emdash 0.34.0 → 0.35.0

package/dist/astro/middleware/auth.d.mts

@@ -1,13 +1,13 @@
-import "../../options-DRe1pIBL.mjs";
-import "../../types-CAGdePf3.mjs";
-import "../../types-Cs-TFLNf.mjs";
-import "../../relations-DItI3MN9.mjs";
-import "../../index-C3Y-rsyN.mjs";
-import "../../runner-CgQbELYC.mjs";
-import "../../index-Cof4-Fab.mjs";
-import "../../types-DefV3OiO.mjs";
-import "../../hreflang-D3Uehfv2.mjs";
-import "../../validate-DeGtBN84.mjs";
+import "../../options--hhz-jZ1.mjs";
+import "../../types-DQIDRKF2.mjs";
+import "../../types-DrJrVCT1.mjs";
+import "../../relations-BHo5A8Zf.mjs";
+import "../../index-BVBZj4-7.mjs";
+import "../../runner-BYHZn3Jy.mjs";
+import "../../index-C9KuQyO-.mjs";
+import "../../types-CXnOzDe1.mjs";
+import "../../hreflang-DwT2E0Sa.mjs";
+import "../../validate-CTqt5nuE.mjs";
 import { EmDashHandlers } from "../types.mjs";
 import { User } from "@emdash-cms/auth";
 import * as astro from "astro";

package/dist/astro/middleware/auth.mjs

@@ -3,10 +3,10 @@ import "../../base64-CvLhUKQv.mjs";
 import "../../types-CQPWhPxE.mjs";
 import { t as apiError } from "../../error-DupyJZE2.mjs";
 import { r as getPublicOrigin } from "../../public-url-CWoFhQT8.mjs";
-import { t as getAuthMode } from "../../mode-Bpe-tNNy.mjs";
-import { t as resolveSessionUser } from "../../session-user-BzVemLkw.mjs";
-import { i as hasScope } from "../../api-tokens-CyTsLszZ.mjs";
-import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-CFXu8F_2.mjs";
+import { t as getAuthMode } from "../../mode-BDoH_WcF.mjs";
+import { t as resolveSessionUser } from "../../session-user-BEorKVT-.mjs";
+import { i as hasScope } from "../../api-tokens-rIXC6LdE.mjs";
+import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-KO24G1Fd.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";

package/dist/astro/middleware/redirect.mjs

@@ -4,8 +4,8 @@ import "../../after-CBU2vkoO.mjs";
 import "../../base64-CvLhUKQv.mjs";
 import "../../types-CQPWhPxE.mjs";
 import { t as RedirectRepository } from "../../redirect-COsS6SWJ.mjs";
-import { i as matchCachedPatterns, r as loadCachedRedirects } from "../../cache-CBJaDy_E.mjs";
-import { s as getDb } from "../../loader-DLBqRiGP.mjs";
+import { i as matchCachedPatterns, r as loadCachedRedirects } from "../../cache-C46-3Irl.mjs";
+import { s as getDb } from "../../loader-CdG_Ci3H.mjs";
 import { n as isTerminalStatus } from "../../status-CWVYpbD8.mjs";
 import { defineMiddleware } from "astro:middleware";
 

package/dist/astro/middleware/request-context.mjs

@@ -3,7 +3,7 @@ import { getRequestContext, runWithContext } from "../../request-context.mjs";
 import "../../base64-CvLhUKQv.mjs";
 import "../../options-CBXIHUoT.mjs";
 import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-C39klX8R.mjs";
-import { i as resolveSecretsCached } from "../../secrets-dtYs2hDo.mjs";
+import { i as resolveSecretsCached } from "../../secrets-BEgsAQEU.mjs";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";
 

package/dist/astro/middleware/setup.mjs

@@ -1,4 +1,4 @@
-import { t as getAuthMode } from "../../mode-Bpe-tNNy.mjs";
+import { t as getAuthMode } from "../../mode-BDoH_WcF.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/setup.ts

package/dist/astro/middleware.d.mts

@@ -1,13 +1,13 @@
-import "../options-DRe1pIBL.mjs";
-import "../types-CAGdePf3.mjs";
-import "../types-Cs-TFLNf.mjs";
-import "../relations-DItI3MN9.mjs";
-import { Qn as MediaUsageMaintenanceResult, Zn as EmDashRuntime, er as PublishedRef } from "../index-C3Y-rsyN.mjs";
-import "../runner-CgQbELYC.mjs";
-import "../index-Cof4-Fab.mjs";
-import "../types-DefV3OiO.mjs";
-import "../hreflang-D3Uehfv2.mjs";
-import "../validate-DeGtBN84.mjs";
+import "../options--hhz-jZ1.mjs";
+import "../types-DQIDRKF2.mjs";
+import "../types-DrJrVCT1.mjs";
+import "../relations-BHo5A8Zf.mjs";
+import { Kn as EmDashRuntime, Yn as PublishedRef, qn as MediaUsageMaintenanceResult } from "../index-BVBZj4-7.mjs";
+import "../runner-BYHZn3Jy.mjs";
+import "../index-C9KuQyO-.mjs";
+import "../types-CXnOzDe1.mjs";
+import "../hreflang-DwT2E0Sa.mjs";
+import "../validate-CTqt5nuE.mjs";
 import * as astro from "astro";
 
 //#region src/astro/middleware.d.ts

package/dist/astro/middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/astro/middleware.ts"],"mappings":";;;;;;;;;;;;;;;;;AA2RA;;;;;;;;;;iBAAsB,iBAAA,CACrB,OAAA;EAAW,WAAA,IAAe,IAAA,EAAM,YAAA,OAAmB,OAAA;AAAA,IACjD,OAAA;EAAU,SAAA,EAAW,YAAA;AAAA;AAAA,iBAMF,2BAAA,CAAA,GAA+B,OAAA,CAAQ,2BAAA;;;;AAA7D;;;;;AAyCA;;;;;;;;;;;;;;;;;;;;;;AAoPA;;;;;iBApPsB,iBAAA,GAAA,CACrB,GAAA,GAAM,OAAA,EAAS,aAAA,KAAkB,CAAA,GAAI,OAAA,CAAQ,CAAA,IAC3C,OAAA,CAAQ,CAAA;AAAA,cAkPE,SAAA,EA4bX,KAAA,CA5boB,iBAAA"}
+{"version":3,"file":"middleware.d.mts","names":[],"sources":["../../src/astro/middleware.ts"],"mappings":";;;;;;;;;;;;;;;;;AAsSA;;;;;;;;;;iBAAsB,iBAAA,CACrB,OAAA;EAAW,WAAA,IAAe,IAAA,EAAM,YAAA,OAAmB,OAAA;AAAA,IACjD,OAAA;EAAU,SAAA,EAAW,YAAA;AAAA;AAAA,iBAMF,2BAAA,CAAA,GAA+B,OAAA,CAAQ,2BAAA;;;;AAA7D;;;;;AAyCA;;;;;;;;;;;;;;;;;;;;;;AA8QA;;;;;iBA9QsB,iBAAA,GAAA,CACrB,GAAA,GAAM,OAAA,EAAS,aAAA,KAAkB,CAAA,GAAI,OAAA,CAAQ,CAAA,IAC3C,OAAA,CAAQ,CAAA;AAAA,cA4QE,SAAA,EAgdX,KAAA,CAhdoB,iBAAA"}

package/dist/astro/middleware.mjs

@@ -1,73 +1,73 @@
-import { a as runMigrations, n as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "../runner-BiDvq5dv.mjs";
+import { r as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "../runner-C1T11CfC.mjs";
 import { t as validateIdentifier } from "../validate-BpwoDOgt.mjs";
 import { c as isSqlite, p as tableExists, s as isPostgres, u as listTablesLike } from "../dialect-helpers-BSbfaO3F.mjs";
 import { r as getI18nConfig, s as setI18nConfig } from "../config-C3EBstHi.mjs";
-import { C as createHookPipeline, M as AuditRepository, T as definePlugin, _ as PluginRouteRegistry, b as toRouteCallerInfo, c as getSandboxRouteErrorDetails, t as getMenu, v as buildRouteMeta, w as resolveExclusiveHooks, x as EmailPipeline, y as parseRouteInput } from "../menus-CC-yn1F9.mjs";
+import { C as createHookPipeline, M as AuditRepository, T as definePlugin, _ as PluginRouteRegistry, b as toRouteCallerInfo, c as getSandboxRouteErrorDetails, t as getMenu, v as buildRouteMeta, w as resolveExclusiveHooks, x as EmailPipeline, y as parseRouteInput } from "../menus-DSo5QeW0.mjs";
 import { n as createDeferredTaskTracker, t as after } from "../after-CBU2vkoO.mjs";
 import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
 import { o as getLastContentWriteAt } from "../object-cache-71tPfV4A.mjs";
 import { i as MAX_COLLECTION_LIST_COLUMNS } from "../types-75KIqzL9.mjs";
-import { i as RevisionRepository, t as ContentRepository } from "../content-BNfwh7xX.mjs";
+import { i as RevisionRepository, t as ContentRepository } from "../content-ZHCc1ngN.mjs";
 import { n as isMissingTableError } from "../db-errors-Cl-sKYTm.mjs";
 import "../slugify-B994zkXC.mjs";
 import "../base64-CvLhUKQv.mjs";
 import { n as ContentMutationConflictError } from "../types-CQPWhPxE.mjs";
 import { t as MediaRepository } from "../media-CzhAn2--.mjs";
-import "../user-sHgJ62SP.mjs";
+import "../user-DJZfUJVE.mjs";
 import { t as withTransaction } from "../transaction-NQj4VJ7Z.mjs";
-import "../taxonomy-CPeM8d2o.mjs";
+import "../taxonomy-BqCZ1TdU.mjs";
 import "../comment-Dxlep6cE.mjs";
 import { t as OptionsRepository } from "../options-CBXIHUoT.mjs";
-import { r as createSiteInfo } from "../context-DRgOvSnW.mjs";
-import "../menus-fxvEDYE6.mjs";
+import { r as createSiteInfo } from "../context-ZldbZcle.mjs";
+import "../menus-TCNSd2vp.mjs";
 import "../redirect-COsS6SWJ.mjs";
 import { i as setRequestCacheEntry, r as requestCached } from "../request-cache-BSUptuJR.mjs";
 import "../byline-registry-DDun8sxh.mjs";
 import { n as initWithLock, t as createInitLock } from "../init-lock-6b309ZrF.mjs";
-import "../field-defs-cache-hg6QkjV9.mjs";
-import "../byline-pEcoDps8.mjs";
-import "../relation-DtmAQH7s.mjs";
+import "../field-defs-cache-BzwBlJrR.mjs";
+import "../byline-yjvWq4ip.mjs";
+import "../relation-BnHB0T4J.mjs";
 import { n as normalizeMediaValue } from "../normalize-Bc-s_r-a.mjs";
 import "../dist-D_6CKR8z.mjs";
 import "../enrich-_ySMEvEE.mjs";
-import "../seo-CvDxfvFb.mjs";
+import "../seo-Dq4G-RrO.mjs";
 import { r as singleFlightCached, t as createSingleFlightCache } from "../single-flight-cache-B0eLKS6K.mjs";
-import "../cache-CBJaDy_E.mjs";
-import { t as FTSManager } from "../fts-manager-CZ-5dVwJ.mjs";
+import "../cache-C46-3Irl.mjs";
+import { t as FTSManager } from "../fts-manager-DyZEohZC.mjs";
 import "../resolve-DOhVEvty.mjs";
 import { createRecorder, flushRecorder, isInstrumentationEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
-import { s as getDb } from "../loader-DLBqRiGP.mjs";
-import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-B0o9ExNV.mjs";
-import { $ as handleContentUnschedule, A as handleMediaUpdate, B as handleContentDelete, D as handleMediaDelete, E as handleMediaCreate, F as handleContentAuthors, G as handleContentList, H as handleContentDuplicate, I as handleContentCompare, J as handleContentPublish, K as handleContentListTrashed, L as handleContentCountScheduled, M as handleRevisionList, N as handleRevisionRestore, O as handleMediaGet, Q as handleContentUnpublish, R as handleContentCountTrashed, U as handleContentGet, V as handleContentDiscardDraft, W as handleContentGetIncludingTrashed, X as handleContentSchedule, Y as handleContentRestore, Z as handleContentTranslations, _ as loadBundleFromR2, et as handleContentUpdate, j as handleRevisionGet, k as handleMediaList, q as handleContentPermanentDelete, s as normalizeRegistryConfig, tt as validateRev, v as syncDeclaredStorageIndexes, z as handleContentCreate } from "../api-DdAsirBe.mjs";
-import { n as recordSchedulerHeartbeatSafely } from "../dashboard-CB8J89rJ.mjs";
+import { s as getDb } from "../loader-CdG_Ci3H.mjs";
+import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-BlrncHi9.mjs";
+import { $ as handleContentUnschedule, A as handleMediaUpdate, B as handleContentDelete, D as handleMediaDelete, E as handleMediaCreate, F as handleContentAuthors, G as handleContentList, H as handleContentDuplicate, I as handleContentCompare, J as handleContentPublish, K as handleContentListTrashed, L as handleContentCountScheduled, M as handleRevisionList, N as handleRevisionRestore, O as handleMediaGet, Q as handleContentUnpublish, R as handleContentCountTrashed, U as handleContentGet, V as handleContentDiscardDraft, W as handleContentGetIncludingTrashed, X as handleContentSchedule, Y as handleContentRestore, Z as handleContentTranslations, _ as loadBundleFromR2, et as handleContentUpdate, j as handleRevisionGet, k as handleMediaList, q as handleContentPermanentDelete, s as normalizeRegistryConfig, tt as validateRev, v as syncDeclaredStorageIndexes, z as handleContentCreate } from "../api-BeBglVxU.mjs";
+import { n as recordSchedulerHeartbeatSafely } from "../dashboard-DvHbk_cv.mjs";
 import { r as hashString } from "../hash-Cg0TXJPV.mjs";
-import { _ as loadContentMediaUsageFields, a as findNonTranslatableSiblingContentIds, g as buildContentMediaUsageFieldFingerprint, l as refreshContentMediaUsageAfterWrite, r as deleteContentMediaUsage, s as markContentMediaUsageCollectionStale, u as refreshContentMediaUsageForWork, v as CONTENT_SOURCE_SCHEMA_VERSION, y as MediaUsageRepository } from "../content-refresh-DNERP4-f.mjs";
+import { _ as loadContentMediaUsageFields, a as findNonTranslatableSiblingContentIds, g as buildContentMediaUsageFieldFingerprint, l as refreshContentMediaUsageAfterWrite, r as deleteContentMediaUsage, s as markContentMediaUsageCollectionStale, u as refreshContentMediaUsageForWork, v as CONTENT_SOURCE_SCHEMA_VERSION, y as MediaUsageRepository } from "../content-refresh-B_8SJzuU.mjs";
 import { t as MediaUsageWorkRepository } from "../media-usage-work-DrCbqBcl.mjs";
-import "../media-usage-De3qvwjc.mjs";
-import { n as collectionDeletionCurrentTimestamp, r as deleteActivatedMediaUsageCollection, t as MediaUsageCollectionDeletionRepository } from "../collection-deletion-C8BugSGz.mjs";
-import "../media-usage-work-B9Bksh_b.mjs";
-import { n as SchemaRegistry } from "../registry-C581V4TP.mjs";
-import "../query-vgZNwIhh.mjs";
-import "../zod-generator-D11MhxG4.mjs";
-import "../schema-BFyTg38T.mjs";
-import "../schema-CeQSNwB3.mjs";
+import "../media-usage-BZCydfvu.mjs";
+import { n as collectionDeletionCurrentTimestamp, r as deleteActivatedMediaUsageCollection, t as MediaUsageCollectionDeletionRepository } from "../collection-deletion-DQPvMD8R.mjs";
+import "../media-usage-work-CLo_6tct.mjs";
+import { n as SchemaRegistry } from "../registry-Cqa2I749.mjs";
+import "../query-BWs7O5Il.mjs";
+import "../zod-generator-LC-on_Vb.mjs";
+import "../schema-DZ5YVVZj.mjs";
+import "../schema-2AOsSn2v.mjs";
 import "../seo-AFpVvTqr.mjs";
 import { t as PluginStateRepository } from "../state-DYwPue40.mjs";
-import "../sections-COctk6hf.mjs";
-import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-B372MV0p.mjs";
-import "../settings-BE9aqn_9.mjs";
-import "../taxonomies-Dk3MAklL.mjs";
+import "../sections-DmHviGyM.mjs";
+import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-xRdoUZr0.mjs";
+import "../settings-DE9xtzqd.mjs";
+import "../taxonomies-OHUIiIpI.mjs";
 import { r as normalizeManifestRoute } from "../manifest-schema-BXbUAHod.mjs";
 import "../types-CP1CflWf.mjs";
 import "../ssrf-Cpvg_n3A.mjs";
 import "../error-DupyJZE2.mjs";
 import "../parse-DFbuc-Fh.mjs";
 import "../media-BWWWb8kg.mjs";
-import "../redirects-cV9g7V-0.mjs";
+import "../redirects-DTDHWH31.mjs";
 import "../relations-BBApI4e2.mjs";
 import "../status-CWVYpbD8.mjs";
-import { a as invalidateUrlPatternCache } from "../query-BgjfiLUQ.mjs";
-import "../import-B41u8Rot.mjs";
+import { a as invalidateUrlPatternCache } from "../query-zTVAR1Sl.mjs";
+import "../import-DPkLmeXO.mjs";
 import { t as getTrustedProxyHeaders } from "../trusted-proxy-CEVekpby.mjs";
 import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DgZJh3zG.mjs";
 import "../ssrf-DpXgKsna.mjs";
@@ -77,24 +77,25 @@ import { n as assertMediaUsageActivationWriteAllowed } from "../media-usage-writ
 import "../utils-D4vD_Y98.mjs";
 import "../tokens-C39klX8R.mjs";
 import "../preview-PW-nOnq4.mjs";
-import "../hreflang-DNswoYsi.mjs";
-import "../comment-reaction-D6qfHKBc.mjs";
-import "../bylines-BWemdX2k.mjs";
-import { n as getWidgetAreas } from "../widgets-Cwzvww0W.mjs";
-import "../validate-BkqIG_Uj.mjs";
-import "../apply-D5zfeD09.mjs";
-import "../load-DmvJrtxS.mjs";
-import "../search-BpuPKZb0.mjs";
+import "../hreflang-BBe83kKa.mjs";
+import "../comment-reaction-D-2J84UE.mjs";
+import "../bylines-DjXS5p0P.mjs";
+import { n as getWidgetAreas } from "../widgets-BD3ho7Rq.mjs";
+import "../validate-BMLBvxOC.mjs";
+import "../apply-kUDt80-G.mjs";
+import "../load-YJ2xl3ra.mjs";
+import "../search-u1QYdOCG.mjs";
 import "../index.mjs";
-import { n as VERSION, t as COMMIT } from "../version-x0NjTScG.mjs";
-import { t as getAuthMode } from "../mode-Bpe-tNNy.mjs";
-import "../snapshot-B5h6aPMh.mjs";
-import { u as maybeRunScheduledBackup } from "../backup-LHjIAVNP.mjs";
-import { t as cleanupExpiredChallenges } from "../challenge-store-CZyFVaad.mjs";
-import { t as removeUploadAttempt } from "../upload-attempts-hlne3iA1.mjs";
-import { a as validateEncryptionKeyAtStartup } from "../secrets-dtYs2hDo.mjs";
+import { i as resolveRuntimeMigrationMode, n as enforceRuntimeMigrationPolicy, t as PendingMigrationsError } from "../policy-TluUIxuu.mjs";
+import { n as VERSION, t as COMMIT } from "../version-DB_fqCSI.mjs";
+import { t as getAuthMode } from "../mode-BDoH_WcF.mjs";
+import "../snapshot-BBlGkb2q.mjs";
+import { u as maybeRunScheduledBackup } from "../backup-DWYpJlLj.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-SIL5DsF2.mjs";
+import { t as removeUploadAttempt } from "../upload-attempts-D4FS8LT6.mjs";
+import { a as validateEncryptionKeyAtStartup } from "../secrets-BEgsAQEU.mjs";
 import { isRecord } from "../plugin-utils.mjs";
-import { t as resolveSessionUser } from "../session-user-BzVemLkw.mjs";
+import { t as resolveSessionUser } from "../session-user-BEorKVT-.mjs";
 import { Kysely, sql } from "kysely";
 import { ulid } from "ulidx";
 import { z } from "zod";
@@ -2417,7 +2418,7 @@ var EmDashRuntime = class EmDashRuntime {
 				});
 			}
 		};
-		const db = await phase("rt.db", "DB init + migrations", () => EmDashRuntime.getDatabase(deps));
+		const db = await phase("rt.db", "DB init + migration policy", () => EmDashRuntime.getDatabase(deps));
 		const resolveDb = () => {
 			return getRequestContext()?.db ?? db;
 		};
@@ -2436,6 +2437,14 @@ var EmDashRuntime = class EmDashRuntime {
 		const ownsConfiguredDb = !!deps.config.database && !(reqCtx?.dbIsIsolated && reqCtx.db);
 		let readDb = db;
 		let readDbDisposable;
+		const disposeReadDb = async () => {
+			const disposable = readDbDisposable;
+			readDbDisposable = void 0;
+			if (!disposable) return;
+			try {
+				await disposable.destroy();
+			} catch {}
+		};
 		if (ownsConfiguredDb && deps.createCoalescingDialect && deps.config.database) try {
 			const dialect = deps.createCoalescingDialect(deps.config.database.config);
 			if (dialect) {
@@ -2449,6 +2458,10 @@ var EmDashRuntime = class EmDashRuntime {
 			readDb = db;
 		}
 		const optionsRepo = new OptionsRepository(readDb);
+		let missingManualSchemaError;
+		const captureMissingManualSchema = (error) => {
+			if ((deps.migrationMode ?? "auto") === "manual" && isMissingTableError(error)) missingManualSchemaError ??= error;
+		};
 		const readSiteInfo = async () => {
 			const siteOpts = await optionsRepo.getMany([
 				"emdash:site_title",
@@ -2468,11 +2481,15 @@ var EmDashRuntime = class EmDashRuntime {
 			try {
 				const states = await readDb.selectFrom("_plugin_state").select(["plugin_id", "status"]).execute();
 				pluginStates = new Map(states.map((s) => [s.plugin_id, s.status]));
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		}), phase("rt.site", "Site info options", async () => {
 			try {
 				siteInfo = await readSiteInfo();
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		})];
 		if (ownsConfiguredDb) coldStartReads.push(phase("rt.seedcheck", "Auto-seed gate", async () => {
 			try {
@@ -2488,9 +2505,15 @@ var EmDashRuntime = class EmDashRuntime {
 					collectionCount: collectionCount.count,
 					setupDone
 				};
-			} catch {}
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
 		}));
 		await Promise.all(coldStartReads);
+		if (missingManualSchemaError) {
+			await disposeReadDb();
+			throw missingManualSchemaError;
+		}
 		if (localeCasingRepairVersion && (configuredLocales.some((locale) => locale.includes("-") || locale !== locale.toLowerCase()) || storedLocaleCasingRepairVersion !== void 0) && storedLocaleCasingRepairVersion !== localeCasingRepairVersion) await phase("rt.locale", "Repair locale casing", async () => {
 			await repairLocaleCasing(db, configuredLocales);
 			await new OptionsRepository(db).set(LOCALE_CASING_REPAIR_OPTION, localeCasingRepairVersion);
@@ -2500,9 +2523,9 @@ var EmDashRuntime = class EmDashRuntime {
 			const seedHolder = getSeedHolder();
 			try {
 				await initWithLock(seedHolder.lock, () => seedHolder.done.has(seedKey) ? true : void 0, async () => {
-					const { applySeed } = await import("../apply-D5zfeD09.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-DmvJrtxS.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-BkqIG_Uj.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-kUDt80-G.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-YJ2xl3ra.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-BMLBvxOC.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -2519,9 +2542,7 @@ var EmDashRuntime = class EmDashRuntime {
 				} catch {}
 			} catch {}
 		}
-		if (readDbDisposable) try {
-			await readDbDisposable.destroy();
-		} catch {}
+		await disposeReadDb();
 		const enabledPlugins = /* @__PURE__ */ new Set();
 		for (const plugin of deps.plugins) {
 			const status = pluginStates.get(plugin.id);
@@ -2743,9 +2764,9 @@ var EmDashRuntime = class EmDashRuntime {
 				log: kyselyLogOption()
 			});
 			try {
-				await runMigrations(db);
+				await enforceRuntimeMigrationPolicy(db, deps.migrationMode ?? "auto");
 			} catch (error) {
-				if (!(error instanceof ConcurrentMigrationTimeoutError)) holder.failures.set(cacheKey, {
+				if (!(error instanceof ConcurrentMigrationTimeoutError) && !(error instanceof PendingMigrationsError)) holder.failures.set(cacheKey, {
 					at: Date.now(),
 					message: error instanceof Error ? error.message : String(error)
 				});
@@ -3333,7 +3354,7 @@ var EmDashRuntime = class EmDashRuntime {
 		if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(body.data, collection, true)).content;
 		processedData = await this.runSandboxedBeforeSave(processedData, collection, true);
 		processedData = await this.normalizeMediaFields(collection, processedData);
-		const { validateContentData } = await import("../validation-CiJb_X5o.mjs");
+		const { validateContentData } = await import("../validation-npvENUCB.mjs");
 		const validation = await validateContentData(this.db, collection, processedData, { partial: false });
 		if (!validation.ok) return {
 			success: false,
@@ -3376,7 +3397,7 @@ var EmDashRuntime = class EmDashRuntime {
 			if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(bodyWithoutRev.data, collection, false)).content;
 			processedData = await this.runSandboxedBeforeSave(processedData, collection, false);
 			processedData = await this.normalizeMediaFields(collection, processedData);
-			const { validateContentData } = await import("../validation-CiJb_X5o.mjs");
+			const { validateContentData } = await import("../validation-npvENUCB.mjs");
 			const validation = await validateContentData(this.db, collection, processedData, { partial: true });
 			if (!validation.ok) return {
 				success: false,
@@ -4234,6 +4255,21 @@ function createPublicMediaUrlResolver(storage) {
 * middleware.ts.
 */
 const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
+/**
+* Whether the request ended authenticated, for the db adapter's `commit()`.
+* `isAuthenticated` is captured before the route runs, so it misses
+* login/signup/invite requests that create the Astro session mid-request;
+* `session.set()` writes the `astro-session` cookie into the jar synchronously,
+* so scanning the outgoing cookies detects them. Only outgoing cookies count —
+* a stale `astro-session` cookie arriving on an anonymous render must not
+* qualify, or its replica-read bookmark would overwrite a fresher one from an
+* earlier authenticated write.
+*/
+function requestEndedAuthenticated(isAuthenticated, cookies) {
+	if (isAuthenticated) return true;
+	for (const header of cookies.headers()) if (header.startsWith("astro-session=")) return true;
+	return false;
+}
 /** Hold the real adapter close behind both response and deferred-task completion. */
 function coordinateScopedDbLifecycle(scoped) {
 	if (!scoped.close) return { lifecycle: scoped };
@@ -4580,10 +4616,11 @@ function getPlugins() {
 /**
 * Build runtime dependencies from virtual modules
 */
-function buildDependencies(config) {
+function buildDependencies(config, migrationMode) {
 	const sandboxModule = virtualSandboxRunnerModule;
 	return {
 		config,
+		migrationMode,
 		plugins: getPlugins(),
 		createDialect,
 		createCoalescingDialect,
@@ -4604,10 +4641,10 @@ function buildDependencies(config) {
 * cached instance) push nothing — callers should treat an empty array
 * as "warm, nothing to report".
 */
-async function getRuntime(config, initTimings) {
+async function getRuntime(config, migrationMode, initTimings) {
 	const holder = getRuntimeHolder();
 	return initWithLock(holder.lock, () => holder.instance, async (isCurrentClaim) => {
-		const deps = buildDependencies(config);
+		const deps = buildDependencies(config, migrationMode);
 		const runtime = await EmDashRuntime.create(deps, initTimings);
 		if (isCurrentClaim()) holder.instance = runtime;
 		else runtime.stopCron().catch((error) => {
@@ -4702,7 +4739,8 @@ async function withEmDashRuntime(run) {
 * event scoping return null and keep using the singleton.
 */
 async function runOutsideRequest(config, fn) {
-	if (getRequestContext()) return runOutsideRequestWithRuntime(config, await getRuntime(config), fn);
+	const migrationMode = resolveConfiguredMigrationMode(config);
+	if (getRequestContext()) return runOutsideRequestWithRuntime(config, await getRuntime(config, migrationMode), fn);
 	const deferredTasks = createDeferredTaskTracker(() => {});
 	return runWithContext({
 		editMode: false,
@@ -4711,7 +4749,7 @@ async function runOutsideRequest(config, fn) {
 	}, async () => {
 		return runOutsideRequestWithRuntime(config, await (async () => {
 			try {
-				return await getRuntime(config);
+				return await getRuntime(config, migrationMode);
 			} finally {
 				deferredTasks.settle();
 				await deferredTasks.settled;
@@ -4774,6 +4812,24 @@ const NOOP_COOKIE_JAR = {
 * that path, so the value is never used — it exists to satisfy the contract.
 */
 const CRON_EVENT_URL = new URL("https://cron.emdash.internal/");
+function resolveConfiguredMigrationMode(config) {
+	const processOverride = typeof process !== "undefined" && process.env ? process.env.EMDASH_MIGRATIONS_MODE : void 0;
+	const importMetaOverride = import.meta.env.EMDASH_MIGRATIONS_MODE;
+	return resolveRuntimeMigrationMode(config.migrations, {
+		dev: import.meta.env.DEV,
+		override: processOverride ?? importMetaOverride
+	});
+}
+function pendingMigrationsResponse(error) {
+	console.error("[emdash] database migrations are pending:", error.pending.join(", "));
+	return migrationRequiredResponse();
+}
+function migrationRequiredResponse() {
+	return new Response("Database migrations are required. Apply the deployment migration manifest and retry.", {
+		status: 503,
+		headers: { "Retry-After": "60" }
+	});
+}
 /**
 * Baseline security headers applied to all responses.
 * Admin routes get additional headers (strict CSP) from auth middleware.
@@ -4889,6 +4945,8 @@ const onRequest = defineMiddleware(async (context, next) => {
 	const queryRecorder = isInstrumentationEnabled() ? createRecorder(url.pathname, request.method, request.headers.get("x-perf-phase") ?? "default") : void 0;
 	const metrics = createRequestMetrics(performance.now());
 	const run = async () => {
+		const config = getConfig();
+		const migrationMode = config ? resolveConfiguredMigrationMode(config) : "auto";
 		const isEmDashRoute = url.pathname.startsWith("/_emdash");
 		const isPublicRuntimeRoute = PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
 		const hasEditCookie = cookies.get("emdash-edit-mode")?.value === "true";
@@ -4899,15 +4957,16 @@ const onRequest = defineMiddleware(async (context, next) => {
 		const hasBearerAuth = (request.headers.get("authorization") ?? "").toLowerCase().startsWith("bearer ");
 		const isWrite = request.method !== "GET" && request.method !== "HEAD";
 		const isAuthenticated = !!sessionUser || hasBearerAuth;
+		const endedAuthenticated = () => requestEndedAuthenticated(isAuthenticated, cookies);
 		const canUseCachedBinding = !isAuthenticated && !isWrite && !playgroundDb && !isEmDashRoute && !hasEditCookie && !hasPreviewToken;
 		if (!isEmDashRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
 			if (!sessionUser && !playgroundDb) {
 				const timings = [];
 				const mwStart = performance.now();
-				if (!isSetupVerified() && !context.isPrerendered) {
+				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
-						const { getDb } = await import("../loader-DLBqRiGP.mjs").then((n) => n.c);
+						const { getDb } = await import("../loader-CdG_Ci3H.mjs").then((n) => n.c);
 						await (await getDb()).selectFrom("_emdash_migrations").selectAll().limit(1).execute();
 						markSetupVerified();
 					} catch (error) {
@@ -4920,12 +4979,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 						desc: "Setup probe"
 					});
 				}
-				const config = getConfig();
 				if (config) {
 					const initSubTimings = [];
 					const t0 = performance.now();
 					try {
-						const runtime = await getRuntime(config, initSubTimings);
+						const runtime = await getRuntime(config, migrationMode, initSubTimings);
 						markSetupVerified();
 						locals.emdash = {
 							handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
@@ -4935,6 +4993,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 							storage: runtime.storage
 						};
 					} catch (error) {
+						if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+						if (migrationMode === "manual" && isMissingTableError(error)) {
+							console.error("[emdash] database schema is unavailable in manual migration mode:", error);
+							return migrationRequiredResponse();
+						}
 						if (Date.now() - lastRuntimeInitErrorLogAt >= RUNTIME_INIT_ERROR_LOG_INTERVAL_MS) {
 							lastRuntimeInitErrorLogAt = Date.now();
 							console.error("[emdash] runtime init failed (page renders without CMS data):", error);
@@ -4951,6 +5014,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 				const anonScoped = createRequestScopedDb$1({
 					config: config?.database?.config,
 					isAuthenticated,
+					endedAuthenticated,
 					isWrite,
 					canUseCachedBinding,
 					cookies,
@@ -4995,7 +5059,6 @@ const onRequest = defineMiddleware(async (context, next) => {
 				return runAnon();
 			}
 		}
-		const config = getConfig();
 		if (!config) {
 			console.error("EmDash: No configuration found");
 			return finalizeResponse(await next());
@@ -5006,7 +5069,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 			try {
 				const initSubTimings = [];
 				let t0 = performance.now();
-				const runtime = await getRuntime(config, initSubTimings);
+				const runtime = await getRuntime(config, migrationMode, initSubTimings);
 				timings.push({
 					name: "rt",
 					dur: performance.now() - t0,
@@ -5075,12 +5138,18 @@ const onRequest = defineMiddleware(async (context, next) => {
 					setPluginStatus: runtime.setPluginStatus.bind(runtime)
 				};
 			} catch (error) {
+				if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+				if (migrationMode === "manual" && isMissingTableError(error)) {
+					console.error("[emdash] database schema is unavailable in manual migration mode:", error);
+					return migrationRequiredResponse();
+				}
 				console.error("EmDash middleware error:", error);
 			}
 			const lastContentWriteAt = canUseCachedBinding && config?.database?.needsLastContentWriteAt ? await getLastContentWriteAt() : void 0;
 			const scoped = createRequestScopedDb$1({
 				config: config?.database?.config,
 				isAuthenticated,
+				endedAuthenticated,
 				isWrite,
 				canUseCachedBinding,
 				cookies: context.cookies,