emdash 0.40.1 → 0.42.0

package/dist/astro/middleware/auth.d.mts

@@ -1,15 +1,15 @@
-import "../../parse-CVgO-Qai.mjs";
-import "../../types-B7Lmsh1E.mjs";
-import "../../types-Cr-Kg-3D.mjs";
-import "../../options-SQCHQCPH.mjs";
-import "../../entry-lock-Cf5OoIgN.mjs";
-import "../../config-BjEm_3xL.mjs";
-import "../../runner-D5_LzKXI.mjs";
-import "../../storage-query-FXJH5pI8.mjs";
-import "../../index-D-hdtLe8.mjs";
-import "../../types-Cd-O03VG.mjs";
-import "../../hreflang-D5uNnsGJ.mjs";
-import "../../validate-CM79QXYE.mjs";
+import "../../parse-D5Sw9wAI.mjs";
+import "../../types-DZeDpzMc.mjs";
+import "../../types-pOLeFKGq.mjs";
+import "../../options-C2IDQnD2.mjs";
+import "../../entry-lock-B-1bUDxX.mjs";
+import "../../config-DHsDMpXc.mjs";
+import "../../runner-Ji7qyH2A.mjs";
+import "../../storage-query-C9bK0Dg6.mjs";
+import "../../index-D1_ykO2u.mjs";
+import "../../types-DuQAIPA-.mjs";
+import "../../hreflang-C7ETs0Tv.mjs";
+import "../../validate-dK97qe7F.mjs";
 import { EmDashHandlers } from "../types.mjs";
 import { User } from "@emdash-cms/auth";
 import * as astro from "astro";

package/dist/astro/middleware/auth.mjs

@@ -1,15 +1,15 @@
 import "../../after-PcEvMY_6.mjs";
 import "../../base64-DvnNgP7e.mjs";
-import "../../types-BkUg2yHx.mjs";
-import "../../errors-DgE1zJGG.mjs";
-import "../../errors-BF0_LFhW.mjs";
-import { r as getRegistryConfigInput } from "../../config-IhybvkIQ.mjs";
-import { t as apiError } from "../../error-CfvOHP0M.mjs";
-import { r as getPublicOrigin } from "../../public-url-Bn7U0D7-.mjs";
-import { t as getAuthMode } from "../../mode-CCuKXUci.mjs";
-import { t as resolveSessionUser } from "../../session-user-BhaVp8w0.mjs";
-import { a as hasScope, n as TRANSFER_SCOPES } from "../../api-tokens-CE1ECIg0.mjs";
-import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-s4i4aUp_.mjs";
+import "../../types-j6MBDjlZ.mjs";
+import "../../errors-CjXd1LgH.mjs";
+import { r as getRegistryConfigInput } from "../../config-BnuORwSP.mjs";
+import "../../errors-CNvATh_7.mjs";
+import { t as apiError } from "../../error-CEdm_AWU.mjs";
+import { r as getPublicOrigin } from "../../public-url-B5a0QAh6.mjs";
+import { t as getAuthMode } from "../../mode-nh0ppSX5.mjs";
+import { n as resolveSessionUser } from "../../session-user-DVcHsFD5.mjs";
+import { a as hasScope, n as TRANSFER_SCOPES } from "../../api-tokens-BLz2MtQs.mjs";
+import { a as resolveApiToken, o as resolveOAuthToken } from "../../api-tokens-P3mAaQgr.mjs";
 import { ulid } from "ulidx";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";

package/dist/astro/middleware/media-usage-write-fence.mjs

@@ -1,10 +1,10 @@
 import "../../dialect-helpers-7_IqPdh9.mjs";
 import "../../base64-DvnNgP7e.mjs";
-import "../../types-BkUg2yHx.mjs";
-import "../../errors-DgE1zJGG.mjs";
-import "../../errors-BF0_LFhW.mjs";
-import { t as apiError } from "../../error-CfvOHP0M.mjs";
-import { a as readSiteWriteFence, o as recordSiteWrite } from "../../fence-CMDXJYc_.mjs";
+import "../../types-j6MBDjlZ.mjs";
+import "../../errors-CjXd1LgH.mjs";
+import "../../errors-CNvATh_7.mjs";
+import { t as apiError } from "../../error-CEdm_AWU.mjs";
+import { a as readSiteWriteFence, o as recordSiteWrite } from "../../fence-BrnQffdY.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/media-usage-write-fence.ts

package/dist/astro/middleware/redirect.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.mts","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"mappings":";;;;;;AAmCA;;;;;;;;;;;;cAAa,SAAA,EAmGX,KAAA,CAnGoB,iBAAA"}
+{"version":3,"file":"redirect.d.mts","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"mappings":";;;;;;AA0CA;;;;;;;;;;;;cAAa,SAAA,EAyGX,KAAA,CAzGoB,iBAAA"}

package/dist/astro/middleware/redirect.mjs

@@ -2,13 +2,14 @@ import "../../dialect-helpers-7_IqPdh9.mjs";
 import "../../config-CvmjJcVw.mjs";
 import "../../after-PcEvMY_6.mjs";
 import "../../base64-DvnNgP7e.mjs";
-import "../../types-BkUg2yHx.mjs";
-import "../../resolve-2WbQsCvT.mjs";
-import { t as RedirectRepository } from "../../redirect-B29UjdUn.mjs";
-import "../../request-cache-DzLYKm_x.mjs";
-import { i as matchCachedPatterns, r as loadCachedRedirects } from "../../cache-m7UEkRFV.mjs";
-import { s as getDb } from "../../loader-BzqeR1ZN.mjs";
-import { n as isTerminalStatus } from "../../status-DZKIG4a9.mjs";
+import "../../request-cache-C4CIo5ad.mjs";
+import "../../types-j6MBDjlZ.mjs";
+import "../../resolve-D-kqyKns.mjs";
+import { t as isSiteRelativeDestination } from "../../destination-r2zIAZ2S.mjs";
+import { t as RedirectRepository } from "../../redirect-BvFKh8Sz.mjs";
+import { i as matchCachedPatterns, r as loadCachedRedirects } from "../../cache-CPanL9IO.mjs";
+import { s as getDb } from "../../loader-B_bcoE1h.mjs";
+import { n as isTerminalStatus } from "../../status-D39Fpy8R.mjs";
 import { defineMiddleware } from "astro:middleware";
 
 //#region src/astro/middleware/redirect.ts
@@ -34,6 +35,9 @@ const ASSET_EXTENSION = /\.\w{1,10}$/;
 function isRedirectCode(code) {
 	return code === 301 || code === 302 || code === 303 || code === 307 || code === 308;
 }
+function warnUnsafeDestination(id) {
+	console.warn(`[emdash:redirects] Skipping redirect ${id}: destination is not a site-relative path`);
+}
 const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 	if (SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix))) return next();
@@ -58,7 +62,10 @@ const onRequest = defineMiddleware(async (context, next) => {
 				return new Response(null, { status: exact.type });
 			}
 			const dest = exact.destination;
-			if (dest.startsWith("//") || dest.startsWith("/\\")) return next();
+			if (!isSiteRelativeDestination(dest)) {
+				warnUnsafeDestination(exact.id);
+				return next();
+			}
 			repo.recordHit(exact.id).catch(() => {});
 			const code = isRedirectCode(exact.type) ? exact.type : 301;
 			return context.redirect(dest, code);
@@ -70,7 +77,10 @@ const onRequest = defineMiddleware(async (context, next) => {
 				repo.recordHit(redirect.id).catch(() => {});
 				return new Response(null, { status: redirect.type });
 			}
-			if (destination.startsWith("//") || destination.startsWith("/\\")) return next();
+			if (!isSiteRelativeDestination(destination)) {
+				warnUnsafeDestination(redirect.id);
+				return next();
+			}
 			repo.recordHit(redirect.id).catch(() => {});
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
 			return context.redirect(destination, code);

package/dist/astro/middleware/redirect.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.mjs","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"sourcesContent":["/**\n * Redirect middleware\n *\n * Intercepts incoming requests and checks for matching redirect rules.\n * Runs after runtime init (needs db) but before setup/auth (should handle\n * ALL routes, including public ones, and should be fast).\n *\n * Skip paths:\n * - /_emdash/* (admin UI, API routes, auth endpoints)\n * - /_image (Astro image optimization)\n * - Static assets (files with extensions)\n *\n * 404 logging happens post-response: if next() returns 404 and the path\n * wasn't already matched by a redirect, log it.\n */\n\nimport { defineMiddleware } from \"astro:middleware\";\n\nimport { RedirectRepository } from \"../../database/repositories/redirect.js\";\nimport { getDb } from \"../../loader.js\";\nimport { loadCachedRedirects, matchCachedPatterns } from \"../../redirects/cache.js\";\nimport { isTerminalStatus } from \"../../redirects/status.js\";\n\n/** Paths that should never be intercepted by redirects */\nconst SKIP_PREFIXES = [\"/_emdash\", \"/_image\"];\n\n/** Static asset extensions -- don't redirect file requests */\nconst ASSET_EXTENSION = /\\.\\w{1,10}$/;\n\ntype RedirectCode = 301 | 302 | 303 | 307 | 308;\n\nfunction isRedirectCode(code: number): code is RedirectCode {\n\treturn code === 301 || code === 302 || code === 303 || code === 307 || code === 308;\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { pathname } = context.url;\n\n\t// Skip internal paths and static assets\n\tif (SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {\n\t\treturn next();\n\t}\n\tif (ASSET_EXTENSION.test(pathname)) {\n\t\treturn next();\n\t}\n\n\t// Public visitors hit the runtime's anonymous fast path, which intentionally\n\t// omits `db` from `locals.emdash` to keep the public render boundary minimal\n\t// (issue #808). Fall back to `getDb()`, which transparently returns the\n\t// per-request scoped db (set in ALS by the runtime middleware) or the\n\t// singleton — same path the loader and template helpers use.\n\tlet db = context.locals.emdash?.db;\n\tif (!db) {\n\t\ttry {\n\t\t\tdb = await getDb();\n\t\t} catch {\n\t\t\treturn next();\n\t\t}\n\t}\n\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\n\t\t// One query loads both exact and pattern rules into the cache; warm\n\t\t// requests issue zero queries. Empty-redirect sites cache an empty\n\t\t// Map + array, so the next request returns immediately without probing.\n\t\tconst cached = await loadCachedRedirects(() => repo.findAllEnabled());\n\n\t\t// 1. Exact match (O(1) Map lookup)\n\t\tlet exact = cached.exact.get(pathname);\n\t\tif (!exact && pathname.length > 1) {\n\t\t\tconst alt = pathname.endsWith(\"/\") ? pathname.slice(0, -1) : `${pathname}/`;\n\t\t\texact = cached.exact.get(alt);\n\t\t}\n\t\tif (exact) {\n\t\t\t// Terminal statuses (410 Gone / 451): serve the status directly,\n\t\t\t// with no Location header.\n\t\t\tif (isTerminalStatus(exact.type)) {\n\t\t\t\trepo.recordHit(exact.id).catch(() => {});\n\t\t\t\treturn new Response(null, { status: exact.type });\n\t\t\t}\n\t\t\tconst dest = exact.destination;\n\t\t\tif (dest.startsWith(\"//\") || dest.startsWith(\"/\\\\\")) return next();\n\t\t\trepo.recordHit(exact.id).catch(() => {});\n\t\t\tconst code = isRedirectCode(exact.type) ? exact.type : 301;\n\t\t\treturn context.redirect(dest, code);\n\t\t}\n\n\t\t// 2. Pattern match (compile once, match every request)\n\t\tconst patternMatch = matchCachedPatterns(cached.patterns, pathname);\n\t\tif (patternMatch) {\n\t\t\tconst { redirect, destination } = patternMatch;\n\t\t\t// Terminal statuses (410 Gone / 451): serve the status directly.\n\t\t\tif (isTerminalStatus(redirect.type)) {\n\t\t\t\trepo.recordHit(redirect.id).catch(() => {});\n\t\t\t\treturn new Response(null, { status: redirect.type });\n\t\t\t}\n\t\t\tif (destination.startsWith(\"//\") || destination.startsWith(\"/\\\\\")) return next();\n\t\t\trepo.recordHit(redirect.id).catch(() => {});\n\t\t\tconst code = isRedirectCode(redirect.type) ? redirect.type : 301;\n\t\t\treturn context.redirect(destination, code);\n\t\t}\n\n\t\t// No redirect matched -- proceed and check for 404\n\t\tconst response = await next();\n\n\t\t// Log misses (fire-and-forget) under the path the visitor requested.\n\t\t// Two shapes count as a miss: an unmatched route rendering the error\n\t\t// page with status 404, and a matched route answering a content miss\n\t\t// with a redirect to /404 (the documented template pattern) — there the\n\t\t// missed path exists only on this first pass, before the browser\n\t\t// follows the redirect. The error page itself is never logged: /404\n\t\t// answers 404 by design and carries no path information.\n\t\tconst location = response.headers.get(\"location\");\n\t\tconst missedByRedirect =\n\t\t\tisRedirectCode(response.status) && (location === \"/404\" || location === \"/404/\");\n\t\tconst missedDirectly = response.status === 404 && pathname !== \"/404\" && pathname !== \"/404/\";\n\t\tif (missedDirectly || missedByRedirect) {\n\t\t\tconst referrer = context.request.headers.get(\"referer\") ?? null;\n\t\t\tconst userAgent = context.request.headers.get(\"user-agent\") ?? null;\n\t\t\trepo\n\t\t\t\t.log404({\n\t\t\t\t\tpath: pathname,\n\t\t\t\t\treferrer,\n\t\t\t\t\tuserAgent,\n\t\t\t\t})\n\t\t\t\t.catch(() => {});\n\t\t}\n\n\t\treturn response;\n\t} catch {\n\t\t// If the redirects table doesn't exist yet (pre-migration), skip silently\n\t\treturn next();\n\t}\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,gBAAgB,CAAC,YAAY,UAAU;;AAG7C,MAAM,kBAAkB;AAIxB,SAAS,eAAe,MAAoC;AAC3D,QAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;;AAGjF,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,aAAa,QAAQ;AAG7B,KAAI,cAAc,MAAM,WAAW,SAAS,WAAW,OAAO,CAAC,CAC9D,QAAO,MAAM;AAEd,KAAI,gBAAgB,KAAK,SAAS,CACjC,QAAO,MAAM;CAQd,IAAI,KAAK,QAAQ,OAAO,QAAQ;AAChC,KAAI,CAAC,GACJ,KAAI;AACH,OAAK,MAAM,OAAO;SACX;AACP,SAAO,MAAM;;AAIf,KAAI;EACH,MAAM,OAAO,IAAI,mBAAmB,GAAG;EAKvC,MAAM,SAAS,MAAM,0BAA0B,KAAK,gBAAgB,CAAC;EAGrE,IAAI,QAAQ,OAAO,MAAM,IAAI,SAAS;AACtC,MAAI,CAAC,SAAS,SAAS,SAAS,GAAG;GAClC,MAAM,MAAM,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS;AACzE,WAAQ,OAAO,MAAM,IAAI,IAAI;;AAE9B,MAAI,OAAO;AAGV,OAAI,iBAAiB,MAAM,KAAK,EAAE;AACjC,SAAK,UAAU,MAAM,GAAG,CAAC,YAAY,GAAG;AACxC,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,MAAM,CAAC;;GAElD,MAAM,OAAO,MAAM;AACnB,OAAI,KAAK,WAAW,KAAK,IAAI,KAAK,WAAW,MAAM,CAAE,QAAO,MAAM;AAClE,QAAK,UAAU,MAAM,GAAG,CAAC,YAAY,GAAG;GACxC,MAAM,OAAO,eAAe,MAAM,KAAK,GAAG,MAAM,OAAO;AACvD,UAAO,QAAQ,SAAS,MAAM,KAAK;;EAIpC,MAAM,eAAe,oBAAoB,OAAO,UAAU,SAAS;AACnE,MAAI,cAAc;GACjB,MAAM,EAAE,UAAU,gBAAgB;AAElC,OAAI,iBAAiB,SAAS,KAAK,EAAE;AACpC,SAAK,UAAU,SAAS,GAAG,CAAC,YAAY,GAAG;AAC3C,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,SAAS,MAAM,CAAC;;AAErD,OAAI,YAAY,WAAW,KAAK,IAAI,YAAY,WAAW,MAAM,CAAE,QAAO,MAAM;AAChF,QAAK,UAAU,SAAS,GAAG,CAAC,YAAY,GAAG;GAC3C,MAAM,OAAO,eAAe,SAAS,KAAK,GAAG,SAAS,OAAO;AAC7D,UAAO,QAAQ,SAAS,aAAa,KAAK;;EAI3C,MAAM,WAAW,MAAM,MAAM;EAS7B,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;EACjD,MAAM,mBACL,eAAe,SAAS,OAAO,KAAK,aAAa,UAAU,aAAa;AAEzE,MADuB,SAAS,WAAW,OAAO,aAAa,UAAU,aAAa,WAChE,kBAAkB;GACvC,MAAM,WAAW,QAAQ,QAAQ,QAAQ,IAAI,UAAU,IAAI;GAC3D,MAAM,YAAY,QAAQ,QAAQ,QAAQ,IAAI,aAAa,IAAI;AAC/D,QACE,OAAO;IACP,MAAM;IACN;IACA;IACA,CAAC,CACD,YAAY,GAAG;;AAGlB,SAAO;SACA;AAEP,SAAO,MAAM;;EAEb"}
+{"version":3,"file":"redirect.mjs","names":[],"sources":["../../../src/astro/middleware/redirect.ts"],"sourcesContent":["/**\n * Redirect middleware\n *\n * Intercepts incoming requests and checks for matching redirect rules.\n * Runs after runtime init (needs db) but before setup/auth (should handle\n * ALL routes, including public ones, and should be fast).\n *\n * Skip paths:\n * - /_emdash/* (admin UI, API routes, auth endpoints)\n * - /_image (Astro image optimization)\n * - Static assets (files with extensions)\n *\n * 404 logging happens post-response: if next() returns 404 and the path\n * wasn't already matched by a redirect, log it.\n */\n\nimport { defineMiddleware } from \"astro:middleware\";\n\nimport { RedirectRepository } from \"../../database/repositories/redirect.js\";\nimport { getDb } from \"../../loader.js\";\nimport { loadCachedRedirects, matchCachedPatterns } from \"../../redirects/cache.js\";\nimport { isSiteRelativeDestination } from \"../../redirects/destination.js\";\nimport { isTerminalStatus } from \"../../redirects/status.js\";\n\n/** Paths that should never be intercepted by redirects */\nconst SKIP_PREFIXES = [\"/_emdash\", \"/_image\"];\n\n/** Static asset extensions -- don't redirect file requests */\nconst ASSET_EXTENSION = /\\.\\w{1,10}$/;\n\ntype RedirectCode = 301 | 302 | 303 | 307 | 308;\n\nfunction isRedirectCode(code: number): code is RedirectCode {\n\treturn code === 301 || code === 302 || code === 303 || code === 307 || code === 308;\n}\n\nfunction warnUnsafeDestination(id: string): void {\n\tconsole.warn(\n\t\t`[emdash:redirects] Skipping redirect ${id}: destination is not a site-relative path`,\n\t);\n}\n\nexport const onRequest = defineMiddleware(async (context, next) => {\n\tconst { pathname } = context.url;\n\n\t// Skip internal paths and static assets\n\tif (SKIP_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {\n\t\treturn next();\n\t}\n\tif (ASSET_EXTENSION.test(pathname)) {\n\t\treturn next();\n\t}\n\n\t// Public visitors hit the runtime's anonymous fast path, which intentionally\n\t// omits `db` from `locals.emdash` to keep the public render boundary minimal\n\t// (issue #808). Fall back to `getDb()`, which transparently returns the\n\t// per-request scoped db (set in ALS by the runtime middleware) or the\n\t// singleton — same path the loader and template helpers use.\n\tlet db = context.locals.emdash?.db;\n\tif (!db) {\n\t\ttry {\n\t\t\tdb = await getDb();\n\t\t} catch {\n\t\t\treturn next();\n\t\t}\n\t}\n\n\ttry {\n\t\tconst repo = new RedirectRepository(db);\n\n\t\t// One query loads both exact and pattern rules into the cache; warm\n\t\t// requests issue zero queries. Empty-redirect sites cache an empty\n\t\t// Map + array, so the next request returns immediately without probing.\n\t\tconst cached = await loadCachedRedirects(() => repo.findAllEnabled());\n\n\t\t// 1. Exact match (O(1) Map lookup)\n\t\tlet exact = cached.exact.get(pathname);\n\t\tif (!exact && pathname.length > 1) {\n\t\t\tconst alt = pathname.endsWith(\"/\") ? pathname.slice(0, -1) : `${pathname}/`;\n\t\t\texact = cached.exact.get(alt);\n\t\t}\n\t\tif (exact) {\n\t\t\t// Terminal statuses (410 Gone / 451): serve the status directly,\n\t\t\t// with no Location header.\n\t\t\tif (isTerminalStatus(exact.type)) {\n\t\t\t\trepo.recordHit(exact.id).catch(() => {});\n\t\t\t\treturn new Response(null, { status: exact.type });\n\t\t\t}\n\t\t\tconst dest = exact.destination;\n\t\t\tif (!isSiteRelativeDestination(dest)) {\n\t\t\t\twarnUnsafeDestination(exact.id);\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\trepo.recordHit(exact.id).catch(() => {});\n\t\t\tconst code = isRedirectCode(exact.type) ? exact.type : 301;\n\t\t\treturn context.redirect(dest, code);\n\t\t}\n\n\t\t// 2. Pattern match (compile once, match every request)\n\t\tconst patternMatch = matchCachedPatterns(cached.patterns, pathname);\n\t\tif (patternMatch) {\n\t\t\tconst { redirect, destination } = patternMatch;\n\t\t\t// Terminal statuses (410 Gone / 451): serve the status directly.\n\t\t\tif (isTerminalStatus(redirect.type)) {\n\t\t\t\trepo.recordHit(redirect.id).catch(() => {});\n\t\t\t\treturn new Response(null, { status: redirect.type });\n\t\t\t}\n\t\t\tif (!isSiteRelativeDestination(destination)) {\n\t\t\t\twarnUnsafeDestination(redirect.id);\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\trepo.recordHit(redirect.id).catch(() => {});\n\t\t\tconst code = isRedirectCode(redirect.type) ? redirect.type : 301;\n\t\t\treturn context.redirect(destination, code);\n\t\t}\n\n\t\t// No redirect matched -- proceed and check for 404\n\t\tconst response = await next();\n\n\t\t// Log misses (fire-and-forget) under the path the visitor requested.\n\t\t// Two shapes count as a miss: an unmatched route rendering the error\n\t\t// page with status 404, and a matched route answering a content miss\n\t\t// with a redirect to /404 (the documented template pattern) — there the\n\t\t// missed path exists only on this first pass, before the browser\n\t\t// follows the redirect. The error page itself is never logged: /404\n\t\t// answers 404 by design and carries no path information.\n\t\tconst location = response.headers.get(\"location\");\n\t\tconst missedByRedirect =\n\t\t\tisRedirectCode(response.status) && (location === \"/404\" || location === \"/404/\");\n\t\tconst missedDirectly = response.status === 404 && pathname !== \"/404\" && pathname !== \"/404/\";\n\t\tif (missedDirectly || missedByRedirect) {\n\t\t\tconst referrer = context.request.headers.get(\"referer\") ?? null;\n\t\t\tconst userAgent = context.request.headers.get(\"user-agent\") ?? null;\n\t\t\trepo\n\t\t\t\t.log404({\n\t\t\t\t\tpath: pathname,\n\t\t\t\t\treferrer,\n\t\t\t\t\tuserAgent,\n\t\t\t\t})\n\t\t\t\t.catch(() => {});\n\t\t}\n\n\t\treturn response;\n\t} catch {\n\t\t// If the redirects table doesn't exist yet (pre-migration), skip silently\n\t\treturn next();\n\t}\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,gBAAgB,CAAC,YAAY,UAAU;;AAG7C,MAAM,kBAAkB;AAIxB,SAAS,eAAe,MAAoC;AAC3D,QAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS;;AAGjF,SAAS,sBAAsB,IAAkB;AAChD,SAAQ,KACP,wCAAwC,GAAG,2CAC3C;;AAGF,MAAa,YAAY,iBAAiB,OAAO,SAAS,SAAS;CAClE,MAAM,EAAE,aAAa,QAAQ;AAG7B,KAAI,cAAc,MAAM,WAAW,SAAS,WAAW,OAAO,CAAC,CAC9D,QAAO,MAAM;AAEd,KAAI,gBAAgB,KAAK,SAAS,CACjC,QAAO,MAAM;CAQd,IAAI,KAAK,QAAQ,OAAO,QAAQ;AAChC,KAAI,CAAC,GACJ,KAAI;AACH,OAAK,MAAM,OAAO;SACX;AACP,SAAO,MAAM;;AAIf,KAAI;EACH,MAAM,OAAO,IAAI,mBAAmB,GAAG;EAKvC,MAAM,SAAS,MAAM,0BAA0B,KAAK,gBAAgB,CAAC;EAGrE,IAAI,QAAQ,OAAO,MAAM,IAAI,SAAS;AACtC,MAAI,CAAC,SAAS,SAAS,SAAS,GAAG;GAClC,MAAM,MAAM,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS;AACzE,WAAQ,OAAO,MAAM,IAAI,IAAI;;AAE9B,MAAI,OAAO;AAGV,OAAI,iBAAiB,MAAM,KAAK,EAAE;AACjC,SAAK,UAAU,MAAM,GAAG,CAAC,YAAY,GAAG;AACxC,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,MAAM,MAAM,CAAC;;GAElD,MAAM,OAAO,MAAM;AACnB,OAAI,CAAC,0BAA0B,KAAK,EAAE;AACrC,0BAAsB,MAAM,GAAG;AAC/B,WAAO,MAAM;;AAEd,QAAK,UAAU,MAAM,GAAG,CAAC,YAAY,GAAG;GACxC,MAAM,OAAO,eAAe,MAAM,KAAK,GAAG,MAAM,OAAO;AACvD,UAAO,QAAQ,SAAS,MAAM,KAAK;;EAIpC,MAAM,eAAe,oBAAoB,OAAO,UAAU,SAAS;AACnE,MAAI,cAAc;GACjB,MAAM,EAAE,UAAU,gBAAgB;AAElC,OAAI,iBAAiB,SAAS,KAAK,EAAE;AACpC,SAAK,UAAU,SAAS,GAAG,CAAC,YAAY,GAAG;AAC3C,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,SAAS,MAAM,CAAC;;AAErD,OAAI,CAAC,0BAA0B,YAAY,EAAE;AAC5C,0BAAsB,SAAS,GAAG;AAClC,WAAO,MAAM;;AAEd,QAAK,UAAU,SAAS,GAAG,CAAC,YAAY,GAAG;GAC3C,MAAM,OAAO,eAAe,SAAS,KAAK,GAAG,SAAS,OAAO;AAC7D,UAAO,QAAQ,SAAS,aAAa,KAAK;;EAI3C,MAAM,WAAW,MAAM,MAAM;EAS7B,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;EACjD,MAAM,mBACL,eAAe,SAAS,OAAO,KAAK,aAAa,UAAU,aAAa;AAEzE,MADuB,SAAS,WAAW,OAAO,aAAa,UAAU,aAAa,WAChE,kBAAkB;GACvC,MAAM,WAAW,QAAQ,QAAQ,QAAQ,IAAI,UAAU,IAAI;GAC3D,MAAM,YAAY,QAAQ,QAAQ,QAAQ,IAAI,aAAa,IAAI;AAC/D,QACE,OAAO;IACP,MAAM;IACN;IACA;IACA,CAAC,CACD,YAAY,GAAG;;AAGlB,SAAO;SACA;AAEP,SAAO,MAAM;;EAEb"}

package/dist/astro/middleware/request-context.d.mts

@@ -5,7 +5,8 @@ import * as astro from "astro";
  * EmDash Request Context Middleware
  *
  * Sets up AsyncLocalStorage-based request context for query functions.
- * Skips ALS entirely for logged-out users with no CMS signals (fast path).
+ * Skips ALS for logged-out users with no CMS signals unless a configured
+ * object cache must be fenced off during a route-cache render.
  *
  * Handles:
  * - Preview tokens: _preview query param with signed HMAC token

package/dist/astro/middleware/request-context.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../src/astro/middleware/request-context.ts"],"mappings":";;;;;;AAmJA;;;;;;;;;;;cAAa,SAAA,EAoLX,KAAA,CApLoB,iBAAA"}
+{"version":3,"file":"request-context.d.mts","names":[],"sources":["../../../src/astro/middleware/request-context.ts"],"mappings":";;;;;;AAoJA;;;;;;;;;;;;cAAa,SAAA,EA0LX,KAAA,CA1LoB,iBAAA"}

package/dist/astro/middleware/request-context.mjs

@@ -3,9 +3,9 @@ import { getRequestContext, runWithContext } from "../../request-context.mjs";
 import "../../options-DhrI7eMv.mjs";
 import "../../base64-DvnNgP7e.mjs";
 import { a as resolveSecretsCached } from "../../secrets-CIi0nFiR.mjs";
-import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-u78jETkX.mjs";
-import { t as escapeHtml } from "../../escape-CuaZhZvL.mjs";
-import { n as generateVisualEditingActionToken, t as VISUAL_ACTION_TOKEN_INVALID } from "../../action-token-DYwe4Pk0.mjs";
+import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-BIGxi8sP.mjs";
+import { t as escapeHtml } from "../../escape-nJW7dR0s.mjs";
+import { n as generateVisualEditingActionToken, t as VISUAL_ACTION_TOKEN_INVALID } from "../../action-token-DBki7IT4.mjs";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";
 import { loadVisualEditingToolbarLabels } from "@emdash-cms/admin/locales/server";
@@ -1655,7 +1655,8 @@ function renderToolbar(config) {
 * EmDash Request Context Middleware
 *
 * Sets up AsyncLocalStorage-based request context for query functions.
-* Skips ALS entirely for logged-out users with no CMS signals (fast path).
+* Skips ALS for logged-out users with no CMS signals unless a configured
+* object cache must be fenced off during a route-cache render.
 *
 * Handles:
 * - Preview tokens: _preview query param with signed HMAC token
@@ -1784,8 +1785,16 @@ const onRequest = defineMiddleware(async (context, next) => {
 		if (!isEditor) return redirectToCanonical(url);
 	}
 	if (!hasEditCookie && !hasPreviewToken && !isEditor) {
-		if (toolbarMode === "client") return injectBootstrap(await next());
-		return next();
+		const render = async () => {
+			const response = await next();
+			return toolbarMode === "client" ? injectBootstrap(response) : response;
+		};
+		if (virtualConfig?.objectCacheEnabled && context.cache?.enabled) return runWithContext({
+			...getRequestContext(),
+			editMode: false,
+			routeCacheFill: true
+		}, render);
+		return render();
 	}
 	const editMode = hasEditCookie && isEditor;
 	const locale = context.currentLocale;