emdash 0.25.1 → 0.27.0

package/src/api/handlers/content.ts

@@ -327,6 +327,36 @@ async function resolveSearchColumns(db: Kysely<Database>, collection: string): P
 	return columns;
 }
 
+/**
+ * Create a 301 auto-redirect from an entry's old URL to its new one after a
+ * slug change, using the collection's URL pattern. Shared by
+ * handleContentUpdate (direct slug edits) and handleContentPublish (slug edits
+ * staged as `_slug` in a draft revision, which only land on publish).
+ */
+async function createSlugChangeRedirect(
+	db: Kysely<Database>,
+	collection: string,
+	oldSlug: string,
+	newSlug: string,
+	contentId: string,
+): Promise<void> {
+	const collectionRow = await db
+		.selectFrom("_emdash_collections")
+		.select("url_pattern")
+		.where("slug", "=", collection)
+		.executeTakeFirst();
+
+	const redirectRepo = new RedirectRepository(db);
+	await redirectRepo.createAutoRedirect(
+		collection,
+		oldSlug,
+		newSlug,
+		contentId,
+		collectionRow?.url_pattern ?? null,
+	);
+	invalidateRedirectCache();
+}
+
 /** Matches a date-only `YYYY-MM-DD` bound (no time component). */
 const DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
 
@@ -865,21 +895,7 @@ export async function handleContentUpdate(
 
 			// Create auto-redirect when slug changes
 			if (oldSlug && body.slug) {
-				const collectionRow = await trx
-					.selectFrom("_emdash_collections")
-					.select("url_pattern")
-					.where("slug", "=", collection)
-					.executeTakeFirst();
-
-				const redirectRepo = new RedirectRepository(trx);
-				await redirectRepo.createAutoRedirect(
-					collection,
-					oldSlug,
-					body.slug,
-					resolvedId,
-					collectionRow?.url_pattern ?? null,
-				);
-				invalidateRedirectCache();
+				await createSlugChangeRedirect(trx, collection, oldSlug, body.slug, resolvedId);
 			}
 
 			// Sync non-translatable fields to sibling locales in the same
@@ -1362,7 +1378,34 @@ export async function handleContentPublish(
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
 			const resolvedId = (await resolveId(repo, collection, id)) ?? id;
-			return repo.publish(collection, resolvedId, options.publishedAt, options.requireScheduledDue);
+
+			// Capture the pre-publish state. For revision-supporting collections a
+			// slug edit is staged as `_slug` in the draft revision and only lands
+			// on the live `slug` column here, inside `repo.publish()` — it never
+			// passes through handleContentUpdate, where slug-change auto-redirects
+			// are normally created.
+			const existing = await repo.findById(collection, resolvedId);
+
+			const published = await repo.publish(
+				collection,
+				resolvedId,
+				options.publishedAt,
+				options.requireScheduledDue,
+			);
+
+			// Leave a 301 behind when publishing changed the slug of an entry that
+			// was already published — its old URL was live and may be indexed or
+			// linked. A first publish is excluded: a draft's URL was never public.
+			if (
+				existing?.status === "published" &&
+				existing.slug &&
+				published.slug &&
+				existing.slug !== published.slug
+			) {
+				await createSlugChangeRedirect(trx, collection, existing.slug, published.slug, resolvedId);
+			}
+
+			return published;
 		});
 
 		const hasSeo = await collectionHasSeo(db, collection);

package/src/api/handlers/plugins.ts

@@ -5,6 +5,7 @@
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
+import type { SandboxedPluginEntry } from "../../emdash-runtime.js";
 import { PluginStateRepository, type PluginState, type PluginStatus } from "../../plugins/state.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
 import type { ApiResult } from "../types.js";
@@ -17,6 +18,8 @@ export interface PluginInfo {
 	enabled: boolean;
 	status: PluginStatus;
 	source?: "config" | "marketplace" | "registry";
+	/** True for statically-sandboxed plugins (registered via `sandboxed: []`) */
+	sandboxed?: boolean;
 	marketplaceVersion?: string;
 	/** Publisher DID, for registry-source plugins */
 	registryPublisherDid?: string;
@@ -84,12 +87,43 @@ function buildPluginInfo(
 	};
 }
 
+/**
+ * Build plugin info for a statically-sandboxed plugin entry
+ */
+function buildSandboxedPluginInfo(
+	entry: SandboxedPluginEntry,
+	state: PluginState | null,
+): PluginInfo {
+	const status = state?.status ?? "active";
+	const enabled = status === "active";
+
+	return {
+		id: entry.id,
+		name: state?.displayName || entry.id,
+		version: entry.version,
+		package: undefined, // v2 doesn't have package field
+		enabled,
+		status,
+		source: "config",
+		sandboxed: true,
+		capabilities: entry.capabilities,
+		hasAdminPages: (entry.adminPages?.length ?? 0) > 0,
+		hasDashboardWidgets: (entry.adminWidgets?.length ?? 0) > 0,
+		hasHooks: false,
+		installedAt: state?.installedAt?.toISOString(),
+		activatedAt: state?.activatedAt?.toISOString() ?? undefined,
+		deactivatedAt: state?.deactivatedAt?.toISOString() ?? undefined,
+		description: state?.description ?? undefined,
+	};
+}
+
 /**
  * List all configured plugins with their state
  */
 export async function handlePluginList(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	marketplaceUrl?: string,
 ): Promise<ApiResult<PluginListResponse>> {
 	try {
@@ -104,6 +138,14 @@ export async function handlePluginList(
 			return buildPluginInfo(plugin, state, marketplaceUrl);
 		});
 
+		// Include statically-sandboxed plugins (registered via `sandboxed: []`
+		// in astro.config.mjs).
+		for (const entry of sandboxedPluginEntries) {
+			if (configuredIds.has(entry.id)) continue;
+			configuredIds.add(entry.id);
+			items.push(buildSandboxedPluginInfo(entry, stateMap.get(entry.id) ?? null));
+		}
+
 		// Include runtime-installed plugins (marketplace or registry) that
 		// aren't in the configured plugins list.
 		for (const state of allStates) {
@@ -156,27 +198,37 @@ export async function handlePluginList(
 export async function handlePluginGet(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	pluginId: string,
 	marketplaceUrl?: string,
 ): Promise<ApiResult<PluginResponse>> {
 	try {
+		const stateRepo = new PluginStateRepository(db);
 		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (!plugin) {
+
+		if (plugin) {
+			const state = await stateRepo.get(pluginId);
 			return {
-				success: false,
-				error: {
-					code: "NOT_FOUND",
-					message: `Plugin not found: ${pluginId}`,
-				},
+				success: true,
+				data: { item: buildPluginInfo(plugin, state, marketplaceUrl) },
 			};
 		}
 
-		const stateRepo = new PluginStateRepository(db);
-		const state = await stateRepo.get(pluginId);
+		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+		if (sandboxed) {
+			const state = await stateRepo.get(pluginId);
+			return {
+				success: true,
+				data: { item: buildSandboxedPluginInfo(sandboxed, state) },
+			};
+		}
 
 		return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, state, marketplaceUrl) },
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Plugin not found: ${pluginId}`,
+			},
 		};
 	} catch {
 		return {
@@ -227,6 +279,7 @@ function buildStateOnlyPluginInfo(
 export async function handlePluginEnable(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	pluginId: string,
 ): Promise<ApiResult<PluginResponse>> {
 	try {
@@ -239,6 +292,13 @@ export async function handlePluginEnable(
 			return { success: true, data: { item: buildPluginInfo(plugin, state) } };
 		}
 
+		// Statically-sandboxed plugin: addressable via its build-time entry.
+		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+		if (sandboxed) {
+			const state = await stateRepo.enable(pluginId, sandboxed.version);
+			return { success: true, data: { item: buildSandboxedPluginInfo(sandboxed, state) } };
+		}
+
 		// Runtime-installed plugin (marketplace or registry): only
 		// addressable through the state row. Fall back to the existing
 		// version recorded there.
@@ -268,6 +328,7 @@ export async function handlePluginEnable(
 export async function handlePluginDisable(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	pluginId: string,
 ): Promise<ApiResult<PluginResponse>> {
 	try {
@@ -279,6 +340,12 @@ export async function handlePluginDisable(
 			return { success: true, data: { item: buildPluginInfo(plugin, state) } };
 		}
 
+		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+		if (sandboxed) {
+			const state = await stateRepo.disable(pluginId, sandboxed.version);
+			return { success: true, data: { item: buildSandboxedPluginInfo(sandboxed, state) } };
+		}
+
 		const existing = await stateRepo.get(pluginId);
 		if (!existing || (existing.source !== "marketplace" && existing.source !== "registry")) {
 			return {

package/src/api/handlers/taxonomies.ts

@@ -12,7 +12,7 @@ import { ulid } from "ulidx";
 
 import { TaxonomyRepository } from "../../database/repositories/taxonomy.js";
 import type { Database, TaxonomyDefTable } from "../../database/types.js";
-import { invalidateTermCache } from "../../taxonomies/index.js";
+import { invalidateTaxonomyDefsCache, invalidateTermCache } from "../../taxonomies/index.js";
 import type { ApiResult } from "../types.js";
 
 const NAME_PATTERN = /^[a-z][a-z0-9_]*$/;
@@ -290,6 +290,10 @@ export async function handleTaxonomyCreate(
 			})
 			.execute();
 
+		// A new def changes which taxonomies exist — drop the isolate-wide
+		// defs/names caches so this isolate reflects it immediately.
+		invalidateTaxonomyDefsCache();
+
 		const row = await db
 			.selectFrom("_emdash_taxonomy_defs")
 			.selectAll()

package/src/astro/integration/virtual-modules.ts

@@ -242,6 +242,21 @@ export function generatePluginsModule(descriptors: PluginDescriptor[]): string {
 	let needsAdapter = false;
 
 	descriptors.forEach((descriptor, index) => {
+		// Every `plugins: []` entry must resolve to a file/package entrypoint that
+		// can be statically imported and bundled at build time. An in-process
+		// `definePlugin({...})` result passed directly has no entrypoint; without
+		// this guard the generator emitted `import pluginDefN from "undefined";`,
+		// which failed deep in Rollup with `failed to resolve import "undefined"`
+		// (#1416). Fail fast with an actionable message instead.
+		if (!descriptor.entrypoint) {
+			throw new Error(
+				`[emdash] Plugin "${descriptor.id}" has no \`entrypoint\`. The astro integration's ` +
+					`\`plugins: []\` requires plugins that resolve to a file/package entrypoint so they can be ` +
+					`bundled at build time; an in-process \`definePlugin({...})\` result passed directly is not ` +
+					`supported. Move the plugin into its own module and reference it via a factory that returns ` +
+					`a descriptor with an \`entrypoint\` (e.g. \`plugins: [myPlugin()]\`).`,
+			);
+		}
 		if (descriptor.format === "standard") {
 			// Standard format: import default export, wrap with adaptSandboxEntry
 			needsAdapter = true;

package/src/astro/integration/vite-config.ts

@@ -444,7 +444,18 @@ export function createViteConfig(
 						// during pre-bundling and can't resolve them. Vite's exclude
 						// uses prefix matching (id.startsWith(m + "/")), so
 						// "virtual:emdash" matches all "virtual:emdash/*" imports.
-						exclude: ["virtual:emdash"],
+						//
+						// First-party packages must also stay excluded. In a
+						// real install (unlike the workspace symlink, which Vite never
+						// optimizes), the optimizer bundles their dist and code-splits
+						// lazily-executed dynamic imports (MCP tools, content
+						// validation) into hashed chunks. A mid-session re-optimization
+						// deletes those chunks while loaded modules still reference
+						// them, so every content write fails with "The file does not
+						// exist at .../deps_ssr/..." until the dev server restarts.
+						// Their CJS deps are still pre-bundled via the "parent > dep"
+						// include entries below, which resolve through excluded parents.
+						exclude: ["virtual:emdash", "emdash", "@emdash-cms/admin", "@emdash-cms/cloudflare"],
 						include: [
 							// EmDash direct deps
 							"emdash > @portabletext/toolkit",
@@ -455,6 +466,9 @@ export function createViteConfig(
 							"emdash > jose",
 							"emdash > jpeg-js",
 							"emdash > kysely",
+							// Only imported by the migration runner, so the first
+							// dev-bypass/setup request would otherwise discover it.
+							"emdash > kysely/migration",
 							"emdash > mime/lite",
 							"emdash > modern-tar",
 							"emdash > sanitize-html",
@@ -496,6 +510,7 @@ export function createViteConfig(
 							// Top-level deps (use astro > path for pnpm compat)
 							"astro > zod/v4",
 							"astro > zod/v4/core",
+							"astro/zod",
 							// zod-generator imports the bare `zod` entry, not `zod/v4`
 							"emdash > zod",
 							"@emdash-cms/cloudflare > kysely-d1",
@@ -507,6 +522,9 @@ export function createViteConfig(
 							"astro/assets/fonts/runtime.js",
 							"astro/assets/services/noop",
 							"@astrojs/cloudflare/image-service",
+							// Only imported by the /_image route, so the first image
+							// request would otherwise discover it.
+							"@astrojs/cloudflare/image-transform-endpoint",
 						],
 					},
 				}

package/src/astro/middleware/auth.ts

@@ -120,6 +120,7 @@ const PUBLIC_API_EXACT = new Set([
 	// so unauthenticated callers only see published content. Admin endpoints
 	// (/enable, /rebuild, /stats) remain private because they're not in this set.
 	"/_emdash/api/search",
+	"/_emdash/api/search/suggest",
 ]);
 
 // Build merged public routes at module load from auth provider descriptors.

package/src/astro/middleware.ts

@@ -752,6 +752,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					hooks: runtime.hooks,
 					email: runtime.email,
 					configuredPlugins: runtime.configuredPlugins,
+					sandboxedPluginEntries: runtime.sandboxedPluginEntries,
 
 					// Configuration (for checking database type, auth mode, etc.)
 					config,

package/src/astro/routes/api/admin/plugins/[id]/disable.ts

@@ -28,7 +28,12 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginDisable(emdash.db, emdash.configuredPlugins, id);
+	const result = await handlePluginDisable(
+		emdash.db,
+		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
+		id,
+	);
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -28,7 +28,12 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginEnable(emdash.db, emdash.configuredPlugins, id);
+	const result = await handlePluginEnable(
+		emdash.db,
+		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
+		id,
+	);
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/admin/plugins/[id]/index.ts

@@ -30,6 +30,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const result = await handlePluginGet(
 		emdash.db,
 		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
 		id,
 		emdash.config.marketplace,
 	);

package/src/astro/routes/api/admin/plugins/index.ts

@@ -25,6 +25,7 @@ export const GET: APIRoute = async ({ locals }) => {
 	const result = await handlePluginList(
 		emdash.db,
 		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
 		emdash.config.marketplace,
 	);
 

package/src/astro/routes/api/manifest.ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { handleError } from "#api/error.js";
 import { getAuthMode } from "#auth/mode.js";
+import { OptionsRepository } from "#db/repositories/options.js";
 
 import { COMMIT, VERSION } from "../../../version.js";
 import type { EmDashManifest } from "../../types.js";
@@ -39,7 +40,25 @@ export const GET: APIRoute = async ({ locals }) => {
 		// doesn't assign it to globalThis, so getStoredConfig() always returned
 		// null and the React SPA never received custom logo/siteName/favicon.
 		// See issue #835.
-		const adminBranding = emdash?.config?.admin;
+		let adminBranding = emdash?.config?.admin;
+
+		// When no build-time `admin.siteName` is configured, brand the admin with
+		// the site's own title so multi-site operators can tell backends apart
+		// (WordPress-style: wp-admin always shows the site name). Precedence:
+		// explicit `admin.siteName` → Site Title (Settings → General) → the title
+		// captured by the setup wizard → the bundled "EmDash" default in the SPA.
+		if (!adminBranding?.siteName && emdash?.db) {
+			try {
+				const options = new OptionsRepository(emdash.db);
+				const titles = await options.getMany<string>(["site:title", "emdash:site_title"]);
+				const siteTitle = titles.get("site:title") || titles.get("emdash:site_title");
+				if (siteTitle) {
+					adminBranding = { ...adminBranding, siteName: siteTitle };
+				}
+			} catch {
+				// options table may not exist yet (pre-setup) — keep the default.
+			}
+		}
 
 		// Check if self-signup is enabled (any allowed domain with enabled = 1)
 		// Only relevant for passkey auth — external auth providers handle their own signup

package/src/astro/routes/api/setup/dev-bypass.ts

@@ -10,6 +10,8 @@
  * Usage:
  * - GET with redirect: /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin
  * - POST for API: Returns JSON with setup info
+ * - ?content=0 (or ?content=false): apply schema/structure only, skipping
+ *   sample content entries, bylines, and taxonomy terms
  *
  * For agent/browser testing, navigate to:
  *   /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin
@@ -57,12 +59,15 @@ async function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Respon
 		const migrations = await runMigrations(emdash.db);
 		console.log("[setup-dev-bypass] Migrations applied:", migrations.applied);
 
-		// Apply seed (user seed or built-in default)
+		// Apply seed (user seed or built-in default). `?content=0` (or `false`)
+		// applies schema/structure only — no sample content, bylines, or terms.
+		const contentParam = url.searchParams.get("content");
+		const includeContent = contentParam !== "0" && contentParam !== "false";
 		const seed = await loadSeed();
 		const validation = validateSeed(seed);
 		if (validation.valid) {
 			const seedResult = await applySeed(emdash.db, seed, {
-				includeContent: true,
+				includeContent,
 				onConflict: "skip",
 				storage: emdash.storage ?? undefined,
 			});

package/src/astro/routes/sitemap-[collection].xml.ts

@@ -138,11 +138,12 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				lines.push("    </image:image>");
 			}
 
-			if (useXhtml && siblings && siblings.length > 1) {
+			const alternateEntries = siblings ?? (useXhtml ? [entry] : null);
+			if (useXhtml && alternateEntries) {
 				// Emit one xhtml:link per sibling (including self -- Google
 				// recommends including the page's own hreflang annotation).
 				// Siblings with unroutable locales are skipped here too.
-				for (const sib of siblings) {
+				for (const sib of alternateEntries) {
 					const sibLoc = await resolveEntryUrl(sib);
 					if (sibLoc === null) continue;
 					lines.push(
@@ -154,13 +155,13 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				// the first sibling with a routable URL. Stable order:
 				// rows arrive sorted by updated_at DESC from the handler.
 				const defaultSibling =
-					i18nConfig && siblings.find((s) => s.locale === i18nConfig.defaultLocale);
+					i18nConfig && alternateEntries.find((s) => s.locale === i18nConfig.defaultLocale);
 				let xDefaultLoc: string | null = null;
 				if (defaultSibling) {
 					xDefaultLoc = await resolveEntryUrl(defaultSibling);
 				}
 				if (xDefaultLoc === null) {
-					for (const sib of siblings) {
+					for (const sib of alternateEntries) {
 						const sibLoc = await resolveEntryUrl(sib);
 						if (sibLoc !== null) {
 							xDefaultLoc = sibLoc;

package/src/astro/types.ts

@@ -434,6 +434,10 @@ export interface EmDashHandlers {
 	// Configured plugins (for plugin management)
 	configuredPlugins: import("../plugins/types.js").ResolvedPlugin[];
 
+	// Statically-sandboxed plugin entries (registered via `sandboxed: []`),
+	// surfaced through the admin plugin management API alongside configured plugins.
+	sandboxedPluginEntries: import("../emdash-runtime.js").SandboxedPluginEntry[];
+
 	// Configuration (for checking database type, auth mode, etc.)
 	config: import("./integration/runtime.js").EmDashConfig;
 

package/src/cli/commands/seed.ts

@@ -108,7 +108,7 @@ export const seedCommand = defineCommand({
 		},
 		"no-content": {
 			type: "boolean",
-			description: "Skip sample content",
+			description: "Skip sample data (content entries, bylines, taxonomy terms)",
 			default: false,
 		},
 		"on-conflict": {

package/src/components/EmDashHead.astro

@@ -17,8 +17,14 @@
  * ```
  */
 import type { PublicPageContext, PageMetadataContribution } from "../plugins/types.js";
-import { resolvePageMetadata, renderPageMetadata } from "../page/metadata.js";
+import {
+	createSha256CspHash,
+	resolvePageMetadata,
+	renderPageMetadata,
+	type ResolvedPageMetadata,
+} from "../page/metadata.js";
 import { renderFragments } from "../page/fragments.js";
+import JsonLdScript from "./JsonLdScript.astro";
 import {
 	generateBaseSeoContributions,
 	generateSiteSeoContributions,
@@ -38,6 +44,7 @@ const runtime = getPageRuntime(Astro.locals as Record<string, unknown>);
 let metadataHtml = "";
 let siteIdentityHtml = "";
 let fragmentsHtml = "";
+let jsonLdScripts: ResolvedPageMetadata["jsonld"] = [];
 
 if (runtime) {
 	// Run independent async loads in parallel: site settings (SEO meta
@@ -79,17 +86,30 @@ if (runtime) {
 	const siteContributions = generateSiteSeoContributions(siteSettings.seo);
 	const allContributions = [...pluginContributions, ...siteContributions, ...baseContributions];
 	const resolved = resolvePageMetadata(allContributions);
-	metadataHtml = renderPageMetadata(resolved);
+	jsonLdScripts = resolved.jsonld;
+	metadataHtml = renderPageMetadata(resolved, { includeJsonLd: false });
 	siteIdentityHtml = renderSiteIdentity({ favicon: siteSettings.favicon });
 	fragmentsHtml = renderFragments(fragments, "head");
 } else {
 	// No runtime (EmDash not initialized) — still render base SEO
 	const baseContributions: PageMetadataContribution[] = generateBaseSeoContributions(page);
 	const resolved = resolvePageMetadata(baseContributions);
-	metadataHtml = renderPageMetadata(resolved);
+	jsonLdScripts = resolved.jsonld;
+	metadataHtml = renderPageMetadata(resolved, { includeJsonLd: false });
+}
+
+if (Astro.csp && jsonLdScripts.length > 0) {
+	await Promise.all(
+		jsonLdScripts.map(async ({ json }) => {
+			Astro.csp?.insertScriptHash(await createSha256CspHash(json));
+		}),
+	);
 }
 ---
 
 <Fragment set:html={metadataHtml} />
+{
+	jsonLdScripts.map(({ json }) => <JsonLdScript json={json} />)
+}
 <Fragment set:html={siteIdentityHtml} />
 <Fragment set:html={fragmentsHtml} />

package/src/components/JsonLdScript.astro

@@ -0,0 +1,9 @@
+---
+interface Props {
+	json: string;
+}
+
+const { json } = Astro.props;
+---
+
+<script type="application/ld+json" set:html={json}></script>