emdash 0.21.0 → 0.23.0

package/src/astro/integration/virtual-modules.ts

@@ -33,6 +33,9 @@ export const RESOLVED_VIRTUAL_DIALECT_ID = "\0" + VIRTUAL_DIALECT_ID;
 export const VIRTUAL_STORAGE_ID = "virtual:emdash/storage";
 export const RESOLVED_VIRTUAL_STORAGE_ID = "\0" + VIRTUAL_STORAGE_ID;
 
+export const VIRTUAL_OBJECT_CACHE_ID = "virtual:emdash/object-cache";
+export const RESOLVED_VIRTUAL_OBJECT_CACHE_ID = "\0" + VIRTUAL_OBJECT_CACHE_ID;
+
 export const VIRTUAL_ADMIN_REGISTRY_ID = "virtual:emdash/admin-registry";
 export const RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID = "\0" + VIRTUAL_ADMIN_REGISTRY_ID;
 
@@ -93,14 +96,21 @@ export function generateDialectModule(opts: {
 			`export const createDialect = undefined;`,
 			`export const dialectType = "sqlite";`,
 			`export const createRequestScopedDb = (_opts) => null;`,
+			`export const createCoalescingDialect = undefined;`,
 		].join("\n");
 	}
 	const type = opts.type ?? "sqlite";
 
+	// Namespace access (not a named re-export) so backends that don't export
+	// createCoalescingDialect yield `undefined` rather than a build error.
+	const coalescingReExport = `import * as _dialectModule from "${entrypoint}";
+export const createCoalescingDialect = _dialectModule.createCoalescingDialect;`;
+
 	if (supportsRequestScope) {
 		return `
 import { createDialect as _createDialect } from "${entrypoint}";
 export { createRequestScopedDb } from "${entrypoint}";
+${coalescingReExport}
 export const createDialect = _createDialect;
 export const dialectType = ${JSON.stringify(type)};
 `;
@@ -108,6 +118,7 @@ export const dialectType = ${JSON.stringify(type)};
 
 	return `
 import { createDialect as _createDialect } from "${entrypoint}";
+${coalescingReExport}
 export const createDialect = _createDialect;
 export const dialectType = ${JSON.stringify(type)};
 export const createRequestScopedDb = (_opts) => null;
@@ -128,6 +139,31 @@ export const createStorage = _createStorage;
 `;
 }
 
+/**
+ * Generates the object-cache virtual module.
+ *
+ * Statically imports the configured object-cache backend's `createObjectCache`
+ * factory and embeds its serializable config. When no object cache is
+ * configured, exports `undefined` so the runtime read-through layer becomes a
+ * transparent passthrough (cache off by default).
+ */
+export function generateObjectCacheModule(
+	entrypoint?: string,
+	config?: Record<string, unknown>,
+): string {
+	if (!entrypoint) {
+		return [
+			`export const createObjectCache = undefined;`,
+			`export const objectCacheConfig = undefined;`,
+		].join("\n");
+	}
+	return `
+import { createObjectCache as _createObjectCache } from "${entrypoint}";
+export const createObjectCache = _createObjectCache;
+export const objectCacheConfig = ${JSON.stringify(config ?? {})};
+`;
+}
+
 /**
  * Generates the auth virtual module.
  * Statically imports the configured auth provider.
@@ -220,6 +256,8 @@ export function generatePluginsModule(descriptors: PluginDescriptor[]): string {
 					storage: descriptor.storage,
 					adminPages: descriptor.adminPages,
 					adminWidgets: descriptor.adminWidgets,
+					portableTextBlocks: descriptor.portableTextBlocks,
+					fieldWidgets: descriptor.fieldWidgets,
 				})})`,
 			);
 		} else {
@@ -589,6 +627,8 @@ export const sandboxedPlugins = [];
     storage: ${JSON.stringify(descriptor.storage ?? {})},
     adminPages: ${JSON.stringify(descriptor.adminPages ?? [])},
     adminWidgets: ${JSON.stringify(descriptor.adminWidgets ?? [])},
+    portableTextBlocks: ${JSON.stringify(descriptor.portableTextBlocks ?? [])},
+    fieldWidgets: ${JSON.stringify(descriptor.fieldWidgets ?? [])},
     adminEntry: ${JSON.stringify(descriptor.adminEntry)},
     // Code read from: ${filePath}
     code: ${JSON.stringify(code)},

package/src/astro/integration/vite-config.ts

@@ -22,6 +22,8 @@ import {
 	RESOLVED_VIRTUAL_DIALECT_ID,
 	VIRTUAL_STORAGE_ID,
 	RESOLVED_VIRTUAL_STORAGE_ID,
+	VIRTUAL_OBJECT_CACHE_ID,
+	RESOLVED_VIRTUAL_OBJECT_CACHE_ID,
 	VIRTUAL_ADMIN_REGISTRY_ID,
 	RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID,
 	VIRTUAL_PLUGINS_ID,
@@ -50,6 +52,7 @@ import {
 	generateConfigModule,
 	generateDialectModule,
 	generateStorageModule,
+	generateObjectCacheModule,
 	generateAuthModule,
 	generateAuthProvidersModule,
 	generatePluginsModule,
@@ -176,6 +179,9 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 			if (id === VIRTUAL_STORAGE_ID) {
 				return RESOLVED_VIRTUAL_STORAGE_ID;
 			}
+			if (id === VIRTUAL_OBJECT_CACHE_ID) {
+				return RESOLVED_VIRTUAL_OBJECT_CACHE_ID;
+			}
 			if (id === VIRTUAL_ADMIN_REGISTRY_ID) {
 				return RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID;
 			}
@@ -227,6 +233,14 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 			if (id === RESOLVED_VIRTUAL_STORAGE_ID) {
 				return generateStorageModule(resolvedConfig.storage?.entrypoint);
 			}
+			// Generate the object-cache module — statically imports the
+			// configured backend factory, or exports undefined (cache off).
+			if (id === RESOLVED_VIRTUAL_OBJECT_CACHE_ID) {
+				return generateObjectCacheModule(
+					resolvedConfig.objectCache?.entrypoint,
+					resolvedConfig.objectCache?.config,
+				);
+			}
 			// Generate plugins module that imports and instantiates all plugins
 			if (id === RESOLVED_VIRTUAL_PLUGINS_ID) {
 				return generatePluginsModule(pluginDescriptors);
@@ -293,6 +307,10 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
  * On Cloudflare, the adapter handles its own externalization — setting
  * ssr.external there conflicts with @cloudflare/vite-plugin's validation.
  */
+// Matches the admin stylesheet import with or without a trailing query (e.g.
+// `?url`), so both forms resolve to dist rather than the source alias.
+const ADMIN_STYLES_ALIAS = /^@emdash-cms\/admin\/styles\.css/;
+
 const NODE_NATIVE_EXTERNALS = [
 	"better-sqlite3",
 	"bindings",
@@ -339,8 +357,12 @@ export function createViteConfig(
 			// The styles.css alias must come before the package alias, otherwise
 			// Vite's prefix matching on "@emdash-cms/admin" would resolve
 			// "@emdash-cms/admin/styles.css" through the source directory.
+			// Regex (not string) so the `?url` variant — admin.astro imports the
+			// stylesheet as `?url` to keep it out of the page CSS graph — also
+			// resolves to dist; a string `find` only matches on a `/` or end
+			// boundary, so `styles.css?url` would slip through to the source alias.
 			alias: [
-				{ find: "@emdash-cms/admin/styles.css", replacement: resolve(adminDistPath, "styles.css") },
+				{ find: ADMIN_STYLES_ALIAS, replacement: resolve(adminDistPath, "styles.css") },
 				{ find: "@emdash-cms/admin", replacement: useSource ? adminSourcePath : adminDistPath },
 				// `use-sync-external-store/shim` is a React <18 polyfill that ships
 				// only as CJS. It's pulled in transitively by `@tiptap/react`. With
@@ -435,6 +457,8 @@ export function createViteConfig(
 							// Top-level deps (use astro > path for pnpm compat)
 							"astro > zod/v4",
 							"astro > zod/v4/core",
+							// zod-generator imports the bare `zod` entry, not `zod/v4`
+							"emdash > zod",
 							"@emdash-cms/cloudflare > kysely-d1",
 							// Astro internal deps not covered by @astrojs/cloudflare adapter
 							"astro/virtual-modules/middleware.js",

package/src/astro/middleware/auth.ts

@@ -32,6 +32,7 @@ import { resolveApiToken, resolveOAuthToken } from "../../api/handlers/api-token
 import { hasScope } from "../../auth/api-tokens.js";
 import { getAuthMode, type ExternalAuthMode } from "../../auth/mode.js";
 import type { ExternalAuthConfig } from "../../auth/types.js";
+import { resolveSessionUser } from "../session-user.js";
 import type { EmDashHandlers } from "../types.js";
 import { buildEmDashCsp } from "./csp.js";
 
@@ -407,7 +408,7 @@ async function handlePluginRouteAuth(
 	try {
 		// Try session auth (sets locals.user if session exists)
 		const { session } = context;
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 		if (sessionUser?.id && emdash?.db) {
 			const adapter = createKyselyAdapter(emdash.db);
 			const user = await adapter.getUserById(sessionUser.id);
@@ -435,7 +436,7 @@ async function handlePublicRouteAuth(
 	const { emdash } = locals;
 
 	try {
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 		if (sessionUser?.id && emdash?.db) {
 			const adapter = createKyselyAdapter(emdash.db);
 			const user = await adapter.getUserById(sessionUser.id);
@@ -650,7 +651,7 @@ async function handlePasskeyAuth(
 
 	try {
 		// Check session for user (session.get returns a Promise)
-		const sessionUser = await session?.get("user");
+		const sessionUser = await resolveSessionUser(session);
 
 		if (!sessionUser?.id) {
 			if (isApiRoute) {

package/src/astro/middleware/request-context.ts

@@ -30,10 +30,15 @@ async function injectToolbar(response: Response, toolbarHtml: string): Promise<R
 	if (!html.includes("</body>")) return new Response(html, response);
 
 	const injected = html.replace("</body>", `${toolbarHtml}</body>`);
-	return new Response(injected, {
+	const result = new Response(injected, {
 		status: response.status,
 		headers: response.headers,
 	});
+	// Toolbar-injected HTML is session-specific (its presence reveals an active
+	// editor session); it must never be stored in a shared CDN cache and served
+	// to anonymous visitors. Mirrors the preview branch's guard (#1398).
+	result.headers.set("Cache-Control", "private, no-store");
+	return result;
 }
 
 export const onRequest = defineMiddleware(async (context, next) => {

package/src/astro/middleware/scoped-db.ts

@@ -0,0 +1,131 @@
+/**
+ * Request-scoped database lifecycle helpers.
+ *
+ * Extracted from middleware.ts so they can be unit-tested without pulling in
+ * the virtual:emdash/* module graph. The middleware imports these to settle a
+ * request-scoped db adapter's lifecycle around the response.
+ */
+
+/**
+ * Astro attaches AstroCookies to outgoing responses via a well-known global
+ * symbol. Cloning a Response (`new Response(body, init)`) drops non-header
+ * metadata, so any helper that wraps the response must explicitly forward this
+ * symbol or `cookies.set()` calls will be silently dropped. `Symbol.for`
+ * returns the same registry symbol everywhere, so this matches the copy in
+ * middleware.ts.
+ */
+export const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
+
+/**
+ * Run a request-scoped db's `close()` once the response body has finished
+ * streaming. Astro streams HTML and components issue DB queries during that
+ * stream, so a connection-backed adapter (e.g. Postgres over Hyperdrive) must
+ * not be torn down until the body is flushed. Bodyless responses (redirects,
+ * 304s, errors) close immediately. A guard makes close idempotent and a stream
+ * `cancel` (client disconnect) still triggers it so connections never leak.
+ *
+ * No-op for adapters without a `close` (D1): the response passes through.
+ */
+export function wrapResponseForScopedClose(response: Response, close: () => void): Response {
+	let closed = false;
+	const runClose = () => {
+		if (closed) return;
+		closed = true;
+		try {
+			close();
+		} catch (error) {
+			console.error("[emdash] request-scoped db close failed:", error);
+		}
+	};
+
+	if (!response.body) {
+		runClose();
+		return response;
+	}
+
+	const transform = new TransformStream<Uint8Array, Uint8Array>({
+		flush: runClose,
+		cancel: runClose,
+	});
+	const wrapped = new Response(response.body.pipeThrough(transform), response);
+	const astroCookies = Reflect.get(response, ASTRO_COOKIES_SYMBOL);
+	if (astroCookies !== undefined) {
+		Reflect.set(wrapped, ASTRO_COOKIES_SYMBOL, astroCookies);
+	}
+	// Byte counts are preserved by the identity transform, but a stale
+	// Content-Length on a reconstructed streaming Response risks truncation.
+	wrapped.headers.delete("Content-Length");
+	return wrapped;
+}
+
+/**
+ * Run the request body under a request-scoped db, then settle its lifecycle:
+ * `commit()` runs before the response is returned (so per-request state like a
+ * D1 bookmark cookie is persisted in the headers, even if render throws), while
+ * `close()` (if any) is deferred to stream-end so a connection-backed adapter
+ * isn't torn down mid-render. On error the connection is closed immediately
+ * before rethrowing so it never leaks.
+ *
+ * On the error path both `commit()` and `close()` are defended: a throw from
+ * either is logged and swallowed so it can't replace the propagating render
+ * error (which is the one the caller needs to see). On the success path
+ * `commit()` is guarded too — if it throws, the connection is closed before the
+ * failure is surfaced, so it never leaks. For the current adapters `commit()`
+ * is a no-op (Hyperdrive) or a cookie write (D1, no `close`) and `close()` is
+ * fire-and-forget, so these guards only matter for a future connection-backed
+ * adapter with throwing teardown, but the helper is generic and must not leak
+ * or mask.
+ */
+export async function finishScoped(
+	scoped: { commit: () => void; close?: () => void },
+	run: () => Promise<Response>,
+): Promise<Response> {
+	let response: Response;
+	try {
+		response = await run();
+	} catch (error) {
+		// A render error is already propagating; neither commit nor close may
+		// mask it, and close must still run so the connection doesn't leak.
+		commitSafely(scoped.commit);
+		closeSafely(scoped.close);
+		throw error;
+	}
+	try {
+		scoped.commit();
+	} catch (error) {
+		// commit() failed on the success path: close the connection now (the
+		// response won't be wrapped, so stream-end close would never run) and
+		// surface the failure. close is swallowed so it can't mask the commit
+		// error that the caller needs to see.
+		closeSafely(scoped.close);
+		throw error;
+	}
+	return scoped.close ? wrapResponseForScopedClose(response, scoped.close) : response;
+}
+
+/**
+ * Run commit() swallowing any error. Used where an exception is already
+ * propagating (or about to be thrown) and a commit failure must neither mask it
+ * nor skip the subsequent close().
+ */
+function commitSafely(commit: () => void): void {
+	try {
+		commit();
+	} catch (error) {
+		console.error("[emdash] request-scoped db commit failed during error handling:", error);
+	}
+}
+
+/**
+ * Run close() swallowing any error. Used on the error/commit-failure paths
+ * where another exception is the one the caller must see; a throwing teardown
+ * must not replace it.
+ */
+function closeSafely(close: (() => void) | undefined): void {
+	if (!close) return;
+	try {
+		close();
+	} catch (error) {
+		console.error("[emdash] request-scoped db close failed during error handling:", error);
+	}
+}

package/src/astro/middleware/stream-end-metrics.ts

@@ -18,19 +18,15 @@
  * in normal production traffic.
  */
 
-import { isInstrumentationEnabled } from "../../database/instrumentation.js";
+import { flushRecorder, isInstrumentationEnabled } from "../../database/instrumentation.js";
 import { getRequestContext } from "../../request-context.js";
+// Reuse the single source of truth for Astro's well-known cookies symbol
+// rather than redefining `Symbol.for("astro.cookies")` here — it must stay in
+// lockstep with the copy the rest of the middleware forwards.
+import { ASTRO_COOKIES_SYMBOL } from "./scoped-db.js";
 
 export const STREAM_END_PREFIX = "[emdash-stream-end]";
 
-/**
- * Astro attaches AstroCookies to outgoing responses via a well-known global
- * symbol. Constructing a new Response drops non-header metadata, so the
- * symbol must be forwarded explicitly or `cookies.set()` calls are silently
- * dropped. Same pattern as finalizeResponse in ../middleware.ts.
- */
-const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
-
 /** Shape of the NDJSON snapshot emitted when the body finishes streaming. */
 export interface StreamEndSnapshot {
 	route?: string;
@@ -64,6 +60,14 @@ export function wrapBodyForStreamMetrics(response: Response): Response {
 	if (!metrics) return response;
 	const recorder = ctx?.queryRecorder;
 
+	// Claim the per-query flush: the recorder is mutated in-place by the
+	// Kysely log hook for the whole request, including queries issued by
+	// components while the body streams. Flushing here (rather than when
+	// middleware returns) is what captures those streaming queries. The
+	// flag tells the middleware's fallback flush to leave this recorder
+	// to us.
+	if (recorder) recorder.deferredFlush = true;
+
 	const transform = new TransformStream<Uint8Array, Uint8Array>({
 		flush() {
 			const snapshot: StreamEndSnapshot = {
@@ -79,6 +83,8 @@ export function wrapBodyForStreamMetrics(response: Response): Response {
 				cacheMisses: metrics.cacheMisses,
 			};
 			console.log(`${STREAM_END_PREFIX} ${JSON.stringify(snapshot)}`);
+			// Emit the full per-query log now that streaming is complete.
+			if (recorder) flushRecorder(recorder);
 		},
 	});
 

package/src/astro/middleware.ts

@@ -12,6 +12,7 @@ import type { Kysely } from "kysely";
 import virtualConfig from "virtual:emdash/config";
 // @ts-ignore - virtual module
 import {
+	createCoalescingDialect as virtualCreateCoalescingDialect,
 	createDialect as virtualCreateDialect,
 	createRequestScopedDb as virtualCreateRequestScopedDb,
 } from "virtual:emdash/dialect";
@@ -59,8 +60,11 @@ import type { PublishedRef } from "../scheduled-publish.js";
 import { isMissingTableError } from "../utils/db-errors.js";
 import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
 import type { EmDashConfig } from "./integration/runtime.js";
+import { ASTRO_COOKIES_SYMBOL, finishScoped } from "./middleware/scoped-db.js";
 import { wrapBodyForStreamMetrics } from "./middleware/stream-end-metrics.js";
+import { prefetchLayoutData } from "./prefetch.js";
 import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
+import { resolveSessionUser } from "./session-user.js";
 import type { EmDashHandlers } from "./types.js";
 
 /**
@@ -177,6 +181,10 @@ function buildDependencies(config: EmDashConfig): RuntimeDependencies {
 		config,
 		plugins: getPlugins(),
 		createDialect: virtualCreateDialect as (config: Record<string, unknown>) => unknown,
+		// Optional: only batching backends (D1, DO) export this; undefined otherwise.
+		createCoalescingDialect: virtualCreateCoalescingDialect as
+			| ((config: Record<string, unknown>) => unknown)
+			| undefined,
 		createStorage: virtualCreateStorage as ((config: Record<string, unknown>) => Storage) | null,
 		createScheduler: virtualCreateScheduler as CreateSchedulerFn | null,
 		sandboxEnabled: sandboxModule.sandboxEnabled as boolean,
@@ -268,16 +276,71 @@ export async function runScheduledTasks(
 	const config = getConfig();
 	if (!config) return { published: [] };
 	const runtime = await getRuntime(config);
-	return runtime.runScheduledTasks(options);
+
+	// Connection-backed adapters (e.g. Postgres over Hyperdrive) cannot reuse
+	// the per-isolate singleton from a Cron Trigger: its socket belongs to the
+	// request that opened it, and workerd rejects cross-event I/O. Open an
+	// event-scoped connection for the sweep and run the batch under it in ALS —
+	// the runtime's db getter, the cron executor, and plugin cron contexts all
+	// resolve the connection from ALS — then close it. Gated on the adapter
+	// being connection-backed (it exposes `close()`); stateless adapters (D1,
+	// Node SQLite) return null or a close-less scope and keep using the
+	// singleton, so their cron path is unchanged.
+	const scoped = createRequestScopedDb({
+		config: config.database?.config,
+		isAuthenticated: false,
+		// The sweep publishes and cleans up — a write workload — so a
+		// connection-backed adapter routes it to the primary.
+		isWrite: true,
+		cookies: NOOP_COOKIE_JAR,
+		url: CRON_EVENT_URL,
+	});
+	if (!scoped?.close) {
+		// Stateless adapter (or no per-request scoping): the singleton is safe
+		// outside a request. Any close-less scope created above is discarded.
+		return runtime.runScheduledTasks(options);
+	}
+
+	const parent = getRequestContext();
+	const ctx = parent
+		? { ...parent, db: scoped.db }
+		: { editMode: false, db: scoped.db, metrics: createRequestMetrics(performance.now()) };
+	try {
+		return await runWithContext(ctx, () => runtime.runScheduledTasks(options));
+	} finally {
+		// Guard both so a throw in teardown can't mask the sweep result or skip
+		// close() and leak the connection. Mirrors closeSafely() in scoped-db.ts.
+		try {
+			scoped.commit();
+		} catch (error) {
+			console.error("[scheduled] request-scoped db commit failed:", error);
+		}
+		try {
+			scoped.close();
+		} catch (error) {
+			console.error("[scheduled] request-scoped db close failed:", error);
+		}
+	}
 }
 
 /**
- * Astro attaches AstroCookies to outgoing responses via a well-known global
- * symbol. Cloning a Response (`new Response(body, init)`) drops non-header
- * metadata, so any middleware that wraps the response must explicitly forward
- * this symbol or `cookies.set()` calls will be silently dropped.
+ * A cookie jar that reads nothing and writes nothing, for request-scoped db
+ * adapters invoked outside an HTTP request (the Cron Trigger sweep). Connection
+ * adapters like Hyperdrive ignore cookies entirely; the D1 session adapter
+ * reads/writes a bookmark cookie, but cron never reaches that path (it has no
+ * `close()`), so the no-ops are never observed.
  */
-const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
+const NOOP_COOKIE_JAR = {
+	get: () => undefined,
+	set: () => {},
+};
+
+/**
+ * Synthetic URL for the cron sweep's request-scoped db opts. Only the D1
+ * session adapter inspects `url` (for cookie `secure`), and cron doesn't take
+ * that path, so the value is never used — it exists to satisfy the contract.
+ */
+const CRON_EVENT_URL = new URL("https://cron.emdash.internal/");
 
 /**
  * Baseline security headers applied to all responses.
@@ -354,12 +417,12 @@ const SITEMAP_COLLECTION_RE = /^\/sitemap-[a-z][a-z0-9_]*\.xml$/;
  */
 function createRequestScopedDb(
 	opts: RequestScopedDbOpts,
-): { db: Kysely<Database>; commit: () => void } | null {
+): { db: Kysely<Database>; commit: () => void; close?: () => void } | null {
 	if (typeof virtualCreateRequestScopedDb !== "function") return null;
 	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- adapter returns Kysely<unknown>; cast to Database since core owns that type
 	const fn = virtualCreateRequestScopedDb as (
 		o: RequestScopedDbOpts,
-	) => { db: Kysely<Database>; commit: () => void } | null;
+	) => { db: Kysely<Database>; commit: () => void; close?: () => void } | null;
 	return fn(opts);
 }
 
@@ -415,7 +478,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// turns normal traffic into a flood of KV read misses. See #733.
 		const hasSessionCookie = cookies.get("astro-session") !== undefined;
 		const sessionUser =
-			context.isPrerendered || !hasSessionCookie ? null : await context.session?.get("user");
+			context.isPrerendered || !hasSessionCookie ? null : await resolveSessionUser(context.session);
 
 		if (!isEmDashRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
 			if (!sessionUser && !playgroundDb) {
@@ -428,7 +491,13 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// Do a one-time lightweight probe using the same getDb() instance the
 				// page will use: if the migrations table doesn't exist, no migrations
 				// have ever run -- redirect to the setup wizard.
-				if (!isSetupVerified()) {
+				// Skip the probe when prerendering: a prerendered route is built to
+				// static HTML, so returning context.redirect("/_emdash/admin/setup")
+				// below would bake that redirect into the page and ship it to
+				// production. The build database is legitimately empty in CI and there
+				// is no live visitor to send to the wizard at build time (session reads
+				// are already skipped for prerender above for the same reason).
+				if (!isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
 						const { getDb } = await import("../loader.js");
@@ -475,6 +544,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
+							// Exposed so the wrapped image endpoint (`/_image`) can read media
+							// bytes from storage on the anonymous fast path -- public `<img>`
+							// requests carry no session.
+							storage: runtime.storage,
 						} as EmDashHandlers;
 					} catch {
 						// Non-fatal — EmDashHead will fall back to base SEO contributions
@@ -512,16 +585,32 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					const ctx = parent
 						? { ...parent, db: anonScoped.db }
 						: { editMode: false, db: anonScoped.db, metrics };
+					// Eagerly warm site-global layout data (menus, widget areas,
+					// taxonomy terms, settings) concurrently so the layout's
+					// per-component reads overlap into ~one wall-clock round trip and
+					// hit a warm cache instead of serializing. Three guards:
+					//  - request-scoped (remote) backend only -- this branch implies it;
+					//    pointless on synchronous local SQLite.
+					//  - HTML navigations only -- feeds/sitemaps/JSON don't render the
+					//    layout, so prefetching their chrome is pure waste.
+					//  - via after(): it runs immediately (still warms the render) but
+					//    hands the promise to waitUntil, so the surplus warm-up (chrome a
+					//    given page doesn't render) is kept alive past the response rather
+					//    than erroring on workerd as orphaned request I/O.
+					// Gate on the CLIENT'S PREFERRED type (leading media range), not a
+					// substring -- browser navigations lead with `text/html`, while feed
+					// readers lead with `application/rss+xml` etc. and only list
+					// `text/html;q=0.8` later, so a substring match would leak onto feeds.
+					const acceptsHtml = (request.headers.get("accept") ?? "")
+						.split(",", 1)[0]!
+						.trim()
+						.startsWith("text/html");
 					return runWithContext(ctx, async () => {
-						// commit() in finally: the write reached the primary independently
-						// of render, so the bookmark cookie must be persisted even if
-						// render throws -- otherwise a write-then-failed-render leaves the
-						// next request able to read pre-write state off a lagging replica.
-						try {
-							return await runAnon();
-						} finally {
-							anonScoped.commit();
-						}
+						if (acceptsHtml) after(() => prefetchLayoutData());
+						// commit() persists per-request state (e.g. the D1 bookmark cookie)
+						// before the response is returned, even if render throws; close()
+						// (connection teardown) is deferred to stream-end. See finishScoped.
+						return finishScoped(anonScoped, runAnon);
 					});
 				}
 				return runAnon();
@@ -625,7 +714,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 					// Direct access (for advanced use cases)
 					storage: runtime.storage,
-					db: runtime.db,
+					// Lazy getter, not an eager snapshot: `locals.emdash` is built
+					// before the per-request scoped db is installed in ALS, so reading
+					// `runtime.db` here would capture the per-isolate singleton. Routes
+					// access `emdash.db` later, during the request, when the scoped db
+					// is active. For a stateless binding (D1) the two are equivalent,
+					// but for a request-bound connection (pg/Hyperdrive) the singleton
+					// belongs to the cold-start request and reusing it from a warm
+					// request hangs on workerd's cross-request I/O guard.
+					get db() {
+						return runtime.db;
+					},
 					getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
 					hooks: runtime.hooks,
 					email: runtime.email,
@@ -689,16 +788,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				const ctx = parent
 					? { ...parent, db: scoped.db }
 					: { editMode: false, db: scoped.db, metrics };
-				return runWithContext(ctx, async () => {
-					// commit() in finally: persist the bookmark cookie even if render
-					// throws -- the write already reached the primary, so a failed
-					// render must not strand the next request on a stale replica read.
-					try {
-						return await renderAndFinalize();
-					} finally {
-						scoped.commit();
-					}
-				});
+				return runWithContext(ctx, () =>
+					// commit() persists per-request state (e.g. the D1 bookmark cookie)
+					// before the response returns, even if render throws; close()
+					// (connection teardown) is deferred to stream-end. See finishScoped.
+					finishScoped(scoped, renderAndFinalize),
+				);
 			}
 
 			return renderAndFinalize();
@@ -723,7 +818,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	try {
 		return await runWithContext({ editMode: false, queryRecorder, metrics }, run);
 	} finally {
-		if (queryRecorder) flushRecorder(queryRecorder);
+		// Streamed responses defer the flush to stream end (see
+		// wrapBodyForStreamMetrics) so the log captures queries issued while
+		// the body renders. Only flush here for responses that were not
+		// wrapped (no body: redirects, 304s, bodyless errors), where all
+		// queries have already run by the time middleware returns.
+		if (queryRecorder && !queryRecorder.deferredFlush) flushRecorder(queryRecorder);
 	}
 });