emdash 0.28.1 → 0.30.0

package/src/astro/integration/routes.ts

@@ -213,6 +213,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/media/[id].ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/media/[id]/usage",
+		entrypoint: resolveRoute("api/media/[id]/usage.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/media/[id]/confirm",
 		entrypoint: resolveRoute("api/media/[id]/confirm.ts"),
@@ -234,6 +239,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/media/providers/[providerId]/[itemId].ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/admin/media-usage/repair",
+		entrypoint: resolveRoute("api/admin/media-usage/repair.ts"),
+	});
+
 	// Import API routes
 	injectRoute({
 		pattern: "/_emdash/api/import/probe",
@@ -341,6 +351,27 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/settings/email.ts"),
 	});
 
+	// Backup routes
+	injectRoute({
+		pattern: "/_emdash/api/settings/backups",
+		entrypoint: resolveRoute("api/settings/backups/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/settings/backups/export",
+		entrypoint: resolveRoute("api/settings/backups/export.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/settings/backups/archives",
+		entrypoint: resolveRoute("api/settings/backups/archives/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/settings/backups/archives/[name]",
+		entrypoint: resolveRoute("api/settings/backups/archives/[name].ts"),
+	});
+
 	// Snapshot route (for DO preview database population)
 	injectRoute({
 		pattern: "/_emdash/api/snapshot",
@@ -393,6 +424,15 @@ export function injectCoreRoutes(
 		pattern: "/_emdash/api/admin/plugins/[id]/disable",
 		entrypoint: resolveRoute("api/admin/plugins/[id]/disable.ts"),
 	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/plugins/[id]/mcp",
+		entrypoint: resolveRoute("api/admin/plugins/[id]/mcp.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/admin/plugins/[id]/settings",
+		entrypoint: resolveRoute("api/admin/plugins/[id]/settings.ts"),
+	});
 
 	// Marketplace plugin routes
 	injectRoute({

package/src/astro/integration/runtime.ts

@@ -13,8 +13,10 @@ import type { MediaProviderDescriptor } from "../../media/types.js";
 import type { ObjectCacheDescriptor } from "../../object-cache/types.js";
 import type {
 	FieldWidgetConfig,
+	PluginMcpManifestConfig,
 	PortableTextBlockConfig,
 	ResolvedPlugin,
+	SettingField,
 } from "../../plugins/types.js";
 import type { ExperimentalConfig } from "../../registry/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
@@ -103,6 +105,8 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
 	adminPages?: PluginAdminPage[];
 	/** Dashboard widgets */
 	adminWidgets?: PluginDashboardWidget[];
+	/** Settings schema for the auto-generated admin settings form */
+	settingsSchema?: Record<string, SettingField>;
 	/**
 	 * Portable Text block types this plugin contributes to the editor.
 	 * Declarative (Block Kit) — surfaced in the admin slash menu and consumed
@@ -131,6 +135,8 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
 	 * Sandboxed plugins can only access declared collections.
 	 */
 	storage?: Record<string, StorageCollectionDeclaration>;
+	/** Serialized MCP declarations emitted by the plugin build. */
+	mcp?: PluginMcpManifestConfig;
 }
 
 /**
@@ -589,6 +595,30 @@ export interface EmDashConfig {
 		favicon?: string;
 	};
 
+	/**
+	 * Editor toolbar delivery on public pages.
+	 *
+	 * - `"server"` (default): the toolbar is injected server-side into every
+	 *   HTML response rendered for an authenticated editor. Simple and
+	 *   zero-config, but behind a shared cache (Cloudflare Cache Everything /
+	 *   Workers Cache, Fastly, Varnish, …) editors often receive the cached
+	 *   anonymous variant — without the toolbar — whenever an anonymous visitor
+	 *   primed the cache first, so the toolbar appears and disappears with
+	 *   cache state.
+	 * - `"client"`: public HTML is identical for everyone (nothing
+	 *   session-specific is injected server-side, so shared caches stay fully
+	 *   effective). A tiny bootstrap script shows an "Edit" pill for browsers
+	 *   that have logged into the admin (non-secret localStorage flag). Clicking
+	 *   it verifies the session and reloads the page with an `_edit` query
+	 *   param, which is always rendered fresh (never cached) with the full
+	 *   toolbar. Logged-out visitors opening an `_edit` URL are redirected to
+	 *   the canonical URL.
+	 * - `false`: never render the toolbar or bootstrap script.
+	 *
+	 * See the visual-editing docs for the cache-behavior details.
+	 */
+	toolbar?: "server" | "client" | false;
+
 	/**
 	 * Version of Astro the host project is building with. Populated by the
 	 * integration's `astro:config:setup` hook (not authored by the user) and

package/src/astro/integration/virtual-modules.ts

@@ -69,6 +69,9 @@ export const RESOLVED_VIRTUAL_WAIT_UNTIL_ID = "\0" + VIRTUAL_WAIT_UNTIL_ID;
 export const VIRTUAL_SCHEDULER_ID = "virtual:emdash/scheduler";
 export const RESOLVED_VIRTUAL_SCHEDULER_ID = "\0" + VIRTUAL_SCHEDULER_ID;
 
+export const VIRTUAL_ENV_ID = "virtual:emdash/env";
+export const RESOLVED_VIRTUAL_ENV_ID = "\0" + VIRTUAL_ENV_ID;
+
 /**
  * Generates the config virtual module.
  */
@@ -84,13 +87,18 @@ export function generateConfigModule(serializableConfig: Record<string, unknown>
  * the generator re-exports it so middleware can ask for a per-request Kysely
  * (used for D1 Sessions API, bookmark cookies, read-replica routing). Other
  * adapters get a stub that returns null.
+ *
+ * Adapters independently opt into the cold-start coalescing dialect. Keeping
+ * this capability explicit prevents bundlers from probing exports that do not
+ * exist on SQLite, libSQL, PostgreSQL, or other adapters.
  */
 export function generateDialectModule(opts: {
 	entrypoint?: string;
 	type?: string;
 	supportsRequestScope: boolean;
+	supportsCoalescing: boolean;
 }): string {
-	const { entrypoint, supportsRequestScope } = opts;
+	const { entrypoint, supportsRequestScope, supportsCoalescing } = opts;
 	if (!entrypoint) {
 		return [
 			`export const createDialect = undefined;`,
@@ -101,16 +109,16 @@ export function generateDialectModule(opts: {
 	}
 	const type = opts.type ?? "sqlite";
 
-	// Namespace access (not a named re-export) so backends that don't export
-	// createCoalescingDialect yield `undefined` rather than a build error.
-	const coalescingReExport = `import * as _dialectModule from "${entrypoint}";
-export const createCoalescingDialect = _dialectModule.createCoalescingDialect;`;
+	const coalescingExport = supportsCoalescing
+		? `import { createCoalescingDialect as _createCoalescingDialect } from "${entrypoint}";
+export const createCoalescingDialect = _createCoalescingDialect;`
+		: `export const createCoalescingDialect = undefined;`;
 
 	if (supportsRequestScope) {
 		return `
 import { createDialect as _createDialect } from "${entrypoint}";
 export { createRequestScopedDb } from "${entrypoint}";
-${coalescingReExport}
+${coalescingExport}
 export const createDialect = _createDialect;
 export const dialectType = ${JSON.stringify(type)};
 `;
@@ -118,7 +126,7 @@ export const dialectType = ${JSON.stringify(type)};
 
 	return `
 import { createDialect as _createDialect } from "${entrypoint}";
-${coalescingReExport}
+${coalescingExport}
 export const createDialect = _createDialect;
 export const dialectType = ${JSON.stringify(type)};
 export const createRequestScopedDb = (_opts) => null;
@@ -271,6 +279,7 @@ export function generatePluginsModule(descriptors: PluginDescriptor[]): string {
 					storage: descriptor.storage,
 					adminPages: descriptor.adminPages,
 					adminWidgets: descriptor.adminWidgets,
+					settingsSchema: descriptor.settingsSchema,
 					portableTextBlocks: descriptor.portableTextBlocks,
 					fieldWidgets: descriptor.fieldWidgets,
 				})})`,
@@ -469,6 +478,25 @@ export function generateWaitUntilModule(adapterName: string | undefined): string
 	return `export const waitUntil = undefined;`;
 }
 
+/**
+ * Generates the env virtual module.
+ *
+ * Under @astrojs/cloudflare, re-exports `env` from `cloudflare:workers` so
+ * routes can read Worker bindings/secrets without touching
+ * `Astro.locals.runtime.env`, which Astro 6+ removed (accessing it throws
+ * rather than returning undefined, so `locals.runtime?.env` optional-chaining
+ * doesn't help -- see #1736). For any other adapter, exports `undefined` so
+ * callers fall back to `import.meta.env`. Mirrors generateWaitUntilModule:
+ * core stays adapter-agnostic, with no direct `cloudflare:workers` import
+ * that would fail to resolve under a Node build.
+ */
+export function generateEnvModule(adapterName: string | undefined): string {
+	if (adapterName === "@astrojs/cloudflare") {
+		return `export { env } from "cloudflare:workers";`;
+	}
+	return `export const env = undefined;`;
+}
+
 /**
  * Generates the scheduler virtual module.
  *
@@ -598,12 +626,14 @@ function resolveModulePathFromProject(specifier: string, projectRoot: string): s
 /**
  * Generates the sandboxed plugins module.
  * Resolves plugin entrypoints to files, reads them, and embeds the code.
+ * Notifies the caller about each resolved entry so build tools can watch it.
  *
  * At runtime, middleware uses SandboxRunner to load these into isolates.
  */
 export function generateSandboxedPluginsModule(
 	sandboxed: PluginDescriptor[],
 	projectRoot: string,
+	onEntryResolved?: (filePath: string) => void,
 ): string {
 	if (sandboxed.length === 0) {
 		return `
@@ -630,6 +660,8 @@ export const sandboxedPlugins = [];
 			);
 		}
 
+		onEntryResolved?.(filePath);
+
 		const code = readFileSync(filePath, "utf-8");
 
 		// Create the plugin entry with embedded code and sandbox config
@@ -640,8 +672,10 @@ export const sandboxedPlugins = [];
     capabilities: ${JSON.stringify(descriptor.capabilities ?? [])},
     allowedHosts: ${JSON.stringify(descriptor.allowedHosts ?? [])},
     storage: ${JSON.stringify(descriptor.storage ?? {})},
+    mcp: ${JSON.stringify(descriptor.mcp)},
     adminPages: ${JSON.stringify(descriptor.adminPages ?? [])},
     adminWidgets: ${JSON.stringify(descriptor.adminWidgets ?? [])},
+    settingsSchema: ${JSON.stringify(descriptor.settingsSchema)},
     portableTextBlocks: ${JSON.stringify(descriptor.portableTextBlocks ?? [])},
     fieldWidgets: ${JSON.stringify(descriptor.fieldWidgets ?? [])},
     adminEntry: ${JSON.stringify(descriptor.adminEntry)},

package/src/astro/integration/vite-config.ts

@@ -46,9 +46,12 @@ import {
 	RESOLVED_VIRTUAL_WAIT_UNTIL_ID,
 	VIRTUAL_SCHEDULER_ID,
 	RESOLVED_VIRTUAL_SCHEDULER_ID,
+	VIRTUAL_ENV_ID,
+	RESOLVED_VIRTUAL_ENV_ID,
 	generateSeedModule,
 	generateWaitUntilModule,
 	generateSchedulerModule,
+	generateEnvModule,
 	generateConfigModule,
 	generateDialectModule,
 	generateStorageModule,
@@ -227,6 +230,9 @@ export function createVirtualModulesPlugin(
 			if (id === VIRTUAL_SCHEDULER_ID) {
 				return RESOLVED_VIRTUAL_SCHEDULER_ID;
 			}
+			if (id === VIRTUAL_ENV_ID) {
+				return RESOLVED_VIRTUAL_ENV_ID;
+			}
 		},
 		load(id: string) {
 			if (id === RESOLVED_VIRTUAL_CONFIG_ID) {
@@ -239,6 +245,7 @@ export function createVirtualModulesPlugin(
 					entrypoint: resolvedConfig.database?.entrypoint,
 					type: resolvedConfig.database?.type,
 					supportsRequestScope: resolvedConfig.database?.supportsRequestScope ?? false,
+					supportsCoalescing: resolvedConfig.database?.supportsCoalescing ?? false,
 				});
 			}
 			// Generate a module that statically imports the configured storage
@@ -271,7 +278,11 @@ export function createVirtualModulesPlugin(
 			if (id === RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID) {
 				// Pass project root for proper module resolution
 				const projectRoot = fileURLToPath(astroConfig.root);
-				return generateSandboxedPluginsModule(resolvedConfig.sandboxed ?? [], projectRoot);
+				return generateSandboxedPluginsModule(
+					resolvedConfig.sandboxed ?? [],
+					projectRoot,
+					(filePath) => this.addWatchFile(filePath),
+				);
 			}
 			// Generate auth module that statically imports the configured auth provider
 			if (id === RESOLVED_VIRTUAL_AUTH_ID) {
@@ -317,6 +328,11 @@ export function createVirtualModulesPlugin(
 				const schedulerCommand = astroCommand === "dev" ? "serve" : "build";
 				return generateSchedulerModule(astroConfig.adapter?.name, schedulerCommand);
 			}
+			// Generate env module — re-exports cloudflare:workers' env under
+			// the Cloudflare adapter, undefined otherwise (#1736).
+			if (id === RESOLVED_VIRTUAL_ENV_ID) {
+				return generateEnvModule(astroConfig.adapter?.name);
+			}
 		},
 	};
 }

package/src/astro/middleware/auth.ts

@@ -60,13 +60,7 @@ function isUnsafeMethod(method: string): boolean {
 }
 
 function csrfRejectedResponse(): Response {
-	return new Response(
-		JSON.stringify({ error: { code: "CSRF_REJECTED", message: "Missing required header" } }),
-		{
-			status: 403,
-			headers: { "Content-Type": "application/json", ...MW_CACHE_HEADERS },
-		},
-	);
+	return apiError("CSRF_REJECTED", "Missing required header", 403);
 }
 
 function mcpUnauthorizedResponse(
@@ -74,16 +68,13 @@ function mcpUnauthorizedResponse(
 	config?: Parameters<typeof getPublicOrigin>[1],
 ): Response {
 	const origin = getPublicOrigin(url, config);
-	return Response.json(
-		{ error: { code: "NOT_AUTHENTICATED", message: "Not authenticated" } },
-		{
-			status: 401,
-			headers: {
-				"WWW-Authenticate": `Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource"`,
-				...MW_CACHE_HEADERS,
-			},
-		},
+	const response = apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	// Preserve the OAuth discovery header so MCP clients can find the auth server.
+	response.headers.set(
+		"WWW-Authenticate",
+		`Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource"`,
 	);
+	return response;
 }
 
 /**
@@ -224,15 +215,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		if (method !== "GET" && method !== "HEAD" && method !== "OPTIONS") {
 			const csrfHeader = context.request.headers.get("X-EmDash-Request");
 			if (csrfHeader !== "1") {
-				return new Response(
-					JSON.stringify({
-						error: { code: "CSRF_REJECTED", message: "Missing required header" },
-					}),
-					{
-						status: 403,
-						headers: { "Content-Type": "application/json", ...MW_CACHE_HEADERS },
-					},
-				);
+				return apiError("CSRF_REJECTED", "Missing required header", 403);
 			}
 		}
 		return next();
@@ -250,20 +233,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	const bearerResult = await handleBearerAuth(context);
 
 	if (bearerResult === "invalid") {
-		const headers: Record<string, string> = {
-			"Content-Type": "application/json",
-			...MW_CACHE_HEADERS,
-		};
+		const response = apiError("INVALID_TOKEN", "Invalid or expired token", 401);
 		// Add WWW-Authenticate header on MCP endpoint 401s to trigger OAuth discovery
 		if (url.pathname === "/_emdash/api/mcp") {
 			const origin = getPublicOrigin(url, context.locals.emdash?.config);
-			headers["WWW-Authenticate"] =
-				`Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource"`;
+			response.headers.set(
+				"WWW-Authenticate",
+				`Bearer resource_metadata="${origin}/.well-known/oauth-protected-resource"`,
+			);
 		}
-		return new Response(
-			JSON.stringify({ error: { code: "INVALID_TOKEN", message: "Invalid or expired token" } }),
-			{ status: 401, headers },
-		);
+		return response;
 	}
 
 	const isTokenAuth = bearerResult === "authenticated";
@@ -308,7 +287,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				"Content-Security-Policy",
 				buildEmDashCsp(
 					context.locals.emdash?.config.experimental?.registry,
-					getConfiguredStorageEndpoint(context.locals.emdash?.config.storage),
+					getConfiguredStorageEndpoint(
+						context.locals.emdash?.config.storage,
+						context.locals.emdash?.storage,
+					),
 				),
 			);
 		}
@@ -323,7 +305,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			"Content-Security-Policy",
 			buildEmDashCsp(
 				context.locals.emdash?.config.experimental?.registry,
-				getConfiguredStorageEndpoint(context.locals.emdash?.config.storage),
+				getConfiguredStorageEndpoint(
+					context.locals.emdash?.config.storage,
+					context.locals.emdash?.storage,
+				),
 			),
 		);
 	}
@@ -378,15 +363,28 @@ async function handleEmDashAuth(
 }
 
 /**
- * Soft auth for plugin routes: resolve user from Bearer token or session if present,
- * but never block unauthenticated requests. The catch-all handler checks route
- * metadata to decide whether auth is required (public vs private routes).
+ * Plugin-route auth. Resolves the user in three steps, stopping at the first that
+ * applies:
+ *
+ * 1. Bearer token (all modes). A valid token authenticates; an invalid/expired one
+ *    returns 401 (we never silently downgrade a bad token to anonymous).
+ * 2. External provider — only for a *private* route in production external-auth
+ *    mode. Here `handleExternalAuth` is the sole authority: the provider (e.g.
+ *    Cloudflare Access) is re-verified on every request, so it hard-blocks with
+ *    401 on failure. It does persist an EmDash session (so public pages can
+ *    identify the user), but on these routes that session is deliberately NOT
+ *    consulted as a fallback — the provider check is authoritative every time.
+ * 3. Session — everything else (non-external mode, DEV, and all public routes).
+ *    This is soft: it sets `locals.user` if a session exists but never blocks.
+ *
+ * Public routes are always allowed through. The catch-all handler still enforces
+ * the `plugins:manage` permission and CSRF for private invocations.
  */
 async function handlePluginRouteAuth(
 	context: Parameters<Parameters<typeof defineMiddleware>[0]>[0],
 	next: Parameters<Parameters<typeof defineMiddleware>[0]>[1],
 ): Promise<Response> {
-	const { locals } = context;
+	const { locals, url } = context;
 	const { emdash } = locals;
 
 	try {
@@ -399,19 +397,22 @@ async function handlePluginRouteAuth(
 		if (bearerResult === "invalid") {
 			// A token was presented but is invalid/expired — return 401 so the
 			// caller knows their token is bad (don't silently downgrade to no-auth).
-			return new Response(
-				JSON.stringify({ error: { code: "INVALID_TOKEN", message: "Invalid or expired token" } }),
-				{
-					status: 401,
-					headers: { "Content-Type": "application/json", ...MW_CACHE_HEADERS },
-				},
-			);
+			return apiError("INVALID_TOKEN", "Invalid or expired token", 401);
 		}
-		// "none" — no token presented, try session auth below.
+		// "none" — no token presented, try external/session auth below.
 	} catch (error) {
 		console.error("Plugin route bearer auth error:", error);
 	}
 
+	const authMode = getAuthMode(emdash?.config);
+	if (
+		authMode.type === "external" &&
+		!import.meta.env.DEV &&
+		!isPublicPluginApiRoute(url.pathname, emdash)
+	) {
+		return handleExternalAuth(context, next, authMode, true);
+	}
+
 	try {
 		// Try session auth (sets locals.user if session exists)
 		const { session } = context;
@@ -431,6 +432,17 @@ async function handlePluginRouteAuth(
 	return next();
 }
 
+function isPublicPluginApiRoute(pathname: string, emdash: EmDashHandlers | undefined): boolean {
+	const prefix = "/_emdash/api/plugins/";
+	const route = pathname.slice(prefix.length);
+	const slashIndex = route.indexOf("/");
+	if (slashIndex <= 0 || !emdash?.getPluginRouteMeta) return false;
+
+	return (
+		emdash.getPluginRouteMeta(route.slice(0, slashIndex), route.slice(slashIndex))?.public === true
+	);
+}
+
 /**
  * Soft auth check for public routes with edit mode cookie.
  * Checks the session and sets locals.user if valid, but never blocks the request.
@@ -662,10 +674,7 @@ async function handlePasskeyAuth(
 
 		if (!sessionUser?.id) {
 			if (isApiRoute) {
-				return Response.json(
-					{ error: { code: "NOT_AUTHENTICATED", message: "Not authenticated" } },
-					{ status: 401, headers: MW_CACHE_HEADERS },
-				);
+				return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
 			}
 			const loginUrl = new URL("/_emdash/admin/login", getPublicOrigin(url, emdash?.config));
 			loginUrl.searchParams.set("redirect", url.pathname);
@@ -680,10 +689,7 @@ async function handlePasskeyAuth(
 			// User no longer exists - clear session
 			session?.destroy();
 			if (isApiRoute) {
-				return Response.json(
-					{ error: { code: "NOT_FOUND", message: "User not found" } },
-					{ status: 401, headers: MW_CACHE_HEADERS },
-				);
+				return apiError("NOT_FOUND", "User not found", 401);
 			}
 			const loginUrl = new URL("/_emdash/admin/login", getPublicOrigin(url, emdash?.config));
 			return context.redirect(loginUrl.toString());
@@ -764,9 +770,6 @@ const SCOPE_RULES: Array<[prefix: string, method: string, scope: string]> = [
 	// settings:manage are not rejected at the middleware level.
 	["/_emdash/api/settings", "GET", "settings:read"],
 	["/_emdash/api/settings", "WRITE", "settings:manage"],
-
-	// MCP endpoint — scopes enforced per-tool inside mcp/server.ts
-	["/_emdash/api/mcp", "*", "content:read"],
 ];
 
 const WRITE_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
@@ -785,6 +788,11 @@ function enforceTokenScope(
 	// Session auth — implicit full access, no scope restrictions
 	if (!tokenScopes) return null;
 
+	// MCP is authenticated here, but each tool enforces its own scope. A
+	// blanket content:read/admin requirement would prevent plugin-scoped tokens
+	// from reaching `mcp/server.ts`, where the actual tool policy lives.
+	if (pathname === MCP_ENDPOINT_PATH) return null;
+
 	const isWrite = WRITE_METHODS.has(method);
 
 	for (const [prefix, ruleMethod, scope] of SCOPE_RULES) {
@@ -795,28 +803,12 @@ function enforceTokenScope(
 		if (ruleMethod === "*" || (ruleMethod === "WRITE" && isWrite) || ruleMethod === method) {
 			if (hasScope(tokenScopes, scope)) return null;
 
-			return new Response(
-				JSON.stringify({
-					error: {
-						code: "INSUFFICIENT_SCOPE",
-						message: `Token lacks required scope: ${scope}`,
-					},
-				}),
-				{ status: 403, headers: { "Content-Type": "application/json", ...MW_CACHE_HEADERS } },
-			);
+			return apiError("INSUFFICIENT_SCOPE", `Token lacks required scope: ${scope}`, 403);
 		}
 	}
 
 	// No rule matched — default to admin scope (fail-closed)
 	if (hasScope(tokenScopes, "admin")) return null;
 
-	return new Response(
-		JSON.stringify({
-			error: {
-				code: "INSUFFICIENT_SCOPE",
-				message: "Token lacks required scope: admin",
-			},
-		}),
-		{ status: 403, headers: { "Content-Type": "application/json", ...MW_CACHE_HEADERS } },
-	);
+	return apiError("INSUFFICIENT_SCOPE", "Token lacks required scope: admin", 403);
 }

package/src/astro/middleware/csp.ts

@@ -13,6 +13,7 @@
  * are configured, in which case those origins are allowed too.
  */
 import type { RegistryConfigInput } from "../../registry/types.js";
+import type { Storage } from "../../storage/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
 
 /** Entrypoint constant used by the `s3()` adapter (see `astro/storage/adapters.ts`). */
@@ -28,10 +29,12 @@ const S3_ADAPTER_ENTRYPOINT = "emdash/storage/s3";
  * `endpoint` -- from the matching `S3_*` env var at runtime (see
  * `storage/s3.ts`'s `resolveS3Config`). A site configured as `s3({ ... })`
  * with only `S3_ENDPOINT` set has no `endpoint` in the descriptor's config,
- * so fall back to that env var for S3-adapter storage before giving up.
+ * so fall back to that env var for S3-adapter storage. Custom adapters can
+ * expose their runtime upload origin through `getClientUploadOrigin()`.
  */
 export function getConfiguredStorageEndpoint(
 	storage: StorageDescriptor | undefined,
+	runtimeStorage?: Pick<Storage, "getClientUploadOrigin"> | null,
 ): string | undefined {
 	const config = storage?.config;
 	if (typeof config === "object" && config !== null && "endpoint" in config) {
@@ -45,7 +48,7 @@ export function getConfiguredStorageEndpoint(
 		if (envEndpoint) return envEndpoint;
 	}
 
-	return undefined;
+	return runtimeStorage?.getClientUploadOrigin?.();
 }
 
 function getRegistryAggregatorOrigin(