emdash 0.40.1 → 0.42.0

package/src/api/schemas/import.ts

@@ -40,24 +40,60 @@ export const wpPluginExecuteBody = z.object({
 	commentRoots: z.record(z.string(), z.string().min(1)).optional(),
 });
 
-export const wpPrepareBody = z.object({
-	postTypes: z.array(
+export const wxrImportConfig = z.object({
+	postTypeMappings: z.record(
+		z.string(),
 		z.object({
-			name: z.string().min(1),
 			collection: z.string().min(1),
-			fields: z
-				.array(
-					z.object({
-						slug: z.string().min(1),
-						label: z.string().min(1),
-						type: z.string().min(1),
-						required: z.boolean(),
-						searchable: z.boolean().optional(),
-					}),
-				)
-				.optional(),
+			enabled: z.boolean(),
 		}),
 	),
+	skipExisting: z.boolean().default(false),
+	importSections: z.boolean().optional(),
+	authorMappings: z.record(z.string(), z.string().min(1).nullable()).optional(),
+	locale: z.string().min(1).optional(),
+});
+
+export const wxrChunkCursor = z.object({
+	offset: z.number().int().min(0).max(10_000_000),
+	source: z.string().regex(/^[a-f0-9]{64}$/),
+	taxonomiesReady: z.literal(true),
+});
+
+export const wxrChunkState = z.object({
+	translationGroups: z
+		.record(z.string().max(1024), z.string().min(1).max(256))
+		.refine((groups) => Object.keys(groups).length <= 100_000, "Too many translation groups"),
+});
+
+const wpPrepareField = z.object({
+	slug: z.string().min(1),
+	label: z.string().min(1),
+	type: z.string().min(1),
+	required: z.boolean(),
+	searchable: z.boolean().optional(),
+});
+
+export const wpPrepareBody = z.object({
+	postTypes: z.array(
+		z
+			.object({
+				name: z.string().min(1),
+				collection: z.string().min(1).optional(),
+				suggestedCollection: z.string().min(1).optional(),
+				fields: z.array(wpPrepareField).optional(),
+				requiredFields: z.array(wpPrepareField).optional(),
+			})
+			.refine((pt) => pt.collection || pt.suggestedCollection, {
+				message: "collection or suggestedCollection is required",
+				path: ["collection"],
+			})
+			.transform((pt) => ({
+				name: pt.name,
+				collection: pt.collection ?? pt.suggestedCollection!,
+				fields: pt.fields ?? pt.requiredFields ?? [],
+			})),
+	),
 });
 
 export const wpMediaImportBody = z.object({

package/src/api/schemas/relations.ts

@@ -1,7 +1,5 @@
 import { z } from "zod";
 
-import { localeCode } from "./common.js";
-
 const slugPattern = /^[a-z][a-z0-9_]*$/;
 const collectionSlug = z
 	.string()
@@ -9,95 +7,107 @@ const collectionSlug = z
 	.max(63)
 	.regex(slugPattern, "Invalid collection slug format");
 
+/** NULL means unlimited on that side. */
+const roleLimit = z.number().int().positive().nullable().optional();
+const roleLabelSingular = z.string().min(1).max(200).nullable().optional();
+
 export const createRelationBody = z
 	.object({
-		name: z
+		slug: z
 			.string()
 			.min(1)
 			.max(63)
-			.regex(slugPattern, "Name must be lowercase alphanumeric with underscores"),
-		parentCollection: collectionSlug.optional(),
-		childCollection: collectionSlug.optional(),
+			.regex(slugPattern, "Slug must be lowercase alphanumeric with underscores"),
+		parentCollection: collectionSlug,
+		childCollection: collectionSlug,
 		parentLabel: z.string().min(1).max(200),
+		parentLabelSingular: roleLabelSingular,
 		childLabel: z.string().min(1).max(200),
-		locale: localeCode.optional(),
-		translationOf: z.string().min(1).optional(),
+		childLabelSingular: roleLabelSingular,
+		maxChildrenPerParent: roleLimit,
+		maxParentsPerChild: roleLimit,
 	})
-	// A translation inherits its structural fields (name, parentCollection,
-	// childCollection) from the source relation, so the handler ignores any
-	// collections supplied alongside `translationOf`. Require them only when
-	// minting a base relation, so callers aren't forced to pass discarded values.
-	.refine(
-		(body) =>
-			body.translationOf !== undefined ||
-			(body.parentCollection !== undefined && body.childCollection !== undefined),
-		{ message: "parentCollection and childCollection are required unless translationOf is set" },
-	)
 	.meta({ id: "CreateRelationBody" });
 
+export const relationListQuery = z
+	.object({
+		collection: collectionSlug.optional().meta({
+			description: "Only relations with this collection on one end",
+		}),
+	})
+	.meta({ id: "RelationListQuery" });
+
 export const updateRelationBody = z
 	.object({
 		parentLabel: z.string().min(1).max(200).optional(),
+		parentLabelSingular: roleLabelSingular,
 		childLabel: z.string().min(1).max(200).optional(),
+		childLabelSingular: roleLabelSingular,
+		maxChildrenPerParent: roleLimit,
+		maxParentsPerChild: roleLimit,
 	})
 	// Reject empty payloads: an update touching no field is a client mistake, not
 	// a successful no-op. Without this, `{}` validates and the handler returns 200
 	// with the unchanged row, so a typo'd payload looks like it landed.
-	.refine((body) => body.parentLabel !== undefined || body.childLabel !== undefined, {
-		message: "At least one of parentLabel or childLabel is required",
+	.refine((body) => Object.values(body).some((value) => value !== undefined), {
+		message: "At least one field is required",
 	})
 	.meta({ id: "UpdateRelationBody" });
 
-export const setReferenceChildrenBody = z
-	.object({ childIds: z.array(z.string().min(1)).max(1000) })
-	.meta({ id: "SetReferenceChildrenBody" });
-
 export const relationDefSchema = z
 	.object({
 		id: z.string(),
-		name: z.string(),
+		slug: z.string(),
 		parentCollection: z.string(),
 		childCollection: z.string(),
 		parentLabel: z.string(),
+		parentLabelSingular: z.string().nullable(),
 		childLabel: z.string(),
-		locale: z.string(),
-		translationGroup: z.string(),
+		childLabelSingular: z.string().nullable(),
+		maxChildrenPerParent: z.number().int().nullable(),
+		maxParentsPerChild: z.number().int().nullable(),
 	})
 	.meta({ id: "RelationDef" });
 
+/** A relation plus what deleting it would take: the fields that view it and
+ * how many links it holds. */
+export const relationWithUsageSchema = relationDefSchema
+	.extend({
+		boundFields: z.array(
+			z.object({
+				collectionSlug: z.string(),
+				fieldSlug: z.string(),
+				side: z.enum(["parent", "child"]),
+			}),
+		),
+		linkCount: z.number().int(),
+	})
+	.meta({ id: "RelationWithUsage" });
+
 export const relationListResponseSchema = z
-	.object({ relations: z.array(relationDefSchema) })
+	.object({ relations: z.array(relationWithUsageSchema) })
 	.meta({ id: "RelationListResponse" });
 
 export const relationResponseSchema = z
-	.object({ relation: relationDefSchema })
+	.object({ relation: relationWithUsageSchema })
 	.meta({ id: "RelationResponse" });
 
-export const relationTranslationsSchema = z
-	.object({
-		translationGroup: z.string(),
-		translations: z.array(
-			z.object({
-				id: z.string(),
-				name: z.string(),
-				locale: z.string(),
-				parentLabel: z.string(),
-				childLabel: z.string(),
-			}),
-		),
-	})
-	.meta({ id: "RelationTranslations" });
-
 export const entryRefSchema = z
 	.object({
 		id: z.string(),
 		slug: z.string().nullable(),
 		collection: z.string(),
+		// Display label sourced from the entry's `title`, then `name`, field —
+		// `null` when neither is set. Mirrors the runtime `EntryRef`.
+		title: z.string().nullable(),
 		// The actual locale of the resolved variant. When no variant matches the
 		// requesting entry's locale, the ref falls back to another locale's row;
 		// this field makes that substitution explicit instead of silently
 		// presenting a wrong-locale entry under the requested context.
 		locale: z.string().nullable(),
+		// The translation group the ref resolved from — the locale-stable identity
+		// of the referenced entry, which `id` is not.
+		translationGroup: z.string().nullable(),
 		sortOrder: z.number().int().optional(),
 	})
 	.meta({ id: "ReferenceEntryRef" });

package/src/api/schemas/schema.ts

@@ -1,6 +1,10 @@
 import { z } from "zod";
 
-import { MAX_COLLECTION_GROUP_LENGTH, MAX_COLLECTION_LIST_COLUMNS } from "../../schema/types.js";
+import {
+	MAX_COLLECTION_GROUP_LENGTH,
+	MAX_COLLECTION_ICON_LENGTH,
+	MAX_COLLECTION_LIST_COLUMNS,
+} from "../../schema/types.js";
 import { compileUrlPattern } from "../../schema/url-pattern.js";
 import { slugPattern } from "./common.js";
 
@@ -30,10 +34,12 @@ const collectionAdminInputConfig = z.object({
 			`At most ${MAX_COLLECTION_LIST_COLUMNS} list columns are allowed`,
 		)
 		.optional(),
+	quickCreate: z.boolean().optional(),
 });
 
 const collectionAdminResponseConfig = z.object({
 	listColumns: collectionListColumns.optional(),
+	quickCreate: z.boolean().optional(),
 });
 
 const fieldTypeValues = z.enum([
@@ -79,10 +85,10 @@ const repeaterSubFieldSchema = z.object({
 const urlPatternValue = z.string().superRefine((pattern, ctx) => {
 	try {
 		compileUrlPattern(pattern);
-	} catch {
+	} catch (error) {
 		ctx.addIssue({
 			code: "custom",
-			message: "Invalid URL pattern",
+			message: error instanceof Error ? error.message : "Invalid URL pattern",
 		});
 	}
 });
@@ -108,6 +114,20 @@ const fieldValidation = z
 			.min(1, "allowedMimeTypes must not be empty — omit the field to allow all types")
 			.max(64, "allowedMimeTypes may contain at most 64 entries")
 			.optional(),
+		// Reference fields: the picker targets a collection and may allow more
+		// than one entry. Without these keys Zod strips them and the create
+		// handler rejects the field for a missing target collection.
+		targetCollection: z.string().min(1).optional(),
+		multiple: z.boolean().optional(),
+		// Reference fields: bind to an existing relation instead of creating one,
+		// and say which of its ends this collection sits on.
+		relation: z
+			.string()
+			.min(1)
+			.max(63)
+			.regex(slugPattern, "Invalid relation slug format")
+			.optional(),
+		relationSide: z.enum(["parent", "child"]).optional(),
 		allowedTypes: z.array(z.string().min(1).max(63).regex(slugPattern)).optional(),
 		retiredTypes: z.array(z.string().min(1).max(63).regex(slugPattern)).optional(),
 	})
@@ -153,7 +173,7 @@ export const createCollectionBody = z
 		label: z.string().min(1),
 		labelSingular: z.string().optional(),
 		description: z.string().optional(),
-		icon: z.string().optional(),
+		icon: z.string().trim().max(MAX_COLLECTION_ICON_LENGTH).optional(),
 		admin: collectionAdminInputConfig.optional(),
 		supports: z.array(collectionSupportValues).optional(),
 		source: z.string().regex(collectionSourcePattern).optional(),
@@ -172,10 +192,10 @@ export const updateCollectionBody = z
 		label: z.string().min(1).optional(),
 		labelSingular: z.string().optional(),
 		description: z.string().optional(),
-		icon: z.string().optional(),
+		icon: z.string().trim().max(MAX_COLLECTION_ICON_LENGTH).optional(),
 		admin: collectionAdminInputConfig.optional(),
 		supports: z.array(collectionSupportValues).optional(),
-		urlPattern: urlPatternValue.nullish(),
+		urlPattern: z.string().nullish(),
 		routable: z.boolean().optional(),
 		hasSeo: z.boolean().optional(),
 		hidden: z.boolean().optional(),

package/src/api/setup-complete.ts

@@ -6,11 +6,59 @@
  * and marks setup as complete.
  */
 
-import type { Kysely } from "kysely";
+import { Role } from "@emdash-cms/auth";
+import { sql, type Kysely } from "kysely";
+import { ulid } from "ulidx";
 
+import { isPostgres } from "../database/dialect-helpers.js";
 import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 
+export const FIRST_ADMIN_LOCK_KEY = 1_168_624_764;
+
+export interface FirstAdmin {
+	id: string;
+	email: string;
+	name: string | null;
+	role: typeof Role.ADMIN;
+}
+
+/**
+ * Create the first admin only while the users table is empty.
+ *
+ * Returns null when a user already exists, including one created by a
+ * concurrent call after the caller's own zero-users check. On Postgres the
+ * insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see
+ * another transaction's uncommitted row under READ COMMITTED.
+ */
+export async function createFirstAdmin(
+	db: Kysely<Database>,
+	input: { email: string; name: string | null },
+): Promise<FirstAdmin | null> {
+	const admin: FirstAdmin = {
+		id: ulid(),
+		email: input.email.toLowerCase(),
+		name: input.name,
+		role: Role.ADMIN,
+	};
+	const now = new Date().toISOString();
+	const insert = async (executor: Kysely<Database>) =>
+		sql<{ id: string }>`
+			INSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)
+			SELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}
+			WHERE NOT EXISTS (SELECT 1 FROM users)
+			RETURNING id
+		`.execute(executor);
+
+	const result = isPostgres(db)
+		? await db.transaction().execute(async (trx) => {
+				await sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);
+				return insert(trx);
+			})
+		: await insert(db);
+	return result.rows.length > 0 ? admin : null;
+}
+
 /**
  * Finalize setup after the first admin user is created.
  *

package/src/api/types.ts

@@ -57,8 +57,12 @@ export interface ManifestCollectionDescriptor {
 	titleField?: string;
 	dateField?: string;
 	hidden?: boolean;
+	/** Phosphor icon name for the admin sidebar entry */
+	icon?: string;
 	/** Admin sidebar folder shared with other collections of the same group */
 	group?: string;
+	/** `false` omits the dashboard's "new entry" quick action */
+	quickCreate?: boolean;
 	listColumns?: string[];
 	fields: Record<string, ManifestFieldDescriptor>;
 }

package/src/astro/dev-typegen.ts

@@ -1,34 +1,27 @@
 /**
- * Dev-only hook for regenerating `emdash-env.d.ts` when the schema changes.
+ * Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.
  *
- * The Astro integration registers an environment-specific refresh function
- * (filesystem + local HTTP in Node dev, no-op everywhere else). Schema
- * mutation code just triggers the hook, so runtime modules stay free of
- * Node-only I/O.
+ * Schema mutations send an event over the Vite module runner's hot channel;
+ * the Astro integration listens for it in Node and does the filesystem work.
+ * The hot channel crosses realms (workerd under the Cloudflare adapter), and
+ * runtime modules stay free of Node-only I/O. When HMR is disabled there is
+ * no hot channel, so the integration also registers a same-realm global.
  */
 
-const REFRESH_FN_KEY = "__emdashDevTypegenRefresh";
+export const DEV_TYPEGEN_REFRESH_EVENT = "emdash:typegen-refresh";
 
-export interface DevTypegenRefreshFn {
-	(db: unknown): void | Promise<void>;
-}
+export const DEV_TYPEGEN_REFRESH_GLOBAL = "__emdashDevTypegenRefresh";
 
-export function setDevTypegenRefresh(fn: DevTypegenRefreshFn): void {
-	if (typeof globalThis !== "undefined") {
-		Reflect.set(globalThis, REFRESH_FN_KEY, fn);
-	}
-}
-
-export function refreshDevTypes(db: unknown): void {
+export function refreshDevTypes(): void {
 	if (typeof import.meta.env === "undefined" || !import.meta.env.DEV) return;
 
-	const fn = Reflect.get(globalThis, REFRESH_FN_KEY);
-	if (typeof fn !== "function") return;
-
 	try {
-		Promise.resolve(fn(db)).catch((error: unknown) => {
-			console.error("[emdash] dev typegen refresh failed:", error);
-		});
+		if (import.meta.hot) {
+			import.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);
+			return;
+		}
+		const fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);
+		if (typeof fn === "function") fn();
 	} catch (error) {
 		console.error("[emdash] dev typegen refresh failed:", error);
 	}

package/src/astro/integration/dev-typegen.ts

@@ -1,12 +1,41 @@
 import type { AstroIntegrationLogger } from "astro";
 
+import { DEV_TYPEGEN_REFRESH_EVENT, DEV_TYPEGEN_REFRESH_GLOBAL } from "../dev-typegen.js";
+
+interface DevServerEnvironments {
+	environments: Record<
+		string,
+		{
+			config: { consumer: string };
+			hot: { on(event: string, listener: () => void): void };
+		}
+	>;
+}
+
+/**
+ * Call `refresh` whenever server-side code in any Vite environment reports a
+ * schema change. Schema mutations can run in a separate realm from the
+ * integration (workerd under the Cloudflare adapter), so the signal travels
+ * over each environment's hot channel. The global covers same-realm SSR when
+ * HMR is disabled and modules have no hot channel.
+ */
+export function listenForDevTypegenRefresh(
+	server: DevServerEnvironments,
+	refresh: () => void,
+): void {
+	for (const environment of Object.values(server.environments)) {
+		if (environment.config.consumer !== "server") continue;
+		environment.hot.on(DEV_TYPEGEN_REFRESH_EVENT, () => refresh());
+	}
+	Reflect.set(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL, refresh);
+}
+
 /**
  * Create a debounced refresh function that fetches the generated types from
  * the dev server and writes them to `emdash-env.d.ts` in the project root.
  *
- * This runs in the Astro integration (Node) and is registered for schema
- * mutations to call back into. It never runs in production builds or in
- * workerd SSR isolates, because only the integration registers it.
+ * This runs in the Astro integration (Node), never in production builds or
+ * in workerd SSR isolates.
  */
 export function createDebouncedTypegenRefresh(
 	port: number,

package/src/astro/integration/index.ts

@@ -27,11 +27,14 @@ import {
 import { buildMigrationManifest } from "../../migrations/manifest-builder.js";
 import { writeMigrationManifest } from "../../migrations/manifest-writer.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
-import { normalizeRegistryConfig, resolveRegistryConfigForSandbox } from "../../registry/config.js";
+import {
+	normalizeRegistryConfig,
+	parseDurationSeconds,
+	resolveRegistryConfigForSandbox,
+} from "../../registry/config.js";
 import { VERSION } from "../../version.js";
-import { setDevTypegenRefresh } from "../dev-typegen.js";
 import { local } from "../storage/adapters.js";
-import { createDebouncedTypegenRefresh } from "./dev-typegen.js";
+import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
 import { notoSans } from "./font-provider.js";
 import {
 	injectCoreRoutes,
@@ -155,6 +158,34 @@ export function buildImageRemotePatterns(
 	return patterns;
 }
 
+/**
+ * Build the config subset baked into `virtual:emdash/config` and exposed
+ * at runtime as `locals.emdash.config`. A config option that runtime code
+ * reads (routes, middleware) MUST be listed here — an option only on
+ * `EmDashConfig` is invisible at runtime and silently ignored.
+ *
+ * @internal Exported for unit testing.
+ */
+export function buildSerializableConfig(resolvedConfig: EmDashConfig): Record<string, unknown> {
+	return {
+		database: resolvedConfig.database,
+		migrations: resolvedConfig.migrations,
+		storage: resolvedConfig.storage,
+		auth: resolvedConfig.auth,
+		authProviders: resolvedConfig.authProviders,
+		marketplace: resolvedConfig.marketplace,
+		registry: resolvedConfig.registry,
+		experimental: resolvedConfig.experimental,
+		siteUrl: resolvedConfig.siteUrl,
+		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders,
+		maxUploadSize: resolvedConfig.maxUploadSize,
+		admin: resolvedConfig.admin,
+		toolbar: resolvedConfig.toolbar,
+		updateCheck: resolvedConfig.updateCheck,
+		objectCacheEnabled: resolvedConfig.objectCache !== undefined,
+	};
+}
+
 /**
  * Stock image endpoints EmDash may safely replace with its storage-backed
  * wrapper. Our wrapper delegates non-EmDash images to the platform's transform
@@ -236,6 +267,31 @@ export function missingReactIntegrationWarning(
 	);
 }
 
+/**
+ * Warn when Astro has no session driver. Sign-in stores the user in the Astro
+ * session, so without a driver every sign-in route fails. The Node, Cloudflare,
+ * and Netlify adapters configure a driver in `astro:config:setup`; others,
+ * such as Vercel, do not.
+ */
+function missingSessionDriverWarning(
+	session: { driver?: unknown } | false | undefined,
+): string | undefined {
+	if (session && session.driver) return undefined;
+	const problem =
+		session === false
+			? `Astro sessions are disabled (\`session: false\`), but EmDash stores signed-in users in the Astro session.`
+			: `No Astro session driver is configured, but EmDash stores signed-in users in the Astro session.`;
+	return (
+		`${problem} Without one, signing in to the admin fails. Use an adapter that ` +
+		`provides a driver (Node, Cloudflare, Netlify) or configure one yourself, for example:\n\n` +
+		`  import { defineConfig, sessionDrivers } from "astro/config";\n` +
+		`  export default defineConfig({\n` +
+		`    session: { driver: sessionDrivers.redis({ url: process.env.REDIS_URL }) },\n` +
+		`  });\n\n` +
+		`See https://docs.astro.build/en/guides/sessions/`
+	);
+}
+
 // Terminal formatting
 const dim = (s: string) => `\x1b[2m${s}\x1b[22m`;
 const bold = (s: string) => `\x1b[1m${s}\x1b[22m`;
@@ -345,6 +401,20 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		fieldPrefix: registry.fieldPrefix,
 	});
 
+	const updateCheckAge =
+		typeof resolvedConfig.updateCheck === "object"
+			? resolvedConfig.updateCheck?.minimumReleaseAge
+			: undefined;
+	if (updateCheckAge !== undefined) {
+		try {
+			parseDurationSeconds(updateCheckAge);
+		} catch (e) {
+			throw new Error(`Invalid updateCheck.minimumReleaseAge: ${String(updateCheckAge)}`, {
+				cause: e,
+			});
+		}
+	}
+
 	// Validate marketplace URL
 	if (resolvedConfig.marketplace) {
 		const url = resolvedConfig.marketplace;
@@ -443,21 +513,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 	// Serialize config for virtual module (database/storage/auth - plugins handled separately)
 	// i18n is populated in astro:config:setup from astroConfig.i18n
-	const serializableConfig: Record<string, unknown> = {
-		database: resolvedConfig.database,
-		migrations: resolvedConfig.migrations,
-		storage: resolvedConfig.storage,
-		auth: resolvedConfig.auth,
-		authProviders: resolvedConfig.authProviders,
-		marketplace: resolvedConfig.marketplace,
-		registry: resolvedConfig.registry,
-		experimental: resolvedConfig.experimental,
-		siteUrl: resolvedConfig.siteUrl,
-		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders,
-		maxUploadSize: resolvedConfig.maxUploadSize,
-		admin: resolvedConfig.admin,
-		toolbar: resolvedConfig.toolbar,
-	};
+	const serializableConfig = buildSerializableConfig(resolvedConfig);
 
 	// Determine auth mode for route injection
 	// Check if auth is an AuthDescriptor (has entrypoint) indicating external auth
@@ -473,7 +529,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		name: "emdash",
 		hooks: {
 			"astro:config:setup": ({
-				injectRoute,
+				injectRoute: astroInjectRoute,
 				addMiddleware,
 				logger,
 				updateConfig,
@@ -599,6 +655,12 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					),
 				});
 
+				// Astro reads a route's `export const prerender` by matching the file's
+				// source text, which the compiled route modules don't match. Without an
+				// explicit value, `output: "static"` would prerender them.
+				const injectRoute: typeof astroInjectRoute = (route) =>
+					astroInjectRoute({ ...route, prerender: false });
+
 				// Inject all core routes
 				injectCoreRoutes(injectRoute, { srcDir: astroConfig.srcDir });
 
@@ -628,6 +690,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			"astro:config:done": async ({ config: finalConfig, logger }) => {
 				const warning = missingReactIntegrationWarning(finalConfig.integrations);
 				if (warning) logger.warn(warning);
+				const sessionWarning = useExternalAuth
+					? undefined
+					: missingSessionDriverWarning(finalConfig.session);
+				if (sessionWarning) logger.warn(sessionWarning);
 
 				if (astroCommand !== "build" && astroCommand !== "sync") return;
 				if (!migrationMetadata.database) {
@@ -669,8 +735,8 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					});
 				}
 
-				// Generate types once the server is listening, and register the
-				// refresh hook so schema mutations in dev update the file too.
+				// Generate types once the server is listening, and listen for
+				// schema mutations in dev so they update the file too.
 				// The endpoint returns the types content; we write the file here
 				// (in Node) because workerd has no real filesystem access.
 				server.httpServer?.once("listening", () => {
@@ -679,7 +745,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 					const port = address.port;
 					const refreshDevTypes = createDebouncedTypegenRefresh(port, logger);
-					setDevTypegenRefresh(refreshDevTypes);
+					listenForDevTypegenRefresh(server, refreshDevTypes);
 
 					// Initial generation now that the server is up.
 					refreshDevTypes();