emdash 0.19.0 → 0.21.0

package/src/astro/middleware/redirect.ts

@@ -23,6 +23,7 @@ import {
 	matchCachedPatterns,
 	setCachedRedirects,
 } from "../../redirects/cache.js";
+import { isTerminalStatus } from "../../redirects/status.js";
 
 /** Paths that should never be intercepted by redirects */
 const SKIP_PREFIXES = ["/_emdash", "/_image"];
@@ -80,6 +81,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			exact = cached.exact.get(alt);
 		}
 		if (exact) {
+			// Terminal statuses (410 Gone / 451): serve the status directly,
+			// with no Location header.
+			if (isTerminalStatus(exact.type)) {
+				repo.recordHit(exact.id).catch(() => {});
+				return new Response(null, { status: exact.type });
+			}
 			const dest = exact.destination;
 			if (dest.startsWith("//") || dest.startsWith("/\\")) return next();
 			repo.recordHit(exact.id).catch(() => {});
@@ -91,6 +98,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		const patternMatch = matchCachedPatterns(cached.patterns, pathname);
 		if (patternMatch) {
 			const { redirect, destination } = patternMatch;
+			// Terminal statuses (410 Gone / 451): serve the status directly.
+			if (isTerminalStatus(redirect.type)) {
+				repo.recordHit(redirect.id).catch(() => {});
+				return new Response(null, { status: redirect.type });
+			}
 			if (destination.startsWith("//") || destination.startsWith("/\\")) return next();
 			repo.recordHit(redirect.id).catch(() => {});
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;

package/src/astro/middleware.ts

@@ -333,6 +333,9 @@ function pushMetricsTimings(
 			timings.push({ name: "db.last", dur: metrics.dbLastOffset, desc: "Last query at" });
 		}
 	}
+	if (metrics.rpcCount > 0) {
+		timings.push({ name: "rpc.count", dur: metrics.rpcCount, desc: "DB round trips" });
+	}
 	if (metrics.cacheHits + metrics.cacheMisses > 0) {
 		timings.push({ name: "cache.hit", dur: metrics.cacheHits, desc: "Cache hits" });
 		timings.push({ name: "cache.miss", dur: metrics.cacheMisses, desc: "Cache misses" });
@@ -510,9 +513,15 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						? { ...parent, db: anonScoped.db }
 						: { editMode: false, db: anonScoped.db, metrics };
 					return runWithContext(ctx, async () => {
-						const response = await runAnon();
-						anonScoped.commit();
-						return response;
+						// commit() in finally: the write reached the primary independently
+						// of render, so the bookmark cookie must be persisted even if
+						// render throws -- otherwise a write-then-failed-render leaves the
+						// next request able to read pre-write state off a lagging replica.
+						try {
+							return await runAnon();
+						} finally {
+							anonScoped.commit();
+						}
 					});
 				}
 				return runAnon();
@@ -681,9 +690,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					? { ...parent, db: scoped.db }
 					: { editMode: false, db: scoped.db, metrics };
 				return runWithContext(ctx, async () => {
-					const response = await renderAndFinalize();
-					scoped.commit();
-					return response;
+					// commit() in finally: persist the bookmark cookie even if render
+					// throws -- the write already reached the primary, so a failed
+					// render must not strand the next request on a stale replica read.
+					try {
+						return await renderAndFinalize();
+					} finally {
+						scoped.commit();
+					}
 				});
 			}
 

package/src/astro/routes/api/schema/index.ts

@@ -13,7 +13,7 @@ import type { APIRoute } from "astro";
 import { hashString } from "emdash";
 
 import { requirePerm } from "#api/authorize.js";
-import { handleError, requireDb } from "#api/error.js";
+import { apiSuccess, handleError, requireDb } from "#api/error.js";
 import { SchemaRegistry } from "#schema/registry.js";
 import { generateTypeScript } from "#schema/zod-generator.js";
 
@@ -89,20 +89,12 @@ import type { PortableTextBlock } from "emdash";
 
 		const version = await hashString(JSON.stringify(schemaExport));
 
-		return new Response(
-			JSON.stringify({
-				...schemaExport,
-				version,
-			}),
-			{
-				status: 200,
-				headers: {
-					"Content-Type": "application/json",
-					"Cache-Control": "private, no-store",
-					"X-Schema-Version": version,
-				},
-			},
-		);
+		const response = apiSuccess({
+			...schemaExport,
+			version,
+		});
+		response.headers.set("X-Schema-Version", version);
+		return response;
 	} catch (error) {
 		return handleError(error, "Schema export failed", "SCHEMA_EXPORT_ERROR");
 	}

package/src/astro/routes/sitemap-[collection].xml.ts

@@ -23,6 +23,7 @@ import { getSiteSettingsWithDb } from "#settings/index.js";
 
 import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
 import { interpolateUrlPattern, localizePath } from "../../i18n/resolve.js";
+import { buildSeoImageUrl } from "../../seo/media-url.js";
 
 export const prerender = false;
 
@@ -112,8 +113,8 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 		const lines: string[] = ['<?xml version="1.0" encoding="UTF-8"?>'];
 		lines.push(
 			useXhtml
-				? '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">'
-				: '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+				? '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">'
+				: '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1">',
 		);
 
 		const writeUrl = async (entry: Entry, siblings: Entry[] | null) => {
@@ -127,6 +128,16 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			lines.push(`    <loc>${escapeXml(loc)}</loc>`);
 			lines.push(`    <lastmod>${escapeXml(entry.updatedAt)}</lastmod>`);
 
+			// Google image sitemap extension: advertise the entry's SEO
+			// image (the same "preferred image" used for og:image) so it
+			// can be discovered and indexed for Google Images.
+			if (entry.image) {
+				const imageLoc = buildSeoImageUrl(entry.image, siteUrl);
+				lines.push("    <image:image>");
+				lines.push(`      <image:loc>${escapeXml(imageLoc)}</image:loc>`);
+				lines.push("    </image:image>");
+			}
+
 			if (useXhtml && siblings && siblings.length > 1) {
 				// Emit one xhtml:link per sibling (including self -- Google
 				// recommends including the page's own hreflang annotation).

package/src/bylines/field-defs-cache.ts

@@ -8,8 +8,12 @@
  * but are read on every byline hydration (admin pages, content rendering,
  * API responses). Caching at the isolate level drops the SELECT-from-
  * `_emdash_byline_fields` from once-per-hydration to once-per-isolate-
- * after-bump. The cache holds a Promise (not the resolved value) so
- * concurrent cold-isolate readers share the in-flight query.
+ * after-bump. The cache holds the resolved *value* behind a reclaimable
+ * single-flight lock (see `utils/single-flight-cache.ts`), never an
+ * in-flight promise: concurrent cold-isolate readers coalesce onto one
+ * query by polling the published value, so a reader whose request is
+ * cancelled mid-query can never strand later byline hydrations on the
+ * isolate (the workerd never-settling-promise hazard that produced 524s).
  *
  * Stored on globalThis under `Symbol.for("emdash:byline-field-defs")` so
  * Vite SSR chunk duplication can't produce two independent caches (same
@@ -50,17 +54,23 @@
 
 import type { Kysely } from "kysely";
 
+import { after } from "../after.js";
 import type { Database } from "../database/types.js";
 import { requestCached } from "../request-cache.js";
 import { getRequestContext } from "../request-context.js";
 import { BylineSchemaRegistry } from "../schema/byline-registry.js";
 import type { BylineFieldDefinition } from "../schema/types.js";
+import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
 
 interface FieldDefsHolder {
-	/** In-flight or resolved defs promise for the cached version. Null until first read. */
-	cached: Promise<BylineFieldDefinition[]> | null;
-	/** Persisted-version value that `cached` was fetched against. */
+	/** Last resolved defs, valid only when `hasValue` is true. */
+	value: BylineFieldDefinition[] | null;
+	/** Presence flag, separate from `value` so an empty-array result still caches. */
+	hasValue: boolean;
+	/** Persisted-version value that `value` was fetched against. */
 	cachedVersion: number;
+	/** Reclaimable single-flight lock so a cancelled owner can't wedge readers. */
+	lock: InitLock;
 }
 
 const HOLDER_KEY = Symbol.for("emdash:byline-field-defs");
@@ -69,7 +79,12 @@ const holder: FieldDefsHolder =
 	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-cache.ts)
 	(g[HOLDER_KEY] as FieldDefsHolder | undefined) ??
 	(() => {
-		const h: FieldDefsHolder = { cached: null, cachedVersion: -1 };
+		const h: FieldDefsHolder = {
+			value: null,
+			hasValue: false,
+			cachedVersion: -1,
+			lock: createInitLock(),
+		};
 		g[HOLDER_KEY] = h;
 		return h;
 	})();
@@ -77,6 +92,16 @@ const holder: FieldDefsHolder =
 const REQUEST_CACHE_KEY_VERSION = "byline-fields-version";
 const REQUEST_CACHE_KEY_DEFS_PREFIX = "byline-field-defs:";
 
+/**
+ * Reclaim window for the single-flight lock: if an owner holds it past
+ * this without publishing (e.g. its request was cancelled and the
+ * anchored fetch hasn't completed yet), the next reader reclaims and
+ * refetches. `listFields` is a single fast SELECT, so this only needs to
+ * cover a genuinely slow/stranded query. Mutable solely so tests can
+ * shorten it; production never changes it.
+ */
+let reclaimDeadlineMs = 10_000;
+
 /**
  * Read the persisted `options.byline_fields_version` counter. Cached for
  * the duration of the current request via `requestCached`. Returns `0`
@@ -107,19 +132,29 @@ export async function getBylineFieldDefs(db: Kysely<Database>): Promise<BylineFi
 		if (isolated || dirty) {
 			return new BylineSchemaRegistry(db).listFields();
 		}
-		if (holder.cached !== null && holder.cachedVersion === version) {
-			return holder.cached;
-		}
-		const defs = new BylineSchemaRegistry(db).listFields().catch((error) => {
-			if (holder.cached === defs) {
-				holder.cached = null;
-				holder.cachedVersion = -1;
-			}
-			throw error;
-		});
-		holder.cached = defs;
-		holder.cachedVersion = version;
-		return defs;
+		// Per-isolate single-flight cache keyed on the persisted version.
+		// Coalesce concurrent cold readers via the lock and read the
+		// published value; never await another request's in-flight promise
+		// (a cancelled owner would otherwise strand every later byline
+		// hydration on the isolate). The fetch is anchored so a cancelled
+		// originator still drives it to completion and populates the cache.
+		return initWithLock<BylineFieldDefinition[]>(
+			holder.lock,
+			() => (holder.hasValue && holder.cachedVersion === version ? holder.value : null),
+			(isCurrentClaim) =>
+				(async () => {
+					const defs = await new BylineSchemaRegistry(db).listFields();
+					// Publish only while still the current claim, and never
+					// regress over a newer version a concurrent reader stored.
+					if (isCurrentClaim() && version >= holder.cachedVersion) {
+						holder.value = defs;
+						holder.hasValue = true;
+						holder.cachedVersion = version;
+					}
+					return defs;
+				})(),
+			{ deadlineMs: reclaimDeadlineMs, anchor: (promise) => after(() => promise) },
+		);
 	});
 }
 
@@ -133,6 +168,21 @@ export async function getBylineFieldDefs(db: Kysely<Database>): Promise<BylineFi
  * coordination that lets other isolates see the change.
  */
 export function resetBylineFieldDefsCacheForTests(): void {
-	holder.cached = null;
+	holder.value = null;
+	holder.hasValue = false;
 	holder.cachedVersion = -1;
+	holder.lock.ownerStartedAt = null;
+	holder.lock.generation = 0;
+	reclaimDeadlineMs = 10_000;
+}
+
+/**
+ * Test-only: shorten the single-flight reclaim window so a "stranded
+ * owner" scenario can be exercised without waiting out the production
+ * deadline. Reset by `resetBylineFieldDefsCacheForTests`.
+ *
+ * @internal
+ */
+export function setBylineFieldDefsReclaimDeadlineForTests(ms: number): void {
+	reclaimDeadlineMs = ms;
 }

package/src/cli/commands/bundle-utils.ts

@@ -13,6 +13,7 @@ import { pipeline } from "node:stream/promises";
 import { imageSize } from "image-size";
 import { packTar } from "modern-tar/fs";
 
+import { capabilitiesToDeclaredAccess } from "../../plugins/types.js";
 import type {
 	PluginManifest,
 	ResolvedPlugin,
@@ -151,6 +152,7 @@ export function extractManifest(plugin: ResolvedPlugin): PluginManifest {
 	return {
 		id: plugin.id,
 		version: plugin.version,
+		declaredAccess: capabilitiesToDeclaredAccess(plugin.capabilities, plugin.allowedHosts),
 		capabilities: plugin.capabilities,
 		allowedHosts: plugin.allowedHosts,
 		storage: plugin.storage,

package/src/cli/commands/doctor.ts

@@ -124,7 +124,7 @@ async function checkDatabase(dbPath: string): Promise<CheckResult[]> {
 		try {
 			const usersResult = await sql<{
 				count: number;
-			}>`SELECT COUNT(id) as count FROM _emdash_users`.execute(db);
+			}>`SELECT COUNT(id) as count FROM users`.execute(db);
 			const count = usersResult.rows[0]?.count ?? 0;
 			results.push({
 				name: "users",

package/src/cli/commands/secrets.ts

@@ -4,7 +4,7 @@
  * Pure (no-DB) commands for working with EmDash secrets:
  *
  * - `emdash secrets generate` — emits a fresh `EMDASH_ENCRYPTION_KEY`.
- *   Optionally writes it to `.dev.vars` (Workers) or `.env` (Node).
+ *   Optionally writes it to a local-secrets file (`.env`).
  * - `emdash secrets fingerprint <key>` — prints the kid for a key,
  *   useful in CI for verifying what's been deployed without exposing
  *   the raw value.
@@ -87,7 +87,7 @@ const generateCommand = defineCommand({
 		write: {
 			type: "string",
 			description:
-				"Optional path to write the key to (e.g. .dev.vars or .env). " +
+				"Optional path to write the key to (e.g. .env). " +
 				"Won't overwrite an existing entry without --force.",
 		},
 		force: {

package/src/config/secrets.ts

@@ -31,9 +31,15 @@ import { sha256 } from "@oslojs/crypto/sha2";
 import { encodeHexLowerCase } from "@oslojs/encoding";
 import type { Kysely } from "kysely";
 
+import { after } from "../after.js";
 import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 import { decodeBase64url, encodeBase64url } from "../utils/base64.js";
+import {
+	createSingleFlightCache,
+	type SingleFlightCache,
+	singleFlightCached,
+} from "../utils/single-flight-cache.js";
 
 /** v1 encryption key prefix. Bumping requires a separate KDF version. */
 export const ENCRYPTION_KEY_PREFIX = "emdash_enc_v1_";
@@ -370,17 +376,23 @@ export async function validateEncryptionKeyAtStartup(env?: SecretsEnv): Promise<
  *
  * Lives on `globalThis` so module-duplication during SSR bundling can't
  * fragment the cache. See `request-context.ts` for the same pattern.
+ *
+ * Each db gets its own poison-immune single-flight cache (see
+ * `utils/single-flight-cache.ts`): the resolved *value* is cached, never an
+ * in-flight promise, so a request cancelled mid-resolve can't strand later
+ * preview/comment requests on the isolate.
  */
 // Versioned to prevent cache fragmentation if `ResolvedSecrets`'s shape
 // ever changes. Bump the suffix on incompatible changes so a co-resident
-// older build doesn't read a newer-shape value.
-const SECRETS_CACHE_KEY = Symbol.for("@emdash-cms/core/secrets-cache@1");
+// older build doesn't read a newer-shape value. Bumped to @2 when the cached
+// value changed from a bare promise to a single-flight cache.
+const SECRETS_CACHE_KEY = Symbol.for("@emdash-cms/core/secrets-cache@2");
 
 interface SecretsCacheHolder {
-	cache: WeakMap<Kysely<Database>, Promise<ResolvedSecrets>>;
+	cache: WeakMap<Kysely<Database>, SingleFlightCache<ResolvedSecrets>>;
 }
 
-function getSecretsCache(): WeakMap<Kysely<Database>, Promise<ResolvedSecrets>> {
+function getSecretsCache(): WeakMap<Kysely<Database>, SingleFlightCache<ResolvedSecrets>> {
 	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern
 	const holder = globalThis as Record<symbol, SecretsCacheHolder | undefined>;
 	let entry = holder[SECRETS_CACHE_KEY];
@@ -397,19 +409,21 @@ function getSecretsCache(): WeakMap<Kysely<Database>, Promise<ResolvedSecrets>>
  * env / re-query options on every request.
  *
  * The cache is keyed by `Kysely` instance, so playground / per-DO / per-test
- * databases each get their own resolution.
+ * databases each get their own resolution. Concurrent cold callers coalesce
+ * onto one resolution via the single-flight lock; a failed resolution
+ * propagates to the caller and releases the lock so the next caller retries.
  */
 export function resolveSecretsCached(db: Kysely<Database>): Promise<ResolvedSecrets> {
-	const cache = getSecretsCache();
-	const cached = cache.get(db);
-	if (cached) return cached;
-	const promise = resolveSecrets({ db }).catch((error) => {
-		// Don't poison the cache on transient failure; next caller retries.
-		cache.delete(db);
-		throw error;
+	const caches = getSecretsCache();
+	let cache = caches.get(db);
+	if (!cache) {
+		cache = createSingleFlightCache<ResolvedSecrets>();
+		caches.set(db, cache);
+	}
+	return singleFlightCached(cache, () => resolveSecrets({ db }), {
+		anchor: (promise) => after(() => promise),
+		ownerTimeoutMs: 30_000,
 	});
-	cache.set(db, promise);
-	return promise;
 }
 
 /**

package/src/database/instrumentation.ts

@@ -110,3 +110,16 @@ function kyselyLog(event: LogEvent): void {
 export function kyselyLogOption(): Logger {
 	return kyselyLog;
 }
+
+/**
+ * Record physical database round trips for the current request.
+ *
+ * Called by backends that batch (the DO SQL driver coalesces same-turn SELECTs
+ * into one RPC), so we can see round-trip count separately from logical query
+ * count (`dbCount`, bumped by the Kysely log hook). No-op outside a request or
+ * when metrics aren't attached (e.g. migrations on the singleton).
+ */
+export function recordRpc(count = 1): void {
+	const ctx = getRequestContext();
+	if (ctx?.metrics) ctx.metrics.rpcCount += count;
+}

package/src/emdash-runtime.ts

@@ -45,6 +45,7 @@ import type {
 import type { FieldType } from "./schema/types.js";
 import { hashString } from "./utils/hash.js";
 import { createInitLock, type InitLock, initWithLock } from "./utils/init-lock.js";
+import { createSingleFlightCache, singleFlightCached } from "./utils/single-flight-cache.js";
 import { COMMIT, VERSION } from "./version.js";
 
 const LEADING_SLASH_PATTERN = /^\//;
@@ -417,12 +418,12 @@ export class EmDashRuntime {
 	private pluginStates: Map<string, string>;
 
 	/**
-	 * Set to true after FTS indexes have been verified for this worker
-	 * lifetime so we don't re-scan on every admin request. See
-	 * ensureSearchHealthy().
+	 * Isolate-lifetime guard so FTS indexes are verified at most once per
+	 * worker rather than on every admin request. See ensureSearchHealthy().
+	 * Uses the poison-immune single-flight cache (never a shared awaitable
+	 * promise) so a cancelled first caller can't wedge later ones.
 	 */
-	private _searchHealthChecked = false;
-	private _searchHealthPromise: Promise<void> | null = null;
+	private readonly _searchHealthCache = createSingleFlightCache<void>();
 
 	/** Current hook pipeline. Use the `hooks` getter for external access. */
 	get hooks(): HookPipeline {
@@ -2228,27 +2229,32 @@ export class EmDashRuntime {
 	 * defend against FTS not existing yet (pre-setup).
 	 */
 	async ensureSearchHealthy(): Promise<void> {
-		if (this._searchHealthChecked) return;
-		if (this._searchHealthPromise) return this._searchHealthPromise;
-		if (!isSqlite(this._db)) {
-			this._searchHealthChecked = true;
-			return;
+		// Non-SQLite has no FTS to verify; the check is a cheap synchronous
+		// branch, no need to cache it.
+		if (!isSqlite(this._db)) return;
+		try {
+			await singleFlightCached(
+				this._searchHealthCache,
+				async () => {
+					try {
+						const ftsManager = new FTSManager(this._db);
+						const repaired = await ftsManager.verifyAndRepairAll();
+						if (repaired > 0) {
+							console.log(`Repaired ${repaired} corrupted FTS index(es)`);
+						}
+					} catch {
+						// FTS tables may not exist yet (pre-setup). Non-fatal — cache
+						// the "checked" state regardless so we don't re-scan.
+					}
+				},
+				{ anchor: (promise) => after(() => promise), ownerTimeoutMs: 30_000 },
+			);
+		} catch {
+			// This check is best-effort and must never fail the calling request.
+			// The inner body already swallows verify errors; this guards the
+			// outer failure modes (owner timeout, waiter give-up) so a slow FTS
+			// scan degrades to "unverified", not a 500 on admin/search routes.
 		}
-		this._searchHealthPromise = (async () => {
-			try {
-				const ftsManager = new FTSManager(this._db);
-				const repaired = await ftsManager.verifyAndRepairAll();
-				if (repaired > 0) {
-					console.log(`Repaired ${repaired} corrupted FTS index(es)`);
-				}
-			} catch {
-				// FTS tables may not exist yet (pre-setup). Non-fatal.
-			} finally {
-				this._searchHealthChecked = true;
-				this._searchHealthPromise = null;
-			}
-		})();
-		return this._searchHealthPromise;
 	}
 
 	// =========================================================================

package/src/loader.ts

@@ -680,7 +680,12 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 
 				// Separate taxonomy / byline filters from field filters
 				let result: { rows: Record<string, unknown>[] };
-				let taxonomyFilter: { name: string; slugs: string[] } | null = null;
+				// Taxonomy filters AND together: each entry constrains the base
+				// row to match at least one of its slugs *within that taxonomy*.
+				// Term slugs are unique only within a taxonomy, so every filter
+				// keeps its own `name` and emits its own `EXISTS` clause rather
+				// than pooling slugs into one `IN`.
+				const taxonomyFilters: { name: string; slugs: string[] }[] = [];
 				// A byline filter matches entries credited to any of the given
 				// byline translation groups via the `_emdash_content_bylines`
 				// junction table. `null` means no byline filter; an empty
@@ -710,14 +715,8 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 								);
 								continue;
 							}
-							if (taxonomyFilter) {
-								console.warn(
-									`[emdash] where filter: only one taxonomy is supported per query, "${key}" ignored`,
-								);
-								continue;
-							}
 							const slugs = Array.isArray(value) ? value : [value];
-							taxonomyFilter = { name: key, slugs };
+							taxonomyFilters.push({ name: key, slugs });
 						} else {
 							fieldFilters[key] = value;
 						}
@@ -729,7 +728,7 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 				// SQL on both dialects).
 				if (
 					(bylineFilter && bylineFilter.groups.length === 0) ||
-					(taxonomyFilter && taxonomyFilter.slugs.length === 0)
+					taxonomyFilters.some((f) => f.slugs.length === 0)
 				) {
 					return { entries: [], cacheHint: { tags: [type] } };
 				}
@@ -753,16 +752,26 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 					const fieldCondsSQL =
 						fieldConds.length > 0 ? sql`${sql.join(fieldConds, sql` AND `)}` : null;
 
-					const taxonomyCond = taxonomyFilter
-						? sql`AND EXISTS (
+					// One `EXISTS` per taxonomy, AND'd together: an entry must be
+					// tagged with a matching term in *every* requested taxonomy.
+					// Each clause pins its own `t.name`, so slugs never pool
+					// across taxonomies (they're only unique within one).
+					const taxonomyCond =
+						taxonomyFilters.length > 0
+							? sql`${sql.join(
+									taxonomyFilters.map(
+										(f) => sql`AND EXISTS (
 							SELECT 1 FROM content_taxonomies ct
 							INNER JOIN taxonomies t ON t.id = ct.taxonomy_id
 							WHERE ct.collection = ${type}
 								AND ct.entry_id = ${sql.ref(tableName)}.id
-								AND t.name = ${taxonomyFilter.name}
-								AND t.slug IN (${sql.join(taxonomyFilter.slugs.map((s) => sql`${s}`))})
-						)`
-						: sql``;
+								AND t.name = ${f.name}
+								AND t.slug IN (${sql.join(f.slugs.map((s) => sql`${s}`))})
+						)`,
+									),
+									sql` `,
+								)}`
+							: sql``;
 
 					// `_emdash_content_bylines.byline_id` stores the byline's
 					// translation_group (migration 040), so a credit spans every