emdash 0.37.0 → 0.39.0

package/src/seo/index.ts

@@ -30,13 +30,12 @@
  */
 
 import type { ContentSeo } from "../database/repositories/types.js";
-import { buildSeoImageUrl } from "./media-url.js";
+import { buildSeoImageUrl, resolveSeoCanonicalUrl } from "./media-url.js";
 
 export { getHreflangAlternates, getHreflangAlternatesWithDb } from "./hreflang.js";
 export type { HreflangAlternate, HreflangOptions } from "./hreflang.js";
 
 const TRAILING_SLASH_RE = /\/$/;
-const ABSOLUTE_URL_RE = /^https?:\/\//i;
 
 /**
  * Content input for SEO functions.
@@ -138,16 +137,12 @@ export function getSeoMeta<T>(content: SeoContentInput<T>, options: SeoMetaOptio
 	// OG image: SEO image > default
 	const ogImage = seo.image ? buildSeoImageUrl(seo.image, siteUrl) : (defaultOgImage ?? null);
 
-	// Canonical: explicit > path-based > null
+	// Canonical: explicit > path-based > null. The explicit value goes
+	// through the same resolver as the <EmDashHead> overlay, so a panel
+	// canonical renders identically on both paths.
 	let canonical: string | null = null;
 	if (seo.canonical) {
-		// Ensure relative canonical paths get a leading slash so we don't
-		// produce "https://example.composts/x" when joined with siteUrl
-		if (siteUrl && !seo.canonical.startsWith("/") && !ABSOLUTE_URL_RE.test(seo.canonical)) {
-			canonical = `${siteUrl.replace(TRAILING_SLASH_RE, "")}/${seo.canonical}`;
-		} else {
-			canonical = seo.canonical;
-		}
+		canonical = resolveSeoCanonicalUrl(seo.canonical, siteUrl);
 	} else if (siteUrl && path) {
 		const safePath = path.startsWith("/") ? path : `/${path}`;
 		canonical = `${siteUrl.replace(TRAILING_SLASH_RE, "")}${safePath}`;

package/src/seo/media-url.ts

@@ -20,6 +20,12 @@ export function buildSeoImageUrl(imageRef: string, siteUrl?: string): string {
 		return imageRef;
 	}
 
+	// `//host/path` is protocol-relative — already qualified, not a path
+	// to prefix with the site URL.
+	if (imageRef.startsWith("//")) {
+		return imageRef;
+	}
+
 	// Root-relative path (already includes the media API prefix). Without
 	// this branch we'd re-prefix and produce a doubled path that 404s.
 	if (imageRef.startsWith("/")) {
@@ -30,3 +36,23 @@ export function buildSeoImageUrl(imageRef: string, siteUrl?: string): string {
 	const mediaPath = `/_emdash/api/media/file/${imageRef}`;
 	return siteUrl ? `${siteUrl.replace(TRAILING_SLASH_RE, "")}${mediaPath}` : mediaPath;
 }
+
+/**
+ * Resolve a stored SEO canonical value to a URL.
+ *
+ * The SEO panel accepts absolute URLs, root-relative paths, and bare
+ * relative paths. Relative paths are joined with `siteUrl` (adding a
+ * leading slash when missing, so we never produce
+ * `https://example.composts/x`). Without a `siteUrl` the value is
+ * returned as-is. Absolute output matters here: the resolved value feeds
+ * `<link rel="canonical">` and `og:url`, both of which search engines and
+ * scrapers expect fully qualified.
+ */
+export function resolveSeoCanonicalUrl(canonical: string, siteUrl?: string): string {
+	// `//host/path` is protocol-relative — already qualified, not a path.
+	if (!siteUrl || ABSOLUTE_URL_RE.test(canonical) || canonical.startsWith("//")) {
+		return canonical;
+	}
+	const path = canonical.startsWith("/") ? canonical : `/${canonical}`;
+	return `${siteUrl.replace(TRAILING_SLASH_RE, "")}${path}`;
+}

package/src/settings/index.ts

@@ -9,11 +9,17 @@ import type { Kysely } from "kysely";
 
 import { after } from "../after.js";
 import { siteSettingsTag } from "../cache/chrome-tags.js";
+import { resolvePluginEncryptionKeys } from "../config/secrets.js";
 import { MediaRepository } from "../database/repositories/media.js";
 import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 import { getDb } from "../loader.js";
 import { cachedQuery, invalidateObjectCache } from "../object-cache/index.js";
+import {
+	PluginSettingEncryptionError,
+	decryptPluginSetting,
+	isEncryptedPluginSetting,
+} from "../plugins/settings.js";
 import type { CacheHint } from "../query.js";
 import { peekRequestCache, requestCached } from "../request-cache.js";
 
@@ -31,6 +37,34 @@ import type { SiteSettings, SiteSettingKey, MediaReference, SeoSettings } from "
 /** Prefix for site settings in the options table */
 const SETTINGS_PREFIX = "site:";
 
+function isPluginSettingEnvelopeRecord(value: unknown): value is Record<string, unknown> {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		!Array.isArray(value) &&
+		"$emdash" in value &&
+		value.$emdash === "plugin-setting"
+	);
+}
+
+async function decodePersistedPluginSetting(
+	pluginId: string,
+	key: string,
+	value: unknown,
+	encryptionKeys?: Awaited<ReturnType<typeof resolvePluginEncryptionKeys>>,
+): Promise<unknown> {
+	if (isEncryptedPluginSetting(value)) {
+		return decryptPluginSetting(pluginId, key, value, encryptionKeys);
+	}
+	if (isPluginSettingEnvelopeRecord(value)) {
+		throw new PluginSettingEncryptionError(
+			"PLUGIN_SETTING_DECRYPTION_FAILED",
+			"Plugin secret setting has an invalid encrypted envelope",
+		);
+	}
+	return value;
+}
+
 /**
  * Worker-isolate cache for the resolved `site:*` settings.
  *
@@ -360,8 +394,10 @@ export async function getPluginSettingWithDb<T = unknown>(
 	db: Kysely<Database>,
 ): Promise<T | undefined> {
 	const options = new OptionsRepository(db);
-	const value = await options.get<T>(`plugin:${pluginId}:settings:${key}`);
-	return value ?? undefined;
+	const value = await options.get(`plugin:${pluginId}:settings:${key}`);
+	if (value === null) return undefined;
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- caller supplies the expected plugin setting type
+	return (await decodePersistedPluginSetting(pluginId, key, value)) as T;
 }
 
 /**
@@ -388,13 +424,19 @@ export async function getPluginSettingsWithDb(
 	const options = new OptionsRepository(db);
 	const allOptions = await options.getByPrefix(prefix);
 
-	const settings: Record<string, unknown> = {};
-	for (const [key, value] of allOptions) {
-		if (!key.startsWith(prefix)) {
-			continue;
-		}
-		settings[key.slice(prefix.length)] = value;
-	}
-
-	return settings;
+	const entries = [...allOptions].filter(([key]) => key.startsWith(prefix));
+	const encryptionKeys = entries.some(([, value]) => isEncryptedPluginSetting(value))
+		? await resolvePluginEncryptionKeys()
+		: undefined;
+	return Object.fromEntries(
+		await Promise.all(
+			entries.map(async ([storedKey, value]) => {
+				const key = storedKey.slice(prefix.length);
+				return [
+					key,
+					await decodePersistedPluginSetting(pluginId, key, value, encryptionKeys),
+				] as const;
+			}),
+		),
+	);
 }

package/src/taxonomies/term-counts.ts

@@ -19,6 +19,10 @@ import { sql } from "kysely";
 import { buildStatusCondition, compoundSelectLimit } from "../database/dialect-helpers.js";
 import type { Database } from "../database/types.js";
 import { validateIdentifier } from "../database/validate.js";
+import {
+	filterToRegisteredCollections,
+	noteStaleRegisteredCollections,
+} from "../schema/collection-slugs-cache.js";
 import { chunks } from "../utils/chunks.js";
 import { isMissingTableError } from "../utils/db-errors.js";
 
@@ -100,6 +104,11 @@ async function runBatch(
 		return await runCounts(db, taxonomyName, collections, locale);
 	} catch (error) {
 		if (!isMissingTableError(error)) throw error;
+		// The slug filter let a missing table through: the collection was
+		// deleted on another isolate (stale cache) or the registry drifted
+		// from the physical schema. Window-gated, so the delete case stops
+		// sending failing statements within one revalidation window.
+		noteStaleRegisteredCollections();
 	}
 
 	const counts = new Map<string, number>();
@@ -120,10 +129,15 @@ async function runBatch(
  * it preserves the locale-agnostic API used by legacy callers.
  *
  * Counts are scoped to the taxonomy's declared collections — pass
- * `TaxonomyDef.collections` (`_emdash_taxonomy_defs.collections`). Collections
- * whose `ec_*` table doesn't exist (pre-migration drift, a declared collection
- * that was never created) are skipped, yielding a partial-but-correct count
- * rather than a throw.
+ * `TaxonomyDef.collections` (`_emdash_taxonomy_defs.collections`). Declared
+ * collections without a `_emdash_collections` row (the migration-seeded
+ * defaults declare `posts` unconditionally) are filtered out before any SQL
+ * is built, so no statement referencing a missing `ec_*` table is sent — a
+ * failed statement is logged by the database even when the caller recovers,
+ * flooding D1 observability with phantom errors. The missing-table guards in
+ * `runBatch` stay as the backstop for registry/table drift (e.g. a partially
+ * applied D1 create) and for a table dropped mid-flight, yielding a
+ * partial-but-correct count rather than a throw.
  *
  * One database round-trip for the whole taxonomy (UNION ALL across
  * collections). On a backend that caps compound-SELECT terms — D1 allows five
@@ -146,8 +160,11 @@ export async function fetchVisibleTermCounts(
 	for (const collection of unique) validateIdentifier(collection, "collection slug");
 	if (unique.length === 0) return new Map();
 
+	const present = await filterToRegisteredCollections(db, unique);
+	if (present.length === 0) return new Map();
+
 	const limit = compoundSelectLimit(db);
-	const batched = limit === null ? [unique] : chunks(unique, limit);
+	const batched = limit === null ? [present] : chunks(present, limit);
 	const batches = await Promise.all(
 		batched.map((batch) => runBatch(db, taxonomyName, batch, locale)),
 	);

package/src/visual-editing/action-token.ts

@@ -0,0 +1,31 @@
+import { generatePreviewToken, verifyPreviewToken } from "../preview/tokens.js";
+
+const VISUAL_ACTION_SECRET_DOMAIN = "emdash:visual-editing-action:v1:";
+export const VISUAL_ACTION_TOKEN_INVALID = "VISUAL_ACTION_TOKEN_INVALID";
+
+function visualActionSecret(previewSecret: string): string {
+	return `${VISUAL_ACTION_SECRET_DOMAIN}${previewSecret}`;
+}
+
+export function generateVisualEditingActionToken(
+	previewSecret: string,
+	userId: string,
+): Promise<string> {
+	return generatePreviewToken({
+		contentId: `visual-editing:${userId}`,
+		expiresIn: "5m",
+		secret: visualActionSecret(previewSecret),
+	});
+}
+
+export async function verifyVisualEditingActionToken(
+	token: string,
+	previewSecret: string,
+	userId: string,
+): Promise<boolean> {
+	const verification = await verifyPreviewToken({
+		token,
+		secret: visualActionSecret(previewSecret),
+	});
+	return verification.valid && verification.payload.cid === `visual-editing:${userId}`;
+}

package/src/visual-editing/toolbar-bootstrap.ts

@@ -11,7 +11,7 @@
  * Clicking it verifies the session server-side and reloads the page with the
  * `_edit` query param — that URL is always rendered fresh with the full
  * server-side toolbar. Logged-out browsers pay one localStorage read and
- * nothing else. See Discussion #1742.
+ * nothing else.
  */
 
 /**
@@ -30,6 +30,9 @@ export const EDITOR_FLAG_KEY = "emdash-editor";
  */
 export const TOOLBAR_DISMISSED_KEY = "emdash-toolbar-dismissed";
 
+/** Localized bootstrap labels written by the admin SPA for this browser. */
+export const TOOLBAR_LABELS_KEY = "emdash-toolbar-labels";
+
 /**
  * Query param that requests a fresh (never cached) editor render. Presence is
  * verified server-side: non-editors are redirected to the canonical URL.
@@ -40,15 +43,37 @@ export function renderToolbarBootstrap(): string {
 	return `
 <!-- EmDash Toolbar Bootstrap -->
 <script>
-(function() {
-  var flag, dismissed;
+(function mountToolbar() {
+  var flag, dismissed, labelsRaw;
+  var labels = null;
   try {
     flag = localStorage.getItem("${EDITOR_FLAG_KEY}");
     dismissed = localStorage.getItem("${TOOLBAR_DISMISSED_KEY}");
+    labelsRaw = localStorage.getItem("${TOOLBAR_LABELS_KEY}");
   } catch (e) {
     return;
   }
   if (!flag || dismissed) return;
+  if (labelsRaw) {
+    try {
+      var storedLabels = JSON.parse(labelsRaw);
+      if (storedLabels && typeof storedLabels.editMode === "string" && typeof storedLabels.hideToolbar === "string") {
+        labels = storedLabels;
+      }
+    } catch (e) {}
+  }
+  if (!labels) {
+    fetch("/_emdash/api/visual-editing/toolbar-labels", { credentials: "same-origin" })
+      .then(function(response) { return response.ok ? response.json() : null; })
+      .then(function(body) {
+        var fetched = body && body.data;
+        if (!fetched || typeof fetched.editMode !== "string" || typeof fetched.hideToolbar !== "string") return;
+        try { localStorage.setItem("${TOOLBAR_LABELS_KEY}", JSON.stringify(fetched)); } catch (e) { return; }
+        mountToolbar();
+      })
+      .catch(function() {});
+    return;
+  }
   // The server toolbar is present on _edit / edit-mode / preview renders.
   if (document.getElementById("emdash-toolbar")) return;
 
@@ -67,13 +92,13 @@ export function renderToolbarBootstrap(): string {
   divider.style.cssText = "width:1px;height:16px;background:rgba(255,255,255,0.15);";
 
   var editBtn = document.createElement("button");
-  editBtn.textContent = "Edit";
+  editBtn.textContent = labels.editMode;
   editBtn.style.cssText = "padding:4px 12px;background:#3b82f6;color:#fff;border:none;border-radius:999px;font-size:12px;font-weight:600;cursor:pointer;font-family:inherit;";
 
   var closeBtn = document.createElement("button");
   closeBtn.textContent = "\\u00d7";
-  closeBtn.title = "Hide toolbar";
-  closeBtn.setAttribute("aria-label", "Hide toolbar");
+  closeBtn.title = labels.hideToolbar;
+  closeBtn.setAttribute("aria-label", labels.hideToolbar);
   closeBtn.style.cssText = "background:none;border:none;color:#666;cursor:pointer;font-size:16px;padding:0 2px;line-height:1;font-family:inherit;";
 
   editBtn.addEventListener("click", function() {

package/src/visual-editing/toolbar.ts

@@ -1,3 +1,6 @@
+import { escapeHtml } from "../api/escape.js";
+import { VISUAL_ACTION_TOKEN_INVALID } from "./action-token.js";
+
 /**
  * EmDash Visual Editing Toolbar
  *
@@ -9,10 +12,34 @@
 interface ToolbarConfig {
 	editMode: boolean;
 	isPreview: boolean;
+	actionToken?: string;
+	labels: ToolbarLabels;
+}
+
+export interface ToolbarLabels {
+	publish: string;
+	publishing: string;
+	sessionExpired: string;
+	refreshPage: string;
+	publishFailed: string;
+	editMode: string;
+	openInAdmin: string;
+	hideToolbar: string;
+}
+
+const SCRIPT_LINE_SEPARATOR_RE = /\u2028/g;
+const SCRIPT_PARAGRAPH_SEPARATOR_RE = /\u2029/g;
+
+function inlineScriptJson(value: unknown): string {
+	return JSON.stringify(value)
+		.replaceAll("<", "\\u003c")
+		.replace(SCRIPT_LINE_SEPARATOR_RE, "\\u2028")
+		.replace(SCRIPT_PARAGRAPH_SEPARATOR_RE, "\\u2029");
 }
 
 export function renderToolbar(config: ToolbarConfig): string {
-	const { editMode, isPreview } = config;
+	const { editMode, isPreview, actionToken = "", labels } = config;
+	const recoveryBadge = `<span class="emdash-tb-badge emdash-tb-badge--error">${escapeHtml(labels.sessionExpired)}</span>`;
 
 	return `
 <!-- EmDash Visual Editing Toolbar -->
@@ -22,25 +49,25 @@ export function renderToolbar(config: ToolbarConfig): string {
 
     <div class="emdash-tb-divider"></div>
 
-    <label class="emdash-tb-toggle" title="Toggle edit mode">
+    <label class="emdash-tb-toggle" title="${escapeHtml(labels.editMode)}">
       <input type="checkbox" id="emdash-edit-toggle" ${editMode ? "checked" : ""} />
       <span class="emdash-tb-toggle-track">
         <span class="emdash-tb-toggle-thumb"></span>
       </span>
-      <span class="emdash-tb-toggle-label">Edit</span>
+      <span class="emdash-tb-toggle-label">${escapeHtml(labels.editMode)}</span>
     </label>
 
     <span class="emdash-tb-status" id="emdash-tb-status"></span>
 
     <span class="emdash-tb-save-status" id="emdash-tb-save-status"></span>
 
-    <a class="emdash-tb-admin" id="emdash-tb-admin" href="#" target="emdash-admin" style="display:none" title="Open in admin">
+    <a class="emdash-tb-admin" id="emdash-tb-admin" href="#" target="emdash-admin" style="display:none" title="${escapeHtml(labels.openInAdmin)}">
       <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg>
     </a>
 
-    <button class="emdash-tb-publish" id="emdash-tb-publish" style="display:none">Publish</button>
+    <button class="emdash-tb-publish" id="emdash-tb-publish" style="display:none">${escapeHtml(labels.publish)}</button>
 
-    <button class="emdash-tb-dismiss" id="emdash-tb-dismiss" title="Hide toolbar" aria-label="Hide toolbar">&times;</button>
+    <button class="emdash-tb-dismiss" id="emdash-tb-dismiss" title="${escapeHtml(labels.hideToolbar)}" aria-label="${escapeHtml(labels.hideToolbar)}">&times;</button>
   </div>
 </div>
 
@@ -549,6 +576,60 @@ export function renderToolbar(config: ToolbarConfig): string {
   }
 
   var isEditMode = toolbar.getAttribute("data-edit-mode") === "true";
+  var visualActionToken = ${inlineScriptJson(actionToken)};
+  var visualActionTokenErrorCode = ${inlineScriptJson(VISUAL_ACTION_TOKEN_INVALID)};
+  var toolbarLabels = ${inlineScriptJson(labels)};
+  var visualActionRefreshTimer = null;
+
+  function showVisualActionRecovery() {
+    if (visualActionRefreshTimer !== null) clearTimeout(visualActionRefreshTimer);
+    visualActionRefreshTimer = null;
+    statusEl.innerHTML = ${inlineScriptJson(recoveryBadge)};
+    publishBtn.disabled = true;
+    publishBtn.textContent = toolbarLabels.refreshPage;
+  }
+
+  function showPublishError(message) {
+    statusEl.textContent = message || toolbarLabels.publishFailed;
+    publishBtn.disabled = false;
+    publishBtn.textContent = toolbarLabels.publish;
+  }
+
+  function scheduleVisualActionTokenRefresh(delay) {
+    if (visualActionRefreshTimer !== null) clearTimeout(visualActionRefreshTimer);
+    visualActionRefreshTimer = setTimeout(function() {
+      visualActionRefreshTimer = null;
+      refreshVisualActionToken();
+    }, delay);
+  }
+
+  function refreshVisualActionToken() {
+    return ecFetch("/_emdash/api/visual-editing/action-token", {
+      method: "POST",
+      credentials: "same-origin",
+      headers: { "X-EmDash-Visual-Action": visualActionToken },
+    })
+    .then(function(res) {
+      if (res.status === 401 || res.status === 403) {
+        showVisualActionRecovery();
+        return null;
+      }
+      if (!res.ok) throw new Error("Visual action token renewal failed");
+      return res.json();
+    })
+    .then(function(body) {
+      if (!body) return;
+      if (!body.data || !body.data.token) throw new Error("Visual action token renewal returned no token");
+      visualActionToken = body.data.token;
+      scheduleVisualActionTokenRefresh(240000);
+    })
+    .catch(function(error) {
+      console.error("Visual action token renewal failed:", error);
+      scheduleVisualActionTokenRefresh(30000);
+    });
+  }
+
+  if (visualActionToken) scheduleVisualActionTokenRefresh(240000);
 
   var dismissBtn = document.getElementById("emdash-tb-dismiss");
   if (dismissBtn) {
@@ -677,11 +758,12 @@ export function renderToolbar(config: ToolbarConfig): string {
     }
 
     publishBtn.disabled = true;
-    publishBtn.textContent = "Publishing\u2026";
+    publishBtn.textContent = toolbarLabels.publishing;
 
-    ecFetch("/_emdash/api/content/" + encodeURIComponent(collection) + "/" + encodeURIComponent(id) + "/publish", {
+    ecFetch("/_emdash/api/visual-editing/content/" + encodeURIComponent(collection) + "/" + encodeURIComponent(id) + "/publish", {
       method: "POST",
       credentials: "same-origin",
+      headers: { "X-EmDash-Visual-Action": visualActionToken },
     })
     .then(function(res) {
       if (res.ok) {
@@ -691,14 +773,23 @@ export function renderToolbar(config: ToolbarConfig): string {
           location.reload();
         }
       } else {
-        publishBtn.disabled = false;
-        publishBtn.textContent = "Publish";
-        console.error("Publish failed:", res.status);
+        if (res.status === 401) {
+          showVisualActionRecovery();
+          return;
+        }
+        return res.json().catch(function() { return null; }).then(function(body) {
+          if (body && body.error && body.error.code === visualActionTokenErrorCode) {
+            showVisualActionRecovery();
+            return;
+          }
+          showPublishError(body && body.error && body.error.message);
+          console.error("Publish failed:", res.status);
+        });
       }
     })
     .catch(function(err) {
       publishBtn.disabled = false;
-      publishBtn.textContent = "Publish";
+      publishBtn.textContent = toolbarLabels.publish;
       console.error("Publish failed:", err);
     });
   }

package/src/widgets/archives.ts

@@ -29,29 +29,23 @@ export function groupEntriesByPublishedAt(
 ): ArchiveGroup[] {
 	const type = options.type ?? "monthly";
 	const limit = options.limit ?? 12;
-	const archives = new Map<string, ArchiveGroup>();
+	const archives = new Map<string, { date: Date; count: number; url: string }>();
 
 	for (const entry of entries) {
 		const date = toPublishedDate(entry.data.publishedAt);
 		if (!date) continue;
 
 		let key: string;
-		let label: string;
 		let url: string;
 
 		if (type === "yearly") {
 			const year = date.getFullYear();
 			key = `${year}`;
-			label = `${year}`;
 			url = `/archives/${year}`;
 		} else {
 			const year = date.getFullYear();
 			const month = date.getMonth() + 1;
 			key = `${year}-${month.toString().padStart(2, "0")}`;
-			label = date.toLocaleDateString("en-US", {
-				year: "numeric",
-				month: "long",
-			});
 			url = `/archives/${year}/${month.toString().padStart(2, "0")}`;
 		}
 
@@ -59,9 +53,16 @@ export function groupEntriesByPublishedAt(
 		if (existing) {
 			existing.count++;
 		} else {
-			archives.set(key, { label, count: 1, url });
+			archives.set(key, { date, count: 1, url });
 		}
 	}
 
-	return [...archives.values()].slice(0, limit);
+	return [...archives.values()].slice(0, limit).map(({ date, count, url }) => ({
+		label:
+			type === "yearly"
+				? `${date.getFullYear()}`
+				: date.toLocaleDateString("en-US", { year: "numeric", month: "long" }),
+		count,
+		url,
+	}));
 }

package/src/widgets/index.ts

@@ -1,7 +1,7 @@
 import { widgetAreaTag } from "../cache/chrome-tags.js";
 import { getDb } from "../loader.js";
 import type { CacheHint } from "../query.js";
-import { requestCached } from "../request-cache.js";
+import { peekRequestCache, requestCached } from "../request-cache.js";
 import { getWidgetComponents as getComponentRegistry } from "./components.js";
 import type { Widget, WidgetArea, WidgetRow, WidgetComponentDef } from "./types.js";
 
@@ -26,6 +26,16 @@ export type {
  */
 export async function getWidgetArea(name: string): Promise<WidgetArea | null> {
 	return requestCached(`widget-area:${name}`, async () => {
+		const prefetched = peekRequestCache<WidgetArea[]>("widget-areas");
+		if (prefetched) {
+			try {
+				const areas = await prefetched;
+				return areas.find((area) => area.name === name) ?? null;
+			} catch {
+				// Optional prefetch failure must still allow the scoped read.
+			}
+		}
+
 		const db = await getDb();
 		const rows = await db
 			.selectFrom("_emdash_widget_areas as a")