Feat/hyperdrive adapter

.gitignore

@@ -70,3 +70,4 @@ examples/wp-theme-unit-test/
 
 .perf-query-counts
 query-counts-out/
+**/.dev.vars

demos/cloudflare/.gitignore

@@ -0,0 +1 @@
+.dev.vars

demos/cloudflare/astro.config.mjs

@@ -2,15 +2,14 @@
 import cloudflare from "@astrojs/cloudflare";
 import react from "@astrojs/react";
 import {
-	d1,
+	hyperdrive,
 	r2,
-	access,
 	sandbox,
-	cloudflareCache,
-	cloudflareImages,
-	cloudflareStream,
+	//	cloudflareCache,
 } from "@emdash-cms/cloudflare";
 import { formsPlugin } from "@emdash-cms/plugin-forms";
+import { notifyOnPublishPlugin } from "@emdash-cms/plugin-notify-on-publish";
+import { notifyPostmarkPlugin } from "@emdash-cms/plugin-notify-postmark";
 import { webhookNotifierPlugin } from "@emdash-cms/plugin-webhook-notifier";
 import { defineConfig, fontProviders } from "astro/config";
 import emdash from "emdash/astro";
@@ -36,55 +35,46 @@ export default defineConfig({
 	integrations: [
 		react(),
 		emdash({
-			// D1 database - binding name must match wrangler.jsonc
-			// session: "auto" enables read replicas (nearest replica for anon,
-			// bookmark-based consistency for authenticated users)
-			database: d1({ binding: "DB", session: "auto" }),
+			// Hyperdrive database — binding name must match wrangler.jsonc
+			database: hyperdrive({ binding: "HYPERDRIVE" }),
 			// R2 storage for media
 			storage: r2({ binding: "MEDIA" }),
 			// Cloudflare Access authentication
 			// Reads CF_ACCESS_AUDIENCE from env (wrangler secret or .dev.vars)
-			auth: access({
-				teamDomain: "cloudflare-cto.cloudflareaccess.com",
-				autoProvision: true,
-				defaultRole: 30, // Author
-				// Map your IdP groups to roles (optional)
-				// roleMapping: {
-				// 	"Admins": 50,
-				// 	"Editors": 40,
-				// },
-			}),
 			// Media providers - Cloudflare Images and Stream
 			// Reads from env vars at runtime: CF_ACCOUNT_ID, CF_IMAGES_TOKEN, CF_STREAM_TOKEN
 			// Or customize with accountIdEnvVar/apiTokenEnvVar options
-			mediaProviders: [
-				cloudflareImages({
-					accountIdEnvVar: "CF_MEDIA_ACCOUNT_ID",
-					apiTokenEnvVar: "CF_MEDIA_API_TOKEN",
-					accountHash: "5LGXGUnHU18h6ehN_xjpXQ",
-				}),
-				cloudflareStream({
-					accountIdEnvVar: "CF_MEDIA_ACCOUNT_ID",
-					apiTokenEnvVar: "CF_MEDIA_API_TOKEN",
-				}),
-			],
 			// Trusted plugins (run in host worker)
 			plugins: [
 				// Test plugin that exercises all v2 APIs
 				formsPlugin(),
+				notifyOnPublishPlugin(),
+				notifyPostmarkPlugin(),
+				//	notifyOnPublishPlugin({
+				//        recipients: ["ljanaideh@atypon.com"],
+				//        collections: ["posts"],
+				//        from: "onboarding@resend.dev",
+				//        siteUrl: "https://emdash-laith.laithaljanaideh.workers.dev",
+				//      }),
+				//			notifyOnPublishPlugin({
+				//                          recipients: (process.env.EMAIL_TO || "").split(",").map(s => s.trim()).filter(Boolean),
+				//                          collections: ["posts"],
+				//                          from: process.env.EMAIL_FROM || "onboarding@resend.dev",
+				//                          siteUrl: process.env.SITE_URL || "https://emdash-laith.laithaljanaideh.workers.dev",
+				//                        }),
 			],
 			// Sandboxed plugins (run in isolated workers)
-			sandboxed: [webhookNotifierPlugin()],
+			sandboxed: [],
 			// Sandbox runner for Cloudflare
 			sandboxRunner: sandbox(),
 			// Plugin marketplace
 			marketplace: "https://marketplace.emdashcms.com",
 		}),
 	],
 	experimental: {
-		cache: {
-			provider: cloudflareCache(),
-		},
+		//	cache: {
+		//		provider: cloudflareCache(),
+		//	},
 		routeRules: {
 			"/": {
 				maxAge: 3_600,

demos/cloudflare/emdash-env.d.ts

@@ -10,7 +10,6 @@ export interface Page {
   slug: string | null;
   status: string;
   title: string;
-  template?: "Default" | "Full Width";
   content?: PortableTextBlock[];
   createdAt: Date;
   updatedAt: Date;

demos/cloudflare/package.json

@@ -8,16 +8,21 @@
     "build": "astro build",
     "build:all": "pnpm run --filter @emdash-cms/demo-cloudflare... build",
     "preview": "astro preview",
-    "deploy": "pnpm build:all && wrangler deploy",
+    "deploy": "wrangler deploy",
+    "db:bootstrap": "node scripts/bootstrap-postgres.mjs",
     "db:create": "wrangler d1 create emdash-demo",
     "db:reset:remote": "./scripts/reset-db.sh",
     "typecheck": "astro check"
   },
   "dependencies": {
+    "kysely": "^0.27.0",
+    "pg": "^8.0.0",
     "@astrojs/cloudflare": "catalog:",
     "@astrojs/react": "catalog:",
     "@emdash-cms/cloudflare": "workspace:*",
     "@emdash-cms/plugin-forms": "workspace:*",
+    "@emdash-cms/plugin-notify-on-publish": "workspace:*",
+    "@emdash-cms/plugin-notify-postmark": "workspace:*",
     "@emdash-cms/plugin-webhook-notifier": "workspace:*",
     "@tanstack/react-query": "catalog:",
     "@tanstack/react-router": "catalog:",
@@ -34,7 +39,5 @@
   },
   "emdash": {
     "seed": "seed/seed.json"
-  },
-  "peerDependencies": {},
-  "optionalDependencies": {}
+  }
 }

demos/cloudflare/scripts/bootstrap-postgres.mjs

@@ -0,0 +1,40 @@
+/**
+ * Bootstrap script — runs EmDash migrations against a PostgreSQL database.
+ *
+ * Run as part of the deploy command, or manually:
+ *
+ *   DATABASE_URL="postgres://user:pass@host:5432/db" node scripts/bootstrap-postgres.mjs
+ */
+
+import { runMigrations } from "emdash/db";
+import { Kysely, PostgresDialect } from "kysely";
+import pg from "pg";
+
+const { Pool } = pg;
+
+const connectionString = process.env.DATABASE_URL;
+if (!connectionString) {
+	console.error("Error: DATABASE_URL environment variable is required.");
+	process.exit(1);
+}
+
+console.log("Connecting to PostgreSQL...");
+const ssl = process.env.DATABASE_SSL === "false" ? false : { rejectUnauthorized: false };
+const pool = new Pool({ connectionString, max: 1, ssl });
+const db = new Kysely({ dialect: new PostgresDialect({ pool }) });
+
+try {
+	console.log("Running migrations...");
+	const { applied } = await runMigrations(db);
+
+	if (applied.length === 0) {
+		console.log("No new migrations — database is already up to date.");
+	} else {
+		console.log(`Applied ${applied.length} migration(s):`);
+		for (const m of applied) {
+			console.log(`  ✓ ${m}`);
+		}
+	}
+} finally {
+	await pool.end();
+}

demos/cloudflare/terraform/outputs.tf

@@ -0,0 +1,60 @@
+output "rds_endpoint" {
+  description = "RDS instance hostname"
+  value       = aws_db_instance.emdash.address
+}
+
+output "rds_port" {
+  description = "RDS port"
+  value       = aws_db_instance.emdash.port
+}
+
+output "rds_db_name" {
+  description = "Database name"
+  value       = aws_db_instance.emdash.db_name
+}
+
+output "connection_string" {
+  description = "DATABASE_URL for bootstrap script (uses master user — swap to emdash_app after setup)"
+  value       = "postgres://${var.master_username}:PASSWORD@${aws_db_instance.emdash.address}:${aws_db_instance.emdash.port}/${var.db_name}?sslmode=require"
+  sensitive   = false
+}
+
+output "hyperdrive_origin" {
+  description = "Host to use when running: wrangler hyperdrive update <id> --origin-host <this>"
+  value       = aws_db_instance.emdash.address
+}
+
+output "post_provision_steps" {
+  description = "Reminder of manual steps after terraform apply"
+  value       = <<-EOT
+
+    ── Post-provision checklist ────────────────────────────────────────────
+
+    1. Connect as master user and create the app user:
+
+         psql "postgres://${var.master_username}:PASSWORD@${aws_db_instance.emdash.address}:5432/${var.db_name}?sslmode=require"
+
+         CREATE USER emdash_app WITH PASSWORD 'your-app-password';
+         GRANT CONNECT ON DATABASE ${var.db_name} TO emdash_app;
+         GRANT CREATE ON SCHEMA public TO emdash_app;
+         GRANT USAGE  ON SCHEMA public TO emdash_app;
+         ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES    TO emdash_app;
+         ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO emdash_app;
+
+    2. Update Cloudflare Hyperdrive to point at the new endpoint:
+
+         wrangler hyperdrive update 01b192bf33194ecda6ad2aa1b2f2f8d2 \
+           --origin-host ${aws_db_instance.emdash.address} \
+           --origin-port 5432 \
+           --database ${var.db_name} \
+           --origin-user emdash_app
+
+    3. Update DATABASE_URL in Cloudflare Pages env vars:
+
+         postgres://emdash_app:PASSWORD@${aws_db_instance.emdash.address}:5432/${var.db_name}?sslmode=require
+
+    4. Push a new commit to trigger the Pages build (which runs migrations).
+
+    ────────────────────────────────────────────────────────────────────────
+  EOT
+}

demos/cloudflare/worker-configuration.d.ts

@@ -7,7 +7,7 @@ declare namespace Cloudflare {
 	}
 	interface Env {
 		MEDIA: R2Bucket;
-		DB: D1Database;
+		HYPERDRIVE: Hyperdrive;
 		LOADER: WorkerLoader;
 		CF_ACCESS_AUDIENCE: string;
 		CF_MEDIA_API_TOKEN: string;

demos/cloudflare/wrangler.jsonc

@@ -1,37 +1,38 @@
 {
 	"$schema": "node_modules/wrangler/config-schema.json",
-	"name": "emdash-demo",
+	"name": "emdash-laith",
 	"main": "./src/worker.ts",
 	"compatibility_date": "2026-01-14",
-	// disable_nodejs_process_v2 needed until unenv fix lands in Pages
-	// See: https://github.com/withastro/astro/issues/14511
 	"compatibility_flags": ["nodejs_compat", "disable_nodejs_process_v2"],
-	// Static assets served from dist/
-	"routes": [
+
+	// Hyperdrive binding — emdash-pg config pointing to emdash-demo RDS
+	"hyperdrive": [
 		{
-			"pattern": "demo.emdashcms.com",
-			"zone_name": "demo.emdashcms.com",
-			"custom_domain": true,
+			"binding": "HYPERDRIVE",
+			"id": "01b192bf33194ecda6ad2aa1b2f2f8d2",
 		},
 	],
-	// D1 Database binding
-	"d1_databases": [
-		{
-			"binding": "DB",
-			"database_name": "emdash_db",
-		},
-	],
-	// R2 bucket for media storage
+
+	// R2 bucket — points to existing my-emdash-media bucket
 	"r2_buckets": [
 		{
 			"binding": "MEDIA",
-			"bucket_name": "emdash-media",
+			"bucket_name": "my-emdash-media",
 		},
 	],
-	// Observability
+
 	"observability": {
 		"enabled": true,
 	},
+
+	// KV namespace for Astro session storage
+	"kv_namespaces": [
+		{
+			"binding": "SESSION",
+			"id": "0516c5af42c24460b6a9eba751ffc0e3",
+		},
+	],
+
 	// Worker Loader for plugin sandboxing
 	"worker_loaders": [
 		{