emdash 0.20.0 → 0.22.0

package/src/astro/integration/index.ts

@@ -17,6 +17,7 @@ import type { AstroIntegration, AstroIntegrationLogger } from "astro";
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
 import { INTERNAL_MEDIA_PREFIX } from "../../media/normalize.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
+import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
 import { notoSans } from "./font-provider.js";
 import {
@@ -69,26 +70,21 @@ interface ImageRemotePattern {
 /**
  * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
  *
- * Astro's image services only transform **absolute** URLs whose host is
- * authorized; everything else is passed through unoptimized. We authorize the
- * media sources automatically:
+ * Astro's image services only build a transform URL for sources allowed via
+ * `image.domains` / `image.remotePatterns` (relative URLs are never optimized —
+ * see `isRemoteAllowed`). We authorize the media sources automatically:
  *
- *  1. The storage adapter's public URL host (R2 custom domain, S3/CDN), so
- *     media served directly from a public bucket is optimized.
+ *  1. The storage adapter's public URL host (R2 custom domain, S3/CDN).
  *  2. The site's own origin, scoped to the media proxy route
- *     (`/_emdash/api/media/file/**`), so same-origin proxied media (local
- *     storage, or R2 without a public URL) is optimized too. The pathname
- *     scope keeps Astro's image endpoint from acting as an open proxy for the
- *     whole origin. Only registered when `siteUrl` is known at build time;
- *     `getPublicOrigin` resolves the matching origin at render time.
- *  3. In `astro dev` the dev-server origin (`localhost:<port>`) isn't known at
- *     build time, so we register a host-agnostic pattern scoped to the media
- *     route. This is dev-only — it never ships in a production build — so the
- *     missing host check can't be abused on a deployed site.
+ *     (`/_emdash/api/media/file/**`), so same-origin proxied media is optimized.
+ *     The components absolutize the media URL against this origin; EmDash's
+ *     wrapped image endpoint then serves the bytes from storage (so the absolute
+ *     URL is never fetched). Only registered when `siteUrl` is known at build.
+ *  3. In `astro dev` the dev-server origin isn't known at build time, so we
+ *     register a host-agnostic pattern scoped to the media route. Dev-only.
  *
- * Returns an empty array when no source is statically known (e.g. a production
- * build using local storage with no `siteUrl`), in which case media renders as
- * a plain `<img>`.
+ * Returns an empty array when no source is statically known (production build,
+ * local storage, no `siteUrl`), in which case media renders as a plain `<img>`.
  *
  * @internal Exported for unit testing.
  */
@@ -146,6 +142,59 @@ export function buildImageRemotePatterns(
 	return patterns;
 }
 
+/**
+ * Stock image endpoints EmDash may safely replace with its storage-backed
+ * wrapper. Our wrapper delegates non-EmDash images to the platform's transform
+ * endpoint, so we only override endpoints whose transform we can delegate to.
+ */
+const OVERRIDABLE_IMAGE_ENDPOINTS = new Set([
+	"astro/assets/endpoint/generic",
+	"astro/assets/endpoint/node",
+	"astro/assets/endpoint/dev",
+	"@astrojs/cloudflare/image-transform-endpoint",
+]);
+
+/**
+ * Stock endpoints that deliberately don't transform (the user opted into
+ * passthrough). We leave these untouched -- and without a warning, since it's a
+ * supported choice, not a custom endpoint. Overriding would route non-EmDash
+ * images through a transformer the passthrough setup doesn't provide.
+ */
+const PASSTHROUGH_IMAGE_ENDPOINTS = new Set(["@astrojs/cloudflare/image-passthrough-endpoint"]);
+
+/**
+ * Decide which image endpoint to install (if any). EmDash wraps Astro's image
+ * endpoint so EmDash media bytes load from storage; the wrapper delegates other
+ * images back to the platform's stock endpoint.
+ *
+ * Returns `{ entrypoint }` to install, `{ warn }` to skip with a warning (a
+ * custom endpoint we can't delegate to), or `{}` to skip silently (opted out).
+ *
+ * @internal Exported for unit testing.
+ */
+export function resolveImageEndpoint(opts: {
+	imagesDisabled: boolean;
+	currentEntrypoint: string | undefined;
+	isCloudflare: boolean;
+}): { entrypoint?: string; warn?: string } {
+	if (opts.imagesDisabled) return {};
+	const current = opts.currentEntrypoint;
+	if (current === undefined || OVERRIDABLE_IMAGE_ENDPOINTS.has(current)) {
+		return {
+			entrypoint: opts.isCloudflare
+				? "@emdash-cms/cloudflare/image-endpoint"
+				: "emdash/image-endpoint",
+		};
+	}
+	// A deliberate passthrough setup: leave it alone, no warning.
+	if (PASSTHROUGH_IMAGE_ENDPOINTS.has(current)) return {};
+	return {
+		warn:
+			`A custom image.endpoint (${current}) is configured; EmDash will not wrap ` +
+			`it, so storage-backed media may render unoptimized.`,
+	};
+}
+
 // Terminal formatting
 const dim = (s: string) => `\x1b[2m${s}\x1b[22m`;
 const bold = (s: string) => `\x1b[1m${s}\x1b[22m`;
@@ -155,15 +204,24 @@ const cyan = (s: string) => `\x1b[36m${s}\x1b[39m`;
 function printBanner(_logger: AstroIntegrationLogger): void {
 	const banner = `
 
-  ${bold(cyan("— E M D A S H —"))}
+  ${bold(cyan("— E M D A S H —"))}  ${dim(`v${VERSION}`)}
    `;
 	console.log(banner);
 }
 
-/** Print route injection summary */
-function printRoutesSummary(_logger: AstroIntegrationLogger): void {
-	console.log(`\n  ${dim("›")} Admin UI    ${cyan("/_emdash/admin")}`);
-	console.log(`  ${dim("›")} API         ${cyan("/_emdash/api/*")}`);
+/**
+ * Print dev-server route info with absolute (clickable) URLs, including the
+ * dev-bypass shortcut that skips passkey auth. Dev only -- the dev-bypass
+ * endpoint returns 403 in production.
+ */
+function printDevServerInfo(baseUrl: string, mcpEnabled: boolean): void {
+	const devBypassUrl = `${baseUrl}/_emdash/api/setup/dev-bypass?redirect=/_emdash/admin`;
+	console.log(`\n  ${dim("›")} Admin UI    ${cyan(`${baseUrl}/_emdash/admin`)}`);
+	if (mcpEnabled) {
+		console.log(`  ${dim("›")} MCP server  ${cyan(`${baseUrl}/_emdash/api/mcp`)}`);
+	}
+	console.log(`  ${dim("›")} Dev bypass  ${cyan(devBypassUrl)}`);
+	console.log(`    ${dim("Skips passkey setup/auth and signs you in as a dev admin")}`);
 	console.log("");
 }
 
@@ -298,6 +356,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 	// Check if auth is an AuthDescriptor (has entrypoint) indicating external auth
 	const useExternalAuth = !!(resolvedConfig.auth && "entrypoint" in resolvedConfig.auth);
 
+	// Captured in astro:config:setup so the astro:server:setup hook can tell
+	// whether we're running `astro dev` (where the dev-bypass shortcut applies).
+	let astroCommand: "dev" | "build" | "preview" | "sync" | undefined;
+
 	return {
 		name: "emdash",
 		hooks: {
@@ -309,6 +371,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				config: astroConfig,
 				command,
 			}) => {
+				astroCommand = command;
 				printBanner(logger);
 				// Capture the host's Astro version so the runtime can expose it
 				// to the admin and the registry install gate for `env:astro`
@@ -345,7 +408,9 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				const securityConfig: Record<string, unknown> = {
 					checkOrigin: false,
 					...(resolvedConfig.siteUrl
-						? { allowedDomains: [{ hostname: new URL(resolvedConfig.siteUrl).hostname }] }
+						? {
+								allowedDomains: [{ hostname: new URL(resolvedConfig.siteUrl).hostname }],
+							}
 						: {}),
 				};
 
@@ -385,19 +450,32 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 								},
 							];
 
-				// Authorize media sources for Astro image optimization so the
-				// Image components can generate a responsive srcset for R2/S3 and
-				// same-origin proxied media. `updateConfig` merges arrays, so any
-				// user-configured remotePatterns are preserved.
+				// Authorize media sources so Astro's image service builds transform
+				// URLs for them (it won't optimize an un-allowed source). `updateConfig`
+				// merges arrays, so user-configured remotePatterns are preserved.
 				const imageRemotePatterns = buildImageRemotePatterns(
 					resolvedConfig.storage,
 					resolvedConfig.siteUrl,
 					command,
 				);
 
+				// Wrap Astro's image endpoint so EmDash media bytes load straight from
+				// storage (Access-safe) instead of over HTTP. Skip when the user opts
+				// out or has a custom endpoint we can't delegate back to.
+				const { entrypoint: imageEndpoint, warn: imageEndpointWarning } = resolveImageEndpoint({
+					imagesDisabled: resolvedConfig.images === false,
+					currentEntrypoint: astroConfig.image?.endpoint?.entrypoint,
+					isCloudflare: astroConfig.adapter?.name === "@astrojs/cloudflare",
+				});
+				if (imageEndpointWarning) logger.warn(imageEndpointWarning);
+
+				const imageConfig: Record<string, unknown> = {};
+				if (imageRemotePatterns.length) imageConfig.remotePatterns = imageRemotePatterns;
+				if (imageEndpoint) imageConfig.endpoint = { entrypoint: imageEndpoint };
+
 				updateConfig({
 					security: securityConfig,
-					...(imageRemotePatterns.length ? { image: { remotePatterns: imageRemotePatterns } } : {}),
+					...(Object.keys(imageConfig).length ? { image: imageConfig } : {}),
 					// fonts is a valid AstroConfig key but may not be in the
 					// type definition for the minimum supported Astro version
 					...({ fonts: emdashFonts } as Record<string, unknown>),
@@ -413,7 +491,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				});
 
 				// Inject all core routes
-				injectCoreRoutes(injectRoute);
+				injectCoreRoutes(injectRoute, { srcDir: astroConfig.srcDir });
 
 				// Inject routes from pluggable auth providers (authProviders config)
 				if (resolvedConfig.authProviders?.length) {
@@ -473,9 +551,28 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					order: "pre",
 				});
 
-				printRoutesSummary(logger);
+				// Route info is printed with absolute, clickable URLs once the
+				// dev server is listening (see astro:server:setup), since the
+				// port isn't known yet here. Nothing useful to print for build.
 			},
 			"astro:server:setup": ({ server, logger }) => {
+				// Print route info with absolute, clickable URLs once the server
+				// is listening. Only in `astro dev` -- the dev-bypass shortcut is
+				// dev-only and the port is unknown until now.
+				if (astroCommand === "dev") {
+					server.httpServer?.once("listening", () => {
+						const address = server.httpServer?.address();
+						if (!address || typeof address === "string") return;
+						let host = address.address;
+						if (host === "::1" || host === "::" || host === "0.0.0.0") {
+							host = "localhost";
+						} else if (address.family === "IPv6") {
+							host = `[${host}]`;
+						}
+						printDevServerInfo(`http://${host}:${address.port}`, resolvedConfig.mcp !== false);
+					});
+				}
+
 				// Generate types once the server is listening.
 				// The endpoint returns the types content; we write the file here
 				// (in Node) because workerd has no real filesystem access.

package/src/astro/integration/routes.ts

@@ -4,6 +4,7 @@
  * Defines and injects all EmDash routes into the Astro application.
  */
 
+import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -41,10 +42,42 @@ function resolveRoute(route: string): string {
 /** Route injection function type */
 type InjectRoute = (route: { pattern: string; entrypoint: string }) => void;
 
+interface InjectCoreRoutesOptions {
+	srcDir?: URL;
+}
+
+const ROUTE_OVERRIDE_EXTENSIONS = [
+	".astro",
+	".js",
+	".ts",
+	".jsx",
+	".tsx",
+	".mjs",
+	".mts",
+	".md",
+	".mdx",
+	".html",
+];
+
+/**
+ * Detect whether the host site defines its own root-level public route file.
+ */
+export function hasUserDefinedPublicRoute(srcDir: URL, basename: string): boolean {
+	const srcDirPath = fileURLToPath(srcDir);
+	return ROUTE_OVERRIDE_EXTENSIONS.some(
+		(extension) =>
+			existsSync(resolve(srcDirPath, "pages", `${basename}${extension}`)) ||
+			existsSync(resolve(srcDirPath, "pages", basename, `index${extension}`)),
+	);
+}
+
 /**
  * Injects all core EmDash routes.
  */
-export function injectCoreRoutes(injectRoute: InjectRoute): void {
+export function injectCoreRoutes(
+	injectRoute: InjectRoute,
+	options: InjectCoreRoutesOptions = {},
+): void {
 	// Inject admin shell route
 	injectRoute({
 		pattern: "/_emdash/admin/[...path]",
@@ -725,6 +758,11 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/comments/[collection]/[contentId]/index.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/comments/[collection]/[contentId]/reactions",
+		entrypoint: resolveRoute("api/comments/[collection]/[contentId]/reactions.ts"),
+	});
+
 	// Comment routes (admin)
 	injectRoute({
 		pattern: "/_emdash/api/admin/comments",
@@ -752,20 +790,24 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 	});
 
 	// SEO routes (public, at site root)
-	injectRoute({
-		pattern: "/sitemap.xml",
-		entrypoint: resolveRoute("sitemap.xml.ts"),
-	});
+	if (!options.srcDir || !hasUserDefinedPublicRoute(options.srcDir, "sitemap.xml")) {
+		injectRoute({
+			pattern: "/sitemap.xml",
+			entrypoint: resolveRoute("sitemap.xml.ts"),
+		});
+	}
 
 	injectRoute({
 		pattern: "/sitemap-[collection].xml",
 		entrypoint: resolveRoute("sitemap-[collection].xml.ts"),
 	});
 
-	injectRoute({
-		pattern: "/robots.txt",
-		entrypoint: resolveRoute("robots.txt.ts"),
-	});
+	if (!options.srcDir || !hasUserDefinedPublicRoute(options.srcDir, "robots.txt")) {
+		injectRoute({
+			pattern: "/robots.txt",
+			entrypoint: resolveRoute("robots.txt.ts"),
+		});
+	}
 
 	// Setup wizard API routes
 	injectRoute({

package/src/astro/integration/runtime.ts

@@ -10,7 +10,12 @@
 import type { AuthDescriptor, AuthProviderDescriptor } from "../../auth/types.js";
 import type { DatabaseDescriptor } from "../../db/adapters.js";
 import type { MediaProviderDescriptor } from "../../media/types.js";
-import type { ResolvedPlugin } from "../../plugins/types.js";
+import type { ObjectCacheDescriptor } from "../../object-cache/types.js";
+import type {
+	FieldWidgetConfig,
+	PortableTextBlockConfig,
+	ResolvedPlugin,
+} from "../../plugins/types.js";
 import type { ExperimentalConfig } from "../../registry/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
 
@@ -98,6 +103,15 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
 	adminPages?: PluginAdminPage[];
 	/** Dashboard widgets */
 	adminWidgets?: PluginDashboardWidget[];
+	/**
+	 * Portable Text block types this plugin contributes to the editor.
+	 * Declarative (Block Kit) — surfaced in the admin slash menu and consumed
+	 * from the manifest, so standard/sandboxed plugins can contribute blocks
+	 * without a native render component.
+	 */
+	portableTextBlocks?: PortableTextBlockConfig[];
+	/** Field widget types this plugin contributes for schema-field editing UIs. */
+	fieldWidgets?: FieldWidgetConfig[];
 
 	// === Sandbox-specific fields (for sandboxed plugins) ===
 
@@ -151,6 +165,56 @@ export interface EmDashConfig {
 	 * Storage configuration (for media)
 	 */
 	storage?: StorageDescriptor;
+
+	/**
+	 * Optional distributed object cache for query results.
+	 *
+	 * Off by default. When configured, content and chrome (settings, menus,
+	 * taxonomies) reads are cached in a fast key/value store and served without
+	 * touching the database on repeat requests across isolates. This offloads
+	 * read pressure from D1/SQLite, which is especially valuable on Cloudflare
+	 * where D1 has far lower request capacity than KV.
+	 *
+	 * Use a backend adapter:
+	 * - `memoryCache()` from `emdash/astro` — in-isolate (Node / local dev)
+	 * - `kvCache({ binding: "CACHE" })` from `@emdash-cms/cloudflare` — KV
+	 *
+	 * Preview and visual-edit requests bypass the cache, so editors previewing
+	 * see live content. All other reads — including authenticated browsing outside
+	 * edit mode — are served from the cache, which only ever stores published
+	 * content. After an edit, anonymous visitors may see stale content until other
+	 * isolates pick up the bumped epoch: immediate with the memory backend, and on
+	 * KV bounded by KV's edge-cache propagation (eventual consistency, up to ~60s)
+	 * plus the isolate-local `revalidate` window (default 1s).
+	 *
+	 * Scheduled content becomes visible at query time (no write event fires when
+	 * its publish time passes), so a cached list/entry won't surface a newly-due
+	 * scheduled item until the next write to that collection or until the
+	 * entry's TTL lapses (`defaultTtl`, default 1h). Sites that rely on precise
+	 * scheduled publishing should lower `defaultTtl` accordingly.
+	 *
+	 * @example
+	 * ```ts
+	 * import { kvCache } from "@emdash-cms/cloudflare";
+	 *
+	 * emdash({
+	 *   database: d1({ binding: "DB" }),
+	 *   objectCache: kvCache({ binding: "CACHE" }),
+	 * })
+	 * ```
+	 */
+	objectCache?: ObjectCacheDescriptor;
+	/**
+	 * Image optimization.
+	 *
+	 * By default EmDash wraps Astro's image endpoint so media served from
+	 * storage is optimized through the normal `<Image>` / `getImage` pipeline,
+	 * loading source bytes directly from the storage adapter (works behind
+	 * Cloudflare Access). Set to `false` to leave Astro's image endpoint
+	 * untouched -- media then renders as a plain `<img>` unless your image
+	 * service can fetch it over HTTP.
+	 */
+	images?: boolean;
 	/**
 	 * Trusted plugins to load (run in main isolate)
 	 *

package/src/astro/integration/virtual-modules.ts

@@ -33,6 +33,9 @@ export const RESOLVED_VIRTUAL_DIALECT_ID = "\0" + VIRTUAL_DIALECT_ID;
 export const VIRTUAL_STORAGE_ID = "virtual:emdash/storage";
 export const RESOLVED_VIRTUAL_STORAGE_ID = "\0" + VIRTUAL_STORAGE_ID;
 
+export const VIRTUAL_OBJECT_CACHE_ID = "virtual:emdash/object-cache";
+export const RESOLVED_VIRTUAL_OBJECT_CACHE_ID = "\0" + VIRTUAL_OBJECT_CACHE_ID;
+
 export const VIRTUAL_ADMIN_REGISTRY_ID = "virtual:emdash/admin-registry";
 export const RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID = "\0" + VIRTUAL_ADMIN_REGISTRY_ID;
 
@@ -128,6 +131,31 @@ export const createStorage = _createStorage;
 `;
 }
 
+/**
+ * Generates the object-cache virtual module.
+ *
+ * Statically imports the configured object-cache backend's `createObjectCache`
+ * factory and embeds its serializable config. When no object cache is
+ * configured, exports `undefined` so the runtime read-through layer becomes a
+ * transparent passthrough (cache off by default).
+ */
+export function generateObjectCacheModule(
+	entrypoint?: string,
+	config?: Record<string, unknown>,
+): string {
+	if (!entrypoint) {
+		return [
+			`export const createObjectCache = undefined;`,
+			`export const objectCacheConfig = undefined;`,
+		].join("\n");
+	}
+	return `
+import { createObjectCache as _createObjectCache } from "${entrypoint}";
+export const createObjectCache = _createObjectCache;
+export const objectCacheConfig = ${JSON.stringify(config ?? {})};
+`;
+}
+
 /**
  * Generates the auth virtual module.
  * Statically imports the configured auth provider.
@@ -220,6 +248,8 @@ export function generatePluginsModule(descriptors: PluginDescriptor[]): string {
 					storage: descriptor.storage,
 					adminPages: descriptor.adminPages,
 					adminWidgets: descriptor.adminWidgets,
+					portableTextBlocks: descriptor.portableTextBlocks,
+					fieldWidgets: descriptor.fieldWidgets,
 				})})`,
 			);
 		} else {
@@ -589,6 +619,8 @@ export const sandboxedPlugins = [];
     storage: ${JSON.stringify(descriptor.storage ?? {})},
     adminPages: ${JSON.stringify(descriptor.adminPages ?? [])},
     adminWidgets: ${JSON.stringify(descriptor.adminWidgets ?? [])},
+    portableTextBlocks: ${JSON.stringify(descriptor.portableTextBlocks ?? [])},
+    fieldWidgets: ${JSON.stringify(descriptor.fieldWidgets ?? [])},
     adminEntry: ${JSON.stringify(descriptor.adminEntry)},
     // Code read from: ${filePath}
     code: ${JSON.stringify(code)},

package/src/astro/integration/vite-config.ts

@@ -22,6 +22,8 @@ import {
 	RESOLVED_VIRTUAL_DIALECT_ID,
 	VIRTUAL_STORAGE_ID,
 	RESOLVED_VIRTUAL_STORAGE_ID,
+	VIRTUAL_OBJECT_CACHE_ID,
+	RESOLVED_VIRTUAL_OBJECT_CACHE_ID,
 	VIRTUAL_ADMIN_REGISTRY_ID,
 	RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID,
 	VIRTUAL_PLUGINS_ID,
@@ -50,6 +52,7 @@ import {
 	generateConfigModule,
 	generateDialectModule,
 	generateStorageModule,
+	generateObjectCacheModule,
 	generateAuthModule,
 	generateAuthProvidersModule,
 	generatePluginsModule,
@@ -176,6 +179,9 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 			if (id === VIRTUAL_STORAGE_ID) {
 				return RESOLVED_VIRTUAL_STORAGE_ID;
 			}
+			if (id === VIRTUAL_OBJECT_CACHE_ID) {
+				return RESOLVED_VIRTUAL_OBJECT_CACHE_ID;
+			}
 			if (id === VIRTUAL_ADMIN_REGISTRY_ID) {
 				return RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID;
 			}
@@ -227,6 +233,14 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 			if (id === RESOLVED_VIRTUAL_STORAGE_ID) {
 				return generateStorageModule(resolvedConfig.storage?.entrypoint);
 			}
+			// Generate the object-cache module — statically imports the
+			// configured backend factory, or exports undefined (cache off).
+			if (id === RESOLVED_VIRTUAL_OBJECT_CACHE_ID) {
+				return generateObjectCacheModule(
+					resolvedConfig.objectCache?.entrypoint,
+					resolvedConfig.objectCache?.config,
+				);
+			}
 			// Generate plugins module that imports and instantiates all plugins
 			if (id === RESOLVED_VIRTUAL_PLUGINS_ID) {
 				return generatePluginsModule(pluginDescriptors);
@@ -435,6 +449,8 @@ export function createViteConfig(
 							// Top-level deps (use astro > path for pnpm compat)
 							"astro > zod/v4",
 							"astro > zod/v4/core",
+							// zod-generator imports the bare `zod` entry, not `zod/v4`
+							"emdash > zod",
 							"@emdash-cms/cloudflare > kysely-d1",
 							// Astro internal deps not covered by @astrojs/cloudflare adapter
 							"astro/virtual-modules/middleware.js",

package/src/astro/middleware/auth.ts

@@ -32,6 +32,7 @@ import { resolveApiToken, resolveOAuthToken } from "../../api/handlers/api-token
 import { hasScope } from "../../auth/api-tokens.js";
 import { getAuthMode, type ExternalAuthMode } from "../../auth/mode.js";
 import type { ExternalAuthConfig } from "../../auth/types.js";
+import { resolveSessionUser } from "../session-user.js";
 import type { EmDashHandlers } from "../types.js";
 import { buildEmDashCsp } from "./csp.js";
 
@@ -407,7 +408,7 @@ async function handlePluginRouteAuth(
 	try {
 		// Try session auth (sets locals.user if session exists)
 		const { session } = context;
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 		if (sessionUser?.id && emdash?.db) {
 			const adapter = createKyselyAdapter(emdash.db);
 			const user = await adapter.getUserById(sessionUser.id);
@@ -435,7 +436,7 @@ async function handlePublicRouteAuth(
 	const { emdash } = locals;
 
 	try {
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 		if (sessionUser?.id && emdash?.db) {
 			const adapter = createKyselyAdapter(emdash.db);
 			const user = await adapter.getUserById(sessionUser.id);
@@ -650,7 +651,7 @@ async function handlePasskeyAuth(
 
 	try {
 		// Check session for user (session.get returns a Promise)
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 
 		if (!sessionUser?.id) {
 			if (isApiRoute) {

package/src/astro/middleware/redirect.ts

@@ -23,6 +23,7 @@ import {
 	matchCachedPatterns,
 	setCachedRedirects,
 } from "../../redirects/cache.js";
+import { isTerminalStatus } from "../../redirects/status.js";
 
 /** Paths that should never be intercepted by redirects */
 const SKIP_PREFIXES = ["/_emdash", "/_image"];
@@ -80,6 +81,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			exact = cached.exact.get(alt);
 		}
 		if (exact) {
+			// Terminal statuses (410 Gone / 451): serve the status directly,
+			// with no Location header.
+			if (isTerminalStatus(exact.type)) {
+				repo.recordHit(exact.id).catch(() => {});
+				return new Response(null, { status: exact.type });
+			}
 			const dest = exact.destination;
 			if (dest.startsWith("//") || dest.startsWith("/\\")) return next();
 			repo.recordHit(exact.id).catch(() => {});
@@ -91,6 +98,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		const patternMatch = matchCachedPatterns(cached.patterns, pathname);
 		if (patternMatch) {
 			const { redirect, destination } = patternMatch;
+			// Terminal statuses (410 Gone / 451): serve the status directly.
+			if (isTerminalStatus(redirect.type)) {
+				repo.recordHit(redirect.id).catch(() => {});
+				return new Response(null, { status: redirect.type });
+			}
 			if (destination.startsWith("//") || destination.startsWith("/\\")) return next();
 			repo.recordHit(redirect.id).catch(() => {});
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;

package/src/astro/middleware/stream-end-metrics.ts

@@ -18,7 +18,7 @@
  * in normal production traffic.
  */
 
-import { isInstrumentationEnabled } from "../../database/instrumentation.js";
+import { flushRecorder, isInstrumentationEnabled } from "../../database/instrumentation.js";
 import { getRequestContext } from "../../request-context.js";
 
 export const STREAM_END_PREFIX = "[emdash-stream-end]";
@@ -64,6 +64,14 @@ export function wrapBodyForStreamMetrics(response: Response): Response {
 	if (!metrics) return response;
 	const recorder = ctx?.queryRecorder;
 
+	// Claim the per-query flush: the recorder is mutated in-place by the
+	// Kysely log hook for the whole request, including queries issued by
+	// components while the body streams. Flushing here (rather than when
+	// middleware returns) is what captures those streaming queries. The
+	// flag tells the middleware's fallback flush to leave this recorder
+	// to us.
+	if (recorder) recorder.deferredFlush = true;
+
 	const transform = new TransformStream<Uint8Array, Uint8Array>({
 		flush() {
 			const snapshot: StreamEndSnapshot = {
@@ -79,6 +87,8 @@ export function wrapBodyForStreamMetrics(response: Response): Response {
 				cacheMisses: metrics.cacheMisses,
 			};
 			console.log(`${STREAM_END_PREFIX} ${JSON.stringify(snapshot)}`);
+			// Emit the full per-query log now that streaming is complete.
+			if (recorder) flushRecorder(recorder);
 		},
 	});