emdash 0.19.0 → 0.20.0

package/dist/{widgets-ClEnYQCH.mjs → widgets-DZfmAbE4.mjs}

@@ -1,5 +1,6 @@
-import { r as getDb } from "./loader-CpZKpFz0.mjs";
-import { t as getWidgetComponents$1 } from "./components-CTfpu3PZ.mjs";
+import { r as requestCached } from "./request-cache-D32LpnmI.mjs";
+import { r as getDb } from "./loader-ZN1ll-d-.mjs";
+import { t as getWidgetComponents$1 } from "./components-CK0cuUoH.mjs";
 
 //#region src/widgets/index.ts
 /**
@@ -10,48 +11,50 @@ import { t as getWidgetComponents$1 } from "./components-CTfpu3PZ.mjs";
 * row with null widget columns, which we skip when mapping.
 */
 async function getWidgetArea(name) {
-	const rows = await (await getDb()).selectFrom("_emdash_widget_areas as a").leftJoin("_emdash_widgets as w", "w.area_id", "a.id").select([
-		"a.id as a_id",
-		"a.name as a_name",
-		"a.label as a_label",
-		"a.description as a_description",
-		"w.id as w_id",
-		"w.type as w_type",
-		"w.title as w_title",
-		"w.content as w_content",
-		"w.menu_name as w_menu_name",
-		"w.component_id as w_component_id",
-		"w.component_props as w_component_props",
-		"w.area_id as w_area_id",
-		"w.sort_order as w_sort_order",
-		"w.created_at as w_created_at"
-	]).where("a.name", "=", name).orderBy("w.sort_order", "asc").execute();
-	const first = rows[0];
-	if (!first) return null;
-	const widgets = [];
-	for (const row of rows) {
-		if (row.w_id === null) continue;
-		const widgetRow = {
-			id: row.w_id,
-			type: row.w_type,
-			title: row.w_title,
-			content: row.w_content,
-			menu_name: row.w_menu_name,
-			component_id: row.w_component_id,
-			component_props: row.w_component_props,
-			area_id: row.w_area_id,
-			sort_order: row.w_sort_order,
-			created_at: row.w_created_at
+	return requestCached(`widget-area:${name}`, async () => {
+		const rows = await (await getDb()).selectFrom("_emdash_widget_areas as a").leftJoin("_emdash_widgets as w", "w.area_id", "a.id").select([
+			"a.id as a_id",
+			"a.name as a_name",
+			"a.label as a_label",
+			"a.description as a_description",
+			"w.id as w_id",
+			"w.type as w_type",
+			"w.title as w_title",
+			"w.content as w_content",
+			"w.menu_name as w_menu_name",
+			"w.component_id as w_component_id",
+			"w.component_props as w_component_props",
+			"w.area_id as w_area_id",
+			"w.sort_order as w_sort_order",
+			"w.created_at as w_created_at"
+		]).where("a.name", "=", name).orderBy("w.sort_order", "asc").execute();
+		const first = rows[0];
+		if (!first) return null;
+		const widgets = [];
+		for (const row of rows) {
+			if (row.w_id === null) continue;
+			const widgetRow = {
+				id: row.w_id,
+				type: row.w_type,
+				title: row.w_title,
+				content: row.w_content,
+				menu_name: row.w_menu_name,
+				component_id: row.w_component_id,
+				component_props: row.w_component_props,
+				area_id: row.w_area_id,
+				sort_order: row.w_sort_order,
+				created_at: row.w_created_at
+			};
+			widgets.push(rowToWidget(widgetRow));
+		}
+		return {
+			id: first.a_id,
+			name: first.a_name,
+			label: first.a_label,
+			description: first.a_description ?? void 0,
+			widgets
 		};
-		widgets.push(rowToWidget(widgetRow));
-	}
-	return {
-		id: first.a_id,
-		name: first.a_name,
-		label: first.a_label,
-		description: first.a_description ?? void 0,
-		widgets
-	};
+	});
 }
 /**
 * Get all widget areas with their widgets
@@ -103,4 +106,4 @@ function rowToWidget(row) {
 
 //#endregion
 export { rowToWidget as i, getWidgetAreas as n, getWidgetComponents as r, getWidgetArea as t };
-//# sourceMappingURL=widgets-ClEnYQCH.mjs.map
+//# sourceMappingURL=widgets-DZfmAbE4.mjs.map

package/dist/widgets-DZfmAbE4.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"widgets-DZfmAbE4.mjs","names":["getComponentRegistry"],"sources":["../src/widgets/index.ts"],"sourcesContent":["import { getDb } from \"../loader.js\";\nimport { requestCached } from \"../request-cache.js\";\nimport { getWidgetComponents as getComponentRegistry } from \"./components.js\";\nimport type { Widget, WidgetArea, WidgetRow, WidgetComponentDef } from \"./types.js\";\n\nexport type {\n\tWidget,\n\tWidgetArea,\n\tWidgetType,\n\tWidgetComponentDef,\n\tPropDef,\n\tCreateWidgetAreaInput,\n\tCreateWidgetInput,\n\tUpdateWidgetInput,\n\tReorderWidgetsInput,\n} from \"./types.js\";\n\n/**\n * Get a widget area by name, with all its widgets.\n *\n * Single query with a left join rather than area-then-widgets so the\n * common case costs one round-trip. An area with no widgets yields one\n * row with null widget columns, which we skip when mapping.\n */\nexport async function getWidgetArea(name: string): Promise<WidgetArea | null> {\n\treturn requestCached(`widget-area:${name}`, async () => {\n\t\tconst db = await getDb();\n\t\tconst rows = await db\n\t\t\t.selectFrom(\"_emdash_widget_areas as a\")\n\t\t\t.leftJoin(\"_emdash_widgets as w\", \"w.area_id\", \"a.id\")\n\t\t\t.select([\n\t\t\t\t\"a.id as a_id\",\n\t\t\t\t\"a.name as a_name\",\n\t\t\t\t\"a.label as a_label\",\n\t\t\t\t\"a.description as a_description\",\n\t\t\t\t\"w.id as w_id\",\n\t\t\t\t\"w.type as w_type\",\n\t\t\t\t\"w.title as w_title\",\n\t\t\t\t\"w.content as w_content\",\n\t\t\t\t\"w.menu_name as w_menu_name\",\n\t\t\t\t\"w.component_id as w_component_id\",\n\t\t\t\t\"w.component_props as w_component_props\",\n\t\t\t\t\"w.area_id as w_area_id\",\n\t\t\t\t\"w.sort_order as w_sort_order\",\n\t\t\t\t\"w.created_at as w_created_at\",\n\t\t\t])\n\t\t\t.where(\"a.name\", \"=\", name)\n\t\t\t.orderBy(\"w.sort_order\", \"asc\")\n\t\t\t.execute();\n\n\t\tconst first = rows[0];\n\t\tif (!first) return null;\n\t\tconst widgets: Widget[] = [];\n\t\tfor (const row of rows) {\n\t\t\tif (row.w_id === null) continue; // area has no widgets (left-join null row)\n\t\t\t// Left-join makes every w_* column nullable in the type; at runtime\n\t\t\t// they're all non-null once w_id is (we match on widgets.area_id, so\n\t\t\t// a widget row always has the not-null columns filled). Cast is the\n\t\t\t// price of that structural fact.\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- left-join row is non-null when w_id is set; see above\n\t\t\tconst widgetRow = {\n\t\t\t\tid: row.w_id,\n\t\t\t\ttype: row.w_type,\n\t\t\t\ttitle: row.w_title,\n\t\t\t\tcontent: row.w_content,\n\t\t\t\tmenu_name: row.w_menu_name,\n\t\t\t\tcomponent_id: row.w_component_id,\n\t\t\t\tcomponent_props: row.w_component_props,\n\t\t\t\tarea_id: row.w_area_id,\n\t\t\t\tsort_order: row.w_sort_order,\n\t\t\t\tcreated_at: row.w_created_at,\n\t\t\t} as WidgetRow;\n\t\t\twidgets.push(rowToWidget(widgetRow));\n\t\t}\n\n\t\treturn {\n\t\t\tid: first.a_id,\n\t\t\tname: first.a_name,\n\t\t\tlabel: first.a_label,\n\t\t\tdescription: first.a_description ?? undefined,\n\t\t\twidgets,\n\t\t};\n\t});\n}\n\n/**\n * Get all widget areas with their widgets\n */\nexport async function getWidgetAreas(): Promise<WidgetArea[]> {\n\tconst db = await getDb();\n\t// Get all areas\n\tconst areaRows = await db.selectFrom(\"_emdash_widget_areas\").selectAll().execute();\n\n\t// Get all widgets\n\tconst widgetRows = await db\n\t\t.selectFrom(\"_emdash_widgets\")\n\t\t.selectAll()\n\t\t.$castTo<WidgetRow>()\n\t\t.orderBy(\"sort_order\", \"asc\")\n\t\t.execute();\n\n\t// Group widgets by area\n\tconst widgetsByArea = new Map<string, Widget[]>();\n\tfor (const row of widgetRows) {\n\t\tif (!widgetsByArea.has(row.area_id)) {\n\t\t\twidgetsByArea.set(row.area_id, []);\n\t\t}\n\t\twidgetsByArea.get(row.area_id)!.push(rowToWidget(row));\n\t}\n\n\t// Combine\n\treturn areaRows.map((areaRow) => ({\n\t\tid: areaRow.id,\n\t\tname: areaRow.name,\n\t\tlabel: areaRow.label,\n\t\tdescription: areaRow.description ?? undefined,\n\t\twidgets: widgetsByArea.get(areaRow.id) || [],\n\t}));\n}\n\n/**\n * Get available widget components (for admin UI)\n */\nexport function getWidgetComponents(): WidgetComponentDef[] {\n\treturn getComponentRegistry();\n}\n\n/**\n * Convert a widget row to the API type\n */\nexport function rowToWidget(row: WidgetRow): Widget {\n\tconst widget: Widget = {\n\t\tid: row.id,\n\t\ttype: row.type,\n\t\ttitle: row.title ?? undefined,\n\t};\n\n\t// Type-specific fields\n\tif (row.type === \"content\" && row.content) {\n\t\ttry {\n\t\t\twidget.content = JSON.parse(row.content);\n\t\t} catch {\n\t\t\t// Invalid JSON, ignore\n\t\t}\n\t}\n\n\tif (row.type === \"menu\" && row.menu_name) {\n\t\twidget.menuName = row.menu_name;\n\t}\n\n\tif (row.type === \"component\" && row.component_id) {\n\t\twidget.componentId = row.component_id;\n\t\tif (row.component_props) {\n\t\t\ttry {\n\t\t\t\twidget.componentProps = JSON.parse(row.component_props);\n\t\t\t} catch {\n\t\t\t\t// Invalid JSON, ignore\n\t\t\t}\n\t\t}\n\t}\n\n\treturn widget;\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,eAAsB,cAAc,MAA0C;AAC7E,QAAO,cAAc,eAAe,QAAQ,YAAY;EAEvD,MAAM,OAAO,OADF,MAAM,OAAO,EAEtB,WAAW,4BAA4B,CACvC,SAAS,wBAAwB,aAAa,OAAO,CACrD,OAAO;GACP;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,CAAC,CACD,MAAM,UAAU,KAAK,KAAK,CAC1B,QAAQ,gBAAgB,MAAM,CAC9B,SAAS;EAEX,MAAM,QAAQ,KAAK;AACnB,MAAI,CAAC,MAAO,QAAO;EACnB,MAAM,UAAoB,EAAE;AAC5B,OAAK,MAAM,OAAO,MAAM;AACvB,OAAI,IAAI,SAAS,KAAM;GAMvB,MAAM,YAAY;IACjB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,OAAO,IAAI;IACX,SAAS,IAAI;IACb,WAAW,IAAI;IACf,cAAc,IAAI;IAClB,iBAAiB,IAAI;IACrB,SAAS,IAAI;IACb,YAAY,IAAI;IAChB,YAAY,IAAI;IAChB;AACD,WAAQ,KAAK,YAAY,UAAU,CAAC;;AAGrC,SAAO;GACN,IAAI,MAAM;GACV,MAAM,MAAM;GACZ,OAAO,MAAM;GACb,aAAa,MAAM,iBAAiB;GACpC;GACA;GACA;;;;;AAMH,eAAsB,iBAAwC;CAC7D,MAAM,KAAK,MAAM,OAAO;CAExB,MAAM,WAAW,MAAM,GAAG,WAAW,uBAAuB,CAAC,WAAW,CAAC,SAAS;CAGlF,MAAM,aAAa,MAAM,GACvB,WAAW,kBAAkB,CAC7B,WAAW,CACX,SAAoB,CACpB,QAAQ,cAAc,MAAM,CAC5B,SAAS;CAGX,MAAM,gCAAgB,IAAI,KAAuB;AACjD,MAAK,MAAM,OAAO,YAAY;AAC7B,MAAI,CAAC,cAAc,IAAI,IAAI,QAAQ,CAClC,eAAc,IAAI,IAAI,SAAS,EAAE,CAAC;AAEnC,gBAAc,IAAI,IAAI,QAAQ,CAAE,KAAK,YAAY,IAAI,CAAC;;AAIvD,QAAO,SAAS,KAAK,aAAa;EACjC,IAAI,QAAQ;EACZ,MAAM,QAAQ;EACd,OAAO,QAAQ;EACf,aAAa,QAAQ,eAAe;EACpC,SAAS,cAAc,IAAI,QAAQ,GAAG,IAAI,EAAE;EAC5C,EAAE;;;;;AAMJ,SAAgB,sBAA4C;AAC3D,QAAOA,uBAAsB;;;;;AAM9B,SAAgB,YAAY,KAAwB;CACnD,MAAM,SAAiB;EACtB,IAAI,IAAI;EACR,MAAM,IAAI;EACV,OAAO,IAAI,SAAS;EACpB;AAGD,KAAI,IAAI,SAAS,aAAa,IAAI,QACjC,KAAI;AACH,SAAO,UAAU,KAAK,MAAM,IAAI,QAAQ;SACjC;AAKT,KAAI,IAAI,SAAS,UAAU,IAAI,UAC9B,QAAO,WAAW,IAAI;AAGvB,KAAI,IAAI,SAAS,eAAe,IAAI,cAAc;AACjD,SAAO,cAAc,IAAI;AACzB,MAAI,IAAI,gBACP,KAAI;AACH,UAAO,iBAAiB,KAAK,MAAM,IAAI,gBAAgB;UAChD;;AAMV,QAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emdash",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Astro-native CMS with WordPress migration support",
   "type": "module",
   "main": "dist/index.mjs",
@@ -178,7 +178,7 @@
     "#types": "./src/astro/types.js"
   },
   "dependencies": {
-    "@atcute/lexicons": "^1.3.0",
+    "@atcute/lexicons": "^2.0.0",
     "@atcute/multibase": "^1.2.0",
     "@floating-ui/react": "^0.27.16",
     "@modelcontextprotocol/sdk": "^1.26.0",
@@ -217,12 +217,12 @@
     "ulidx": "^2.4.1",
     "upng-js": "^2.1.0",
     "zod": "^4.4.1",
-    "@atcute/client": "^4.2.1",
-    "@emdash-cms/admin": "0.19.0",
-    "@emdash-cms/auth": "0.19.0",
-    "@emdash-cms/gutenberg-to-portable-text": "0.19.0",
-    "@emdash-cms/registry-client": "0.3.1",
-    "@emdash-cms/plugin-types": "0.0.1"
+    "@atcute/client": "^5.0.0",
+    "@emdash-cms/admin": "0.20.0",
+    "@emdash-cms/auth": "0.20.0",
+    "@emdash-cms/gutenberg-to-portable-text": "0.20.0",
+    "@emdash-cms/plugin-types": "0.1.0",
+    "@emdash-cms/registry-client": "0.3.2"
   },
   "optionalDependencies": {
     "@libsql/kysely-libsql": "^0.4.0",
@@ -248,14 +248,14 @@
     "@types/react": "19.2.14",
     "@types/sanitize-html": "^2.16.0",
     "@types/sax": "^1.2.7",
-    "@vitest/ui": "^4.1.7",
+    "@vitest/ui": "^4.1.8",
     "publint": "0.3.17",
     "tsdown": "0.20.3",
     "typescript": "^6.0.3",
     "vite": "^6.0.0",
     "vitest": "^4.1.5",
     "zod-openapi": "^5.4.6",
-    "@emdash-cms/blocks": "0.19.0"
+    "@emdash-cms/blocks": "0.20.0"
   },
   "repository": {
     "type": "git",

package/src/api/handlers/marketplace.ts

@@ -9,7 +9,7 @@ import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
 import { validatePluginIdentifier } from "../../database/validate.js";
-import { pluginManifestSchema } from "../../plugins/manifest-schema.js";
+import { pluginManifestSchema, reconcileManifestAccess } from "../../plugins/manifest-schema.js";
 import { normalizeManifestRoute } from "../../plugins/manifest-schema.js";
 import {
 	createMarketplaceClient,
@@ -271,10 +271,7 @@ export async function loadBundleFromR2(
 		const parsed: unknown = JSON.parse(manifestText);
 		const result = pluginManifestSchema.safeParse(parsed);
 		if (!result.success) return null;
-		// Elements are validated as unknown[] by Zod; cast to PluginManifest
-		// for the Element[] type (Block Kit validation happens at render time).
-		// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Zod types elements as unknown[]; Element type validated at render time
-		const manifest = result.data as unknown as PluginManifest;
+		const manifest = reconcileManifestAccess(result.data);
 
 		// Try to load admin code (optional)
 		let adminCode: string | undefined;

package/src/api/handlers/registry.ts

@@ -49,6 +49,8 @@ import { extractBundle } from "../../plugins/marketplace.js";
 import type { PluginBundle } from "../../plugins/marketplace.js";
 import type { SandboxRunner } from "../../plugins/sandbox/types.js";
 import { PluginStateRepository } from "../../plugins/state.js";
+import { declaredAccessToCapabilities } from "../../plugins/types.js";
+import type { DeclaredAccess } from "../../plugins/types.js";
 import {
 	canonicalCapabilitiesForDriftCheck,
 	coerceRegistryConfig,
@@ -70,6 +72,26 @@ import {
 	storeBundleInR2,
 } from "./marketplace.js";
 
+const RELEASE_EXTENSION_NSID = "com.emdashcms.experimental.package.releaseExtension";
+
+/**
+ * Whether two `declaredAccess` blocks grant exactly the same enforced access --
+ * the same capabilities AND the same host allow-list. Both are lowered through
+ * the canonical converter so that constraint content (`allowedHosts`), not just
+ * the capability set, is part of the comparison. The capability-set consent
+ * gate is blind to host scope; this is what keeps a bundle from being installed
+ * with a wider (or simply different) host allow-list than its published record
+ * advertised and the user consented to.
+ */
+export function enforcedAccessEqual(a: DeclaredAccess, b: DeclaredAccess): boolean {
+	const aa = declaredAccessToCapabilities(a);
+	const bb = declaredAccessToCapabilities(b);
+	return (
+		JSON.stringify(aa.capabilities.toSorted()) === JSON.stringify(bb.capabilities.toSorted()) &&
+		JSON.stringify(aa.allowedHosts.toSorted()) === JSON.stringify(bb.allowedHosts.toSorted())
+	);
+}
+
 // ── Types ──────────────────────────────────────────────────────────
 
 export interface RegistryInstallInput {
@@ -999,6 +1021,31 @@ export async function handleRegistryInstall(
 		// marketplace plugins that happen to share the publisher's slug.
 		bundle.manifest = { ...bundle.manifest, id: pluginId };
 
+		// Integrity: the bundle that will run MUST declare exactly the access
+		// the signed release record advertises. The consent dialog is driven
+		// from the record's `declaredAccess`, so a bundle enforcing something
+		// different -- a wider host allow-list, an extra capability -- would run
+		// outside what the user reviewed. The capability-set consent gate below
+		// is blind to constraint content (host scope), so compare the full
+		// enforced access of record vs bundle here and refuse on any difference.
+		const recordExt =
+			// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- extensions is the lexicon's open `unknown` map; narrow to read our own extension
+			(release?.extensions as Record<string, { declaredAccess?: DeclaredAccess }> | undefined)?.[
+				RELEASE_EXTENSION_NSID
+			];
+		if (
+			!enforcedAccessEqual(recordExt?.declaredAccess ?? {}, bundle.manifest.declaredAccess ?? {})
+		) {
+			return {
+				success: false,
+				error: {
+					code: "DECLARED_ACCESS_DRIFT",
+					message:
+						"The plugin bundle declares different permissions than its published record. Installation refused.",
+				},
+			};
+		}
+
 		// Capability consent gate: the admin MUST acknowledge the
 		// capabilities the bundle's manifest actually declares before we
 		// install it. The bundle manifest is the only source of truth
@@ -1488,6 +1535,29 @@ export async function handleRegistryUpdate(
 		// and R2 layout stay in sync across install and update.
 		bundle.manifest = { ...bundle.manifest, id: pluginId };
 
+		// Integrity: same gate as install. The new bundle must declare exactly
+		// the access its signed release record advertises. Without it, an update
+		// that changes only the host scope (e.g. api.good.com -> evil.com) keeps
+		// the capability set identical, sails through the escalation diff below,
+		// and installs a bundle enforcing a scope the record never showed.
+		// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- extensions is the lexicon's open `unknown` map; narrow to read our own extension
+		const updateRecordExtensions = signedRelease?.extensions as
+			| Record<string, { declaredAccess?: DeclaredAccess }>
+			| undefined;
+		const recordExt = updateRecordExtensions?.[RELEASE_EXTENSION_NSID];
+		if (
+			!enforcedAccessEqual(recordExt?.declaredAccess ?? {}, bundle.manifest.declaredAccess ?? {})
+		) {
+			return {
+				success: false,
+				error: {
+					code: "DECLARED_ACCESS_DRIFT",
+					message:
+						"The plugin bundle declares different permissions than its published record. Update refused.",
+				},
+			};
+		}
+
 		// Diff capabilities + route visibility against the currently
 		// installed bundle. Loading from R2 keeps us honest: the diff is
 		// against the bytes the sandbox is actually running, not whatever

package/src/api/handlers/seo.ts

@@ -29,6 +29,12 @@ export interface SitemapContentEntry {
 	 * alternates between siblings.
 	 */
 	translationGroup: string | null;
+	/**
+	 * Stored SEO image reference (`_emdash_seo.seo_image`), or null when
+	 * the entry has no SEO image. The route resolves it to an absolute
+	 * URL and emits it as an `<image:image>` sitemap entry.
+	 */
+	image: string | null;
 }
 
 /** Per-collection sitemap data with entries and URL pattern */
@@ -106,8 +112,9 @@ export async function handleSitemapData(
 					updated_at: string;
 					locale: string;
 					translation_group: string | null;
+					seo_image: string | null;
 				}>`
-					SELECT c.slug, c.id, c.updated_at, c.locale, c.translation_group
+					SELECT c.slug, c.id, c.updated_at, c.locale, c.translation_group, s.seo_image
 					FROM ${sql.ref(tableName)} c
 					LEFT JOIN _emdash_seo s
 						ON s.collection = ${col.slug}
@@ -129,6 +136,7 @@ export async function handleSitemapData(
 						updatedAt: row.updated_at,
 						locale: row.locale,
 						translationGroup: row.translation_group,
+						image: row.seo_image ?? null,
 					});
 				}
 

package/src/api/schemas/schema.ts

@@ -31,7 +31,19 @@ const fieldTypeValues = z.enum([
 
 const repeaterSubFieldSchema = z.object({
 	slug: z.string().min(1).max(63).regex(slugPattern, "Invalid slug format"),
-	type: z.enum(["string", "text", "number", "integer", "boolean", "datetime", "select"]),
+	// Keep in sync with REPEATER_SUB_FIELD_TYPES in schema/types.ts.
+	// ("url" was already a documented sub-field type but missing here.)
+	type: z.enum([
+		"string",
+		"text",
+		"url",
+		"number",
+		"integer",
+		"boolean",
+		"datetime",
+		"select",
+		"image",
+	]),
 	label: z.string().min(1),
 	required: z.boolean().optional(),
 	options: z.array(z.string()).optional(),

package/src/astro/middleware.ts

@@ -333,6 +333,9 @@ function pushMetricsTimings(
 			timings.push({ name: "db.last", dur: metrics.dbLastOffset, desc: "Last query at" });
 		}
 	}
+	if (metrics.rpcCount > 0) {
+		timings.push({ name: "rpc.count", dur: metrics.rpcCount, desc: "DB round trips" });
+	}
 	if (metrics.cacheHits + metrics.cacheMisses > 0) {
 		timings.push({ name: "cache.hit", dur: metrics.cacheHits, desc: "Cache hits" });
 		timings.push({ name: "cache.miss", dur: metrics.cacheMisses, desc: "Cache misses" });
@@ -510,9 +513,15 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						? { ...parent, db: anonScoped.db }
 						: { editMode: false, db: anonScoped.db, metrics };
 					return runWithContext(ctx, async () => {
-						const response = await runAnon();
-						anonScoped.commit();
-						return response;
+						// commit() in finally: the write reached the primary independently
+						// of render, so the bookmark cookie must be persisted even if
+						// render throws -- otherwise a write-then-failed-render leaves the
+						// next request able to read pre-write state off a lagging replica.
+						try {
+							return await runAnon();
+						} finally {
+							anonScoped.commit();
+						}
 					});
 				}
 				return runAnon();
@@ -681,9 +690,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					? { ...parent, db: scoped.db }
 					: { editMode: false, db: scoped.db, metrics };
 				return runWithContext(ctx, async () => {
-					const response = await renderAndFinalize();
-					scoped.commit();
-					return response;
+					// commit() in finally: persist the bookmark cookie even if render
+					// throws -- the write already reached the primary, so a failed
+					// render must not strand the next request on a stale replica read.
+					try {
+						return await renderAndFinalize();
+					} finally {
+						scoped.commit();
+					}
 				});
 			}
 

package/src/astro/routes/api/schema/index.ts

@@ -13,7 +13,7 @@ import type { APIRoute } from "astro";
 import { hashString } from "emdash";
 
 import { requirePerm } from "#api/authorize.js";
-import { handleError, requireDb } from "#api/error.js";
+import { apiSuccess, handleError, requireDb } from "#api/error.js";
 import { SchemaRegistry } from "#schema/registry.js";
 import { generateTypeScript } from "#schema/zod-generator.js";
 
@@ -89,20 +89,12 @@ import type { PortableTextBlock } from "emdash";
 
 		const version = await hashString(JSON.stringify(schemaExport));
 
-		return new Response(
-			JSON.stringify({
-				...schemaExport,
-				version,
-			}),
-			{
-				status: 200,
-				headers: {
-					"Content-Type": "application/json",
-					"Cache-Control": "private, no-store",
-					"X-Schema-Version": version,
-				},
-			},
-		);
+		const response = apiSuccess({
+			...schemaExport,
+			version,
+		});
+		response.headers.set("X-Schema-Version", version);
+		return response;
 	} catch (error) {
 		return handleError(error, "Schema export failed", "SCHEMA_EXPORT_ERROR");
 	}

package/src/astro/routes/sitemap-[collection].xml.ts

@@ -23,6 +23,7 @@ import { getSiteSettingsWithDb } from "#settings/index.js";
 
 import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
 import { interpolateUrlPattern, localizePath } from "../../i18n/resolve.js";
+import { buildSeoImageUrl } from "../../seo/media-url.js";
 
 export const prerender = false;
 
@@ -112,8 +113,8 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 		const lines: string[] = ['<?xml version="1.0" encoding="UTF-8"?>'];
 		lines.push(
 			useXhtml
-				? '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">'
-				: '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+				? '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">'
+				: '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">',
 		);
 
 		const writeUrl = async (entry: Entry, siblings: Entry[] | null) => {
@@ -127,6 +128,16 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			lines.push(`    <loc>${escapeXml(loc)}</loc>`);
 			lines.push(`    <lastmod>${escapeXml(entry.updatedAt)}</lastmod>`);
 
+			// Google image sitemap extension: advertise the entry's SEO
+			// image (the same "preferred image" used for og:image) so it
+			// can be discovered and indexed for Google Images.
+			if (entry.image) {
+				const imageLoc = buildSeoImageUrl(entry.image, siteUrl);
+				lines.push("    <image:image>");
+				lines.push(`      <image:loc>${escapeXml(imageLoc)}</image:loc>`);
+				lines.push("    </image:image>");
+			}
+
 			if (useXhtml && siblings && siblings.length > 1) {
 				// Emit one xhtml:link per sibling (including self -- Google
 				// recommends including the page's own hreflang annotation).

package/src/cli/commands/bundle-utils.ts

@@ -13,6 +13,7 @@ import { pipeline } from "node:stream/promises";
 import { imageSize } from "image-size";
 import { packTar } from "modern-tar/fs";
 
+import { capabilitiesToDeclaredAccess } from "../../plugins/types.js";
 import type {
 	PluginManifest,
 	ResolvedPlugin,
@@ -151,6 +152,7 @@ export function extractManifest(plugin: ResolvedPlugin): PluginManifest {
 	return {
 		id: plugin.id,
 		version: plugin.version,
+		declaredAccess: capabilitiesToDeclaredAccess(plugin.capabilities, plugin.allowedHosts),
 		capabilities: plugin.capabilities,
 		allowedHosts: plugin.allowedHosts,
 		storage: plugin.storage,

package/src/cli/commands/secrets.ts

@@ -4,7 +4,7 @@
  * Pure (no-DB) commands for working with EmDash secrets:
  *
  * - `emdash secrets generate` — emits a fresh `EMDASH_ENCRYPTION_KEY`.
- *   Optionally writes it to `.dev.vars` (Workers) or `.env` (Node).
+ *   Optionally writes it to a local-secrets file (`.env`).
  * - `emdash secrets fingerprint <key>` — prints the kid for a key,
  *   useful in CI for verifying what's been deployed without exposing
  *   the raw value.
@@ -87,7 +87,7 @@ const generateCommand = defineCommand({
 		write: {
 			type: "string",
 			description:
-				"Optional path to write the key to (e.g. .dev.vars or .env). " +
+				"Optional path to write the key to (e.g. .env). " +
 				"Won't overwrite an existing entry without --force.",
 		},
 		force: {

package/src/database/instrumentation.ts

@@ -110,3 +110,16 @@ function kyselyLog(event: LogEvent): void {
 export function kyselyLogOption(): Logger {
 	return kyselyLog;
 }
+
+/**
+ * Record physical database round trips for the current request.
+ *
+ * Called by backends that batch (the DO SQL driver coalesces same-turn SELECTs
+ * into one RPC), so we can see round-trip count separately from logical query
+ * count (`dbCount`, bumped by the Kysely log hook). No-op outside a request or
+ * when metrics aren't attached (e.g. migrations on the singleton).
+ */
+export function recordRpc(count = 1): void {
+	const ctx = getRequestContext();
+	if (ctx?.metrics) ctx.metrics.rpcCount += count;
+}

package/src/emdash-runtime.ts

@@ -45,6 +45,7 @@ import type {
 import type { FieldType } from "./schema/types.js";
 import { hashString } from "./utils/hash.js";
 import { createInitLock, type InitLock, initWithLock } from "./utils/init-lock.js";
+import { createIsolateCache, isolateCachedAsync } from "./utils/isolate-cache.js";
 import { COMMIT, VERSION } from "./version.js";
 
 const LEADING_SLASH_PATTERN = /^\//;
@@ -417,12 +418,12 @@ export class EmDashRuntime {
 	private pluginStates: Map<string, string>;
 
 	/**
-	 * Set to true after FTS indexes have been verified for this worker
-	 * lifetime so we don't re-scan on every admin request. See
-	 * ensureSearchHealthy().
+	 * Isolate-lifetime guard so FTS indexes are verified at most once per
+	 * worker rather than on every admin request. See ensureSearchHealthy().
+	 * Uses the poison-immune isolate cache (never a shared awaitable promise)
+	 * so a cancelled first caller can't wedge later ones.
 	 */
-	private _searchHealthChecked = false;
-	private _searchHealthPromise: Promise<void> | null = null;
+	private readonly _searchHealthCache = createIsolateCache<void>();
 
 	/** Current hook pipeline. Use the `hooks` getter for external access. */
 	get hooks(): HookPipeline {
@@ -2228,27 +2229,32 @@ export class EmDashRuntime {
 	 * defend against FTS not existing yet (pre-setup).
 	 */
 	async ensureSearchHealthy(): Promise<void> {
-		if (this._searchHealthChecked) return;
-		if (this._searchHealthPromise) return this._searchHealthPromise;
-		if (!isSqlite(this._db)) {
-			this._searchHealthChecked = true;
-			return;
+		// Non-SQLite has no FTS to verify; the check is a cheap synchronous
+		// branch, no need to cache it.
+		if (!isSqlite(this._db)) return;
+		try {
+			await isolateCachedAsync(
+				this._searchHealthCache,
+				async () => {
+					try {
+						const ftsManager = new FTSManager(this._db);
+						const repaired = await ftsManager.verifyAndRepairAll();
+						if (repaired > 0) {
+							console.log(`Repaired ${repaired} corrupted FTS index(es)`);
+						}
+					} catch {
+						// FTS tables may not exist yet (pre-setup). Non-fatal — cache
+						// the "checked" state regardless so we don't re-scan.
+					}
+				},
+				{ anchor: (promise) => after(() => promise), ownerTimeoutMs: 30_000 },
+			);
+		} catch {
+			// This check is best-effort and must never fail the calling request.
+			// The inner body already swallows verify errors; this guards the
+			// outer failure modes (owner timeout, waiter give-up) so a slow FTS
+			// scan degrades to "unverified", not a 500 on admin/search routes.
 		}
-		this._searchHealthPromise = (async () => {
-			try {
-				const ftsManager = new FTSManager(this._db);
-				const repaired = await ftsManager.verifyAndRepairAll();
-				if (repaired > 0) {
-					console.log(`Repaired ${repaired} corrupted FTS index(es)`);
-				}
-			} catch {
-				// FTS tables may not exist yet (pre-setup). Non-fatal.
-			} finally {
-				this._searchHealthChecked = true;
-				this._searchHealthPromise = null;
-			}
-		})();
-		return this._searchHealthPromise;
 	}
 
 	// =========================================================================