emdash 0.22.0 → 0.23.0

package/src/loader.ts

@@ -12,7 +12,7 @@
  */
 
 import type { LiveLoader } from "astro/loaders";
-import { Kysely, sql, type Dialect } from "kysely";
+import { Kysely, type RawBuilder, sql, type Dialect } from "kysely";
 
 import { currentTimestampValue, isPostgres } from "./database/dialect-helpers.js";
 import { kyselyLogOption } from "./database/instrumentation.js";
@@ -72,8 +72,83 @@ const SYSTEM_COLUMNS = new Set([
 	// fields. The aliases are _emdash_-prefixed so they can't shadow a user
 	// field named e.g. `seo_title`.
 	...SEO_ALIAS_COLUMNS,
+	// Folded hydration JSON columns (see foldedHydrationSelects) — surfaced via
+	// the FOLDED_* markers, never as flat fields.
+	"_emdash_terms",
+	"_emdash_bylines",
 ]);
 
+/** Markers for byline/taxonomy hydration folded into the content query. */
+export const FOLDED_TERMS = Symbol.for("emdash:foldedTerms");
+export const FOLDED_BYLINES = Symbol.for("emdash:foldedBylines");
+
+/**
+ * Correlated JSON-array subqueries that fold taxonomy-term and byline hydration
+ * into the content query, removing the two separate hydration round trips per
+ * fetch. `outer` is the content table's alias/name; each subquery correlates on
+ * `<outer>.id`, so the base query stays one row per entry (no join fan-out, no
+ * duplicated content payload). Order is NOT applied in the aggregate (it differs
+ * across dialects) — the consumer sorts terms by label and credits by sortOrder.
+ *
+ * Dialect-specific aggregation: SQLite `json_group_array`/`json_object` returns
+ * a JSON *string*; Postgres `json_agg`/`json_build_object` (coalesced to `[]`)
+ * returns parsed JSON. {@link stashFolded} handles both.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- any Kysely instance
+function foldedHydrationSelects(db: Kysely<any>, type: string, outer: string) {
+	const o = sql.ref(outer);
+	const pg = isPostgres(db);
+	const obj = (pairs: string) =>
+		pg ? sql.raw(`json_build_object(${pairs})`) : sql.raw(`json_object(${pairs})`);
+	const agg = (inner: RawBuilder<unknown>) =>
+		pg ? sql`coalesce(json_agg(${inner}), '[]'::json)` : sql`json_group_array(${inner})`;
+
+	const termObj = obj(
+		"'id', t.id, 'name', t.name, 'slug', t.slug, 'label', t.label, 'parent_id', t.parent_id, 'locale', t.locale, 'translation_group', t.translation_group",
+	);
+	// Filter terms to the entry's own locale (matches #1441: terms render in the
+	// entry's resolved locale, not all locale variants of the attached group).
+	const terms = sql`(SELECT ${agg(termObj)} FROM ${sql.ref("content_taxonomies")} AS ct JOIN ${sql.ref("taxonomies")} AS t ON t.translation_group = ct.taxonomy_id WHERE ct.collection = ${type} AND ct.entry_id = ${o}.id AND t.locale = ${o}.locale) AS ${sql.ref("_emdash_terms")}`;
+
+	const bylineInner = obj(
+		"'id', b.id, 'slug', b.slug, 'displayName', b.display_name, 'bio', b.bio, 'avatarMediaId', b.avatar_media_id, 'avatarStorageKey', m.storage_key, 'avatarAlt', m.alt, 'avatarBlurhash', m.blurhash, 'avatarDominantColor', m.dominant_color, 'websiteUrl', b.website_url, 'userId', b.user_id, 'isGuest', b.is_guest, 'createdAt', b.created_at, 'updatedAt', b.updated_at, 'locale', b.locale, 'translationGroup', b.translation_group",
+	);
+	const creditObj = pg
+		? sql.raw(
+				"json_build_object('roleLabel', cb.role_label, 'sortOrder', cb.sort_order, 'byline', ",
+			)
+		: sql.raw("json_object('roleLabel', cb.role_label, 'sortOrder', cb.sort_order, 'byline', ");
+	const credit = sql`${creditObj}${bylineInner})`;
+	const bylines = sql`(SELECT ${agg(credit)} FROM ${sql.ref("_emdash_content_bylines")} AS cb JOIN ${sql.ref("_emdash_bylines")} AS b ON b.translation_group = cb.byline_id LEFT JOIN ${sql.ref("media")} AS m ON m.id = b.avatar_media_id WHERE cb.collection_slug = ${type} AND cb.content_id = ${o}.id AND b.locale = ${o}.locale) AS ${sql.ref("_emdash_bylines")}`;
+	return { terms, bylines };
+}
+
+/**
+ * Stash folded hydration JSON (non-enumerable) for the query.ts fast paths.
+ * SQLite returns a JSON string (parse it); Postgres returns already-parsed JSON.
+ */
+function stashFolded(data: Record<string, unknown>, row: Record<string, unknown>): void {
+	for (const [col, sym] of [
+		["_emdash_terms", FOLDED_TERMS],
+		["_emdash_bylines", FOLDED_BYLINES],
+	] as const) {
+		const raw = row[col];
+		let value: unknown;
+		if (typeof raw === "string") {
+			try {
+				value = JSON.parse(raw);
+			} catch {
+				continue; // malformed: fall back to the query path
+			}
+		} else if (Array.isArray(raw)) {
+			value = raw; // Postgres json/jsonb already parsed by the driver
+		} else {
+			continue;
+		}
+		Object.defineProperty(data, sym, { value, enumerable: false, configurable: true });
+	}
+}
+
 /** Resolved SEO shape attached to `entry.data.seo`. Mirrors `ContentSeo`. */
 interface EntrySeo {
 	title: string | null;
@@ -785,8 +860,14 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 						)`
 						: sql``;
 
+					// Fold byline + taxonomy hydration into the list query.
+					const { terms: termsSelect, bylines: bylinesSelect } = foldedHydrationSelects(
+						db,
+						type,
+						tableName,
+					);
 					result = await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.ref(tableName)}
+						SELECT *, ${termsSelect}, ${bylinesSelect} FROM ${sql.ref(tableName)}
 						WHERE deleted_at IS NULL
 						AND ${statusCondition}
 						${localeFilter}
@@ -814,11 +895,13 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 						rowLocale !== "" &&
 						(rowLocale !== i18nConfig.defaultLocale || i18nConfig.prefixDefaultLocale);
 					const id = shouldPrefix ? `${rowLocale}/${slug}` : slug;
+					const data = mapRowToData(row);
+					stashFolded(data, row);
 					return {
 						id,
 						slug: rowStr(row, "slug"),
 						status: rowStr(row, "status", "draft"),
-						data: mapRowToData(row),
+						data,
 						cacheHint: {
 							tags: [rowStr(row, "id")],
 							lastModified: row.updated_at ? new Date(rowStr(row, "updated_at")) : undefined,
@@ -922,9 +1005,17 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 						([col, alias]) => sql`${sql.ref(`s.${col}`)} AS ${sql.ref(alias)}`,
 					),
 				);
+				// Fold byline + taxonomy hydration into the content query (see
+				// foldedHydrationSelects), removing the two separate hydration
+				// round trips per fetch.
+				const { terms: termsSelect, bylines: bylinesSelect } = foldedHydrationSelects(
+					db,
+					type,
+					"c",
+				);
 				const result = locale
 					? await sql<Record<string, unknown>>`
-							SELECT c.*, ${seoSelect}
+							SELECT c.*, ${seoSelect}, ${termsSelect}, ${bylinesSelect}
 							FROM ${sql.ref(tableName)} AS c
 							LEFT JOIN ${sql.ref("_emdash_seo")} AS s
 								ON s.collection = ${type} AND s.content_id = c.id
@@ -933,7 +1024,7 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 							LIMIT 1
 						`.execute(db)
 					: await sql<Record<string, unknown>>`
-							SELECT c.*, ${seoSelect}
+							SELECT c.*, ${seoSelect}, ${termsSelect}, ${bylinesSelect}
 							FROM ${sql.ref(tableName)} AS c
 							LEFT JOIN ${sql.ref("_emdash_seo")} AS s
 								ON s.collection = ${type} AND s.content_id = c.id
@@ -1015,6 +1106,7 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, CollectionFil
 				const entryData = mapRowToData(row);
 				const entrySeo = extractSeo(row);
 				if (entrySeo) entryData.seo = entrySeo;
+				stashFolded(entryData, row);
 				return {
 					id: entryId,
 					slug: rowStr(row, "slug"),

package/src/media/local-runtime.ts

@@ -29,6 +29,14 @@ export interface LocalMediaRuntimeConfig {
 	enabled?: boolean;
 	// These are injected by the runtime, not from user config
 	db?: Kysely<Database>;
+	/**
+	 * Resolver for the live connection, preferred over `db`. The runtime
+	 * injects it so a connection-backed adapter (Postgres over Hyperdrive)
+	 * serves provider queries from the current request-scoped connection in ALS
+	 * rather than a snapshot of the per-isolate singleton. Omitted for stateless
+	 * adapters (D1, Node SQLite), where `db` is used directly.
+	 */
+	getDb?: () => Kysely<Database>;
 	storage?: Storage;
 }
 
@@ -42,11 +50,15 @@ export const createMediaProvider: CreateMediaProviderFn<LocalMediaRuntimeConfig>
 		throw new Error("Local media provider requires database connection");
 	}
 
-	const repo = new MediaRepository(db);
+	// Resolve the connection per operation (not captured once) so a
+	// connection-backed adapter uses the current event-scoped connection; falls
+	// back to the injected `db` for stateless adapters.
+	const resolveDb = config.getDb ?? (() => db);
+	const repo = () => new MediaRepository(resolveDb());
 
 	const provider: MediaProvider = {
 		async list(options: MediaListOptions) {
-			const result = await repo.findMany({
+			const result = await repo().findMany({
 				cursor: options.cursor,
 				limit: options.limit,
 				mimeType: options.mimeType,
@@ -75,7 +87,7 @@ export const createMediaProvider: CreateMediaProviderFn<LocalMediaRuntimeConfig>
 		},
 
 		async get(id: string) {
-			const item = await repo.findById(id);
+			const item = await repo().findById(id);
 			if (!item) return null;
 
 			return {
@@ -108,7 +120,8 @@ export const createMediaProvider: CreateMediaProviderFn<LocalMediaRuntimeConfig>
 		},
 
 		async delete(id: string) {
-			const item = await repo.findById(id);
+			const repoInstance = repo();
+			const item = await repoInstance.findById(id);
 			if (!item) return;
 
 			// Delete from storage if available
@@ -120,7 +133,7 @@ export const createMediaProvider: CreateMediaProviderFn<LocalMediaRuntimeConfig>
 				}
 			}
 
-			await repo.delete(id);
+			await repoInstance.delete(id);
 
 			// If this row was referenced by `logo`, `favicon`, or
 			// `seo.defaultOgImage`, the worker-scoped settings cache now

package/src/plugins/context.ts

@@ -432,23 +432,55 @@ export function createMediaAccess(db: Kysely<Database>): MediaAccess {
 
 /**
  * Create full media access with write operations.
- * If storage is not provided, upload() will throw at call time.
+ *
+ * `getUploadUrlFn` is optional: when omitted, `getUploadUrl()` is derived from
+ * `storage` (create a pending record + a signed PUT URL), mirroring the REST
+ * `/_emdash/api/media/upload-url` endpoint. `upload()` only needs `storage`.
+ * If storage is not provided, both throw at call time.
  */
 export function createMediaAccessWithWrite(
 	db: Kysely<Database>,
-	getUploadUrlFn: (
-		filename: string,
-		contentType: string,
-	) => Promise<{ uploadUrl: string; mediaId: string }>,
+	getUploadUrlFn:
+		| ((filename: string, contentType: string) => Promise<{ uploadUrl: string; mediaId: string }>)
+		| undefined,
 	storage?: Storage,
 ): MediaAccessWithWrite {
 	const mediaRepo = new MediaRepository(db);
 	const readAccess = createMediaAccess(db);
 
+	const getUploadUrl =
+		getUploadUrlFn ??
+		(async (filename: string, contentType: string) => {
+			if (!storage) {
+				throw new Error(
+					"Media getUploadUrl() requires a storage backend. Configure storage in PluginContextFactoryOptions.",
+				);
+			}
+
+			const basename = filename.split("/").pop() ?? filename;
+			const dotIdx = basename.lastIndexOf(".");
+			const ext = dotIdx > 0 ? basename.slice(dotIdx).toLowerCase() : "";
+			const storageKey = `${ulid()}${ext}`;
+
+			const media = await mediaRepo.createPending({
+				filename: basename,
+				mimeType: contentType,
+				storageKey,
+			});
+
+			const signed = await storage.getSignedUploadUrl({
+				key: storageKey,
+				contentType,
+				expiresIn: 3600,
+			});
+
+			return { uploadUrl: signed.url, mediaId: media.id };
+		});
+
 	return {
 		...readAccess,
 
-		getUploadUrl: getUploadUrlFn,
+		getUploadUrl,
 
 		async upload(
 			filename: string,
@@ -836,14 +868,26 @@ export function createUserAccess(db: Kysely<Database>): UserAccess {
 
 export interface PluginContextFactoryOptions {
 	db: Kysely<Database>;
+	/**
+	 * Resolver for the database connection, preferred over `db` when present.
+	 * Called per `createContext()` so connection-backed adapters (e.g. Postgres
+	 * over Hyperdrive) get the current request/event-scoped connection from ALS
+	 * rather than a snapshot of the per-isolate singleton — reusing the
+	 * singleton's socket from a later event trips workerd's cross-request I/O
+	 * guard. When omitted, `db` is used directly (correct for stateless
+	 * adapters like D1 and Node SQLite). `db` remains required as the fallback.
+	 */
+	getDb?: () => Kysely<Database>;
 	/**
 	 * Storage backend for direct media uploads.
 	 * If not provided, upload() will throw.
 	 */
 	storage?: Storage;
 	/**
-	 * Function to generate upload URLs for media.
-	 * If not provided, media write operations will throw.
+	 * Explicit provider for `ctx.media.getUploadUrl()`. Optional: when omitted
+	 * but `storage` is configured, the factory derives a working `getUploadUrl()`
+	 * (and `upload()`) from storage. Only when neither `getUploadUrl` nor
+	 * `storage` is present do media write operations become unavailable.
 	 */
 	getUploadUrl?: (
 		filename: string,
@@ -877,8 +921,7 @@ export interface PluginContextFactoryOptions {
  * Factory for creating plugin contexts
  */
 export class PluginContextFactory {
-	private optionsRepo: OptionsRepository;
-	private db: Kysely<Database>;
+	private resolveDb: () => Kysely<Database>;
 	private storage?: Storage;
 	private getUploadUrl?: (
 		filename: string,
@@ -888,10 +931,16 @@ export class PluginContextFactory {
 	private urlHelper: (path: string) => string;
 	private cronReschedule?: () => void;
 	private emailPipeline?: EmailPipeline;
+	/**
+	 * Plugin IDs already warned about a missing media-write backend, so the
+	 * warning fires once per factory instead of on every hook/route context
+	 * creation (which would spam logs for hook-participating plugins).
+	 */
+	private warnedMissingMediaBackend = new Set<string>();
 
 	constructor(options: PluginContextFactoryOptions) {
-		this.db = options.db;
-		this.optionsRepo = new OptionsRepository(options.db);
+		const fixedDb = options.db;
+		this.resolveDb = options.getDb ?? (() => fixedDb);
 		this.storage = options.storage;
 		this.getUploadUrl = options.getUploadUrl;
 		this.site = createSiteInfo(options.siteInfo ?? {});
@@ -906,10 +955,17 @@ export class PluginContextFactory {
 	createContext(plugin: ResolvedPlugin): PluginContext {
 		const capabilities = new Set(plugin.capabilities);
 
+		// Resolve the connection once per context. For stateless adapters this
+		// is the singleton; for connection-backed adapters it's the current
+		// request/event-scoped connection from ALS. All repos below are built
+		// from this local `db` so a hook never queries a stale singleton socket.
+		const db = this.resolveDb();
+		const optionsRepo = new OptionsRepository(db);
+
 		// Always available
-		const kv = createKVAccess(this.optionsRepo, plugin.id);
+		const kv = createKVAccess(optionsRepo, plugin.id);
 		const log = createLogAccess(plugin.id);
-		const storage = createStorageAccess(this.db, plugin.id, plugin.storage);
+		const storage = createStorageAccess(db, plugin.id, plugin.storage);
 
 		// Capability-gated: content
 		// Note: capabilities reach this point already normalized to the
@@ -917,17 +973,33 @@ export class PluginContextFactory {
 		// names ("read:content", "write:content") never appear here.
 		let content: ContentAccess | ContentAccessWithWrite | undefined;
 		if (capabilities.has("content:write")) {
-			content = createContentAccessWithWrite(this.db);
+			content = createContentAccessWithWrite(db);
 		} else if (capabilities.has("content:read")) {
-			content = createContentAccess(this.db);
+			content = createContentAccess(db);
 		}
 
 		// Capability-gated: media
+		// `upload()` only needs `storage`; `getUploadUrl()` is derived from
+		// storage when no explicit provider is wired. Granting write access on
+		// either avoids silently degrading media:write to read-only — the bug
+		// where the runtime threads `storage` but not `getUploadUrl`.
 		let media: MediaAccess | MediaAccessWithWrite | undefined;
-		if (capabilities.has("media:write") && this.getUploadUrl) {
-			media = createMediaAccessWithWrite(this.db, this.getUploadUrl, this.storage);
+		if (capabilities.has("media:write")) {
+			if (this.getUploadUrl || this.storage) {
+				media = createMediaAccessWithWrite(db, this.getUploadUrl, this.storage);
+			} else {
+				if (!this.warnedMissingMediaBackend.has(plugin.id)) {
+					this.warnedMissingMediaBackend.add(plugin.id);
+					log.warn(
+						"declares the media:write capability but no storage backend is configured; upload() is unavailable.",
+					);
+				}
+				if (capabilities.has("media:read")) {
+					media = createMediaAccess(db);
+				}
+			}
 		} else if (capabilities.has("media:read")) {
-			media = createMediaAccess(this.db);
+			media = createMediaAccess(db);
 		}
 
 		// Capability-gated: http
@@ -941,14 +1013,14 @@ export class PluginContextFactory {
 		// Capability-gated: users
 		let users: UserAccess | undefined;
 		if (capabilities.has("users:read")) {
-			users = createUserAccess(this.db);
+			users = createUserAccess(db);
 		}
 
-		// Cron access ��� always available (scoped to plugin), but only if
+		// Cron access — always available (scoped to plugin), but only if
 		// the runtime provided a reschedule callback (i.e. cron is wired up).
 		let cron: CronAccess | undefined;
 		if (this.cronReschedule) {
-			cron = new CronAccessImpl(this.db, plugin.id, this.cronReschedule);
+			cron = new CronAccessImpl(db, plugin.id, this.cronReschedule);
 		}
 
 		// Email access — requires email:send capability AND a configured provider

package/src/plugins/cron.ts

@@ -39,10 +39,26 @@ export type RescheduleFn = () => void;
  * Stateless — all state lives in the database.
  */
 export class CronExecutor {
+	/**
+	 * Resolves the database connection to use for this tick. A resolver (not a
+	 * captured instance) so connection-backed adapters work across events: on
+	 * Cloudflare the `scheduled()` handler installs an event-scoped connection
+	 * in ALS, and this resolves to it instead of the per-isolate singleton
+	 * whose socket belongs to an earlier request. Accepts a plain `Kysely` too
+	 * (wrapped in a constant resolver) for callers/tests that don't need ALS.
+	 */
+	private readonly resolveDb: () => Kysely<Database>;
+
 	constructor(
-		private db: Kysely<Database>,
+		db: Kysely<Database> | (() => Kysely<Database>),
 		private invokeCronHook: InvokeCronHookFn,
-	) {}
+	) {
+		this.resolveDb = typeof db === "function" ? db : () => db;
+	}
+
+	private get db(): Kysely<Database> {
+		return this.resolveDb();
+	}
 
 	/**
 	 * Process all overdue tasks.

package/src/plugins/routes.ts

@@ -12,6 +12,42 @@ import { PluginContextFactory, type PluginContextFactoryOptions } from "./contex
 import { extractRequestMeta } from "./request-meta.js";
 import type { ResolvedPlugin, RouteContext, PluginRoute } from "./types.js";
 
+/**
+ * Body-reading methods on `Request`. EmDash parses the request body once before
+ * the handler runs and exposes the result as `ctx.input`, leaving the underlying
+ * stream consumed. Calling any of these on `ctx.request` would re-read a spent
+ * stream and throw an opaque platform error ("Body is unusable: Body has already
+ * been read") with no hint about `ctx.input` — so the guard replaces them with an
+ * actionable message instead (#1293).
+ */
+const CONSUMED_BODY_METHODS = new Set(["json", "text", "arrayBuffer", "blob", "formData", "bytes"]);
+
+/**
+ * Wrap the request handed to a plugin route handler so an accidental
+ * `ctx.request.json()` (or `.text()`, `.formData()`, …) fails with a message
+ * pointing at `ctx.input` rather than the runtime's cryptic "body already read"
+ * error. Every non-body member passes through unchanged; function members are
+ * bound to the underlying request so methods like `clone()` don't throw an
+ * "Illegal invocation" when called on the proxy.
+ */
+function guardConsumedRequestBody(request: Request): Request {
+	return new Proxy(request, {
+		get(target, prop) {
+			if (typeof prop === "string" && CONSUMED_BODY_METHODS.has(prop)) {
+				return () => {
+					throw new Error(
+						`[emdash] ctx.request.${prop}() is not available inside a plugin route handler: ` +
+							`EmDash has already parsed the request body and exposes it as ctx.input. ` +
+							`Read ctx.input instead of ctx.request.${prop}().`,
+					);
+				};
+			}
+			const value = Reflect.get(target, prop, target);
+			return typeof value === "function" ? value.bind(target) : value;
+		},
+	});
+}
+
 /**
  * Route metadata (public flag) without the handler.
  * Used by the catch-all route to decide auth before dispatch.
@@ -100,7 +136,10 @@ export class PluginRouteHandler {
 		const routeContext: RouteContext = {
 			...baseContext,
 			input: validatedInput,
-			request: options.request,
+			// The body is already parsed into `input`; guard `ctx.request`'s
+			// body-reading methods so a re-read fails with an actionable message
+			// (#1293). Metadata extraction uses the original request (headers only).
+			request: guardConsumedRequestBody(options.request),
 			requestMeta: extractRequestMeta(options.request, this.trustedProxyHeaders),
 		};
 

package/src/query.ts

@@ -26,7 +26,13 @@
 
 import { encodeCursor } from "./database/repositories/types.js";
 import { getFallbackChain, getI18nConfig, isI18nEnabled } from "./i18n/config.js";
-import { CURSOR_RAW_VALUES, type WhereRange, type WhereValue } from "./loader.js";
+import {
+	CURSOR_RAW_VALUES,
+	FOLDED_BYLINES,
+	FOLDED_TERMS,
+	type WhereRange,
+	type WhereValue,
+} from "./loader.js";
 import {
 	cachedQuery,
 	contentNamespaces,
@@ -34,6 +40,7 @@ import {
 } from "./object-cache/index.js";
 import { requestCached } from "./request-cache.js";
 import { getRequestContext } from "./request-context.js";
+import type { TaxonomyTerm } from "./taxonomies/types.js";
 import { isMissingTableError } from "./utils/db-errors.js";
 import {
 	createEditable,
@@ -930,6 +937,67 @@ interface CachedEntryValue {
 async function hydrateEntryBylines<D>(type: string, entries: ContentEntry<D>[]): Promise<void> {
 	if (entries.length === 0) return;
 
+	// Fast path: bylines were folded into the content query. Parse the JSON
+	// (no extra round trip) for the common case — explicit credits, no byline
+	// custom fields, no author fallback. The query path below handles the rest:
+	//  - author fallback (entry has authorId but no explicit credit), and
+	//  - custom byline fields (can't be expressed in the folded subquery).
+	if (entries.every((e) => FOLDED_BYLINES in entryData(e))) {
+		const parsed = entries.map((entry) => {
+			const data = entryData(entry);
+			const folded = Reflect.get(data, FOLDED_BYLINES);
+			const rows = Array.isArray(folded) ? folded : [];
+			const credits = rows
+				.map((raw) => {
+					const b = raw?.byline ?? {};
+					return {
+						roleLabel: raw?.roleLabel ?? null,
+						sortOrder: Number(raw?.sortOrder ?? 0),
+						source: "explicit" as const,
+						byline: { ...b, isGuest: Boolean(b.isGuest), customFields: {} },
+					};
+				})
+				.toSorted((a, b) => a.sortOrder - b.sortOrder);
+			return { data, credits };
+		});
+
+		// Fall back to the full query path when the fold can't be trusted to be
+		// complete: an entry with a byline reference (explicit primary, or an
+		// author for the author-fallback) but no folded credits — e.g. a credit
+		// in a different locale than the row, which the locale-correlated subquery
+		// skips, or the author-fallback path which the fold doesn't express.
+		let needsQueryPath = parsed.some(
+			(p) =>
+				p.credits.length === 0 &&
+				(dataStr(p.data, "authorId") !== "" || dataStr(p.data, "primaryBylineId") !== ""),
+		);
+		let hasCustomFields = false;
+		if (!needsQueryPath) {
+			try {
+				const { getDb } = await import("./loader.js");
+				const db = await getDb();
+				const { getBylineFieldDefs } = await import("./bylines/field-defs-cache.js");
+				hasCustomFields = (await getBylineFieldDefs(db)).length > 0;
+			} catch (error) {
+				// A missing table is expected pre-migration and means there are no
+				// custom fields — the fold's values are complete. Any other error
+				// (lock-init failure, dialect error) means the probe can't be
+				// trusted, so fall back to the query path rather than risk serving
+				// folded bylines with empty customFields.
+				if (!isMissingTableError(error)) needsQueryPath = true;
+			}
+		}
+
+		if (!needsQueryPath && !hasCustomFields) {
+			for (const p of parsed) {
+				p.data.bylines = p.credits;
+				p.data.byline = p.credits[0]?.byline ?? null;
+			}
+			return;
+		}
+		// Fall through to the full query path for fallback / custom-field cases.
+	}
+
 	try {
 		const { getBylinesForEntries } = await import("./bylines/index.js");
 
@@ -1005,6 +1073,45 @@ async function hydrateEntryTerms<D>(
 ): Promise<void> {
 	if (entries.length === 0) return;
 
+	// Fast path: terms were folded into the content query. Group the JSON and
+	// skip the separate content_taxonomies query.
+	if (entries.every((e) => FOLDED_TERMS in entryData(e))) {
+		const perEntry: Array<{ entryId: string; byTaxonomy: Record<string, TaxonomyTerm[]> }> = [];
+		for (const entry of entries) {
+			const data = entryData(entry);
+			const folded = Reflect.get(data, FOLDED_TERMS);
+			const rows = Array.isArray(folded) ? folded : [];
+			const grouped: Record<string, TaxonomyTerm[]> = {};
+			for (const r of rows) {
+				const name = String(r?.name);
+				(grouped[name] ??= []).push({
+					id: r?.id,
+					name,
+					slug: r?.slug,
+					label: r?.label,
+					parentId: r?.parent_id ?? undefined,
+					children: [],
+					locale: r?.locale,
+					translationGroup: r?.translation_group,
+				});
+			}
+			// Match getAllTermsForEntries' ORDER BY label (dropped from the
+			// aggregate since SQLite and Postgres order it differently).
+			for (const [name, arr] of Object.entries(grouped)) {
+				grouped[name] = arr.toSorted((a, b) => String(a.label).localeCompare(String(b.label)));
+			}
+			data.terms = grouped;
+			const entryId = dataStr(data, "id");
+			if (entryId) perEntry.push({ entryId, byTaxonomy: grouped });
+		}
+		// Prime the per-entry request cache (wildcard + present taxonomies) so
+		// subsequent getEntryTerms(...) calls in this render hit the cache instead
+		// of issuing an N+1 query. No DB lookup — purely from the folded data.
+		const { primeFoldedEntryTerms } = await import("./taxonomies/index.js");
+		primeFoldedEntryTerms(type, perEntry, { locale });
+		return;
+	}
+
 	try {
 		const { getAllTermsForEntries } = await import("./taxonomies/index.js");