emdash 0.32.0 → 0.33.0

package/src/api/openapi/document.ts

@@ -88,6 +88,7 @@ import {
 	createCollectionBody,
 	createFieldBody,
 	fieldListResponseSchema,
+	collectionReorderBody,
 	fieldReorderBody,
 	fieldResponseSchema,
 	orphanedTableListResponseSchema,
@@ -112,10 +113,12 @@ import {
 import { settingsUpdateBody, siteSettingsSchema } from "../schemas/settings.js";
 import {
 	createTermBody,
+	reorderTermsBody,
 	taxonomyListResponseSchema,
 	termGetResponseSchema,
 	termListQuery,
 	termListResponseSchema,
+	termReorderResponseSchema,
 	termResponseSchema,
 	updateTermBody,
 } from "../schemas/taxonomies.js";
@@ -1062,6 +1065,28 @@ const schemaPaths = {
 			},
 		},
 	},
+	"/_emdash/api/schema/collections/reorder": {
+		post: {
+			operationId: "reorderCollections",
+			summary: "Reorder collections in the admin sidebar",
+			description:
+				"Sets the sidebar order. Collections omitted from the list lose their explicit position and fall back to alphabetical order after the ordered ones.",
+			tags: ["Schema"],
+			requestBody: { content: { [JSON_CONTENT]: { schema: collectionReorderBody } } },
+			responses: {
+				"200": {
+					description: "Reordered",
+					content: {
+						[JSON_CONTENT]: {
+							schema: successEnvelope(z.object({ success: z.literal(true) })),
+						},
+					},
+				},
+				...authErrors,
+				...standardErrors(400, 404, 500),
+			},
+		},
+	},
 	"/_emdash/api/schema/collections/{slug}/fields/reorder": {
 		post: {
 			operationId: "reorderFields",
@@ -1320,6 +1345,29 @@ const taxonomyPaths = {
 			},
 		},
 	},
+	"/_emdash/api/taxonomies/{name}/reorder": {
+		post: {
+			operationId: "reorderTerms",
+			summary: "Set the manual order of one sibling group of terms",
+			description:
+				"`ids` names the terms to move, in the desired order, and may be a subset of the group — the listed terms are permuted within the positions they already occupy. A position belongs to a term across every locale, so there is no `locale` parameter. Ordering never reparents — use the term update endpoint to change a parent.",
+			tags: ["Taxonomies"],
+			requestParams: {
+				path: z.object({ name: z.string().meta({ description: "Taxonomy name" }) }),
+			},
+			requestBody: { content: { [JSON_CONTENT]: { schema: reorderTermsBody } } },
+			responses: {
+				"200": {
+					description: "The group in its new order",
+					content: {
+						[JSON_CONTENT]: { schema: successEnvelope(termReorderResponseSchema) },
+					},
+				},
+				...authErrors,
+				...standardErrors(400, 404, 500),
+			},
+		},
+	},
 	"/_emdash/api/taxonomies/{name}/terms": {
 		get: {
 			operationId: "listTerms",

package/src/api/public-url.ts

@@ -10,7 +10,7 @@
  */
 
 /** Minimal config shape — avoids importing the full EmDashConfig type tree. */
-interface SiteUrlConfig {
+export interface SiteUrlConfig {
 	siteUrl?: string;
 }
 
@@ -74,7 +74,19 @@ function getEnvSiteUrl(): string | undefined {
  * @returns Origin string, e.g. `"https://mysite.example.com"`
  */
 export function getPublicOrigin(url: URL, config?: SiteUrlConfig): string {
-	return config?.siteUrl || getEnvSiteUrl() || url.origin;
+	return getConfiguredOrigin(config) || url.origin;
+}
+
+/**
+ * Return the operator-configured public origin, if any.
+ *
+ * The first two steps of {@link getPublicOrigin}'s resolution —
+ * `config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars — without
+ * the request-URL fallback. For callers that have a more trustworthy fallback
+ * than the request (e.g. the stored setup origin used for outbound emails).
+ */
+export function getConfiguredOrigin(config?: SiteUrlConfig): string | undefined {
+	return config?.siteUrl || getEnvSiteUrl() || undefined;
 }
 
 /**

package/src/api/schemas/schema.ts

@@ -86,6 +86,8 @@ export const createCollectionBody = z
 		source: z.string().regex(collectionSourcePattern).optional(),
 		urlPattern: z.string().optional(),
 		hasSeo: z.boolean().optional(),
+		hidden: z.boolean().optional(),
+		sortOrder: z.number().int().nullish(),
 	})
 	.meta({ id: "CreateCollectionBody" });
 
@@ -98,6 +100,8 @@ export const updateCollectionBody = z
 		supports: z.array(collectionSupportValues).optional(),
 		urlPattern: z.string().nullish(),
 		hasSeo: z.boolean().optional(),
+		hidden: z.boolean().optional(),
+		sortOrder: z.number().int().nullish(),
 		commentsEnabled: z.boolean().optional(),
 		commentsModeration: z.enum(["all", "first_time", "none"]).optional(),
 		commentsClosedAfterDays: z.number().int().min(0).optional(),
@@ -144,6 +148,13 @@ export const fieldReorderBody = z
 	})
 	.meta({ id: "FieldReorderBody" });
 
+export const collectionReorderBody = z
+	.object({
+		/** Full desired sidebar order. Collections left out fall back to alphabetical. */
+		slugs: z.array(z.string().min(1)),
+	})
+	.meta({ id: "CollectionReorderBody" });
+
 export const orphanRegisterBody = z
 	.object({
 		label: z.string().optional(),
@@ -179,6 +190,8 @@ export const collectionSchema = z
 		source: z.string().nullable(),
 		urlPattern: z.string().nullable(),
 		hasSeo: z.boolean(),
+		hidden: z.boolean(),
+		sortOrder: z.number().int().nullable(),
 		createdAt: z.string(),
 		updatedAt: z.string(),
 	})

package/src/api/schemas/search.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { SEARCH_TOKENIZERS } from "../../search/types.js";
 import { localeCode } from "./common.js";
 
 // ---------------------------------------------------------------------------
@@ -37,6 +38,7 @@ export const searchEnableBody = z
 		collection: z.string().min(1),
 		enabled: z.boolean(),
 		weights: z.record(z.string(), z.number()).optional(),
+		tokenize: z.enum(SEARCH_TOKENIZERS).optional(),
 	})
 	.meta({ id: "SearchEnableBody" });
 

package/src/api/schemas/taxonomies.ts

@@ -55,6 +55,20 @@ export const updateTermBody = z
 	})
 	.meta({ id: "UpdateTermBody" });
 
+export const reorderTermsBody = z
+	.object({
+		parentId: z.string().min(1).nullish().meta({
+			description:
+				"Parent term whose children are being ordered (translation_group or row id). Omit or null for the top level, which for a flat taxonomy is every term.",
+		}),
+		ids: z.array(z.string().min(1)).max(100).meta({
+			description:
+				"Terms to move, in the desired order — each a row id or translation_group. May be a subset of the group: the listed terms are permuted within the positions they already occupy and every other member keeps its place. An id outside the group is rejected with REORDER_MISMATCH.",
+		}),
+	})
+	.strict()
+	.meta({ id: "ReorderTermsBody" });
+
 export const termListQuery = z
 	.object({
 		locale: localeCode.optional(),
@@ -153,6 +167,10 @@ export const termListResponseSchema = z
 
 export const termResponseSchema = z.object({ term: termSchema }).meta({ id: "TermResponse" });
 
+export const termReorderResponseSchema = z
+	.object({ reordered: z.literal(true) })
+	.meta({ id: "TermReorderResponse" });
+
 export const termGetResponseSchema = z
 	.object({
 		term: termSchema.extend({

package/src/api/site-url.ts

@@ -1,19 +1,29 @@
 /**
  * Resolve the canonical site base URL for use in outbound links (emails, etc.).
  *
- * Uses the stored `emdash:site_url` (set during setup on the real domain)
- * so that Host header spoofing in later requests cannot redirect users to
- * attacker-controlled domains.
- *
- * Falls back to the request URL only if no stored value exists (pre-setup).
+ * Precedence mirrors `getPublicOrigin`: the operator-configured origin
+ * (`config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars) wins,
+ * then the stored `emdash:site_url` option (written once during setup on the
+ * real domain), and only before setup completes does the request URL fill in.
+ * A configured or stored value always beats the request, so Host header
+ * spoofing cannot redirect users to attacker-controlled domains.
  */
 
 import type { Kysely } from "kysely";
 
 import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
+import { getConfiguredOrigin, type SiteUrlConfig } from "./public-url.js";
 
-export async function getSiteBaseUrl(db: Kysely<Database>, request: Request): Promise<string> {
+export async function getSiteBaseUrl(
+	db: Kysely<Database>,
+	request: Request,
+	config?: SiteUrlConfig,
+): Promise<string> {
+	const configured = getConfiguredOrigin(config);
+	if (configured) {
+		return `${configured}/_emdash`;
+	}
 	const options = new OptionsRepository(db);
 	const storedUrl = await options.get<string>("emdash:site_url");
 	if (storedUrl) {

package/src/astro/integration/routes.ts

@@ -313,6 +313,15 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/schema/collections/index.ts"),
 	});
 
+	// Order matters: the static `reorder` route must precede the dynamic
+	// `[slug]` route so Astro's resolver dispatches POST
+	// /schema/collections/reorder to the reorder handler instead of treating
+	// "reorder" as a collection slug.
+	injectRoute({
+		pattern: "/_emdash/api/schema/collections/reorder",
+		entrypoint: resolveRoute("api/schema/collections/reorder.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/schema/collections/[slug]",
 		entrypoint: resolveRoute("api/schema/collections/[slug]/index.ts"),
@@ -389,6 +398,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/taxonomies/index.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/taxonomies/[name]/reorder",
+		entrypoint: resolveRoute("api/taxonomies/[name]/reorder.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/taxonomies/[name]/terms",
 		entrypoint: resolveRoute("api/taxonomies/[name]/terms/index.ts"),

package/src/astro/integration/runtime.ts

@@ -7,6 +7,8 @@
  * DO NOT import Node.js-only modules here (fs, path, module, etc.)
  */
 
+import type { ManifestHookEntry, ManifestRouteEntry } from "@emdash-cms/plugin-types";
+
 import type { AuthDescriptor, AuthProviderDescriptor } from "../../auth/types.js";
 import type { DatabaseDescriptor } from "../../db/adapters.js";
 import type { MediaProviderDescriptor } from "../../media/types.js";
@@ -137,6 +139,17 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
 	storage?: Record<string, StorageCollectionDeclaration>;
 	/** Serialized MCP declarations emitted by the plugin build. */
 	mcp?: PluginMcpManifestConfig;
+	/**
+	 * Route declarations for sandboxed config-declared plugins. Mirrors
+	 * definePlugin({ routes }) and drives route auth decisions; omitted routes
+	 * default to non-public.
+	 */
+	routes?: Array<ManifestRouteEntry | string>;
+	/**
+	 * Hook declarations for sandboxed config-declared plugins. Mirrors
+	 * definePlugin({ hooks }).
+	 */
+	hooks?: Array<ManifestHookEntry | string>;
 }
 
 /**

package/src/astro/integration/virtual-modules.ts

@@ -673,6 +673,8 @@ export const sandboxedPlugins = [];
     allowedHosts: ${JSON.stringify(descriptor.allowedHosts ?? [])},
     storage: ${JSON.stringify(descriptor.storage ?? {})},
     mcp: ${JSON.stringify(descriptor.mcp)},
+    routes: ${JSON.stringify(descriptor.routes ?? [])},
+    hooks: ${JSON.stringify(descriptor.hooks ?? [])},
     adminPages: ${JSON.stringify(descriptor.adminPages ?? [])},
     adminWidgets: ${JSON.stringify(descriptor.adminWidgets ?? [])},
     settingsSchema: ${JSON.stringify(descriptor.settingsSchema)},

package/src/astro/middleware/redirect.ts

@@ -18,11 +18,7 @@ import { defineMiddleware } from "astro:middleware";
 
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
-import {
-	getCachedRedirects,
-	matchCachedPatterns,
-	setCachedRedirects,
-} from "../../redirects/cache.js";
+import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
 import { isTerminalStatus } from "../../redirects/status.js";
 
 /** Paths that should never be intercepted by redirects */
@@ -68,11 +64,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// One query loads both exact and pattern rules into the cache; warm
 		// requests issue zero queries. Empty-redirect sites cache an empty
 		// Map + array, so the next request returns immediately without probing.
-		let cached = getCachedRedirects();
-		if (!cached) {
-			const all = await repo.findAllEnabled();
-			cached = setCachedRedirects(all);
-		}
+		const cached = await loadCachedRedirects(() => repo.findAllEnabled());
 
 		// 1. Exact match (O(1) Map lookup)
 		let exact = cached.exact.get(pathname);

package/src/astro/middleware/scoped-db.ts

@@ -6,6 +6,9 @@
  * request-scoped db adapter's lifecycle around the response.
  */
 
+import { createDeferredTaskTracker } from "../../deferred-tasks.js";
+import type { DeferredTaskTracker } from "../../deferred-tasks.js";
+
 /**
  * Astro attaches AstroCookies to outgoing responses via a well-known global
  * symbol. Cloning a Response (`new Response(body, init)`) drops non-header
@@ -16,6 +19,34 @@
  */
 export const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
 
+interface ScopedDbLifecycle {
+	commit: () => void;
+	close?: () => void;
+}
+
+/** Hold the real adapter close behind both response and deferred-task completion. */
+export function coordinateScopedDbLifecycle(scoped: ScopedDbLifecycle): {
+	closed?: Promise<void>;
+	deferredTasks?: DeferredTaskTracker;
+	lifecycle: ScopedDbLifecycle;
+} {
+	if (!scoped.close) return { lifecycle: scoped };
+
+	const close = scoped.close;
+	const deferredTasks = createDeferredTaskTracker(() => {
+		try {
+			close();
+		} catch (error) {
+			console.error("[emdash] request-scoped db close failed:", error);
+		}
+	});
+	return {
+		closed: deferredTasks.settled,
+		deferredTasks,
+		lifecycle: { commit: scoped.commit, close: deferredTasks.settle },
+	};
+}
+
 /**
  * Run a request-scoped db's `close()` once the response body has finished
  * streaming. Astro streams HTML and components issue DB queries during that
@@ -62,9 +93,9 @@ export function wrapResponseForScopedClose(response: Response, close: () => void
  * Run the request body under a request-scoped db, then settle its lifecycle:
  * `commit()` runs before the response is returned (so per-request state like a
  * D1 bookmark cookie is persisted in the headers, even if render throws), while
- * `close()` (if any) is deferred to stream-end so a connection-backed adapter
- * isn't torn down mid-render. On error the connection is closed immediately
- * before rethrowing so it never leaks.
+ * `close()` (if any) is deferred to lifecycle settlement so a
+ * connection-backed adapter isn't torn down mid-render or mid-task. On error
+ * the lifecycle is settled before rethrowing so it never leaks.
  *
  * On the error path both `commit()` and `close()` are defended: a throw from
  * either is logged and swallowed so it can't replace the propagating render
@@ -77,7 +108,7 @@ export function wrapResponseForScopedClose(response: Response, close: () => void
  * or mask.
  */
 export async function finishScoped(
-	scoped: { commit: () => void; close?: () => void },
+	scoped: ScopedDbLifecycle,
 	run: () => Promise<Response>,
 ): Promise<Response> {
 	let response: Response;

package/src/astro/middleware.ts

@@ -47,6 +47,7 @@ import {
 import { setI18nConfig } from "../i18n/config.js";
 import type { Database, Storage } from "../index.js";
 import { createPublicMediaUrlResolver } from "../media/url.js";
+import { getLastContentWriteAt } from "../object-cache/index.js";
 import type { SandboxRunnerFactory } from "../plugins/sandbox/types.js";
 import type { ResolvedPlugin } from "../plugins/types.js";
 import { invalidateUrlPatternCache } from "../query.js";
@@ -60,7 +61,11 @@ import type { PublishedRef } from "../scheduled-publish.js";
 import { isMissingTableError } from "../utils/db-errors.js";
 import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
 import type { EmDashConfig } from "./integration/runtime.js";
-import { ASTRO_COOKIES_SYMBOL, finishScoped } from "./middleware/scoped-db.js";
+import {
+	ASTRO_COOKIES_SYMBOL,
+	coordinateScopedDbLifecycle,
+	finishScoped,
+} from "./middleware/scoped-db.js";
 import { wrapBodyForStreamMetrics } from "./middleware/stream-end-metrics.js";
 import { prefetchLayoutData } from "./prefetch.js";
 import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
@@ -352,6 +357,7 @@ async function runOutsideRequest<T>(
 		// Event handlers publish, clean up, or run jobs — a write workload —
 		// so a connection-backed adapter routes them to the primary.
 		isWrite: true,
+		canUseCachedBinding: false,
 		cookies: NOOP_COOKIE_JAR,
 		url: CRON_EVENT_URL,
 	});
@@ -360,26 +366,33 @@ async function runOutsideRequest<T>(
 		// outside a request. Any close-less scope created above is discarded.
 		return fn(runtime);
 	}
+	const { closed, deferredTasks, lifecycle } = coordinateScopedDbLifecycle(scoped);
 
 	const parent = getRequestContext();
 	const ctx = parent
-		? { ...parent, db: scoped.db }
-		: { editMode: false, db: scoped.db, metrics: createRequestMetrics(performance.now()) };
+		? { ...parent, db: scoped.db, deferredTasks }
+		: {
+				editMode: false,
+				db: scoped.db,
+				metrics: createRequestMetrics(performance.now()),
+				deferredTasks,
+			};
 	try {
 		return await runWithContext(ctx, () => fn(runtime));
 	} finally {
 		// Guard both so a throw in teardown can't mask the callback result or
-		// skip close() and leak the connection. Mirrors closeSafely() in scoped-db.ts.
+		// skip lifecycle settlement and leak the connection.
 		try {
-			scoped.commit();
+			lifecycle.commit();
 		} catch (error) {
 			console.error("[emdash] event-scoped db commit failed:", error);
 		}
 		try {
-			scoped.close();
+			lifecycle.close?.();
 		} catch (error) {
 			console.error("[emdash] event-scoped db close failed:", error);
 		}
+		await closed;
 	}
 }
 
@@ -561,6 +574,15 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		const hasBearerAuth = (request.headers.get("authorization") ?? "")
 			.toLowerCase()
 			.startsWith("bearer ");
+		const isWrite = request.method !== "GET" && request.method !== "HEAD";
+		const isAuthenticated = !!sessionUser || hasBearerAuth;
+		const canUseCachedBinding =
+			!isAuthenticated &&
+			!isWrite &&
+			!playgroundDb &&
+			!isEmDashRoute &&
+			!hasEditCookie &&
+			!hasPreviewToken;
 
 		if (!isEmDashRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
 			if (!sessionUser && !playgroundDb) {
@@ -647,12 +669,18 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// Even on the anonymous fast path we ask the adapter for a per-request
 				// scoped db. For D1 with read replication this routes anonymous reads
 				// to the nearest replica; for other adapters it's a no-op.
+				const lastContentWriteAt =
+					canUseCachedBinding && config?.database?.needsLastContentWriteAt
+						? await getLastContentWriteAt()
+						: undefined;
 				const anonScoped = createRequestScopedDb({
 					config: config?.database?.config,
-					isAuthenticated: false,
-					isWrite: request.method !== "GET" && request.method !== "HEAD",
+					isAuthenticated,
+					isWrite,
+					canUseCachedBinding,
 					cookies,
 					url,
+					lastContentWriteAt,
 				});
 				const runAnon = async () => {
 					const t0 = performance.now();
@@ -666,10 +694,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					return wrapBodyForStreamMetrics(finalizeResponse(response, timings));
 				};
 				if (anonScoped) {
+					const { deferredTasks, lifecycle } = coordinateScopedDbLifecycle(anonScoped);
 					const parent = getRequestContext();
 					const ctx = parent
-						? { ...parent, db: anonScoped.db }
-						: { editMode: false, db: anonScoped.db, metrics };
+						? { ...parent, db: anonScoped.db, deferredTasks }
+						: { editMode: false, db: anonScoped.db, metrics, deferredTasks };
 					// Eagerly warm site-global layout data (menus, widget areas,
 					// taxonomy terms, settings) concurrently so the layout's
 					// per-component reads overlap into ~one wall-clock round trip and
@@ -678,10 +707,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					//    pointless on synchronous local SQLite.
 					//  - HTML navigations only -- feeds/sitemaps/JSON don't render the
 					//    layout, so prefetching their chrome is pure waste.
-					//  - via after(): it runs immediately (still warms the render) but
-					//    hands the promise to waitUntil, so the surplus warm-up (chrome a
-					//    given page doesn't render) is kept alive past the response rather
-					//    than erroring on workerd as orphaned request I/O.
+					//  - the work starts immediately, then after() keeps both it and the
+					//    request-scoped connection alive until the response also finishes.
 					// Gate on the CLIENT'S PREFERRED type (leading media range), not a
 					// substring -- browser navigations lead with `text/html`, while feed
 					// readers lead with `application/rss+xml` etc. and only list
@@ -694,8 +721,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						if (acceptsHtml) after(() => prefetchLayoutData());
 						// commit() persists per-request state (e.g. the D1 bookmark cookie)
 						// before the response is returned, even if render throws; close()
-						// (connection teardown) is deferred to stream-end. See finishScoped.
-						return finishScoped(anonScoped, runAnon);
+						// waits for stream-end and request-owned deferred work. See finishScoped.
+						return finishScoped(lifecycle, runAnon);
 					});
 				}
 				return runAnon();
@@ -855,12 +882,18 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			// it in ALS so the runtime's db getter and loader's getDb() pick it up,
 			// then call commit() after next() so the adapter can persist any
 			// per-request state (e.g. a D1 bookmark cookie for read-your-writes).
+			const lastContentWriteAt =
+				canUseCachedBinding && config?.database?.needsLastContentWriteAt
+					? await getLastContentWriteAt()
+					: undefined;
 			const scoped = createRequestScopedDb({
 				config: config?.database?.config,
-				isAuthenticated: !!sessionUser || hasBearerAuth,
-				isWrite: request.method !== "GET" && request.method !== "HEAD",
+				isAuthenticated,
+				isWrite,
+				canUseCachedBinding,
 				cookies: context.cookies,
 				url,
+				lastContentWriteAt,
 			});
 
 			const renderAndFinalize = async () => {
@@ -876,15 +909,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			};
 
 			if (scoped) {
+				const { deferredTasks, lifecycle } = coordinateScopedDbLifecycle(scoped);
 				const parent = getRequestContext();
 				const ctx = parent
-					? { ...parent, db: scoped.db }
-					: { editMode: false, db: scoped.db, metrics };
+					? { ...parent, db: scoped.db, deferredTasks }
+					: { editMode: false, db: scoped.db, metrics, deferredTasks };
 				return runWithContext(ctx, () =>
 					// commit() persists per-request state (e.g. the D1 bookmark cookie)
 					// before the response returns, even if render throws; close()
-					// (connection teardown) is deferred to stream-end. See finishScoped.
-					finishScoped(scoped, renderAndFinalize),
+					// waits for stream-end and request-owned deferred work. See finishScoped.
+					finishScoped(lifecycle, renderAndFinalize),
 				);
 			}
 

package/src/astro/routes/api/admin/comments/[id]/status.ts

@@ -93,7 +93,7 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 		// Send notification when a comment is newly approved
 		if (newStatus === "approved" && previousStatus !== "approved" && emdash.email) {
 			try {
-				const adminBaseUrl = await getSiteBaseUrl(emdash.db, request);
+				const adminBaseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
 				const content = await lookupContentAuthor(emdash.db, updated.collection, updated.contentId);
 				if (content?.author) {
 					await sendCommentNotification({

package/src/astro/routes/api/admin/users/[id]/send-recovery.ts

@@ -51,9 +51,9 @@ export const POST: APIRoute = async ({ request, params, locals }) => {
 			);
 		}
 
-		// Build config using stored site URL (not request Host header)
+		// Build config using the configured site URL, stored option as fallback (not request Host header)
 		const options = new OptionsRepository(emdash.db);
-		const baseUrl = await getSiteBaseUrl(emdash.db, request);
+		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
 		const siteName = (await options.get<string>("emdash:site_title")) ?? "EmDash";
 
 		const config: MagicLinkConfig = {

package/src/astro/routes/api/auth/invite/index.ts

@@ -46,8 +46,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const options = new OptionsRepository(emdash.db);
 		const siteName = (await options.get<string>("emdash:site_title")) || "EmDash";
 
-		// Use stored site URL to prevent Host header spoofing in invite emails
-		const baseUrl = await getSiteBaseUrl(emdash.db, request);
+		// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in invite emails
+		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
 
 		// Build email sender from the plugin pipeline (if available)
 		const emailSend = emdash.email?.isAvailable()

package/src/astro/routes/api/auth/magic-link/send.ts

@@ -57,9 +57,9 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			);
 		}
 
-		// Build magic link config using stored site URL (not request Host header)
+		// Build magic link config using the configured site URL, stored option as fallback (not request Host header)
 		const options = new OptionsRepository(emdash.db);
-		const baseUrl = await getSiteBaseUrl(emdash.db, request);
+		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
 		const siteName = (await options.get<string>("emdash:site_title")) ?? "EmDash";
 
 		const config: MagicLinkConfig = {

package/src/astro/routes/api/auth/signup/request.ts

@@ -68,8 +68,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const options = new OptionsRepository(emdash.db);
 		const siteName = (await options.get<string>("emdash:site_title")) || "EmDash";
 
-		// Use stored site URL to prevent Host header spoofing in signup emails
-		const baseUrl = await getSiteBaseUrl(emdash.db, request);
+		// Use the configured site URL (stored option as fallback) to prevent Host header spoofing in signup emails
+		const baseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
 
 		// Request signup - this handles all checks internally and fails silently
 		// if domain not allowed or user exists (to prevent enumeration)

package/src/astro/routes/api/comments/[collection]/[contentId]/index.ts

@@ -302,7 +302,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		// isolate terminates after the response).
 		if (result.comment.status === "approved" && emdash.email && contentAuthor) {
 			try {
-				const adminBaseUrl = await getSiteBaseUrl(emdash.db, request);
+				const adminBaseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
 				await sendCommentNotification({
 					email: emdash.email,
 					comment: result.comment,