emdash 0.22.0 → 0.23.0

package/src/components/index.ts

@@ -36,6 +36,7 @@ export { default as EmDashImage } from "./EmDashImage.astro";
 export { default as EmDashMedia } from "./EmDashMedia.astro";
 
 // Portable Text block type components
+export { default as Block } from "./Block.astro";
 export { default as Image } from "./Image.astro";
 export { default as Code } from "./Code.astro";
 export { default as Embed } from "./Embed.astro";
@@ -57,6 +58,7 @@ export { default as Underline } from "./marks/Underline.astro";
 export { default as StrikeThrough } from "./marks/StrikeThrough.astro";
 export { default as Link } from "./marks/Link.astro";
 
+import BlockComponent from "./Block.astro";
 import BreakComponent from "./Break.astro";
 import ButtonComponent from "./Button.astro";
 import ButtonsComponent from "./Buttons.astro";
@@ -77,11 +79,14 @@ import TableComponent from "./Table.astro";
  * Pre-configured components for EmDash Portable Text content
  *
  * Includes renderers for:
+ * - Block styles: paragraph, h1..h6, blockquote — with `textAlign` honoured
+ *   as a WordPress-style `has-text-align-{value}` class (#1201)
  * - Block types: image, code, embed, gallery, columns, break, htmlBlock, table,
  *   button, buttons, cover, file, pullquote
  * - Marks: superscript, subscript, underline, strike-through, link
  */
 export const emdashComponents = {
+	block: BlockComponent,
 	type: {
 		image: ImageComponent,
 		code: CodeComponent,

package/src/components/portable-text-text-align.ts

@@ -0,0 +1,38 @@
+/**
+ * Maps a Portable Text block's `textAlign` to a WordPress-style class name
+ * (`has-text-align-{value}`) for public rendering. Used by the Portable Text
+ * `Block` override in `./Block.astro`.
+ *
+ * `left` is the document default and intentionally does not produce a class —
+ * this matches the converter's omit-on-default rule (see
+ * `src/content/converters/prosemirror-to-portable-text.ts`) so untouched
+ * content stays bytewise identical and renders without an extra class.
+ *
+ * Related: https://github.com/emdash-cms/emdash/issues/1201
+ */
+
+type AlignClassName = "has-text-align-center" | "has-text-align-right" | "has-text-align-justify";
+
+const ALIGN_CLASS_MAP: Record<string, AlignClassName> = {
+	center: "has-text-align-center",
+	right: "has-text-align-right",
+	justify: "has-text-align-justify",
+};
+
+/**
+ * Returns the CSS class for a textAlign value, or `undefined` when no class
+ * should be emitted (default left, missing, or unknown values).
+ *
+ * Allowlist-only by design: arbitrary strings are rejected so a hand-edited
+ * or imported Portable Text block cannot inject attacker-controlled class
+ * names into the rendered HTML.
+ */
+export function textAlignClassName(value: string | undefined): AlignClassName | undefined {
+	if (value === undefined) return undefined;
+	// `Object.hasOwn` (not `in`) so prototype keys like "toString" or
+	// "constructor" can't slip through as valid alignments.
+	if (Object.hasOwn(ALIGN_CLASS_MAP, value)) {
+		return ALIGN_CLASS_MAP[value];
+	}
+	return undefined;
+}

package/src/content/converters/portable-text-to-prosemirror.ts

@@ -164,7 +164,10 @@ function convertTextBlock(block: PortableTextTextBlock): ProseMirrorNode | null
 			const level = parseInt(style.substring(1), 10);
 			return {
 				type: "heading",
-				attrs: { level },
+				attrs: {
+					level,
+					...(block.textAlign ? { textAlign: block.textAlign } : {}),
+				},
 				content: content.length > 0 ? content : undefined,
 			};
 		}
@@ -184,6 +187,7 @@ function convertTextBlock(block: PortableTextTextBlock): ProseMirrorNode | null
 		default:
 			return {
 				type: "paragraph",
+				attrs: block.textAlign ? { textAlign: block.textAlign } : undefined,
 				content: content.length > 0 ? content : undefined,
 			};
 	}

package/src/content/converters/prosemirror-to-portable-text.ts

@@ -106,12 +106,16 @@ function convertParagraph(node: ProseMirrorNode): PortableTextTextBlock | null {
 		return null;
 	}
 
+	const ta = node.attrs?.textAlign;
+	const textAlign = ta === "center" || ta === "right" || ta === "justify" ? ta : undefined;
+
 	return {
 		_type: "block",
 		_key: generateKey(),
 		style: "normal",
 		children,
 		markDefs: markDefs.length > 0 ? markDefs : undefined,
+		...(textAlign ? { textAlign } : {}),
 	};
 }
 
@@ -147,12 +151,16 @@ function convertHeading(node: ProseMirrorNode): PortableTextTextBlock | null {
 		return null;
 	}
 
+	const ta = node.attrs?.textAlign;
+	const textAlign = ta === "center" || ta === "right" || ta === "justify" ? ta : undefined;
+
 	return {
 		_type: "block",
 		_key: generateKey(),
 		style,
 		children,
 		markDefs: markDefs.length > 0 ? markDefs : undefined,
+		...(textAlign ? { textAlign } : {}),
 	};
 }
 

package/src/content/converters/types.ts

@@ -43,6 +43,7 @@ export interface PortableTextTextBlock {
 	level?: number;
 	children: PortableTextSpan[];
 	markDefs?: PortableTextMarkDef[];
+	textAlign?: "left" | "center" | "right" | "justify";
 }
 
 /**

package/src/database/repositories/byline.ts

@@ -37,6 +37,8 @@ type BylineRow = Selectable<BylineTable>;
 type BylineRowWithAvatar = BylineRow & {
 	avatar_storage_key?: string | null;
 	avatar_alt?: string | null;
+	avatar_blurhash?: string | null;
+	avatar_dominant_color?: string | null;
 };
 
 export interface CreateBylineInput {
@@ -113,6 +115,8 @@ function rowToByline(row: BylineRowWithAvatar): BylineSummary {
 		avatarMediaId: row.avatar_media_id,
 		avatarStorageKey: row.avatar_storage_key ?? null,
 		avatarAlt: row.avatar_alt ?? null,
+		avatarBlurhash: row.avatar_blurhash ?? null,
+		avatarDominantColor: row.avatar_dominant_color ?? null,
 		websiteUrl: row.website_url,
 		userId: row.user_id,
 		isGuest: row.is_guest === 1,
@@ -944,6 +948,8 @@ export class BylineRepository {
 				"b.avatar_media_id as avatar_media_id",
 				"m.storage_key as avatar_storage_key",
 				"m.alt as avatar_alt",
+				"m.blurhash as avatar_blurhash",
+				"m.dominant_color as avatar_dominant_color",
 				"b.website_url as website_url",
 				"b.user_id as user_id",
 				"b.is_guest as is_guest",
@@ -971,6 +977,8 @@ export class BylineRepository {
 			avatar_media_id: row.avatar_media_id,
 			avatar_storage_key: row.avatar_storage_key,
 			avatar_alt: row.avatar_alt,
+			avatar_blurhash: row.avatar_blurhash,
+			avatar_dominant_color: row.avatar_dominant_color,
 			website_url: row.website_url,
 			user_id: row.user_id,
 			is_guest: row.is_guest,
@@ -1080,6 +1088,8 @@ export class BylineRepository {
 					"b.avatar_media_id as avatar_media_id",
 					"m.storage_key as avatar_storage_key",
 					"m.alt as avatar_alt",
+					"m.blurhash as avatar_blurhash",
+					"m.dominant_color as avatar_dominant_color",
 					"b.website_url as website_url",
 					"b.user_id as user_id",
 					"b.is_guest as is_guest",
@@ -1104,6 +1114,8 @@ export class BylineRepository {
 				avatar_media_id: row.avatar_media_id,
 				avatar_storage_key: row.avatar_storage_key,
 				avatar_alt: row.avatar_alt,
+				avatar_blurhash: row.avatar_blurhash,
+				avatar_dominant_color: row.avatar_dominant_color,
 				website_url: row.website_url,
 				user_id: row.user_id,
 				is_guest: row.is_guest,
@@ -1182,6 +1194,8 @@ export class BylineRepository {
 					"b.avatar_media_id as avatar_media_id",
 					"m.storage_key as avatar_storage_key",
 					"m.alt as avatar_alt",
+					"m.blurhash as avatar_blurhash",
+					"m.dominant_color as avatar_dominant_color",
 					"b.website_url as website_url",
 					"b.user_id as user_id",
 					"b.is_guest as is_guest",

package/src/database/repositories/types.ts

@@ -78,6 +78,19 @@ export interface BylineSummary {
 	avatarStorageKey?: string | null;
 	/** Avatar media alt text, from the same media join. Null when not joined. */
 	avatarAlt?: string | null;
+	/**
+	 * Avatar media blurhash (LQIP placeholder, migration 024), folded in by the
+	 * same media join as `avatarStorageKey`. Lets a renderer paint a blurred
+	 * placeholder while the full avatar loads, with no extra media lookup.
+	 * Null when the byline has no avatar, the media row has no blurhash, or the
+	 * byline was loaded through a finder that doesn't join media.
+	 */
+	avatarBlurhash?: string | null;
+	/**
+	 * Avatar media dominant colour (LQIP placeholder, migration 024), from the
+	 * same media join. Null under the same conditions as `avatarBlurhash`.
+	 */
+	avatarDominantColor?: string | null;
 	websiteUrl: string | null;
 	userId: string | null;
 	isGuest: boolean;

package/src/emdash-runtime.ts

@@ -244,6 +244,15 @@ export interface MediaProviderEntry {
  */
 export interface MediaProviderContext {
 	db: Kysely<Database>;
+	/**
+	 * Resolver for the live connection, preferred over `db` by providers that
+	 * query EmDash's database. Resolves the current request/event-scoped
+	 * connection from ALS so connection-backed adapters (Postgres over
+	 * Hyperdrive) don't reuse the per-isolate singleton's socket across events.
+	 * Providers should resolve per operation rather than capturing `db` once.
+	 * Omitted-safe: falls back to `db` for stateless adapters (D1, Node SQLite).
+	 */
+	getDb?: () => Kysely<Database>;
 	storage: Storage | null;
 }
 
@@ -262,6 +271,16 @@ export interface RuntimeDependencies {
 	plugins: ResolvedPlugin[];
 	// eslint-disable-next-line @typescript-eslint/no-explicit-any
 	createDialect: (config: any) => Dialect;
+	/**
+	 * Factory for a dialect that batches same-turn reads into one round trip
+	 * ({@link EmDashRuntime.create} uses it for the cold-start read phase).
+	 * Present only on batching backends (D1, DO); absent backends fall back to
+	 * the singleton. Returns a fresh connection each call — it must never be the
+	 * long-lived singleton, whose coalescing buffer would be shared across
+	 * requests.
+	 */
+	// eslint-disable-next-line @typescript-eslint/no-explicit-any
+	createCoalescingDialect?: (config: any) => Dialect | null;
 	// eslint-disable-next-line @typescript-eslint/no-explicit-any
 	createStorage: ((config: any) => Storage) | null;
 	sandboxEnabled: boolean;
@@ -323,6 +342,7 @@ export interface EmDashRuntimeParts {
 	allPipelinePlugins: ResolvedPlugin[];
 	pipelineFactoryOptions: {
 		db: Kysely<Database>;
+		getDb?: () => Kysely<Database>;
 		storage?: Storage;
 		siteInfo?: { siteName?: string; siteUrl?: string; locale?: string };
 	};
@@ -370,6 +390,28 @@ function getDbHolder(): DbHolder {
 	}
 	return holder;
 }
+
+/**
+ * Auto-seed runs at most once per isolate per database. Its lock + "done" set
+ * live on globalThis (same bundler-duplication reasoning as the db cache) so a
+ * reclaimed-and-rerun `create()` can't seed a second time concurrently. The
+ * lock polls rather than sharing a promise, so it is safe to await across a
+ * cancelled owner in workerd.
+ */
+const SEED_HOLDER_KEY = Symbol.for("emdash:seed-state");
+interface SeedHolder {
+	done: Set<string>;
+	lock: InitLock;
+}
+function getSeedHolder(): SeedHolder {
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis symbol slot, written only below
+	let holder = globalSymbolStore[SEED_HOLDER_KEY] as SeedHolder | undefined;
+	if (!holder) {
+		holder = { done: new Set<string>(), lock: createInitLock() };
+		globalSymbolStore[SEED_HOLDER_KEY] = holder;
+	}
+	return holder;
+}
 const storageCache = new Map<string, Storage>();
 const sandboxedPluginCache = new Map<string, SandboxedPluginInstance>();
 /**
@@ -414,7 +456,20 @@ export class EmDashRuntime {
 	readonly configuredPlugins: ResolvedPlugin[];
 	readonly sandboxedPlugins: Map<string, SandboxedPluginInstance>;
 	readonly sandboxedPluginEntries: SandboxedPluginEntry[];
-	readonly schemaRegistry: SchemaRegistry;
+	/**
+	 * Schema registry bound to the current request/event-scoped connection.
+	 * Built per access (SchemaRegistry just wraps a db) against `this.db`, the
+	 * ALS-aware getter — never a captured snapshot of the singleton. On a
+	 * connection-backed adapter (Postgres over Hyperdrive) a captured singleton
+	 * would query a socket opened by an earlier event and trip workerd's
+	 * cross-request I/O guard; the catch in handlers like handleContentUpdate
+	 * would then silently treat a revision-enabled collection as non-revisioned
+	 * and write draft edits to live columns. Same reasoning as the per-call
+	 * registry in _buildManifest().
+	 */
+	get schemaRegistry(): SchemaRegistry {
+		return new SchemaRegistry(this.db);
+	}
 	private _hooks!: HookPipeline;
 	readonly config: EmDashConfig;
 	readonly mediaProviders: Map<string, MediaProvider>;
@@ -445,6 +500,7 @@ export class EmDashRuntime {
 	/** Factory options for the hook pipeline context factory */
 	private pipelineFactoryOptions: {
 		db: Kysely<Database>;
+		getDb?: () => Kysely<Database>;
 		storage?: Storage;
 		siteInfo?: { siteName?: string; siteUrl?: string; locale?: string };
 	};
@@ -475,7 +531,6 @@ export class EmDashRuntime {
 		this.configuredPlugins = parts.configuredPlugins;
 		this.sandboxedPlugins = parts.sandboxedPlugins;
 		this.sandboxedPluginEntries = parts.sandboxedPluginEntries;
-		this.schemaRegistry = new SchemaRegistry(parts.db);
 		this._hooks = parts.hooks;
 		this.enabledPlugins = parts.enabledPlugins;
 		this.pluginStates = parts.pluginStates;
@@ -621,7 +676,9 @@ export class EmDashRuntime {
 		// The old pipeline's contextFactoryOptions were built up incrementally
 		// via setContextFactory calls during create(). We replay them here.
 		if (this.email) {
-			newPipeline.setContextFactory({ db: this.db, emailPipeline: this.email });
+			// db/getDb are already wired by createHookPipeline above (they live in
+			// pipelineFactoryOptions), so the merge only adds emailPipeline.
+			newPipeline.setContextFactory({ emailPipeline: this.email });
 		}
 		if (this.cronScheduler) {
 			const scheduler = this.cronScheduler;
@@ -985,6 +1042,22 @@ export class EmDashRuntime {
 		// Initialize database (connects, runs migrations if needed)
 		const db = await phase("rt.db", "DB init + migrations", () => EmDashRuntime.getDatabase(deps));
 
+		// Resolver for the live connection, mirroring the `get db()` getter
+		// below (which can't be used here — the runtime instance doesn't exist
+		// yet). Long-lived subsystems built during create() (cron executor,
+		// plugin context factory, media providers) capture this resolver rather
+		// than the `db` snapshot, so a connection-backed adapter (Postgres over
+		// Hyperdrive) serves their queries from the current request/event-scoped
+		// connection in ALS instead of the per-isolate singleton — whose socket
+		// belongs to an earlier request and would trip workerd's cross-request
+		// I/O guard. Stateless adapters (D1, Node SQLite) set no ALS db on most
+		// paths, so this falls back to the singleton: unchanged behavior.
+		const resolveDb = (): Kysely<Database> => {
+			const ctx = getRequestContext();
+			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- ALS db is typed unknown to avoid a circular import; middleware always sets a Kysely<Database>
+			return (ctx?.db as Kysely<Database> | undefined) ?? db;
+		};
+
 		// Validate EMDASH_ENCRYPTION_KEY once here so a malformed value
 		// surfaces in startup logs instead of as request-time 500s. The key
 		// itself is not yet consumed (a follow-up PR adds plugin-secret
@@ -998,47 +1071,156 @@ export class EmDashRuntime {
 		// Initialize storage (sync)
 		const storage = EmDashRuntime.getStorage(deps);
 
-		// Fetch plugin states and site info concurrently — independent reads
-		// against different tables (_plugin_state vs options), so they share
-		// one round-trip window instead of paying two sequential ones. Each
-		// phase() wrapper still records that phase's own duration, and each
-		// body keeps its own non-fatal catch.
 		let pluginStates: Map<string, string> = new Map();
 		let siteInfo: { siteName?: string; siteUrl?: string; locale?: string } | undefined;
-		await Promise.all([
-			// Fetch plugin states from database
+		// "Already set up" by default so a read failure (e.g. tables absent on a
+		// pre-migration db) skips seeding rather than seeding a half-built db.
+		let seedGate = { collectionCount: 1, setupDone: true };
+
+		// Seeding must only touch the configured singleton, never a borrowed
+		// per-request db (playground / DO preview) or the loader-fallback db.
+		const reqCtx = getRequestContext();
+		const ownsConfiguredDb = !!deps.config.database && !(reqCtx?.dbIsIsolated && reqCtx.db);
+
+		// Run the init reads on a coalescing connection so the concurrent
+		// same-turn reads flush as one batch() round trip. The singleton can't:
+		// its plain SqliteAdapter reports supportsMultipleConnections=false, so
+		// Kysely's connection mutex serializes concurrent reads into N round
+		// trips. The connection is per-init and discarded — the long-lived
+		// singleton must never coalesce or one request's reads could land in
+		// another's batch. Backends without a coalescing dialect (Node/SQLite)
+		// fall back to the singleton, where serialization costs nothing.
+		let readDb = db;
+		let readDbDisposable: Kysely<Database> | undefined;
+		if (ownsConfiguredDb && deps.createCoalescingDialect && deps.config.database) {
+			try {
+				const dialect = deps.createCoalescingDialect(deps.config.database.config);
+				if (dialect) {
+					readDb = new Kysely<Database>({ dialect, log: kyselyLogOption() });
+					readDbDisposable = readDb;
+				}
+			} catch {
+				readDb = db;
+			}
+		}
+		const optionsRepo = new OptionsRepository(readDb);
+
+		const readSiteInfo = async () => {
+			const siteOpts = await optionsRepo.getMany<string>([
+				"emdash:site_title",
+				"emdash:site_url",
+				"emdash:locale",
+			]);
+			return {
+				siteName: siteOpts.get("emdash:site_title") ?? undefined,
+				siteUrl: siteOpts.get("emdash:site_url") ?? undefined,
+				locale: siteOpts.get("emdash:locale") ?? undefined,
+			};
+		};
+
+		const coldStartReads: Array<Promise<void>> = [
 			phase("rt.plugins", "Plugin states", async () => {
 				try {
-					const states = await db
+					const states = await readDb
 						.selectFrom("_plugin_state")
 						.select(["plugin_id", "status"])
 						.execute();
 					pluginStates = new Map(states.map((s) => [s.plugin_id, s.status]));
 				} catch {
-					// Plugin state table may not exist yet
+					// _plugin_state may not exist yet on a pre-migration db.
 				}
 			}),
-			// Load site info for plugin context extensions (1 batch query instead of 3)
 			phase("rt.site", "Site info options", async () => {
 				try {
-					const optionsRepo = new OptionsRepository(db);
-					const siteOpts = await optionsRepo.getMany<string>([
-						"emdash:site_title",
-						"emdash:site_url",
-						"emdash:locale",
-					]);
-					siteInfo = {
-						siteName: siteOpts.get("emdash:site_title") ?? undefined,
-						siteUrl: siteOpts.get("emdash:site_url") ?? undefined,
-						locale: siteOpts.get("emdash:locale") ?? undefined,
-					};
+					siteInfo = await readSiteInfo();
 				} catch {
-					// Options table may not exist yet (pre-setup)
+					// options may not exist yet on a pre-migration db.
 				}
 			}),
-		]);
+		];
+
+		if (ownsConfiguredDb) {
+			coldStartReads.push(
+				phase("rt.seedcheck", "Auto-seed gate", async () => {
+					try {
+						const [collectionCount, setupOption] = await Promise.all([
+							readDb
+								.selectFrom("_emdash_collections")
+								.select((eb) => eb.fn.countAll<number>().as("count"))
+								.executeTakeFirstOrThrow(),
+							readDb
+								.selectFrom("options")
+								.select("value")
+								.where("name", "=", "emdash:setup_complete")
+								.executeTakeFirst(),
+						]);
+						const setupDone = (() => {
+							try {
+								return !!setupOption && JSON.parse(setupOption.value) === true;
+							} catch {
+								return false;
+							}
+						})();
+						seedGate = { collectionCount: collectionCount.count, setupDone };
+					} catch {
+						// Leave the "already set up" default so a read failure never
+						// triggers a seed onto a half-built db.
+					}
+				}),
+			);
+		}
+
+		await Promise.all(coldStartReads);
+
+		// Auto-seed the default schema for a first load that skipped the setup
+		// wizard (the wizard and dev-bypass apply seeds explicitly). Run under a
+		// per-isolate lock keyed by the configured db so a reclaimed-and-rerun
+		// create() can't apply the seed a second time concurrently.
+		if (seedGate.collectionCount === 0 && !seedGate.setupDone) {
+			const seedKey = deps.config.database?.entrypoint ?? "default";
+			const seedHolder = getSeedHolder();
+			try {
+				await initWithLock(
+					seedHolder.lock,
+					() => (seedHolder.done.has(seedKey) ? true : undefined),
+					async () => {
+						const { applySeed } = await import("./seed/apply.js");
+						const { loadSeed } = await import("./seed/load.js");
+						const { validateSeed } = await import("./seed/validate.js");
+
+						const seed = await loadSeed();
+						const validation = validateSeed(seed);
+						if (validation.valid) {
+							await applySeed(db, seed, { onConflict: "skip" });
+							console.log("Auto-seeded default collections");
+						}
+						seedHolder.done.add(seedKey);
+						return true;
+					},
+					{ deadlineMs: DB_INIT_DEADLINE_MS, anchor: (promise) => after(() => promise) },
+				);
+				// The site-info read ran before the seed wrote its defaults, so
+				// refresh the snapshot the plugin context sees.
+				try {
+					siteInfo = await readSiteInfo();
+				} catch {
+					// Non-fatal — plugin context falls back to undefined fields.
+				}
+			} catch {
+				// Non-fatal — a failed seed (e.g. missing seed module) leaves the
+				// site un-seeded; a later request retries.
+			}
+		}
+
+		// The read connection is single-use; everything below uses the singleton.
+		if (readDbDisposable) {
+			try {
+				await readDbDisposable.destroy();
+			} catch {
+				// Non-fatal — the underlying binding is shared and needs no teardown.
+			}
+		}
 
-		// Build set of enabled plugins
 		const enabledPlugins = new Set<string>();
 		for (const plugin of deps.plugins) {
 			const status = pluginStates.get(plugin.id);
@@ -1154,9 +1336,15 @@ export class EmDashRuntime {
 		// Filter to currently enabled plugins for the initial pipeline
 		const enabledPluginList = allPipelinePlugins.filter((p) => enabledPlugins.has(p.id));
 
-		// Create hook pipeline
+		// Create hook pipeline. getDb travels here (not just via the email
+		// setContextFactory call below) so it survives rebuildHookPipeline(),
+		// which reconstructs the factory from pipelineFactoryOptions. Without it,
+		// toggling a plugin on an email-less deployment would silently revert
+		// plugin contexts to the singleton db — re-breaking connection-backed
+		// adapters. See #1622.
 		const pipelineFactoryOptions = {
 			db,
+			getDb: resolveDb,
 			storage: storage ?? undefined,
 			siteInfo,
 		};
@@ -1208,7 +1396,7 @@ export class EmDashRuntime {
 		// Initialize media providers
 		const mediaProviders = new Map<string, MediaProvider>();
 		const mediaProviderEntries = deps.mediaProviderEntries ?? [];
-		const providerContext: MediaProviderContext = { db, storage };
+		const providerContext: MediaProviderContext = { db, storage, getDb: resolveDb };
 
 		for (const entry of mediaProviderEntries) {
 			try {
@@ -1249,8 +1437,10 @@ export class EmDashRuntime {
 		};
 
 		// Wire email pipeline into context factory (independent of cron —
-		// must not be inside the cron try/catch or ctx.email breaks when cron fails)
-		pipeline.setContextFactory({ db, emailPipeline });
+		// must not be inside the cron try/catch or ctx.email breaks when cron fails).
+		// db/getDb were already set via pipelineFactoryOptions above; merge only
+		// adds emailPipeline.
+		pipeline.setContextFactory({ emailPipeline });
 
 		let cronExecutor: CronExecutor | null = null;
 		let cronScheduler: CronScheduler | null = null;
@@ -1262,7 +1452,7 @@ export class EmDashRuntime {
 
 		await phase("rt.cron", "Cron init (recovery deferred post-response)", async () => {
 			try {
-				cronExecutor = new CronExecutor(db, invokeCronHook);
+				cronExecutor = new CronExecutor(resolveDb, invokeCronHook);
 
 				// Recover stale locks from previous crashes. Pure bookkeeping
 				// against the _emdash_cron_tasks table — no request needs the
@@ -1444,45 +1634,9 @@ export class EmDashRuntime {
 				// cleanup-flag check costs an extra `options.get()` on every
 				// isolate cold boot forever. Cheaper to leave it.
 
-				// Auto-seed schema if no collections exist and setup hasn't run.
-				// This covers first-load on sites that skip the setup wizard.
-				// Dev-bypass and the wizard apply seeds explicitly.
-				try {
-					const [collectionCount, setupOption] = await Promise.all([
-						db
-							.selectFrom("_emdash_collections")
-							.select((eb) => eb.fn.countAll<number>().as("count"))
-							.executeTakeFirstOrThrow(),
-						db
-							.selectFrom("options")
-							.select("value")
-							.where("name", "=", "emdash:setup_complete")
-							.executeTakeFirst(),
-					]);
-
-					const setupDone = (() => {
-						try {
-							return setupOption && JSON.parse(setupOption.value) === true;
-						} catch {
-							return false;
-						}
-					})();
-
-					if (collectionCount.count === 0 && !setupDone) {
-						const { applySeed } = await import("./seed/apply.js");
-						const { loadSeed } = await import("./seed/load.js");
-						const { validateSeed } = await import("./seed/validate.js");
-
-						const seed = await loadSeed();
-						const validation = validateSeed(seed);
-						if (validation.valid) {
-							await applySeed(db, seed, { onConflict: "skip" });
-							console.log("Auto-seeded default collections");
-						}
-					}
-				} catch {
-					// Tables may not exist yet. Non-fatal.
-				}
+				// This returns a migrated but possibly unseeded db; create() runs
+				// the seed gate and applies the seed, batched with its other init
+				// reads.
 
 				// Publish only while still the current owner: a reclaimed slow
 				// init must not flip the cached Kysely identity back after the
@@ -2965,6 +3119,7 @@ export class EmDashRuntime {
 		if (trustedPlugin && this.enabledPlugins.has(trustedPlugin.id)) {
 			const routeRegistry = new PluginRouteRegistry({
 				db: this.db,
+				storage: this.storage ?? undefined,
 				emailPipeline: this.email ?? undefined,
 				trustedProxyHeaders: getTrustedProxyHeaders(this.config),
 			});