emdash 0.18.0 → 0.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emdash",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Astro-native CMS with WordPress migration support",
   "type": "module",
   "main": "dist/index.mjs",
@@ -178,7 +178,7 @@
     "#types": "./src/astro/types.js"
   },
   "dependencies": {
-    "@atcute/lexicons": "^1.3.0",
+    "@atcute/lexicons": "^2.0.0",
     "@atcute/multibase": "^1.2.0",
     "@floating-ui/react": "^0.27.16",
     "@modelcontextprotocol/sdk": "^1.26.0",
@@ -217,12 +217,12 @@
     "ulidx": "^2.4.1",
     "upng-js": "^2.1.0",
     "zod": "^4.4.1",
-    "@atcute/client": "^4.2.1",
-    "@emdash-cms/admin": "0.18.0",
-    "@emdash-cms/gutenberg-to-portable-text": "0.18.0",
-    "@emdash-cms/auth": "0.18.0",
-    "@emdash-cms/registry-client": "0.3.1",
-    "@emdash-cms/plugin-types": "0.0.1"
+    "@atcute/client": "^5.0.0",
+    "@emdash-cms/admin": "0.20.0",
+    "@emdash-cms/auth": "0.20.0",
+    "@emdash-cms/gutenberg-to-portable-text": "0.20.0",
+    "@emdash-cms/plugin-types": "0.1.0",
+    "@emdash-cms/registry-client": "0.3.2"
   },
   "optionalDependencies": {
     "@libsql/kysely-libsql": "^0.4.0",
@@ -248,14 +248,14 @@
     "@types/react": "19.2.14",
     "@types/sanitize-html": "^2.16.0",
     "@types/sax": "^1.2.7",
-    "@vitest/ui": "^4.1.7",
+    "@vitest/ui": "^4.1.8",
     "publint": "0.3.17",
     "tsdown": "0.20.3",
     "typescript": "^6.0.3",
     "vite": "^6.0.0",
     "vitest": "^4.1.5",
     "zod-openapi": "^5.4.6",
-    "@emdash-cms/blocks": "0.18.0"
+    "@emdash-cms/blocks": "0.20.0"
   },
   "repository": {
     "type": "git",

package/src/api/handlers/content.ts

@@ -14,13 +14,17 @@ import { RevisionRepository } from "../../database/repositories/revision.js";
 import { SeoRepository } from "../../database/repositories/seo.js";
 import {
 	EmDashValidationError,
+	ScheduledNotDueError,
 	InvalidCursorError,
 	type BylineSummary,
 	type ContentBylineCredit,
+	type ContentDateField,
 	type ContentItem,
 	type ContentSeo,
 	type ContentSeoInput,
+	type FindManyOptions,
 } from "../../database/repositories/types.js";
+import { UserRepository } from "../../database/repositories/user.js";
 import { withTransaction } from "../../database/transaction.js";
 import type { Database } from "../../database/types.js";
 import { validateIdentifier } from "../../database/validate.js";
@@ -323,6 +327,24 @@ async function resolveSearchColumns(db: Kysely<Database>, collection: string): P
 	return columns;
 }
 
+/** Matches a date-only `YYYY-MM-DD` bound (no time component). */
+const DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/**
+ * Normalize a date-range bound to an ISO datetime for lexicographic comparison
+ * against stored ISO 8601 timestamps. A bare `YYYY-MM-DD` is widened to the
+ * appropriate UTC day boundary so the range stays inclusive: a `start` bound
+ * becomes the start of the day and an `end` bound the end of the day.
+ * Otherwise a date-only upper bound would exclude every same-day row (since
+ * `2024-06-01T12:00:00Z` sorts after `2024-06-01`). Full datetimes pass
+ * through unchanged.
+ */
+function normalizeDateBound(value: string | undefined, edge: "start" | "end"): string | undefined {
+	if (!value) return undefined;
+	if (!DATE_ONLY_RE.test(value)) return value;
+	return edge === "start" ? `${value}T00:00:00.000Z` : `${value}T23:59:59.999Z`;
+}
+
 /**
  * Create content list handler
  */
@@ -337,18 +359,28 @@ export async function handleContentList(
 		order?: "asc" | "desc";
 		locale?: string;
 		q?: string;
+		authorId?: string;
+		dateField?: ContentDateField;
+		dateFrom?: string;
+		dateTo?: string;
 	},
 ): Promise<ApiResult<ContentListResponse>> {
 	try {
 		const repo = new ContentRepository(db);
-		const where: {
-			status?: string;
-			locale?: string;
-			q?: string;
-			searchColumns?: string[];
-		} = {};
+		const where: FindManyOptions["where"] = {};
 		if (params.status) where.status = params.status;
 		if (params.locale) where.locale = params.locale;
+		if (params.authorId) where.authorId = params.authorId;
+
+		// A date range requires a target column; ignore stray from/to without
+		// a field so a half-specified filter doesn't silently drop all rows.
+		if (params.dateField && (params.dateFrom || params.dateTo)) {
+			where.dateFilter = {
+				field: params.dateField,
+				from: normalizeDateBound(params.dateFrom, "start"),
+				to: normalizeDateBound(params.dateTo, "end"),
+			};
+		}
 
 		const q = params.q?.trim();
 		if (q) {
@@ -412,6 +444,62 @@ export async function handleContentList(
 	}
 }
 
+/** A content author option for the admin author filter. */
+export interface ContentAuthor {
+	id: string;
+	name: string | null;
+	email: string;
+	avatarUrl: string | null;
+}
+
+/**
+ * List the distinct authors of a collection's live content.
+ *
+ * Backs the admin content-list author filter. Unlike `/admin/users` (ADMIN
+ * only), this is gated on `content:read`, so any editor can filter by author.
+ * Returns only users who have authored at least one non-trashed entry, sorted
+ * by display name then email for a stable dropdown order.
+ */
+export async function handleContentAuthors(
+	db: Kysely<Database>,
+	collection: string,
+): Promise<ApiResult<{ items: ContentAuthor[] }>> {
+	try {
+		const repo = new ContentRepository(db);
+		const authorIds = await repo.findDistinctAuthorIds(collection);
+		if (authorIds.length === 0) {
+			return { success: true, data: { items: [] } };
+		}
+
+		const userRepo = new UserRepository(db);
+		const users = await userRepo.findByIds(authorIds);
+
+		const items: ContentAuthor[] = users
+			.map((u) => ({ id: u.id, name: u.name, email: u.email, avatarUrl: u.avatarUrl }))
+			.toSorted((a, b) => (a.name ?? a.email).localeCompare(b.name ?? b.email));
+
+		return { success: true, data: { items } };
+	} catch (error) {
+		if (isMissingTableError(error)) {
+			return {
+				success: false,
+				error: {
+					code: "COLLECTION_NOT_FOUND",
+					message: `Collection '${collection}' not found`,
+				},
+			};
+		}
+		console.error("Content authors error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_AUTHORS_ERROR",
+				message: "Failed to list content authors",
+			},
+		};
+	}
+}
+
 /**
  * Get single content item
  */
@@ -1268,13 +1356,13 @@ export async function handleContentPublish(
 	db: Kysely<Database>,
 	collection: string,
 	id: string,
-	options: { publishedAt?: string } = {},
+	options: { publishedAt?: string; requireScheduledDue?: boolean } = {},
 ): Promise<ApiResult<ContentResponse>> {
 	try {
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
 			const resolvedId = (await resolveId(repo, collection, id)) ?? id;
-			return repo.publish(collection, resolvedId, options.publishedAt);
+			return repo.publish(collection, resolvedId, options.publishedAt, options.requireScheduledDue);
 		});
 
 		const hasSeo = await collectionHasSeo(db, collection);
@@ -1285,6 +1373,17 @@ export async function handleContentPublish(
 			data: { item },
 		};
 	} catch (error) {
+		// The scheduled sweep gates publish on the row still being due; a row
+		// unscheduled in the meantime is a silent skip, not a failure.
+		if (error instanceof ScheduledNotDueError) {
+			return {
+				success: false,
+				error: {
+					code: "NOT_DUE",
+					message: error.message,
+				},
+			};
+		}
 		if (error instanceof EmDashValidationError) {
 			return {
 				success: false,

package/src/api/handlers/index.ts

@@ -7,6 +7,8 @@
 // Content handlers
 export {
 	handleContentList,
+	handleContentAuthors,
+	type ContentAuthor,
 	handleContentGet,
 	handleContentGetIncludingTrashed,
 	handleContentCreate,

package/src/api/handlers/marketplace.ts

@@ -9,7 +9,7 @@ import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
 import { validatePluginIdentifier } from "../../database/validate.js";
-import { pluginManifestSchema } from "../../plugins/manifest-schema.js";
+import { pluginManifestSchema, reconcileManifestAccess } from "../../plugins/manifest-schema.js";
 import { normalizeManifestRoute } from "../../plugins/manifest-schema.js";
 import {
 	createMarketplaceClient,
@@ -271,10 +271,7 @@ export async function loadBundleFromR2(
 		const parsed: unknown = JSON.parse(manifestText);
 		const result = pluginManifestSchema.safeParse(parsed);
 		if (!result.success) return null;
-		// Elements are validated as unknown[] by Zod; cast to PluginManifest
-		// for the Element[] type (Block Kit validation happens at render time).
-		// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Zod types elements as unknown[]; Element type validated at render time
-		const manifest = result.data as unknown as PluginManifest;
+		const manifest = reconcileManifestAccess(result.data);
 
 		// Try to load admin code (optional)
 		let adminCode: string | undefined;

package/src/api/handlers/registry.ts

@@ -49,6 +49,8 @@ import { extractBundle } from "../../plugins/marketplace.js";
 import type { PluginBundle } from "../../plugins/marketplace.js";
 import type { SandboxRunner } from "../../plugins/sandbox/types.js";
 import { PluginStateRepository } from "../../plugins/state.js";
+import { declaredAccessToCapabilities } from "../../plugins/types.js";
+import type { DeclaredAccess } from "../../plugins/types.js";
 import {
 	canonicalCapabilitiesForDriftCheck,
 	coerceRegistryConfig,
@@ -70,6 +72,26 @@ import {
 	storeBundleInR2,
 } from "./marketplace.js";
 
+const RELEASE_EXTENSION_NSID = "com.emdashcms.experimental.package.releaseExtension";
+
+/**
+ * Whether two `declaredAccess` blocks grant exactly the same enforced access --
+ * the same capabilities AND the same host allow-list. Both are lowered through
+ * the canonical converter so that constraint content (`allowedHosts`), not just
+ * the capability set, is part of the comparison. The capability-set consent
+ * gate is blind to host scope; this is what keeps a bundle from being installed
+ * with a wider (or simply different) host allow-list than its published record
+ * advertised and the user consented to.
+ */
+export function enforcedAccessEqual(a: DeclaredAccess, b: DeclaredAccess): boolean {
+	const aa = declaredAccessToCapabilities(a);
+	const bb = declaredAccessToCapabilities(b);
+	return (
+		JSON.stringify(aa.capabilities.toSorted()) === JSON.stringify(bb.capabilities.toSorted()) &&
+		JSON.stringify(aa.allowedHosts.toSorted()) === JSON.stringify(bb.allowedHosts.toSorted())
+	);
+}
+
 // ── Types ──────────────────────────────────────────────────────────
 
 export interface RegistryInstallInput {
@@ -999,6 +1021,31 @@ export async function handleRegistryInstall(
 		// marketplace plugins that happen to share the publisher's slug.
 		bundle.manifest = { ...bundle.manifest, id: pluginId };
 
+		// Integrity: the bundle that will run MUST declare exactly the access
+		// the signed release record advertises. The consent dialog is driven
+		// from the record's `declaredAccess`, so a bundle enforcing something
+		// different -- a wider host allow-list, an extra capability -- would run
+		// outside what the user reviewed. The capability-set consent gate below
+		// is blind to constraint content (host scope), so compare the full
+		// enforced access of record vs bundle here and refuse on any difference.
+		const recordExt =
+			// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- extensions is the lexicon's open `unknown` map; narrow to read our own extension
+			(release?.extensions as Record<string, { declaredAccess?: DeclaredAccess }> | undefined)?.[
+				RELEASE_EXTENSION_NSID
+			];
+		if (
+			!enforcedAccessEqual(recordExt?.declaredAccess ?? {}, bundle.manifest.declaredAccess ?? {})
+		) {
+			return {
+				success: false,
+				error: {
+					code: "DECLARED_ACCESS_DRIFT",
+					message:
+						"The plugin bundle declares different permissions than its published record. Installation refused.",
+				},
+			};
+		}
+
 		// Capability consent gate: the admin MUST acknowledge the
 		// capabilities the bundle's manifest actually declares before we
 		// install it. The bundle manifest is the only source of truth
@@ -1488,6 +1535,29 @@ export async function handleRegistryUpdate(
 		// and R2 layout stay in sync across install and update.
 		bundle.manifest = { ...bundle.manifest, id: pluginId };
 
+		// Integrity: same gate as install. The new bundle must declare exactly
+		// the access its signed release record advertises. Without it, an update
+		// that changes only the host scope (e.g. api.good.com -> evil.com) keeps
+		// the capability set identical, sails through the escalation diff below,
+		// and installs a bundle enforcing a scope the record never showed.
+		// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- extensions is the lexicon's open `unknown` map; narrow to read our own extension
+		const updateRecordExtensions = signedRelease?.extensions as
+			| Record<string, { declaredAccess?: DeclaredAccess }>
+			| undefined;
+		const recordExt = updateRecordExtensions?.[RELEASE_EXTENSION_NSID];
+		if (
+			!enforcedAccessEqual(recordExt?.declaredAccess ?? {}, bundle.manifest.declaredAccess ?? {})
+		) {
+			return {
+				success: false,
+				error: {
+					code: "DECLARED_ACCESS_DRIFT",
+					message:
+						"The plugin bundle declares different permissions than its published record. Update refused.",
+				},
+			};
+		}
+
 		// Diff capabilities + route visibility against the currently
 		// installed bundle. Loading from R2 keeps us honest: the diff is
 		// against the bytes the sandbox is actually running, not whatever

package/src/api/handlers/seo.ts

@@ -29,6 +29,12 @@ export interface SitemapContentEntry {
 	 * alternates between siblings.
 	 */
 	translationGroup: string | null;
+	/**
+	 * Stored SEO image reference (`_emdash_seo.seo_image`), or null when
+	 * the entry has no SEO image. The route resolves it to an absolute
+	 * URL and emits it as an `<image:image>` sitemap entry.
+	 */
+	image: string | null;
 }
 
 /** Per-collection sitemap data with entries and URL pattern */
@@ -106,8 +112,9 @@ export async function handleSitemapData(
 					updated_at: string;
 					locale: string;
 					translation_group: string | null;
+					seo_image: string | null;
 				}>`
-					SELECT c.slug, c.id, c.updated_at, c.locale, c.translation_group
+					SELECT c.slug, c.id, c.updated_at, c.locale, c.translation_group, s.seo_image
 					FROM ${sql.ref(tableName)} c
 					LEFT JOIN _emdash_seo s
 						ON s.collection = ${col.slug}
@@ -129,6 +136,7 @@ export async function handleSitemapData(
 						updatedAt: row.updated_at,
 						locale: row.locale,
 						translationGroup: row.translation_group,
+						image: row.seo_image ?? null,
 					});
 				}
 

package/src/api/openapi/document.ts

@@ -24,6 +24,7 @@ import {
 import { apiErrorSchema, deleteResponseSchema, successEnvelope } from "../schemas/common.js";
 import {
 	contentCompareResponseSchema,
+	contentAuthorsResponseSchema,
 	contentCreateBody,
 	contentItemSchema,
 	contentListQuery,
@@ -597,6 +598,30 @@ const contentPaths = {
 		},
 	},
 
+	"/_emdash/api/content/{collection}/authors": {
+		get: {
+			operationId: "listContentAuthors",
+			summary: "List distinct authors of a collection's content",
+			tags: ["Content"],
+			requestParams: {
+				path: z.object({
+					collection: z.string().meta({ description: "Collection slug" }),
+				}),
+			},
+			responses: {
+				"200": {
+					description: "Content authors",
+					content: {
+						[JSON_CONTENT]: {
+							schema: successEnvelope(contentAuthorsResponseSchema),
+						},
+					},
+				},
+				...authErrors,
+				...standardErrors(500),
+			},
+		},
+	},
 	"/_emdash/api/content/{collection}/trash": {
 		get: {
 			operationId: "listTrashedContent",

package/src/api/schemas/content.ts

@@ -18,6 +18,14 @@ export const contentSeoInput = z
 	})
 	.meta({ id: "ContentSeoInput" });
 
+/** ISO 8601 date or datetime bound for the content-list date range filter. */
+const contentDateBound = z
+	.union([
+		z.iso.datetime({ offset: true, message: "must be an ISO 8601 datetime" }),
+		z.iso.date({ message: "must be an ISO 8601 date" }),
+	])
+	.optional();
+
 export const contentListQuery = cursorPaginationQuery
 	.extend({
 		status: z.string().optional(),
@@ -26,6 +34,14 @@ export const contentListQuery = cursorPaginationQuery
 		locale: localeCode.optional(),
 		/** Case-insensitive substring search across the collection's title/name/slug. */
 		q: z.string().trim().min(1).max(200).optional(),
+		/** Filter to entries authored by this user (the `author_id` column). */
+		authorId: z.string().min(1).max(64).optional(),
+		/** Which timestamp column the `dateFrom`/`dateTo` range applies to. */
+		dateField: z.enum(["createdAt", "updatedAt", "publishedAt"]).optional(),
+		/** Inclusive lower bound for the date range. Requires `dateField`. */
+		dateFrom: contentDateBound,
+		/** Inclusive upper bound for the date range. Requires `dateField`. */
+		dateTo: contentDateBound,
 	})
 	.meta({ id: "ContentListQuery" });
 
@@ -168,6 +184,23 @@ export const contentListResponseSchema = z
 	})
 	.meta({ id: "ContentListResponse" });
 
+/** A distinct content author for the admin author filter */
+export const contentAuthorSchema = z
+	.object({
+		id: z.string(),
+		name: z.string().nullable(),
+		email: z.string(),
+		avatarUrl: z.string().nullable(),
+	})
+	.meta({ id: "ContentAuthor" });
+
+/** Response for the content authors endpoint */
+export const contentAuthorsResponseSchema = z
+	.object({
+		items: z.array(contentAuthorSchema),
+	})
+	.meta({ id: "ContentAuthorsResponse" });
+
 /** Trashed content item */
 export const trashedContentItemSchema = z
 	.object({

package/src/api/schemas/schema.ts

@@ -31,7 +31,19 @@ const fieldTypeValues = z.enum([
 
 const repeaterSubFieldSchema = z.object({
 	slug: z.string().min(1).max(63).regex(slugPattern, "Invalid slug format"),
-	type: z.enum(["string", "text", "number", "integer", "boolean", "datetime", "select"]),
+	// Keep in sync with REPEATER_SUB_FIELD_TYPES in schema/types.ts.
+	// ("url" was already a documented sub-field type but missing here.)
+	type: z.enum([
+		"string",
+		"text",
+		"url",
+		"number",
+		"integer",
+		"boolean",
+		"datetime",
+		"select",
+		"image",
+	]),
 	label: z.string().min(1),
 	required: z.boolean().optional(),
 	options: z.array(z.string()).optional(),

package/src/astro/integration/index.ts

@@ -15,6 +15,7 @@ import { createRequire } from "node:module";
 import type { AstroIntegration, AstroIntegrationLogger } from "astro";
 
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
+import { INTERNAL_MEDIA_PREFIX } from "../../media/normalize.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
 import { local } from "../storage/adapters.js";
 import { notoSans } from "./font-provider.js";
@@ -59,6 +60,92 @@ const DEFAULT_STORAGE = local({
 	baseUrl: "/_emdash/api/media/file",
 });
 
+interface ImageRemotePattern {
+	protocol?: "http" | "https";
+	hostname?: string;
+	pathname?: string;
+}
+
+/**
+ * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
+ *
+ * Astro's image services only transform **absolute** URLs whose host is
+ * authorized; everything else is passed through unoptimized. We authorize the
+ * media sources automatically:
+ *
+ *  1. The storage adapter's public URL host (R2 custom domain, S3/CDN), so
+ *     media served directly from a public bucket is optimized.
+ *  2. The site's own origin, scoped to the media proxy route
+ *     (`/_emdash/api/media/file/**`), so same-origin proxied media (local
+ *     storage, or R2 without a public URL) is optimized too. The pathname
+ *     scope keeps Astro's image endpoint from acting as an open proxy for the
+ *     whole origin. Only registered when `siteUrl` is known at build time;
+ *     `getPublicOrigin` resolves the matching origin at render time.
+ *  3. In `astro dev` the dev-server origin (`localhost:<port>`) isn't known at
+ *     build time, so we register a host-agnostic pattern scoped to the media
+ *     route. This is dev-only — it never ships in a production build — so the
+ *     missing host check can't be abused on a deployed site.
+ *
+ * Returns an empty array when no source is statically known (e.g. a production
+ * build using local storage with no `siteUrl`), in which case media renders as
+ * a plain `<img>`.
+ *
+ * @internal Exported for unit testing.
+ */
+export function buildImageRemotePatterns(
+	storage: { config?: unknown } | undefined,
+	siteUrl: string | undefined,
+	command: "dev" | "build" | "preview" | "sync",
+): ImageRemotePattern[] {
+	const patterns: ImageRemotePattern[] = [];
+
+	const config = storage?.config;
+	const publicUrl =
+		config && typeof config === "object"
+			? (config as { publicUrl?: unknown }).publicUrl
+			: undefined;
+	if (typeof publicUrl === "string" && publicUrl) {
+		try {
+			const url = new URL(publicUrl);
+			// Only authorize http(s) hosts — a `file:`/`ftp:` URL is not a media
+			// origin Astro can fetch.
+			if (url.protocol === "http:" || url.protocol === "https:") {
+				const pattern: ImageRemotePattern = {
+					protocol: url.protocol === "http:" ? "http" : "https",
+					hostname: url.hostname,
+				};
+				// When the public URL has a path prefix (CDN sub-path), scope the
+				// pattern to it so we don't authorize the entire host. Media keys
+				// are appended as `${publicUrl}/${key}`, so the prefix is exact.
+				const prefix = url.pathname.endsWith("/") ? url.pathname.slice(0, -1) : url.pathname;
+				if (prefix && prefix !== "/") {
+					pattern.pathname = `${prefix}/**`;
+				}
+				patterns.push(pattern);
+			}
+		} catch {
+			// ignore an unparseable public URL
+		}
+	}
+
+	if (siteUrl) {
+		try {
+			patterns.push({
+				hostname: new URL(siteUrl).hostname,
+				pathname: `${INTERNAL_MEDIA_PREFIX}**`,
+			});
+		} catch {
+			// ignore an unparseable site URL
+		}
+	}
+
+	if (command === "dev") {
+		patterns.push({ pathname: `${INTERNAL_MEDIA_PREFIX}**` });
+	}
+
+	return patterns;
+}
+
 // Terminal formatting
 const dim = (s: string) => `\x1b[2m${s}\x1b[22m`;
 const bold = (s: string) => `\x1b[1m${s}\x1b[22m`;
@@ -298,8 +385,19 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 								},
 							];
 
+				// Authorize media sources for Astro image optimization so the
+				// Image components can generate a responsive srcset for R2/S3 and
+				// same-origin proxied media. `updateConfig` merges arrays, so any
+				// user-configured remotePatterns are preserved.
+				const imageRemotePatterns = buildImageRemotePatterns(
+					resolvedConfig.storage,
+					resolvedConfig.siteUrl,
+					command,
+				);
+
 				updateConfig({
 					security: securityConfig,
+					...(imageRemotePatterns.length ? { image: { remotePatterns: imageRemotePatterns } } : {}),
 					// fonts is a valid AstroConfig key but may not be in the
 					// type definition for the minimum supported Astro version
 					...({ fonts: emdashFonts } as Record<string, unknown>),

package/src/astro/integration/routes.ts

@@ -88,6 +88,12 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/content/[collection]/[id]/preview-url.ts"),
 	});
 
+	// Content authors (for the admin author filter)
+	injectRoute({
+		pattern: "/_emdash/api/content/[collection]/authors",
+		entrypoint: resolveRoute("api/content/[collection]/authors.ts"),
+	});
+
 	// Trash/restore routes
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/trash",