-types.js";
+import { isStoragelessFieldRow } from "../../schema/types.js";
 import { buildCanonicalSha256Fingerprint } from "./projection-fingerprint.js";
 import type { MediaUsageExtractionField, MediaUsageExtractionSubField } from "./types.js";
 import { CONTENT_SOURCE_SCHEMA_VERSION } from "./types.js";
@@ -89,7 +90,7 @@ export async function loadContentMediaUsageFields(
 		.select(["_emdash_fields.slug", "_emdash_fields.type", "_emdash_fields.validation"])
 		.where("_emdash_collections.slug", "=", collectionSlug);
 	if (collectionId !== undefined) query = query.where("_emdash_collections.id", "=", collectionId);
-	const rows = await query.execute();
+	const rows = (await query.execute()).filter((row) => !isStoragelessFieldRow(row));
 
 	const extractionFields: ContentMediaUsageField[] = [];
 	const rowBySlug = new Map<string, FieldDiscoveryRow>();

package/src/menus/index.ts

@@ -22,9 +22,15 @@ import {
 	resolveLocaleChain,
 } from "../i18n/resolve.js";
 import { getDb } from "../loader.js";
-import { cachedQuery, CacheNamespace } from "../object-cache/index.js";
+import {
+	cachedQueryWithEpochs,
+	CacheNamespace,
+	contentCacheNamespaces,
+	isObjectCacheActive,
+} from "../object-cache/index.js";
 import type { CacheHint } from "../query.js";
 import { requestCached } from "../request-cache.js";
+import { getRequestContext } from "../request-context.js";
 import { chunks, SQL_BATCH_SIZE } from "../utils/chunks.js";
 import { sanitizeHref } from "../utils/url.js";
 import type { Menu, MenuItem, MenuItemRow } from "./types.js";
@@ -37,6 +43,19 @@ export interface MenuQueryOptions {
 	trailingSlash?: "always" | "never" | "ignore";
 }
 
+/** Per isolate: the namespaces each resolved menu was last cached under. */
+const LAST_RESOLVED_NAMESPACES_KEY = Symbol.for("emdash:menu-resolved-namespaces");
+const lastResolvedNamespaces: Map<string, string[]> =
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern
+	((globalThis as Record<symbol, unknown>)[LAST_RESOLVED_NAMESPACES_KEY] as
+		| Map<string, string[]>
+		| undefined) ??
+	(() => {
+		const map = new Map<string, string[]>();
+		(globalThis as Record<symbol, unknown>)[LAST_RESOLVED_NAMESPACES_KEY] = map;
+		return map;
+	})();
+
 /**
  * Get a menu by name with resolved URLs.
  *
@@ -49,16 +68,72 @@ export interface MenuQueryOptions {
 export async function getMenu(name: string, options: MenuQueryOptions = {}): Promise<Menu | null> {
 	const locale = resolveLocale(options.locale);
 	const trailingSlash = options.trailingSlash ?? (await getHostTrailingSlash());
-	return requestCached(`menu:${name}:${locale ?? "*"}:${trailingSlash}`, () =>
-		cachedQuery({
-			namespace: CacheNamespace.MENUS,
-			key: `${name}:${locale ?? "*"}:${trailingSlash}`,
+	const key = `${name}:${locale ?? "*"}:${trailingSlash}`;
+	return requestCached(`menu:${key}`, async () => {
+		if (!(await isObjectCacheActive())) {
+			return getMenuWithDb(name, await getDb(), { locale, trailingSlash });
+		}
+		const readRows = async () => {
+			let epoch: number | undefined;
+			const rows = await cachedQueryWithEpochs({
+				namespace: CacheNamespace.MENUS,
+				key: `rows:${name}:${locale ?? "*"}`,
+				load: async () => loadMenuRows(name, await getDb(), locale),
+				onEpochs: ([menus]) => {
+					epoch = menus;
+				},
+			});
+			return { rows, epoch };
+		};
+		const remembered = lastResolvedNamespaces.get(key);
+		const earlyRead = remembered ? undefined : await readRows();
+		const namespaces =
+			remembered ?? (earlyRead?.rows && resolvedMenuNamespaces(earlyRead.rows.items));
+		if (!namespaces) return null;
+		let resolvedEpoch: number | undefined;
+		let loaded: string[] | undefined;
+		const menu = await cachedQueryWithEpochs<Menu | null>({
+			namespace: namespaces,
+			key,
+			onEpochs: ([menus]) => {
+				resolvedEpoch = menus;
+			},
+			// Rows read before this query captured its epochs are reused only if no menu
+			// edit landed in between; otherwise the old items would be stored as current.
 			load: async () => {
-				const db = await getDb();
-				return getMenuWithDb(name, db, { locale, trailingSlash });
+				const { rows } =
+					earlyRead && earlyRead.epoch === resolvedEpoch ? earlyRead : await readRows();
+				if (!rows) return null;
+				loaded = resolvedMenuNamespaces(rows.items);
+				return resolveMenu(rows, await getDb(), trailingSlash);
 			},
-		}),
-	);
+			cacheable: (value) => value !== null && sameNamespaces(loaded, namespaces),
+		});
+		if (menu) lastResolvedNamespaces.set(key, loaded ?? namespaces);
+		else lastResolvedNamespaces.delete(key);
+		return menu;
+	});
+}
+
+/**
+ * Object-cache namespaces for a resolved menu: the menu epoch plus the content
+ * epoch of every collection its items link to, and the taxonomy epoch when it
+ * links to terms. Which links resolve depends on those rows, so publishing,
+ * unpublishing, or trashing a linked entry invalidates the cached menu.
+ */
+function resolvedMenuNamespaces(items: MenuItemRow[]): string[] {
+	const namespaces: string[] = [CacheNamespace.MENUS];
+	for (const collection of collectContentReferences(items).keys()) {
+		namespaces.push(...contentCacheNamespaces(collection));
+	}
+	if (items.some((item) => item.type === "taxonomy" && item.reference_id)) {
+		namespaces.push(CacheNamespace.TAXONOMIES);
+	}
+	return namespaces;
+}
+
+function sameNamespaces(a: readonly string[] | undefined, b: readonly string[]): boolean {
+	return a !== undefined && a.length === b.length && a.every((namespace, i) => namespace === b[i]);
 }
 
 async function getHostTrailingSlash(): Promise<"always" | "never" | "ignore"> {
@@ -81,7 +156,21 @@ export async function getMenuWithDb(
 	db: Kysely<Database>,
 	options: MenuQueryOptions = {},
 ): Promise<Menu | null> {
-	const chain = resolveLocaleChain(options.locale);
+	const rows = await loadMenuRows(name, db, options.locale);
+	return rows && resolveMenu(rows, db, options.trailingSlash);
+}
+
+interface MenuRows {
+	menu: Omit<Menu, "items">;
+	items: MenuItemRow[];
+}
+
+async function loadMenuRows(
+	name: string,
+	db: Kysely<Database>,
+	requestedLocale: string | undefined,
+): Promise<MenuRows | null> {
+	const chain = resolveLocaleChain(requestedLocale);
 
 	let query = db
 		.selectFrom("_emdash_menus as m")
@@ -116,15 +205,26 @@ export async function getMenuWithDb(
 		(row): row is typeof row & MenuItemRow => row.m_id === menuId && row.id !== null,
 	);
 
-	const items = await buildMenuTree(itemRows, db, menuRow.m_locale, options.trailingSlash);
+	return {
+		menu: {
+			id: menuRow.m_id,
+			name: menuRow.m_name,
+			label: menuRow.m_label,
+			locale: menuRow.m_locale,
+			translationGroup: menuRow.m_translation_group,
+		},
+		items: itemRows,
+	};
+}
 
+async function resolveMenu(
+	rows: MenuRows,
+	db: Kysely<Database>,
+	trailingSlash: MenuQueryOptions["trailingSlash"],
+): Promise<Menu> {
 	return {
-		id: menuRow.m_id,
-		name: menuRow.m_name,
-		label: menuRow.m_label,
-		items,
-		locale: menuRow.m_locale,
-		translationGroup: menuRow.m_translation_group,
+		...rows.menu,
+		items: await buildMenuTree(rows.items, db, rows.menu.locale, trailingSlash),
 	};
 }
 
@@ -206,6 +306,7 @@ async function buildMenuTree(
 
 	const itemMap = new Map<string, MenuItem & { children: MenuItem[] }>();
 	const rootItems: MenuItem[] = [];
+	const itemIds = new Set(items.map((item) => item.id));
 
 	for (const item of validItems) {
 		itemMap.set(item.id, { ...item, children: [] });
@@ -214,10 +315,8 @@ async function buildMenuTree(
 	for (const item of items) {
 		const menuItem = itemMap.get(item.id);
 		if (!menuItem) continue;
-		if (item.parent_id) {
-			const parent = itemMap.get(item.parent_id);
-			if (parent) parent.children.push(menuItem);
-			else rootItems.push(menuItem);
+		if (item.parent_id && itemIds.has(item.parent_id)) {
+			itemMap.get(item.parent_id)?.children.push(menuItem);
 		} else {
 			rootItems.push(menuItem);
 		}
@@ -379,6 +478,8 @@ interface ContentReferenceRow {
 	published_at: string | null;
 	locale: string;
 	translation_group: string;
+	status: string;
+	deleted_at: string | null;
 }
 
 interface ResolvedContentReference {
@@ -394,19 +495,27 @@ async function resolveContentReferences(
 	references: Map<string, Set<string>>,
 	locale: string,
 ): Promise<ContentReferenceLookup> {
+	// Edit mode renders drafts, so a menu link to one still leads somewhere there.
+	const editMode = getRequestContext()?.editMode === true;
+	const isVisible = (row: { status: string; deleted_at: string | null }) =>
+		row.deleted_at === null && (editMode || row.status === "published");
 	const entries = await Promise.all(
 		Array.from(references, async ([collection, referenceGroups]) => {
 			const lookup = new Map<string, ResolvedContentReference>();
 			const localized = new Map<string, ContentReferenceRow>();
+			const found = new Set<string>();
 			try {
 				validateIdentifier(collection, "menu item collection");
 				for (const batch of chunks([...referenceGroups], SQL_BATCH_SIZE)) {
 					const result = await sql<ContentReferenceRow>`
-						SELECT id, slug, published_at, locale, translation_group
+						SELECT id, slug, published_at, locale, translation_group, status, deleted_at
 						FROM ${sql.ref(`ec_${collection}`)}
 						WHERE translation_group IN (${sql.join(batch)})
 					`.execute(db);
 					for (const row of result.rows) {
+						// A hidden row still counts as found, so the legacy id lookup below is skipped.
+						found.add(row.translation_group);
+						if (!isVisible(row)) continue;
 						const existing = localized.get(row.translation_group);
 						if (shouldPreferLocalizedRow(row, existing, locale)) {
 							localized.set(row.translation_group, row);
@@ -417,13 +526,16 @@ async function resolveContentReferences(
 					lookup.set(referenceGroup, { id: row.id, slug: row.slug, publishedAt: row.published_at });
 				}
 
-				const unresolved = [...referenceGroups].filter((id) => !lookup.has(id));
+				const unresolved = [...referenceGroups].filter((id) => !found.has(id));
 				for (const batch of chunks(unresolved, SQL_BATCH_SIZE)) {
-					const result = await sql<Pick<ContentReferenceRow, "id" | "slug" | "published_at">>`
-						SELECT id, slug, published_at FROM ${sql.ref(`ec_${collection}`)}
+					const result = await sql<
+						Pick<ContentReferenceRow, "id" | "slug" | "published_at" | "status" | "deleted_at">
+					>`
+						SELECT id, slug, published_at, status, deleted_at FROM ${sql.ref(`ec_${collection}`)}
 						WHERE id IN (${sql.join(batch)})
 					`.execute(db);
 					for (const row of result.rows) {
+						if (!isVisible(row)) continue;
 						lookup.set(row.id, { id: row.id, slug: row.slug, publishedAt: row.published_at });
 					}
 				}