emdash 0.39.0 → 0.40.0

package/src/astro/integration/vite-config.ts

@@ -372,6 +372,27 @@ function isCloudflareAdapter(astroConfig: AstroConfig): boolean {
 	return astroConfig.adapter?.name === "@astrojs/cloudflare";
 }
 
+/**
+ * Workers built-ins that core imports dynamically behind a runtime fallback.
+ * Outside workerd nothing resolves them, and Rollup fails the server build on
+ * an unresolved import, so they are left to the runtime. List only core's own
+ * imports: any other `cloudflare:` import on a non-Cloudflare adapter should
+ * still fail the build instead of failing at runtime.
+ */
+const CORE_WORKERS_BUILTINS = new Set(["cloudflare:sockets"]);
+
+function createWorkersBuiltinsExternalPlugin(): Plugin {
+	return {
+		name: "emdash-workers-builtins-external",
+		apply: "build",
+		resolveId(id) {
+			if (CORE_WORKERS_BUILTINS.has(id) && this.environment.config.consumer === "server") {
+				return { id, external: true };
+			}
+		},
+	};
+}
+
 function canResolveProjectDependency(projectRoot: string, specifier: string): boolean {
 	try {
 		createRequire(resolve(projectRoot, "package.json")).resolve(specifier);
@@ -464,6 +485,7 @@ export function createViteConfig(
 		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Monorepo has both vite 6 (docs) and vite 7 (core). tsgo resolves correctly.
 		plugins: [
 			createVirtualModulesPlugin(options, command),
+			...(cloudflare ? [] : [createWorkersBuiltinsExternalPlugin()]),
 			// In dev mode with source alias, compile Lingui macros on the fly
 			// and redirect locale .mjs imports to dist/.
 			// In production, macros are pre-compiled by tsdown in the admin package.
@@ -534,6 +556,7 @@ export function createViteConfig(
 							"emdash > @emdash-cms/auth > @oslojs/webauthn",
 							// Registry routes are lazy, so their AT Protocol graph is not
 							// present during Vite's initial dependency scan.
+							"emdash > @atcute/identity-resolver",
 							"emdash > @emdash-cms/registry-lexicons > @atcute/atproto/types/label/defs",
 							"emdash > @emdash-cms/registry-client > @atcute/client",
 							"emdash > @emdash-cms/registry-client > @atcute/crypto",
@@ -566,6 +589,9 @@ export function createViteConfig(
 							// first rendered.
 							"emdash > @emdash-cms/admin > @lingui/react",
 							"emdash > @emdash-cms/admin > @cloudflare/kumo/primitives",
+							// System email copy resolution (invite, magic link) — reached
+							// only when one of those routes sends an email.
+							"emdash > @emdash-cms/admin > @lingui/core",
 							// React (commonly used, may be hoisted)
 							"react",
 							"react/jsx-dev-runtime",

package/src/astro/middleware/auth.ts

@@ -28,8 +28,12 @@ import { getPublicOrigin } from "../../api/public-url.js";
 const MW_CACHE_HEADERS = {
 	"Cache-Control": "private, no-store",
 } as const;
-import { resolveApiToken, resolveOAuthToken } from "../../api/handlers/api-tokens.js";
-import { hasScope } from "../../auth/api-tokens.js";
+import {
+	resolveApiToken,
+	resolveOAuthToken,
+	type ResolvedBearerToken,
+} from "../../api/handlers/api-tokens.js";
+import { hasScope, TRANSFER_SCOPES } from "../../auth/api-tokens.js";
 import { getAuthMode, type ExternalAuthMode } from "../../auth/mode.js";
 import type { ExternalAuthConfig } from "../../auth/types.js";
 import { getRegistryConfigInput } from "../../registry/config.js";
@@ -43,6 +47,8 @@ declare global {
 			user?: User;
 			/** Token scopes when authenticated via API token or OAuth token. Undefined for session auth. */
 			tokenScopes?: string[];
+			/** Id of the API or OAuth token the request authenticated with. Undefined for session auth. */
+			tokenId?: string;
 			emdash?: EmDashHandlers;
 		}
 		interface SessionData {
@@ -348,8 +354,11 @@ async function handleEmDashAuth(
 	const { url, locals } = context;
 	const { emdash } = locals;
 
+	// Pages an anonymous visitor must be able to reach: login itself, and the
+	// two token-bearing pages that emails link to.
 	const isPublicAdminRoute =
 		url.pathname.startsWith("/_emdash/admin/login") ||
+		url.pathname.startsWith("/_emdash/admin/signup") ||
 		url.pathname.startsWith("/_emdash/admin/invite/accept");
 	const isApiRoute = url.pathname.startsWith("/_emdash/api");
 
@@ -652,7 +661,7 @@ async function handleBearerAuth(
 	if (!emdash?.db) return "none";
 
 	// Resolve token based on prefix
-	let resolved: { userId: string; scopes: string[] } | null = null;
+	let resolved: ResolvedBearerToken | null = null;
 
 	if (token.startsWith("ec_pat_")) {
 		resolved = await resolveApiToken(emdash.db, token);
@@ -674,6 +683,7 @@ async function handleBearerAuth(
 	// Set user and scopes on locals
 	locals.user = user;
 	locals.tokenScopes = resolved.scopes;
+	locals.tokenId = resolved.tokenId;
 
 	return "authenticated";
 }
@@ -698,7 +708,9 @@ async function handlePasskeyAuth(
 				return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
 			}
 			const loginUrl = new URL("/_emdash/admin/login", getPublicOrigin(url, emdash?.config));
-			loginUrl.searchParams.set("redirect", url.pathname);
+			// Keep the query string: a token-bearing link that lands here must
+			// still carry its token after login.
+			loginUrl.searchParams.set("redirect", url.pathname + url.search);
 			return context.redirect(loginUrl.toString());
 		}
 
@@ -745,10 +757,11 @@ async function handlePasskeyAuth(
 /**
  * Scope rules: ordered list of (pathPrefix, method, requiredScope) tuples.
  * First matching rule wins. Methods: "*" = any, "WRITE" = POST/PUT/PATCH/DELETE.
+ * A list of scopes is satisfied by holding any one of them.
  *
  * Routes not matched by any rule default to "admin" scope (fail-closed).
  */
-const SCOPE_RULES: Array<[prefix: string, method: string, scope: string]> = [
+const SCOPE_RULES: Array<[prefix: string, method: string, scope: string | readonly string[]]> = [
 	// Content routes
 	["/_emdash/api/content", "GET", "content:read"],
 	["/_emdash/api/content", "WRITE", "content:write"],
@@ -768,6 +781,7 @@ const SCOPE_RULES: Array<[prefix: string, method: string, scope: string]> = [
 	// menus:manage are not rejected. content:write implicitly grants these via
 	// IMPLICIT_SCOPE_GRANTS in @emdash-cms/auth.
 	["/_emdash/api/taxonomies", "GET", "content:read"],
+	["/_emdash/api/taxonomies/bulk-tag", "WRITE", "content:write"],
 	["/_emdash/api/taxonomies", "WRITE", "taxonomies:manage"],
 	["/_emdash/api/menus", "GET", "content:read"],
 	["/_emdash/api/menus", "WRITE", "menus:manage"],
@@ -782,6 +796,10 @@ const SCOPE_RULES: Array<[prefix: string, method: string, scope: string]> = [
 	["/_emdash/api/search", "GET", "content:read"],
 	["/_emdash/api/search", "WRITE", "admin"],
 
+	// Site transfer — must precede the generic /admin rule so a token holding
+	// only a transfer scope reaches the route, which requires its specific one.
+	["/_emdash/api/admin/transfer", "*", TRANSFER_SCOPES],
+
 	// Import, admin, plugins — all require admin scope
 	["/_emdash/api/import", "*", "admin"],
 	["/_emdash/api/admin", "*", "admin"],
@@ -826,9 +844,14 @@ function enforceTokenScope(
 
 		// Check method match
 		if (ruleMethod === "*" || (ruleMethod === "WRITE" && isWrite) || ruleMethod === method) {
-			if (hasScope(tokenScopes, scope)) return null;
+			const anyOf = typeof scope === "string" ? [scope] : scope;
+			if (anyOf.some((required) => hasScope(tokenScopes, required))) return null;
 
-			return apiError("INSUFFICIENT_SCOPE", `Token lacks required scope: ${scope}`, 403);
+			return apiError(
+				"INSUFFICIENT_SCOPE",
+				`Token lacks required scope: ${anyOf.join(" or ")}`,
+				403,
+			);
 		}
 	}
 

package/src/astro/middleware/media-usage-write-fence.ts

@@ -1,30 +1,125 @@
 import { defineMiddleware } from "astro:middleware";
 
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
+import { apiError } from "#api/error.js";
 
-const FENCED_WRITE_PATHS = [
+import { readSiteWriteFence, recordSiteWrite } from "../../transfer/fence.js";
+
+const API_PREFIX = "/_emdash/api/";
+
+/** Write paths that media usage activation fences, in addition to transfer imports. */
+const MEDIA_USAGE_FENCED_PATHS = [
 	"/_emdash/api/content",
 	"/_emdash/api/schema",
 	"/_emdash/api/admin/media-usage/repair",
 	"/_emdash/api/revisions",
 	"/_emdash/api/import",
+] as const;
+
+/**
+ * API write paths a transfer import does not fence: the transfer API itself,
+ * sign-in and identity management, and dev-only tooling. The MCP endpoint
+ * fences each tool call itself (`mcp/server.ts`), since every MCP request is
+ * a POST whether the tool reads or writes.
+ */
+const TRANSFER_EXEMPT_PATHS = [
+	"/_emdash/api/admin/transfer",
 	"/_emdash/api/mcp",
+	"/_emdash/api/auth",
+	"/_emdash/api/oauth",
+	"/_emdash/api/well-known",
+	"/_emdash/api/admin/users",
+	"/_emdash/api/admin/api-tokens",
+	"/_emdash/api/admin/oauth-clients",
+	"/_emdash/api/admin/allowed-domains",
+	"/_emdash/api/setup/dev-bypass",
+	"/_emdash/api/setup/dev-reset",
+	"/_emdash/api/dev",
+	"/_emdash/api/typegen",
+] as const;
+
+/**
+ * Entry edit locks coordinate editors and hold no portable data, so neither a
+ * transfer import nor a running export cares about them.
+ */
+const ENTRY_LOCK_PATTERN = /^\/_emdash\/api\/content\/[^/]+\/[^/]+\/lock$/;
+
+/**
+ * Plugin lifecycle routes check the site write fence themselves, after
+ * authorization; fencing them here as well would query it twice. Their
+ * successful writes are still recorded for running exports.
+ */
+const ROUTE_CHECKED_PATTERNS = [
+	/^\/_emdash\/api\/admin\/plugins\/[^/]+\/(?:enable|disable|uninstall|update)$/,
+	/^\/_emdash\/api\/admin\/plugins\/marketplace\/[^/]+\/install$/,
+	/^\/_emdash\/api\/admin\/plugins\/registry\/[^/]+\/(?:uninstall|update)$/,
+	/^\/_emdash\/api\/admin\/plugins\/registry\/install$/,
 ] as const;
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const SLASH = 0x2f;
+
+function underPrefix(pathname: string, prefix: string): boolean {
+	return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+
+function normalizePathname(pathname: string): string {
+	let decoded = pathname;
+	try {
+		decoded = decodeURI(pathname);
+	} catch {
+		// Keep the raw pathname; the router cannot match it either.
+	}
+	return trimTrailingSlashes(decoded.toLowerCase());
+}
+
+function trimTrailingSlashes(path: string): string {
+	let end = path.length;
+	while (end > 0 && path.charCodeAt(end - 1) === SLASH) end--;
+	return path.slice(0, end);
+}
+
+export interface SiteWriteRequestScope {
+	transfer: boolean;
+	mediaUsage: boolean;
+	/** Whether a successful response is recorded as a write for running exports. */
+	recordWrite: boolean;
+}
+
+/** Which fences apply to a request, or null when it is not a site write. */
+export function siteWriteFenceScope(
+	method: string,
+	pathname: string,
+): SiteWriteRequestScope | null {
+	if (SAFE_METHODS.has(method.toUpperCase())) return null;
+	const path = normalizePathname(pathname);
+	if (!path.startsWith(API_PREFIX)) return null;
+	if (ROUTE_CHECKED_PATTERNS.some((pattern) => pattern.test(path))) {
+		return { transfer: false, mediaUsage: false, recordWrite: true };
+	}
+	const entryLock = ENTRY_LOCK_PATTERN.test(path);
+	const transfer = !entryLock && !TRANSFER_EXEMPT_PATHS.some((prefix) => underPrefix(path, prefix));
+	const mediaUsage = MEDIA_USAGE_FENCED_PATHS.some((prefix) => underPrefix(path, prefix));
+	if (!transfer && !mediaUsage) return null;
+	return { transfer, mediaUsage, recordWrite: !entryLock };
+}
 
 export const onRequest = defineMiddleware(async (context, next) => {
-	if (!isFencedWriteRequest(context.request.method, context.url.pathname)) return next();
+	const scope = siteWriteFenceScope(context.request.method, context.url.pathname);
+	if (!scope) return next();
 	const db = context.locals.emdash?.db;
 	if (!db) return next();
-	return (await checkMediaUsageActivationWriteFence(db)) ?? next();
+	if (!scope.transfer && !scope.mediaUsage) {
+		const response = await next();
+		if (response.ok) await recordSiteWrite(db);
+		return response;
+	}
+	const fence = await readSiteWriteFence(db, scope);
+	if (fence.error) return apiError(fence.error.code, fence.error.message, fence.error.status);
+	const response = await next();
+	// Recorded after the write so an export whose fence was captured while
+	// this request ran still sees it.
+	if (scope.recordWrite && fence.exportRunning && response.ok) await recordSiteWrite(db);
+	return response;
 });
 
-function isFencedWriteRequest(method: string, pathname: string): boolean {
-	if (SAFE_METHODS.has(method.toUpperCase())) return false;
-	return FENCED_WRITE_PATHS.some(
-		(prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
-	);
-}
-
 export default onRequest;

package/src/astro/middleware/request-context.ts

@@ -169,8 +169,22 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	if (playgroundDb) {
 		// Check if playground user has toggled edit mode on
 		const hasEditCookie = cookies.get("emdash-edit-mode")?.value === "true";
-		return runWithContext({ editMode: hasEditCookie, db: playgroundDb, dbIsIsolated: true }, () =>
-			next(),
+		return runWithContext(
+			{ editMode: hasEditCookie, db: playgroundDb, dbIsIsolated: true },
+			async () => {
+				const response = await next();
+				if (!hasEditCookie || toolbarMode === false) return response;
+				// The Playground shows its own bar, so the editor toolbar is hidden and
+				// only provides inline editing.
+				const labels = await loadVisualEditingToolbarLabels(context.request);
+				const toolbarHtml = renderToolbar({
+					editMode: true,
+					isPreview: false,
+					labels,
+					hidden: true,
+				});
+				return injectToolbar(response, toolbarHtml, context.cache);
+			},
 		);
 	}
 

package/src/astro/middleware.ts

@@ -489,6 +489,20 @@ function migrationRequiredResponse(): Response {
 	);
 }
 
+function unmigratedDatabaseResponse(): Response {
+	return new Response(
+		'<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="robots" content="noindex"><title>Site unavailable</title></head><body><p>This site\'s database has not been migrated yet. <a href="/_emdash/admin/setup">Set up EmDash</a></p></body></html>',
+		{
+			status: 503,
+			headers: {
+				"Content-Type": "text/html; charset=utf-8",
+				"Cache-Control": "no-store",
+				"Retry-After": "60",
+			},
+		},
+	);
+}
+
 function runtimeConfigurationErrorResponse(error: unknown, pathname: string): Response | null {
 	if (!pathname.startsWith("/_emdash/api/")) return null;
 	if (error instanceof EmDashConfigurationError) {
@@ -712,13 +726,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// bypasses runtime init and would crash with "no such table: options".
 				// Do a one-time lightweight probe using the same getDb() instance the
 				// page will use: if the migrations table doesn't exist, no migrations
-				// have ever run -- redirect to the setup wizard.
-				// Skip the probe when prerendering: a prerendered route is built to
-				// static HTML, so returning context.redirect("/_emdash/admin/setup")
-				// below would bake that redirect into the page and ship it to
-				// production. The build database is legitimately empty in CI and there
-				// is no live visitor to send to the wizard at build time (session reads
-				// are already skipped for prerender above for the same reason).
+				// have ever run, and the page may only render once runtime init below
+				// has migrated the database.
+				// Skip the probe when prerendering: the build database is legitimately
+				// empty in CI, and a response derived from it would be baked into the
+				// static page (session reads are already skipped for prerender above
+				// for the same reason).
+				let unmigrated = false;
+				let probeFailed = false;
 				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
@@ -727,17 +742,18 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						await db.selectFrom("_emdash_migrations").selectAll().limit(1).execute();
 						markSetupVerified();
 					} catch (error) {
-						// Only a genuinely-missing migrations table means a fresh,
-						// un-set-up database — redirect to the setup wizard.
 						if (isMissingTableError(error)) {
-							return context.redirect("/_emdash/admin/setup");
+							unmigrated = true;
+						} else {
+							// Any other failure (transient D1/replica error, timeout, cold-start
+							// race, locked SQLite) must NOT be read as "fresh install". Leave the
+							// flag unset so a later request can re-verify, and fall through to
+							// render the page normally. Unless a runtime is already running,
+							// skip runtime init for this request: it would connect to the same
+							// database again and make the visitor wait through a second timeout.
+							probeFailed = !getRuntimeHolder().instance;
+							console.error("Setup probe failed (non-fatal):", error);
 						}
-						// Any other failure (transient D1/replica error, timeout, cold-start
-						// race, locked SQLite) must NOT be read as "fresh install" — doing so
-						// bounces real visitors on a set-up site to /_emdash/admin/setup.
-						// Leave the flag unset so a later request can re-verify, and fall
-						// through to render the page normally.
-						console.error("Setup probe failed (non-fatal):", error);
 					}
 					timings.push({ name: "setup", dur: performance.now() - t0, desc: "Setup probe" });
 				}
@@ -745,8 +761,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// Initialize the runtime for page:metadata and page:fragments hooks.
 				// The runtime is a cached singleton — after the first request,
 				// getRuntime() is just a null-check. This enables SEO plugins to
-				// contribute meta tags for all visitors, not just logged-in editors.
-				if (config) {
+				// contribute meta tags for all visitors, not just logged-in editors,
+				// except on a request whose setup probe just failed.
+				if (config && !probeFailed) {
 					// Sub-phase timings are populated only on the cold init. Warm
 					// requests hit the cached runtime and leave this empty.
 					const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
@@ -792,6 +809,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					// rt.sandbox, rt.market, rt.hooks, rt.cron).
 					for (const sub of initSubTimings) timings.push(sub);
 				}
+				if (unmigrated && !locals.emdash) {
+					return finalizeResponse(unmigratedDatabaseResponse(), timings);
+				}
 
 				// Even on the anonymous fast path we ask the adapter for a per-request
 				// scoped db. For D1 with read replication this routes anonymous reads

package/src/astro/routes/admin.astro

@@ -13,6 +13,8 @@ import adminStylesUrl from "@emdash-cms/admin/styles.css?url";
 // (relative imports resolve to absolute paths which break client hydration)
 import AdminWrapper from "emdash/routes/PluginRegistry";
 import { Font } from "astro:assets";
+// @ts-ignore - virtual module
+import { componentDataByCssVariable } from "virtual:astro:assets/fonts/internal";
 
 export const prerender = false;
 
@@ -84,7 +86,7 @@ const faviconType = adminConfig?.favicon ? undefined : siteFaviconType;
 			})();
 		</script>
 		<link rel="stylesheet" href={adminStylesUrl} />
-		<Font cssVariable="--font-emdash" />
+		{componentDataByCssVariable.has("--font-emdash") ? <Font cssVariable="--font-emdash" /> : null}
 		{favicon ? (
 			<link rel="icon" href={favicon} type={faviconType} />
 		) : (

package/src/astro/routes/api/admin/hooks/exclusive/index.ts

@@ -11,7 +11,6 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
-import { OptionsRepository } from "#db/repositories/options.js";
 
 export const prerender = false;
 
@@ -28,19 +27,16 @@ export const GET: APIRoute = async ({ locals }) => {
 	try {
 		const pipeline = emdash.hooks;
 		const exclusiveHookNames = pipeline.getRegisteredExclusiveHooks();
-		const optionsRepo = new OptionsRepository(emdash.db);
 
 		const hooks = [];
 		for (const hookName of exclusiveHookNames) {
 			const providers = pipeline.getExclusiveHookProviders(hookName);
-			const selection = await optionsRepo.get<string>(`emdash:exclusive_hook:${hookName}`);
-
 			hooks.push({
 				hookName,
 				providers: providers.map((provider: { pluginId: string }) => ({
 					pluginId: provider.pluginId,
 				})),
-				selectedPluginId: selection,
+				selectedPluginId: pipeline.getExclusiveSelection(hookName) ?? null,
 			});
 		}
 

package/src/astro/routes/api/admin/plugins/[id]/disable.ts

@@ -8,9 +8,10 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { disableRuntimePlugin } from "#plugins/lifecycle.js";
 
+import { checkSiteWriteFence } from "../../../../../../transfer/fence.js";
+
 export const prerender = false;
 
 export const POST: APIRoute = async ({ params, locals }) => {
@@ -24,8 +25,8 @@ export const POST: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
-	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
-	if (activationFence) return activationFence;
+	const writeFence = await checkSiteWriteFence(emdash.db);
+	if (writeFence) return writeFence;
 
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -8,9 +8,10 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { enableRuntimePlugin } from "#plugins/lifecycle.js";
 
+import { checkSiteWriteFence } from "../../../../../../transfer/fence.js";
+
 export const prerender = false;
 
 export const POST: APIRoute = async ({ params, locals }) => {
@@ -24,8 +25,8 @@ export const POST: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
-	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
-	if (activationFence) return activationFence;
+	const writeFence = await checkSiteWriteFence(emdash.db);
+	if (writeFence) return writeFence;
 
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);

package/src/astro/routes/api/admin/plugins/[id]/uninstall.ts

@@ -10,9 +10,10 @@ import { z } from "zod";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
 import { handleMarketplaceUninstall } from "#api/index.js";
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 
+import { checkSiteWriteFence } from "../../../../../../transfer/fence.js";
+
 export const prerender = false;
 
 const uninstallBodySchema = z.object({
@@ -30,8 +31,8 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
-	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
-	if (activationFence) return activationFence;
+	const writeFence = await checkSiteWriteFence(emdash.db);
+	if (writeFence) return writeFence;
 
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);

package/src/astro/routes/api/admin/plugins/[id]/update.ts

@@ -10,12 +10,13 @@ import { z } from "zod";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
 import { handleMarketplaceUpdate, rollbackPluginUpdate } from "#api/index.js";
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { finalizePluginUpdate } from "#plugins/install-finalization.js";
 import { pluginPublicRouteAcknowledgementSchema } from "#plugins/routes.js";
 import { PluginStateRepository } from "#plugins/state.js";
 
+import { checkSiteWriteFence } from "../../../../../../transfer/fence.js";
+
 export const prerender = false;
 
 const updateBodySchema = z.object({
@@ -36,8 +37,8 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
-	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
-	if (activationFence) return activationFence;
+	const writeFence = await checkSiteWriteFence(emdash.db);
+	if (writeFence) return writeFence;
 
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);

package/src/astro/routes/api/admin/plugins/marketplace/[id]/install.ts

@@ -10,11 +10,12 @@ import { z } from "zod";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
 import { handleMarketplaceInstall, handleMarketplaceUninstall } from "#api/index.js";
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { finalizePluginInstall } from "#plugins/install-finalization.js";
 import { pluginPublicRouteAcknowledgementSchema } from "#plugins/routes.js";
 
+import { checkSiteWriteFence } from "../../../../../../../transfer/fence.js";
+
 export const prerender = false;
 
 const installBodySchema = z.object({
@@ -35,8 +36,8 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		const denied = requirePerm(user, "plugins:manage");
 		if (denied) return denied;
 
-		const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
-		if (activationFence) return activationFence;
+		const writeFence = await checkSiteWriteFence(emdash.db);
+		if (writeFence) return writeFence;
 
 		if (!id) {
 			return apiError("INVALID_REQUEST", "Plugin ID required", 400);

package/src/astro/routes/api/admin/plugins/registry/[id]/uninstall.ts

@@ -13,9 +13,10 @@ import { z } from "zod";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
 import { handleRegistryUninstall } from "#api/index.js";
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 
+import { checkSiteWriteFence } from "../../../../../../../transfer/fence.js";
+
 export const prerender = false;
 
 const uninstallBodySchema = z.object({
@@ -33,8 +34,8 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "plugins:manage");
 	if (denied) return denied;
 
-	const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
-	if (activationFence) return activationFence;
+	const writeFence = await checkSiteWriteFence(emdash.db);
+	if (writeFence) return writeFence;
 
 	if (!id) {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);

package/src/astro/routes/api/admin/plugins/registry/[id]/update.ts

@@ -16,13 +16,13 @@ import { z } from "zod";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
 import { handleRegistryUpdate, rollbackPluginUpdate } from "#api/index.js";
-import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { finalizePluginUpdate } from "#plugins/install-finalization.js";
 import { pluginPublicRouteAcknowledgementSchema } from "#plugins/routes.js";
 import { PluginStateRepository } from "#plugins/state.js";
 
 import { getRegistryConfigInput } from "../../../../../../../registry/config.js";
+import { checkSiteWriteFence } from "../../../../../../../transfer/fence.js";
 import { VERSION } from "../../../../../../../version.js";
 
 export const prerender = false;
@@ -55,8 +55,8 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		const denied = requirePerm(user, "plugins:manage");
 		if (denied) return denied;
 
-		const activationFence = await checkMediaUsageActivationWriteFence(emdash.db);
-		if (activationFence) return activationFence;
+		const writeFence = await checkSiteWriteFence(emdash.db);
+		if (writeFence) return writeFence;
 
 		if (!id) {
 			return apiError("INVALID_REQUEST", "Plugin ID required", 400);