emdash 0.17.1 → 0.18.0

package/src/emdash-runtime.ts

@@ -22,7 +22,7 @@ import { getAuthMode } from "./auth/mode.js";
 import { getTrustedProxyHeaders } from "./auth/trusted-proxy.js";
 import { isSqlite } from "./database/dialect-helpers.js";
 import { kyselyLogOption } from "./database/instrumentation.js";
-import { runMigrations } from "./database/migrations/runner.js";
+import { MIGRATION_RACE_WAIT_MS, runMigrations } from "./database/migrations/runner.js";
 import { RevisionRepository } from "./database/repositories/revision.js";
 import type { ContentItem as ContentItemInternal } from "./database/repositories/types.js";
 import { validateIdentifier } from "./database/validate.js";
@@ -41,6 +41,7 @@ import type {
 } from "./plugins/types.js";
 import type { FieldType } from "./schema/types.js";
 import { hashString } from "./utils/hash.js";
+import { createInitLock, type InitLock, initWithLock } from "./utils/init-lock.js";
 import { COMMIT, VERSION } from "./version.js";
 
 const LEADING_SLASH_PATTERN = /^\//;
@@ -310,9 +311,38 @@ function contentItemToRecord(item: ContentItemInternal): Record<string, unknown>
 	return { ...item };
 }
 
-// Module-level caches (persist across requests within worker)
-const dbCache = new Map<string, Kysely<Database>>();
-let dbInitPromise: Promise<Kysely<Database>> | null = null;
+/**
+ * Db init lock reclaim deadline. Derived from the migration race wait so
+ * they can't drift apart: a healthy init can legitimately block for the
+ * full MIGRATION_RACE_WAIT_MS inside waitForConcurrentMigrator, plus cold
+ * connect and migrator work, before it should be presumed dead. The outer
+ * runtime init lock (middleware.ts) must use a strictly larger deadline —
+ * it wraps create() → getDatabase() → this lock, and equal deadlines would
+ * let the outer reclaim while the inner is legitimately still working.
+ */
+export const DB_INIT_DEADLINE_MS = MIGRATION_RACE_WAIT_MS + 20_000;
+
+/**
+ * Db cache + its init lock live on globalThis behind a Symbol: the bundler
+ * can duplicate this module across SSR chunks (same reasoning as
+ * request-cache.ts), and a duplicated cache/lock would mean concurrent
+ * independent db inits — and duplicate migrators — per isolate.
+ */
+const DB_HOLDER_KEY = Symbol.for("emdash:db-cache");
+interface DbHolder {
+	cache: Map<string, Kysely<Database>>;
+	lock: InitLock;
+}
+const globalSymbolStore = globalThis as Record<symbol, unknown>;
+function getDbHolder(): DbHolder {
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis symbol slot, written only below
+	let holder = globalSymbolStore[DB_HOLDER_KEY] as DbHolder | undefined;
+	if (!holder) {
+		holder = { cache: new Map<string, Kysely<Database>>(), lock: createInitLock() };
+		globalSymbolStore[DB_HOLDER_KEY] = holder;
+	}
+	return holder;
+}
 const storageCache = new Map<string, Storage>();
 const sandboxedPluginCache = new Map<string, SandboxedPluginInstance>();
 /**
@@ -887,19 +917,45 @@ export class EmDashRuntime {
 		// Initialize storage (sync)
 		const storage = EmDashRuntime.getStorage(deps);
 
-		// Fetch plugin states from database
+		// Fetch plugin states and site info concurrently — independent reads
+		// against different tables (_plugin_state vs options), so they share
+		// one round-trip window instead of paying two sequential ones. Each
+		// phase() wrapper still records that phase's own duration, and each
+		// body keeps its own non-fatal catch.
 		let pluginStates: Map<string, string> = new Map();
-		await phase("rt.plugins", "Plugin states", async () => {
-			try {
-				const states = await db
-					.selectFrom("_plugin_state")
-					.select(["plugin_id", "status"])
-					.execute();
-				pluginStates = new Map(states.map((s) => [s.plugin_id, s.status]));
-			} catch {
-				// Plugin state table may not exist yet
-			}
-		});
+		let siteInfo: { siteName?: string; siteUrl?: string; locale?: string } | undefined;
+		await Promise.all([
+			// Fetch plugin states from database
+			phase("rt.plugins", "Plugin states", async () => {
+				try {
+					const states = await db
+						.selectFrom("_plugin_state")
+						.select(["plugin_id", "status"])
+						.execute();
+					pluginStates = new Map(states.map((s) => [s.plugin_id, s.status]));
+				} catch {
+					// Plugin state table may not exist yet
+				}
+			}),
+			// Load site info for plugin context extensions (1 batch query instead of 3)
+			phase("rt.site", "Site info options", async () => {
+				try {
+					const optionsRepo = new OptionsRepository(db);
+					const siteOpts = await optionsRepo.getMany<string>([
+						"emdash:site_title",
+						"emdash:site_url",
+						"emdash:locale",
+					]);
+					siteInfo = {
+						siteName: siteOpts.get("emdash:site_title") ?? undefined,
+						siteUrl: siteOpts.get("emdash:site_url") ?? undefined,
+						locale: siteOpts.get("emdash:locale") ?? undefined,
+					};
+				} catch {
+					// Options table may not exist yet (pre-setup)
+				}
+			}),
+		]);
 
 		// Build set of enabled plugins
 		const enabledPlugins = new Set<string>();
@@ -910,26 +966,6 @@ export class EmDashRuntime {
 			}
 		}
 
-		// Load site info for plugin context extensions (1 batch query instead of 3)
-		let siteInfo: { siteName?: string; siteUrl?: string; locale?: string } | undefined;
-		await phase("rt.site", "Site info options", async () => {
-			try {
-				const optionsRepo = new OptionsRepository(db);
-				const siteOpts = await optionsRepo.getMany<string>([
-					"emdash:site_title",
-					"emdash:site_url",
-					"emdash:locale",
-				]);
-				siteInfo = {
-					siteName: siteOpts.get("emdash:site_title") ?? undefined,
-					siteUrl: siteOpts.get("emdash:site_url") ?? undefined,
-					locale: siteOpts.get("emdash:locale") ?? undefined,
-				};
-			} catch {
-				// Options table may not exist yet (pre-setup)
-			}
-		});
-
 		// Build the full list of pipeline-eligible plugins: all configured
 		// plugins (regardless of current enabled status) plus built-in plugins.
 		// rebuildHookPipeline() filters this to only enabled plugins.
@@ -1050,32 +1086,43 @@ export class EmDashRuntime {
 			EmDashRuntime.loadSandboxedPlugins(deps, db, storage),
 		);
 
-		// Cold-start: load marketplace-installed plugins from site R2 via
-		// the sandbox runner. In bypass mode this was already handled above.
+		// Cold-start: load marketplace- and registry-installed plugins from
+		// site R2 via the sandbox runner. The two tiers only depend on the
+		// sandbox phase above, not on each other, so when both are enabled
+		// they run concurrently instead of paying two sequential loads.
+		// In bypass mode marketplace plugins were already handled above.
+		const installedTierPhases: Promise<void>[] = [];
 		if (deps.config.marketplace && storage && !deps.sandboxBypassed) {
-			await phase("rt.market", "Marketplace plugins", () =>
-				EmDashRuntime.loadInstalledSandboxedPlugins(
-					"marketplace",
-					db,
-					storage,
-					deps,
-					sandboxedPlugins,
+			installedTierPhases.push(
+				phase("rt.market", "Marketplace plugins", () =>
+					EmDashRuntime.loadInstalledSandboxedPlugins(
+						"marketplace",
+						db,
+						storage,
+						deps,
+						sandboxedPlugins,
+					),
 				),
 			);
 		}
 
 		// Cold-start: load registry-installed plugins from site R2
 		if (deps.config.experimental?.registry && storage) {
-			await phase("rt.registry", "Registry plugins", () =>
-				EmDashRuntime.loadInstalledSandboxedPlugins(
-					"registry",
-					db,
-					storage,
-					deps,
-					sandboxedPlugins,
+			installedTierPhases.push(
+				phase("rt.registry", "Registry plugins", () =>
+					EmDashRuntime.loadInstalledSandboxedPlugins(
+						"registry",
+						db,
+						storage,
+						deps,
+						sandboxedPlugins,
+					),
 				),
 			);
 		}
+		if (installedTierPhases.length > 0) {
+			await Promise.all(installedTierPhases);
+		}
 
 		// Initialize media providers
 		const mediaProviders = new Map<string, MediaProvider>();
@@ -1270,83 +1317,86 @@ export class EmDashRuntime {
 
 		const cacheKey = dbConfig.entrypoint;
 
-		// Return cached instance if available
-		const cached = dbCache.get(cacheKey);
-		if (cached) {
-			return cached;
-		}
-
-		// Use initialization lock to prevent race conditions.
-		// Sharing this promise across requests is safe because the Kysely instance
-		// doesn't hold a request-scoped resource — the DO dialect uses a getStub()
-		// factory that creates a fresh stub per query execution.
-		if (dbInitPromise) {
-			return dbInitPromise;
-		}
-
-		dbInitPromise = (async () => {
-			const dialect = deps.createDialect(dbConfig.config);
-			const db = new Kysely<Database>({ dialect, log: kyselyLogOption() });
-
-			await runMigrations(db);
-
-			// Note: legacy installs may carry a stray `emdash:manifest_cache`
-			// row in the options table from versions that persisted a JSON
-			// manifest. The runtime no longer reads or writes it. We do not
-			// proactively delete it: the row is a few hundred bytes of dead
-			// weight and is never on the read path, whereas a one-shot
-			// cleanup-flag check costs an extra `options.get()` on every
-			// isolate cold boot forever. Cheaper to leave it.
-
-			// Auto-seed schema if no collections exist and setup hasn't run.
-			// This covers first-load on sites that skip the setup wizard.
-			// Dev-bypass and the wizard apply seeds explicitly.
-			try {
-				const [collectionCount, setupOption] = await Promise.all([
-					db
-						.selectFrom("_emdash_collections")
-						.select((eb) => eb.fn.countAll<number>().as("count"))
-						.executeTakeFirstOrThrow(),
-					db
-						.selectFrom("options")
-						.select("value")
-						.where("name", "=", "emdash:setup_complete")
-						.executeTakeFirst(),
-				]);
-
-				const setupDone = (() => {
-					try {
-						return setupOption && JSON.parse(setupOption.value) === true;
-					} catch {
-						return false;
-					}
-				})();
-
-				if (collectionCount.count === 0 && !setupDone) {
-					const { applySeed } = await import("./seed/apply.js");
-					const { loadSeed } = await import("./seed/load.js");
-					const { validateSeed } = await import("./seed/validate.js");
-
-					const seed = await loadSeed();
-					const validation = validateSeed(seed);
-					if (validation.valid) {
-						await applySeed(db, seed, { onConflict: "skip" });
-						console.log("Auto-seeded default collections");
+		// Waiters poll the cache rather than sharing the initializing request's
+		// promise: if the request that owns the init is cancelled mid-await
+		// (e.g. client disconnect during cold migrations), a shared promise
+		// never settles — and the owner's `finally` that would clear it never
+		// runs — deadlocking every later request in the isolate. Prevention:
+		// the in-flight init is anchored via after()/waitUntil so a cancelled
+		// owner's init still completes and populates the cache. Net: a stale
+		// lock is reclaimed after a deadline.
+		const holder = getDbHolder();
+		return initWithLock(
+			holder.lock,
+			() => holder.cache.get(cacheKey),
+			async (isCurrentClaim) => {
+				const dialect = deps.createDialect(dbConfig.config);
+				const db = new Kysely<Database>({ dialect, log: kyselyLogOption() });
+
+				await runMigrations(db);
+
+				// Note: legacy installs may carry a stray `emdash:manifest_cache`
+				// row in the options table from versions that persisted a JSON
+				// manifest. The runtime no longer reads or writes it. We do not
+				// proactively delete it: the row is a few hundred bytes of dead
+				// weight and is never on the read path, whereas a one-shot
+				// cleanup-flag check costs an extra `options.get()` on every
+				// isolate cold boot forever. Cheaper to leave it.
+
+				// Auto-seed schema if no collections exist and setup hasn't run.
+				// This covers first-load on sites that skip the setup wizard.
+				// Dev-bypass and the wizard apply seeds explicitly.
+				try {
+					const [collectionCount, setupOption] = await Promise.all([
+						db
+							.selectFrom("_emdash_collections")
+							.select((eb) => eb.fn.countAll<number>().as("count"))
+							.executeTakeFirstOrThrow(),
+						db
+							.selectFrom("options")
+							.select("value")
+							.where("name", "=", "emdash:setup_complete")
+							.executeTakeFirst(),
+					]);
+
+					const setupDone = (() => {
+						try {
+							return setupOption && JSON.parse(setupOption.value) === true;
+						} catch {
+							return false;
+						}
+					})();
+
+					if (collectionCount.count === 0 && !setupDone) {
+						const { applySeed } = await import("./seed/apply.js");
+						const { loadSeed } = await import("./seed/load.js");
+						const { validateSeed } = await import("./seed/validate.js");
+
+						const seed = await loadSeed();
+						const validation = validateSeed(seed);
+						if (validation.valid) {
+							await applySeed(db, seed, { onConflict: "skip" });
+							console.log("Auto-seeded default collections");
+						}
 					}
+				} catch {
+					// Tables may not exist yet. Non-fatal.
 				}
-			} catch {
-				// Tables may not exist yet. Non-fatal.
-			}
 
-			dbCache.set(cacheKey, db);
-			return db;
-		})();
-
-		try {
-			return await dbInitPromise;
-		} finally {
-			dbInitPromise = null;
-		}
+				// Publish only while still the current owner: a reclaimed slow
+				// init must not flip the cached Kysely identity back after the
+				// reclaimer has published its own. The unpublished instance is
+				// still returned and fully valid for the request that built it.
+				if (isCurrentClaim()) {
+					holder.cache.set(cacheKey, db);
+				}
+				return db;
+			},
+			{
+				deadlineMs: DB_INIT_DEADLINE_MS,
+				anchor: (promise) => after(() => promise),
+			},
+		);
 	}
 
 	/**
@@ -1778,6 +1828,7 @@ export class EmDashRuntime {
 			pipeline,
 			isActive: () => true,
 			getOption: (key) => optionsRepo.get<string>(key),
+			getOptions: (keys) => optionsRepo.getMany<string>(keys),
 			setOption: (key, value) => optionsRepo.set(key, value),
 			deleteOption: async (key) => {
 				await optionsRepo.delete(key);

package/src/menus/index.ts

@@ -136,15 +136,10 @@ async function buildMenuTree(
 		}
 	}
 
-	const urlPatterns = new Map<string, string | null>();
-	if (collectionSlugs.size > 0) {
-		const rows = await db
-			.selectFrom("_emdash_collections")
-			.select(["slug", "url_pattern"])
-			.where("slug", "in", [...collectionSlugs])
-			.execute();
-		for (const row of rows) urlPatterns.set(row.slug, row.url_pattern);
-	}
+	const urlPatterns =
+		collectionSlugs.size > 0
+			? await getCollectionUrlPatterns(db, collectionSlugs)
+			: new Map<string, string | null>();
 
 	const resolvedItems = await Promise.all(
 		items.map((item) => resolveMenuItem(item, db, urlPatterns, locale)),
@@ -173,6 +168,29 @@ async function buildMenuTree(
 	return rootItems;
 }
 
+/**
+ * Look up the `url_pattern` for a set of collection slugs, request-cached so
+ * a page rendering several menus (header, footer, ...) only pays for the
+ * lookup once per distinct slug set. Callers must treat the returned map as
+ * read-only — it is shared across cache hits within the request.
+ */
+function getCollectionUrlPatterns(
+	db: Kysely<Database>,
+	collectionSlugs: Set<string>,
+): Promise<Map<string, string | null>> {
+	const key = `menu-collection-patterns:${[...collectionSlugs].toSorted().join(",")}`;
+	return requestCached(key, async () => {
+		const rows = await db
+			.selectFrom("_emdash_collections")
+			.select(["slug", "url_pattern"])
+			.where("slug", "in", [...collectionSlugs])
+			.execute();
+		const urlPatterns = new Map<string, string | null>();
+		for (const row of rows) urlPatterns.set(row.slug, row.url_pattern);
+		return urlPatterns;
+	});
+}
+
 /**
  * Resolve a single menu item's URL. `reference_id` is a translation_group
  * (migration 036 remapped all existing references); we join it against

package/src/plugins/hooks.ts

@@ -1297,6 +1297,13 @@ export interface ExclusiveHookResolutionOptions {
 	isActive: (pluginId: string) => boolean;
 	/** Read an option value from persistent storage. */
 	getOption: (key: string) => Promise<string | null>;
+	/**
+	 * Batch-read option values for many keys in a single round trip.
+	 * When provided, resolution reads all current selections through this
+	 * instead of one getOption() call per hook. Keys absent from the
+	 * returned map are treated as unset.
+	 */
+	getOptions?: (keys: string[]) => Promise<ReadonlyMap<string, string>>;
 	/** Write an option value to persistent storage. */
 	setOption: (key: string, value: string) => Promise<void>;
 	/** Delete an option from persistent storage. */
@@ -1322,8 +1329,26 @@ const EXCLUSIVE_HOOK_KEY_PREFIX = "emdash:exclusive_hook:";
  * 5. If multiple providers and no hint → leave unselected (admin must choose).
  */
 export async function resolveExclusiveHooks(opts: ExclusiveHookResolutionOptions): Promise<void> {
-	const { pipeline, isActive, getOption, setOption, deleteOption, preferredHints } = opts;
+	const { pipeline, isActive, getOption, getOptions, setOption, deleteOption, preferredHints } =
+		opts;
 	const exclusiveHookNames = pipeline.getRegisteredExclusiveHooks();
+	if (exclusiveHookNames.length === 0) return;
+
+	// Batch-read current selections in one round trip when the caller
+	// provides a batch reader (1 query instead of N sequential gets).
+	let batchedSelections: ReadonlyMap<string, string> | undefined;
+	if (getOptions) {
+		try {
+			batchedSelections = await getOptions(
+				exclusiveHookNames.map((hookName) => `${EXCLUSIVE_HOOK_KEY_PREFIX}${hookName}`),
+			);
+		} catch {
+			// Options table may not be ready. Matches the per-key tolerance
+			// below: every hook's read would fail, so resolution is skipped
+			// entirely without touching any selection.
+			return;
+		}
+	}
 
 	for (const hookName of exclusiveHookNames) {
 		const providers = pipeline.getExclusiveHookProviders(hookName);
@@ -1333,11 +1358,15 @@ export async function resolveExclusiveHooks(opts: ExclusiveHookResolutionOptions
 
 		const key = `${EXCLUSIVE_HOOK_KEY_PREFIX}${hookName}`;
 		let currentSelection: string | null = null;
-		try {
-			currentSelection = await getOption(key);
-		} catch {
-			// Options table may not be ready
-			continue;
+		if (batchedSelections) {
+			currentSelection = batchedSelections.get(key) ?? null;
+		} else {
+			try {
+				currentSelection = await getOption(key);
+			} catch {
+				// Options table may not be ready
+				continue;
+			}
 		}
 
 		// If selection exists and the plugin is still active → keep it

package/src/plugins/manager.ts

@@ -544,6 +544,7 @@ export class PluginManager {
 			pipeline: this.hookPipeline!,
 			isActive: (pluginId) => this.isActive(pluginId),
 			getOption: (key) => optionsRepo.get<string>(key),
+			getOptions: (keys) => optionsRepo.getMany<string>(keys),
 			setOption: (key, value) => optionsRepo.set(key, value),
 			deleteOption: async (key) => {
 				await optionsRepo.delete(key);

package/src/schema/zod-generator.ts

@@ -288,6 +288,9 @@ export function generateTypeScript(collection: CollectionWithFields): string {
 	lines.push(`  publishedAt: Date | null;`);
 	// Bylines are eagerly loaded by getEmDashCollection/getEmDashEntry
 	lines.push(`  bylines?: ContentBylineCredit[];`);
+	// Taxonomy terms are eagerly loaded by getEmDashCollection/getEmDashEntry,
+	// keyed by taxonomy name (e.g. data.terms?.tag)
+	lines.push(`  terms?: Record<string, TaxonomyTerm[]>;`);
 	lines.push(`}`);
 
 	return lines.join("\n");
@@ -312,8 +315,9 @@ export function generateTypesFile(collections: CollectionWithFields[]): string {
 		c.fields.some((f) => f.type === "portableText"),
 	);
 
-	// Build imports - ContentBylineCredit is always needed for bylines
-	const imports = ["ContentBylineCredit"];
+	// Build imports - ContentBylineCredit and TaxonomyTerm are always needed
+	// for the hydrated bylines/terms fields
+	const imports = ["ContentBylineCredit", "TaxonomyTerm"];
 	if (needsPortableText) {
 		imports.push("PortableTextBlock");
 	}

package/src/seo/index.ts

@@ -170,7 +170,16 @@ function buildMediaUrl(imageRef: string, siteUrl?: string): string {
 		return imageRef;
 	}
 
-	// Build from media API path
+	// Root-relative path — the CMS SEO panel stores seo_image as
+	// "/_emdash/api/media/file/01KS....svg" (already includes the API
+	// prefix). Without this branch we'd re-prefix and produce
+	// "${siteUrl}/_emdash/api/media/file//_emdash/api/media/file/<id>"
+	// which 404s and breaks <meta property="og:image">.
+	if (imageRef.startsWith("/")) {
+		return siteUrl ? `${siteUrl.replace(TRAILING_SLASH_RE, "")}${imageRef}` : imageRef;
+	}
+
+	// Bare media_id — build the full media API path
 	const mediaPath = `/_emdash/api/media/file/${imageRef}`;
 	if (siteUrl) {
 		return `${siteUrl.replace(TRAILING_SLASH_RE, "")}${mediaPath}`;

package/src/taxonomies/index.ts

@@ -189,13 +189,6 @@ export async function getTerm(
 
 	if (!row) return null;
 
-	const countResult = await db
-		.selectFrom("content_taxonomies")
-		.select((eb) => eb.fn.count<number>("entry_id").as("count"))
-		.where("taxonomy_id", "=", row.translation_group ?? row.id)
-		.executeTakeFirst();
-	const count = countResult?.count ?? 0;
-
 	let childrenQuery = db
 		.selectFrom("taxonomies")
 		.selectAll()
@@ -203,7 +196,18 @@ export async function getTerm(
 		.orderBy("label", "asc");
 	const termLocale = row.locale;
 	if (termLocale) childrenQuery = childrenQuery.where("locale", "=", termLocale);
-	const childRows = await childrenQuery.execute();
+
+	// The usage-count and children queries both depend only on the term row,
+	// so run them concurrently to save a round trip on remote databases.
+	const [countResult, childRows] = await Promise.all([
+		db
+			.selectFrom("content_taxonomies")
+			.select((eb) => eb.fn.count<number>("entry_id").as("count"))
+			.where("taxonomy_id", "=", row.translation_group ?? row.id)
+			.executeTakeFirst(),
+		childrenQuery.execute(),
+	]);
+	const count = countResult?.count ?? 0;
 
 	const children = childRows.map<TaxonomyTerm>((child) => ({
 		id: child.id,