emdash 0.33.0 → 0.35.0

package/src/astro/integration/vite-config.ts

@@ -48,10 +48,13 @@ import {
 	RESOLVED_VIRTUAL_SCHEDULER_ID,
 	VIRTUAL_ENV_ID,
 	RESOLVED_VIRTUAL_ENV_ID,
+	VIRTUAL_BUILD_ID,
+	RESOLVED_VIRTUAL_BUILD_ID,
 	generateSeedModule,
 	generateWaitUntilModule,
 	generateSchedulerModule,
 	generateEnvModule,
+	generateBuildModule,
 	generateConfigModule,
 	generateDialectModule,
 	generateStorageModule,
@@ -179,6 +182,11 @@ export function createVirtualModulesPlugin(
 
 	let viteCommand: "build" | "serve" | undefined;
 
+	// Captured once per plugin instance rather than inside load(): Vite may load
+	// the module more than once (client and server passes, dev reloads), and a
+	// validator that moved between those loads would invalidate at random.
+	const buildTime = Date.now();
+
 	return {
 		name: "emdash-virtual-modules",
 		configResolved(config) {
@@ -233,6 +241,9 @@ export function createVirtualModulesPlugin(
 			if (id === VIRTUAL_ENV_ID) {
 				return RESOLVED_VIRTUAL_ENV_ID;
 			}
+			if (id === VIRTUAL_BUILD_ID) {
+				return RESOLVED_VIRTUAL_BUILD_ID;
+			}
 		},
 		load(id: string) {
 			if (id === RESOLVED_VIRTUAL_CONFIG_ID) {
@@ -246,6 +257,8 @@ export function createVirtualModulesPlugin(
 					type: resolvedConfig.database?.type,
 					supportsRequestScope: resolvedConfig.database?.supportsRequestScope ?? false,
 					supportsCoalescing: resolvedConfig.database?.supportsCoalescing ?? false,
+					supportsCollectionDeletionGuard:
+						resolvedConfig.database?.supportsCollectionDeletionGuard ?? false,
 				});
 			}
 			// Generate a module that statically imports the configured storage
@@ -333,6 +346,9 @@ export function createVirtualModulesPlugin(
 			if (id === RESOLVED_VIRTUAL_ENV_ID) {
 				return generateEnvModule(astroConfig.adapter?.name);
 			}
+			if (id === RESOLVED_VIRTUAL_BUILD_ID) {
+				return generateBuildModule(buildTime);
+			}
 		},
 	};
 }
@@ -478,7 +494,6 @@ export function createViteConfig(
 							"emdash > @unpic/placeholder",
 							"emdash > blurhash",
 							"emdash > croner",
-							"emdash > image-size",
 							"emdash > jose",
 							"emdash > jpeg-js",
 							"emdash > kysely",

package/src/astro/middleware/media-usage-write-fence.ts

@@ -0,0 +1,30 @@
+import { defineMiddleware } from "astro:middleware";
+
+import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
+
+const FENCED_WRITE_PATHS = [
+	"/_emdash/api/content",
+	"/_emdash/api/schema",
+	"/_emdash/api/admin/media-usage/repair",
+	"/_emdash/api/revisions",
+	"/_emdash/api/import",
+	"/_emdash/api/mcp",
+] as const;
+
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+
+export const onRequest = defineMiddleware(async (context, next) => {
+	if (!isFencedWriteRequest(context.request.method, context.url.pathname)) return next();
+	const db = context.locals.emdash?.db;
+	if (!db) return next();
+	return (await checkMediaUsageActivationWriteFence(db)) ?? next();
+});
+
+function isFencedWriteRequest(method: string, pathname: string): boolean {
+	if (SAFE_METHODS.has(method.toUpperCase())) return false;
+	return FENCED_WRITE_PATHS.some(
+		(prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
+	);
+}
+
+export default onRequest;

package/src/astro/middleware/redirect.ts

@@ -104,8 +104,18 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// No redirect matched -- proceed and check for 404
 		const response = await next();
 
-		// Log 404s for unmatched paths (fire-and-forget)
-		if (response.status === 404) {
+		// Log misses (fire-and-forget) under the path the visitor requested.
+		// Two shapes count as a miss: an unmatched route rendering the error
+		// page with status 404, and a matched route answering a content miss
+		// with a redirect to /404 (the documented template pattern) — there the
+		// missed path exists only on this first pass, before the browser
+		// follows the redirect. The error page itself is never logged: /404
+		// answers 404 by design and carries no path information.
+		const location = response.headers.get("location");
+		const missedByRedirect =
+			isRedirectCode(response.status) && (location === "/404" || location === "/404/");
+		const missedDirectly = response.status === 404 && pathname !== "/404" && pathname !== "/404/";
+		if (missedDirectly || missedByRedirect) {
 			const referrer = context.request.headers.get("referer") ?? null;
 			const userAgent = context.request.headers.get("user-agent") ?? null;
 			repo

package/src/astro/middleware/scoped-db.ts

@@ -24,6 +24,27 @@ interface ScopedDbLifecycle {
 	close?: () => void;
 }
 
+/**
+ * Whether the request ended authenticated, for the db adapter's `commit()`.
+ * `isAuthenticated` is captured before the route runs, so it misses
+ * login/signup/invite requests that create the Astro session mid-request;
+ * `session.set()` writes the `astro-session` cookie into the jar synchronously,
+ * so scanning the outgoing cookies detects them. Only outgoing cookies count —
+ * a stale `astro-session` cookie arriving on an anonymous render must not
+ * qualify, or its replica-read bookmark would overwrite a fresher one from an
+ * earlier authenticated write.
+ */
+export function requestEndedAuthenticated(
+	isAuthenticated: boolean,
+	cookies: { headers(): Iterable<string> },
+): boolean {
+	if (isAuthenticated) return true;
+	for (const header of cookies.headers()) {
+		if (header.startsWith("astro-session=")) return true;
+	}
+	return false;
+}
+
 /** Hold the real adapter close behind both response and deferred-task completion. */
 export function coordinateScopedDbLifecycle(scoped: ScopedDbLifecycle): {
 	closed?: Promise<void>;

package/src/astro/middleware.ts

@@ -5,10 +5,13 @@
  * All heavy lifting happens in EmDashRuntime.
  */
 
+import type { APIContext } from "astro";
 import { defineMiddleware } from "astro:middleware";
 import type { Kysely } from "kysely";
 // Import from virtual modules (populated by integration at build time)
 // @ts-ignore - virtual module
+import { buildTime as virtualBuildTime } from "virtual:emdash/build";
+// @ts-ignore - virtual module
 import virtualConfig from "virtual:emdash/config";
 // @ts-ignore - virtual module
 import {
@@ -36,9 +39,16 @@ import {
 	flushRecorder,
 	isInstrumentationEnabled,
 } from "../database/instrumentation.js";
+import {
+	PendingMigrationsError,
+	resolveRuntimeMigrationMode,
+	type RuntimeMigrationMode,
+} from "../database/migrations/policy.js";
+import { createDeferredTaskTracker } from "../deferred-tasks.js";
 import {
 	DB_INIT_DEADLINE_MS,
 	EmDashRuntime,
+	type MediaUsageMaintenanceResult,
 	type RuntimeDependencies,
 	type SandboxedPluginEntry,
 	type MediaProviderEntry,
@@ -65,6 +75,7 @@ import {
 	ASTRO_COOKIES_SYMBOL,
 	coordinateScopedDbLifecycle,
 	finishScoped,
+	requestEndedAuthenticated,
 } from "./middleware/scoped-db.js";
 import { wrapBodyForStreamMetrics } from "./middleware/stream-end-metrics.js";
 import { prefetchLayoutData } from "./prefetch.js";
@@ -187,7 +198,10 @@ function getPlugins(): ResolvedPlugin[] {
 /**
  * Build runtime dependencies from virtual modules
  */
-function buildDependencies(config: EmDashConfig): RuntimeDependencies {
+function buildDependencies(
+	config: EmDashConfig,
+	migrationMode: RuntimeMigrationMode,
+): RuntimeDependencies {
 	/* eslint-disable typescript-eslint/no-unsafe-type-assertion --
 	   The virtual:emdash/* imports above use @ts-ignore because tsgo/IDE
 	   resolution can't see virtual-modules.d.ts in every consumer setup,
@@ -197,6 +211,7 @@ function buildDependencies(config: EmDashConfig): RuntimeDependencies {
 	const sandboxModule = virtualSandboxRunnerModule as Record<string, unknown>;
 	return {
 		config,
+		migrationMode,
 		plugins: getPlugins(),
 		createDialect: virtualCreateDialect as (config: Record<string, unknown>) => unknown,
 		// Optional: only batching backends (D1, DO) export this; undefined otherwise.
@@ -224,6 +239,7 @@ function buildDependencies(config: EmDashConfig): RuntimeDependencies {
  */
 async function getRuntime(
 	config: EmDashConfig,
+	migrationMode: RuntimeMigrationMode,
 	initTimings?: Array<{ name: string; dur: number; desc?: string }>,
 ): Promise<EmDashRuntime> {
 	// Waiters poll rather than awaiting the initializing request's promise —
@@ -238,7 +254,7 @@ async function getRuntime(
 		holder.lock,
 		() => holder.instance,
 		async (isCurrentClaim) => {
-			const deps = buildDependencies(config);
+			const deps = buildDependencies(config, migrationMode);
 			const runtime = await EmDashRuntime.create(deps, initTimings);
 			if (isCurrentClaim()) {
 				holder.instance = runtime;
@@ -284,6 +300,12 @@ export async function runScheduledTasks(
 	return runOutsideRequest(config, (runtime) => runtime.runScheduledTasks(options));
 }
 
+export async function runScheduledMediaUsageTasks(): Promise<MediaUsageMaintenanceResult> {
+	const config = getConfig();
+	if (!config) return { outcome: "inactive", taskClass: null, turn: null };
+	return runOutsideRequest(config, (runtime) => runtime.runScheduledMediaUsageTasks());
+}
+
 /**
  * Run a callback against the EmDash runtime outside any HTTP request — from a
  * Cloudflare Queue consumer, a `scheduled()` handler, or any other
@@ -334,23 +356,51 @@ export async function withEmDashRuntime<T>(
 /**
  * Shared plumbing for request-free entry points (`runScheduledTasks`,
  * `withEmDashRuntime`): resolve the runtime singleton, then run the callback
- * under an event-scoped db connection when the adapter needs one.
+ * under an event-scoped db when the adapter needs one.
  *
  * Connection-backed adapters (e.g. Postgres over Hyperdrive) cannot reuse
  * the per-isolate singleton from a platform event: its socket belongs to the
  * request that opened it, and workerd rejects cross-event I/O. Open an
  * event-scoped connection and run the callback under it in ALS — the
  * runtime's db getter, the cron executor, and plugin contexts all resolve
- * the connection from ALS — then close it. Gated on the adapter being
- * connection-backed (it exposes `close()`); stateless adapters (D1, Node
- * SQLite) return null or a close-less scope and keep using the singleton.
+ * the connection from ALS — then close it when required. Stateless adapters
+ * that need primary routing can return a close-less scope; adapters with no
+ * event scoping return null and keep using the singleton.
  */
 async function runOutsideRequest<T>(
 	config: EmDashConfig,
 	fn: (runtime: EmDashRuntime) => Promise<T>,
 ): Promise<T> {
-	const runtime = await getRuntime(config);
+	const migrationMode = resolveConfiguredMigrationMode(config);
+	if (getRequestContext()) {
+		const runtime = await getRuntime(config, migrationMode);
+		return runOutsideRequestWithRuntime(config, runtime, fn);
+	}
 
+	const deferredTasks = createDeferredTaskTracker(() => {});
+	const context = {
+		editMode: false,
+		metrics: createRequestMetrics(performance.now()),
+		deferredTasks,
+	};
+	return runWithContext(context, async () => {
+		const runtime = await (async () => {
+			try {
+				return await getRuntime(config, migrationMode);
+			} finally {
+				deferredTasks.settle();
+				await deferredTasks.settled;
+			}
+		})();
+		return runOutsideRequestWithRuntime(config, runtime, fn);
+	});
+}
+
+async function runOutsideRequestWithRuntime<T>(
+	config: EmDashConfig,
+	runtime: EmDashRuntime,
+	fn: (runtime: EmDashRuntime) => Promise<T>,
+): Promise<T> {
 	const scoped = createRequestScopedDb({
 		config: config.database?.config,
 		isAuthenticated: false,
@@ -361,9 +411,8 @@ async function runOutsideRequest<T>(
 		cookies: NOOP_COOKIE_JAR,
 		url: CRON_EVENT_URL,
 	});
-	if (!scoped?.close) {
-		// Stateless adapter (or no per-request scoping): the singleton is safe
-		// outside a request. Any close-less scope created above is discarded.
+	if (!scoped) {
+		// This adapter needs no event-specific routing or connection.
 		return fn(runtime);
 	}
 	const { closed, deferredTasks, lifecycle } = coordinateScopedDbLifecycle(scoped);
@@ -415,6 +464,31 @@ const NOOP_COOKIE_JAR = {
  */
 const CRON_EVENT_URL = new URL("https://cron.emdash.internal/");
 
+function resolveConfiguredMigrationMode(config: EmDashConfig): RuntimeMigrationMode {
+	const processOverride =
+		typeof process !== "undefined" && process.env ? process.env.EMDASH_MIGRATIONS_MODE : undefined;
+	const importMetaOverride = import.meta.env.EMDASH_MIGRATIONS_MODE;
+	return resolveRuntimeMigrationMode(config.migrations, {
+		dev: import.meta.env.DEV,
+		override: processOverride ?? importMetaOverride,
+	});
+}
+
+function pendingMigrationsResponse(error: PendingMigrationsError): Response {
+	console.error("[emdash] database migrations are pending:", error.pending.join(", "));
+	return migrationRequiredResponse();
+}
+
+function migrationRequiredResponse(): Response {
+	return new Response(
+		"Database migrations are required. Apply the deployment migration manifest and retry.",
+		{
+			status: 503,
+			headers: { "Retry-After": "60" },
+		},
+	);
+}
+
 /**
  * Baseline security headers applied to all responses.
  * Admin routes get additional headers (strict CSP) from auth middleware.
@@ -509,6 +583,34 @@ function createRequestScopedDb(
 	return fn(opts);
 }
 
+const buildDate = virtualBuildTime ? new Date(virtualBuildTime) : null;
+
+/**
+ * Fold the build timestamp into the route cache validator.
+ *
+ * `CacheHint.lastModified` describes the content, but the response also depends
+ * on the build: `/_astro/*` names are content-hashed, and a deployment only
+ * serves its own. Without the build dimension a code-only deploy answers a
+ * returning visitor's conditional request with 304, leaving them on HTML whose
+ * assets 404.
+ *
+ * Prerendered pages are served by the host's static layer, which manages its
+ * own validators — only on-demand responses need the build dimension.
+ *
+ * Only forward moves are covered. `Last-Modified` expresses newer, not
+ * different, so after a rollback the earlier build still answers a conditional
+ * request with 304 and the browser stays on the newer build's HTML.
+ *
+ * Must run before next(): Astro keeps the later of two dates, so a route's own
+ * hint still wins when content is newer, and a route that opts out with
+ * `Astro.cache.set(false)` stays opted out — calling set() afterwards would
+ * clear that opt-out.
+ */
+function applyBuildValidator(context: APIContext): void {
+	if (context.isPrerendered || !buildDate || !context.cache?.enabled) return;
+	context.cache.set({ lastModified: buildDate });
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { request, locals, cookies } = context;
 	const url = context.url;
@@ -527,6 +629,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
+	applyBuildValidator(context);
+
 	const queryRecorder = isInstrumentationEnabled()
 		? createRecorder(url.pathname, request.method, request.headers.get("x-perf-phase") ?? "default")
 		: undefined;
@@ -534,6 +638,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	const metrics = createRequestMetrics(performance.now());
 
 	const run = async (): Promise<Response> => {
+		const config = getConfig();
+		const migrationMode = config ? resolveConfiguredMigrationMode(config) : "auto";
 		// Process /_emdash routes and public routes with an active session
 		// (logged-in editors need the runtime for toolbar/visual editing on public pages)
 		const isEmDashRoute = url.pathname.startsWith("/_emdash");
@@ -576,6 +682,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			.startsWith("bearer ");
 		const isWrite = request.method !== "GET" && request.method !== "HEAD";
 		const isAuthenticated = !!sessionUser || hasBearerAuth;
+		const endedAuthenticated = () => requestEndedAuthenticated(isAuthenticated, cookies);
 		const canUseCachedBinding =
 			!isAuthenticated &&
 			!isWrite &&
@@ -601,7 +708,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// production. The build database is legitimately empty in CI and there
 				// is no live visitor to send to the wizard at build time (session reads
 				// are already skipped for prerender above for the same reason).
-				if (!isSetupVerified() && !context.isPrerendered) {
+				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
 						const { getDb } = await import("../loader.js");
@@ -628,14 +735,13 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// The runtime is a cached singleton — after the first request,
 				// getRuntime() is just a null-check. This enables SEO plugins to
 				// contribute meta tags for all visitors, not just logged-in editors.
-				const config = getConfig();
 				if (config) {
 					// Sub-phase timings are populated only on the cold init. Warm
 					// requests hit the cached runtime and leave this empty.
 					const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
 					const t0 = performance.now();
 					try {
-						const runtime = await getRuntime(config, initSubTimings);
+						const runtime = await getRuntime(config, migrationMode, initSubTimings);
 						markSetupVerified();
 						const handlePublicPluginApiRoute = createPublicPluginApiRouteHandler(runtime);
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
@@ -650,6 +756,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							storage: runtime.storage,
 						} as EmDashHandlers;
 					} catch (error) {
+						if (error instanceof PendingMigrationsError) {
+							return pendingMigrationsResponse(error);
+						}
+						if (migrationMode === "manual" && isMissingTableError(error)) {
+							console.error(
+								"[emdash] database schema is unavailable in manual migration mode:",
+								error,
+							);
+							return migrationRequiredResponse();
+						}
 						// Non-fatal — EmDashHead falls back to base SEO contributions —
 						// but log it (throttled): a persistently failing init (e.g. a
 						// failing migration, #1744) is otherwise invisible on the
@@ -676,6 +792,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				const anonScoped = createRequestScopedDb({
 					config: config?.database?.config,
 					isAuthenticated,
+					endedAuthenticated,
 					isWrite,
 					canUseCachedBinding,
 					cookies,
@@ -729,7 +846,6 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			}
 		}
 
-		const config = getConfig();
 		if (!config) {
 			console.error("EmDash: No configuration found");
 			return finalizeResponse(await next());
@@ -749,14 +865,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// instance and `initSubTimings` stays empty.
 				const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
 				let t0 = performance.now();
-				const runtime = await getRuntime(config, initSubTimings);
+				const runtime = await getRuntime(config, migrationMode, initSubTimings);
 				timings.push({ name: "rt", dur: performance.now() - t0, desc: "Runtime init" });
 				// Forward any sub-phase samples so cold-start breakdown is visible
 				// in Server-Timing. Each phase appears prefixed "rt." to distinguish
 				// from the aggregate "rt" timing above.
 				for (const sub of initSubTimings) timings.push(sub);
 
-				// Runtime init runs migrations, so the DB is guaranteed set up
+				// Runtime initialization has satisfied the effective migration policy.
 				markSetupVerified();
 
 				// The manifest is no longer pre-loaded here. It's admin-only
@@ -875,6 +991,13 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					setPluginStatus: runtime.setPluginStatus.bind(runtime),
 				};
 			} catch (error) {
+				if (error instanceof PendingMigrationsError) {
+					return pendingMigrationsResponse(error);
+				}
+				if (migrationMode === "manual" && isMissingTableError(error)) {
+					console.error("[emdash] database schema is unavailable in manual migration mode:", error);
+					return migrationRequiredResponse();
+				}
 				console.error("EmDash middleware error:", error);
 			}
 
@@ -889,6 +1012,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			const scoped = createRequestScopedDb({
 				config: config?.database?.config,
 				isAuthenticated,
+				endedAuthenticated,
 				isWrite,
 				canUseCachedBinding,
 				cookies: context.cookies,

package/src/astro/routes/api/admin/media-usage/collection-deletions/index.ts

@@ -0,0 +1,22 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleMediaUsageCollectionDeletionList } from "#api/handlers/media-usage-work.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { mediaUsageCollectionDeletionListQuery } from "#api/schemas.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ request, locals }) => {
+	const dbErr = requireDb(locals.emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(locals.user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+	const query = parseQuery(new URL(request.url), mediaUsageCollectionDeletionListQuery);
+	if (isParseError(query)) return query;
+	return unwrapResult(await handleMediaUsageCollectionDeletionList(locals.emdash.db, query));
+};

package/src/astro/routes/api/admin/media-usage/collection-deletions/retry.ts

@@ -0,0 +1,22 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleMediaUsageCollectionDeletionRetry } from "#api/handlers/media-usage-work.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { mediaUsageCollectionDeletionRetryBody } from "#api/schemas.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const dbErr = requireDb(locals.emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(locals.user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+	const body = await parseBody(request, mediaUsageCollectionDeletionRetryBody);
+	if (isParseError(body)) return body;
+	return unwrapResult(await handleMediaUsageCollectionDeletionRetry(locals.emdash.db, body));
+};

package/src/astro/routes/api/admin/media-usage/work/index.ts

@@ -0,0 +1,26 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleMediaUsageWorkList } from "#api/handlers/media-usage-work.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { mediaUsageWorkListQuery } from "#api/schemas.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+
+	const query = parseQuery(new URL(request.url), mediaUsageWorkListQuery);
+	if (isParseError(query)) return query;
+
+	return unwrapResult(await handleMediaUsageWorkList(emdash.db, query));
+};

package/src/astro/routes/api/admin/media-usage/work/retry.ts

@@ -0,0 +1,26 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleMediaUsageWorkRetry } from "#api/handlers/media-usage-work.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { mediaUsageWorkRetryBody } from "#api/schemas.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+
+	const body = await parseBody(request, mediaUsageWorkRetryBody);
+	if (isParseError(body)) return body;
+
+	return unwrapResult(await handleMediaUsageWorkRetry(emdash.db, body));
+};

package/src/astro/routes/api/admin/plugins/[id]/disable.ts

@@ -9,6 +9,7 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
 import { handlePluginDisable } from "#api/index.js";
+import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { setCronTasksEnabled } from "#plugins/cron.js";
 
 export const prerender = false;
@@ -24,6 +25,9 @@ export const POST: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
+	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
+	if (activationFence) return activationFence;
+
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -9,6 +9,7 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
 import { handlePluginEnable } from "#api/index.js";
+import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { setCronTasksEnabled } from "#plugins/cron.js";
 
 export const prerender = false;
@@ -24,6 +25,9 @@ export const POST: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
+	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
+	if (activationFence) return activationFence;
+
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}

package/src/astro/routes/api/admin/plugins/[id]/uninstall.ts

@@ -10,6 +10,7 @@ import { z } from "zod";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
 import { handleMarketplaceUninstall } from "#api/index.js";
+import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 
 export const prerender = false;
@@ -29,6 +30,9 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
+	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
+	if (activationFence) return activationFence;
+
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}

package/src/astro/routes/api/admin/plugins/[id]/update.ts

@@ -10,6 +10,7 @@ import { z } from "zod";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
 import { handleMarketplaceUpdate } from "#api/index.js";
+import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 
 export const prerender = false;
@@ -32,6 +33,9 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
+	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
+	if (activationFence) return activationFence;
+
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}