emdash 0.41.0 → 0.42.0

package/src/astro/integration/index.ts

@@ -27,11 +27,14 @@ import {
 import { buildMigrationManifest } from "../../migrations/manifest-builder.js";
 import { writeMigrationManifest } from "../../migrations/manifest-writer.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
-import { normalizeRegistryConfig, resolveRegistryConfigForSandbox } from "../../registry/config.js";
+import {
+	normalizeRegistryConfig,
+	parseDurationSeconds,
+	resolveRegistryConfigForSandbox,
+} from "../../registry/config.js";
 import { VERSION } from "../../version.js";
-import { setDevTypegenRefresh } from "../dev-typegen.js";
 import { local } from "../storage/adapters.js";
-import { createDebouncedTypegenRefresh } from "./dev-typegen.js";
+import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
 import { notoSans } from "./font-provider.js";
 import {
 	injectCoreRoutes,
@@ -155,6 +158,34 @@ export function buildImageRemotePatterns(
 	return patterns;
 }
 
+/**
+ * Build the config subset baked into `virtual:emdash/config` and exposed
+ * at runtime as `locals.emdash.config`. A config option that runtime code
+ * reads (routes, middleware) MUST be listed here — an option only on
+ * `EmDashConfig` is invisible at runtime and silently ignored.
+ *
+ * @internal Exported for unit testing.
+ */
+export function buildSerializableConfig(resolvedConfig: EmDashConfig): Record<string, unknown> {
+	return {
+		database: resolvedConfig.database,
+		migrations: resolvedConfig.migrations,
+		storage: resolvedConfig.storage,
+		auth: resolvedConfig.auth,
+		authProviders: resolvedConfig.authProviders,
+		marketplace: resolvedConfig.marketplace,
+		registry: resolvedConfig.registry,
+		experimental: resolvedConfig.experimental,
+		siteUrl: resolvedConfig.siteUrl,
+		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders,
+		maxUploadSize: resolvedConfig.maxUploadSize,
+		admin: resolvedConfig.admin,
+		toolbar: resolvedConfig.toolbar,
+		updateCheck: resolvedConfig.updateCheck,
+		objectCacheEnabled: resolvedConfig.objectCache !== undefined,
+	};
+}
+
 /**
  * Stock image endpoints EmDash may safely replace with its storage-backed
  * wrapper. Our wrapper delegates non-EmDash images to the platform's transform
@@ -236,6 +267,31 @@ export function missingReactIntegrationWarning(
 	);
 }
 
+/**
+ * Warn when Astro has no session driver. Sign-in stores the user in the Astro
+ * session, so without a driver every sign-in route fails. The Node, Cloudflare,
+ * and Netlify adapters configure a driver in `astro:config:setup`; others,
+ * such as Vercel, do not.
+ */
+function missingSessionDriverWarning(
+	session: { driver?: unknown } | false | undefined,
+): string | undefined {
+	if (session && session.driver) return undefined;
+	const problem =
+		session === false
+			? `Astro sessions are disabled (\`session: false\`), but EmDash stores signed-in users in the Astro session.`
+			: `No Astro session driver is configured, but EmDash stores signed-in users in the Astro session.`;
+	return (
+		`${problem} Without one, signing in to the admin fails. Use an adapter that ` +
+		`provides a driver (Node, Cloudflare, Netlify) or configure one yourself, for example:\n\n` +
+		`  import { defineConfig, sessionDrivers } from "astro/config";\n` +
+		`  export default defineConfig({\n` +
+		`    session: { driver: sessionDrivers.redis({ url: process.env.REDIS_URL }) },\n` +
+		`  });\n\n` +
+		`See https://docs.astro.build/en/guides/sessions/`
+	);
+}
+
 // Terminal formatting
 const dim = (s: string) => `\x1b[2m${s}\x1b[22m`;
 const bold = (s: string) => `\x1b[1m${s}\x1b[22m`;
@@ -345,6 +401,20 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		fieldPrefix: registry.fieldPrefix,
 	});
 
+	const updateCheckAge =
+		typeof resolvedConfig.updateCheck === "object"
+			? resolvedConfig.updateCheck?.minimumReleaseAge
+			: undefined;
+	if (updateCheckAge !== undefined) {
+		try {
+			parseDurationSeconds(updateCheckAge);
+		} catch (e) {
+			throw new Error(`Invalid updateCheck.minimumReleaseAge: ${String(updateCheckAge)}`, {
+				cause: e,
+			});
+		}
+	}
+
 	// Validate marketplace URL
 	if (resolvedConfig.marketplace) {
 		const url = resolvedConfig.marketplace;
@@ -443,21 +513,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 	// Serialize config for virtual module (database/storage/auth - plugins handled separately)
 	// i18n is populated in astro:config:setup from astroConfig.i18n
-	const serializableConfig: Record<string, unknown> = {
-		database: resolvedConfig.database,
-		migrations: resolvedConfig.migrations,
-		storage: resolvedConfig.storage,
-		auth: resolvedConfig.auth,
-		authProviders: resolvedConfig.authProviders,
-		marketplace: resolvedConfig.marketplace,
-		registry: resolvedConfig.registry,
-		experimental: resolvedConfig.experimental,
-		siteUrl: resolvedConfig.siteUrl,
-		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders,
-		maxUploadSize: resolvedConfig.maxUploadSize,
-		admin: resolvedConfig.admin,
-		toolbar: resolvedConfig.toolbar,
-	};
+	const serializableConfig = buildSerializableConfig(resolvedConfig);
 
 	// Determine auth mode for route injection
 	// Check if auth is an AuthDescriptor (has entrypoint) indicating external auth
@@ -473,7 +529,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		name: "emdash",
 		hooks: {
 			"astro:config:setup": ({
-				injectRoute,
+				injectRoute: astroInjectRoute,
 				addMiddleware,
 				logger,
 				updateConfig,
@@ -599,6 +655,12 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					),
 				});
 
+				// Astro reads a route's `export const prerender` by matching the file's
+				// source text, which the compiled route modules don't match. Without an
+				// explicit value, `output: "static"` would prerender them.
+				const injectRoute: typeof astroInjectRoute = (route) =>
+					astroInjectRoute({ ...route, prerender: false });
+
 				// Inject all core routes
 				injectCoreRoutes(injectRoute, { srcDir: astroConfig.srcDir });
 
@@ -628,6 +690,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			"astro:config:done": async ({ config: finalConfig, logger }) => {
 				const warning = missingReactIntegrationWarning(finalConfig.integrations);
 				if (warning) logger.warn(warning);
+				const sessionWarning = useExternalAuth
+					? undefined
+					: missingSessionDriverWarning(finalConfig.session);
+				if (sessionWarning) logger.warn(sessionWarning);
 
 				if (astroCommand !== "build" && astroCommand !== "sync") return;
 				if (!migrationMetadata.database) {
@@ -669,8 +735,8 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					});
 				}
 
-				// Generate types once the server is listening, and register the
-				// refresh hook so schema mutations in dev update the file too.
+				// Generate types once the server is listening, and listen for
+				// schema mutations in dev so they update the file too.
 				// The endpoint returns the types content; we write the file here
 				// (in Node) because workerd has no real filesystem access.
 				server.httpServer?.once("listening", () => {
@@ -679,7 +745,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 					const port = address.port;
 					const refreshDevTypes = createDebouncedTypegenRefresh(port, logger);
-					setDevTypegenRefresh(refreshDevTypes);
+					listenForDevTypegenRefresh(server, refreshDevTypes);
 
 					// Initial generation now that the server is up.
 					refreshDevTypes();

package/src/astro/integration/routes.ts

@@ -667,6 +667,12 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/admin/plugins/updates.ts"),
 	});
 
+	// Core update notice
+	injectRoute({
+		pattern: "/_emdash/api/admin/core-update",
+		entrypoint: resolveRoute("api/admin/core-update.ts"),
+	});
+
 	// Exclusive hooks admin routes
 	injectRoute({
 		pattern: "/_emdash/api/admin/hooks/exclusive",

package/src/astro/integration/runtime.ts

@@ -81,7 +81,7 @@ export interface StorageCollectionDeclaration {
 	uniqueIndexes?: string[];
 }
 
-export interface PluginDescriptor<TOptions = Record<string, unknown>> {
+export interface PluginDescriptor<TOptions extends object = object> {
 	/** Unique plugin identifier */
 	id: string;
 	/** Plugin version (semver) */
@@ -169,7 +169,7 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
  * These run in isolated V8 isolates via Worker Loader on Cloudflare.
  * The `entrypoint` is resolved to a file and bundled at build time.
  */
-export type SandboxedPluginDescriptor<TOptions = Record<string, unknown>> =
+export type SandboxedPluginDescriptor<TOptions extends object = object> =
 	PluginDescriptor<TOptions>;
 
 export interface EmDashConfig {
@@ -214,10 +214,12 @@ export interface EmDashConfig {
 	 * Preview and visual-edit requests bypass the cache, so editors previewing
 	 * see live content. All other reads — including authenticated browsing outside
 	 * edit mode — are served from the cache, which only ever stores published
-	 * content. After an edit, anonymous visitors may see stale content until other
-	 * isolates pick up the bumped epoch: immediate with the memory backend, and on
-	 * KV bounded by KV's edge-cache propagation (eventual consistency, up to ~60s)
-	 * plus the isolate-local `revalidate` window (default 1s).
+	 * content. When Astro route caching is enabled, a rendered cache fill bypasses
+	 * the object cache so a purged page cannot be rebuilt from an older snapshot.
+	 * Other requests may see stale content until isolates pick up the bumped epoch:
+	 * immediate with the memory backend, and on KV bounded by KV's edge-cache
+	 * propagation (eventual consistency, up to ~60s) plus the isolate-local
+	 * `revalidate` window (default 1s).
 	 *
 	 * Scheduled content becomes visible at query time (no write event fires when
 	 * its publish time passes), so a cached list/entry won't surface a newly-due
@@ -403,6 +405,27 @@ export interface EmDashConfig {
 	 */
 	registry?: RegistryConfigOption;
 
+	/**
+	 * Core update notice in the admin dashboard.
+	 *
+	 * When enabled (the default), EmDash checks the public npm registry
+	 * (`registry.npmjs.org`) at most once per day for published `emdash`
+	 * releases and shows a dismissible banner in the admin dashboard when
+	 * a newer version is available. The check is deferred after the
+	 * response and carries no site data — it's a plain GET to the public
+	 * registry. Sites without outbound internet simply never see the banner.
+	 *
+	 * The banner names the newest stable release that has been public for
+	 * `minimumReleaseAge`: a duration string (`"48h"`, `"7d"`) or a number
+	 * of seconds, `"24h"` by default. Set it to match a package manager's
+	 * release-age policy, such as pnpm's `minimumReleaseAge`.
+	 *
+	 * Set to `false` to disable the check entirely.
+	 *
+	 * @default true
+	 */
+	updateCheck?: boolean | { minimumReleaseAge?: string | number };
+
 	/**
 	 * Experimental features.
 	 *
@@ -628,6 +651,7 @@ export interface EmDashConfig {
 	 *   admin: {
 	 *     logo: "/images/agency-logo.webp",
 	 *     siteName: "AgencyX CMS",
+	 *     footerLabel: "AgencyX",
 	 *     favicon: "/favicon.ico",
 	 *   },
 	 * })
@@ -636,8 +660,10 @@ export interface EmDashConfig {
 	admin?: {
 		/** URL or path to a custom logo image for the admin UI (login page, sidebar). */
 		logo?: string;
-		/** Custom name displayed in the admin sidebar and browser tab. */
+		/** Custom name displayed in the admin sidebar header and browser tab. */
 		siteName?: string;
+		/** Label displayed beside the version in the sidebar footer. Set to false to hide it. */
+		footerLabel?: string | false;
 		/** URL or path to a custom favicon for the admin panel. */
 		favicon?: string;
 	};

package/src/astro/integration/virtual-modules.ts

@@ -295,6 +295,7 @@ export function generatePluginsModule(descriptors: PluginDescriptor[]): string {
 					settingsSchema: descriptor.settingsSchema,
 					portableTextBlocks: descriptor.portableTextBlocks,
 					fieldWidgets: descriptor.fieldWidgets,
+					mcp: descriptor.mcp,
 				})})`,
 			);
 		} else {

package/src/astro/integration/vite-config.ts

@@ -7,8 +7,8 @@
 
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { dirname, isAbsolute, relative, resolve, win32 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 import type { AstroConfig } from "astro";
 import type { Plugin } from "vite";
@@ -70,16 +70,22 @@ import {
 } from "./virtual-modules.js";
 
 const LOCALE_MESSAGES_RE = /[/\\]([a-z]{2}(?:-[A-Z]{2})?)[/\\]messages\.mjs$/;
+
+export function pathToImportUrl(path: string): string {
+	return pathToFileURL(path, { windows: win32.isAbsolute(path) }).href;
+}
+
 /**
  * Vite plugin that compiles Lingui macros in admin source files.
  * Only active in dev mode when the admin package is aliased to source for HMR.
  * @babel/core is dynamically imported from admin's devDependencies —
  * not declared by core, never ships to end users.
  */
-function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string): Plugin {
-	// Resolve @babel/core from admin's devDependencies, not core's.
+export function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string): Plugin {
 	const adminRequire = createRequire(resolve(adminDistPath, "index.js"));
 	const babelCorePath = adminRequire.resolve("@babel/core");
+	const linguiMacroPluginPath = adminRequire.resolve("@lingui/babel-plugin-lingui-macro");
+	const adminSourceVitePath = adminSourcePath.replaceAll("\\", "/");
 
 	return {
 		name: "emdash-lingui-macro",
@@ -88,18 +94,20 @@ function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string): Plug
 			// Redirect relative locale catalog imports (e.g. ./de/messages.mjs) from
 			// within admin source to the compiled dist/locales/ directory, since
 			// lingui compile only runs during build — not in dev watch mode.
-			if (!importer?.startsWith(adminSourcePath)) return;
+			if (!importer?.startsWith(adminSourceVitePath)) return;
 			const match = id.match(LOCALE_MESSAGES_RE);
 			if (match?.[1]) {
 				return resolve(adminDistPath, "locales", match[1], "messages.mjs");
 			}
 		},
 		async transform(code, id) {
-			if (!id.startsWith(adminSourcePath) || !code.includes("@lingui")) return;
-			const { transformAsync } = (await import(babelCorePath)) as typeof import("@babel/core");
+			if (!id.startsWith(adminSourceVitePath) || !code.includes("@lingui")) return;
+			const { transformAsync } = (await import(
+				pathToImportUrl(babelCorePath)
+			)) as typeof import("@babel/core");
 			const result = await transformAsync(code, {
 				filename: id,
-				plugins: ["@lingui/babel-plugin-lingui-macro"],
+				plugins: [linguiMacroPluginPath],
 				parserOpts: { plugins: ["jsx", "typescript"] },
 			});
 			if (!result?.code) return;

package/src/astro/middleware/redirect.ts

@@ -19,6 +19,7 @@ import { defineMiddleware } from "astro:middleware";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
+import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
 
 /** Paths that should never be intercepted by redirects */
@@ -33,6 +34,12 @@ function isRedirectCode(code: number): code is RedirectCode {
 	return code === 301 || code === 302 || code === 303 || code === 307 || code === 308;
 }
 
+function warnUnsafeDestination(id: string): void {
+	console.warn(
+		`[emdash:redirects] Skipping redirect ${id}: destination is not a site-relative path`,
+	);
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 
@@ -80,7 +87,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				return new Response(null, { status: exact.type });
 			}
 			const dest = exact.destination;
-			if (dest.startsWith("//") || dest.startsWith("/\\")) return next();
+			if (!isSiteRelativeDestination(dest)) {
+				warnUnsafeDestination(exact.id);
+				return next();
+			}
 			repo.recordHit(exact.id).catch(() => {});
 			const code = isRedirectCode(exact.type) ? exact.type : 301;
 			return context.redirect(dest, code);
@@ -95,7 +105,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				repo.recordHit(redirect.id).catch(() => {});
 				return new Response(null, { status: redirect.type });
 			}
-			if (destination.startsWith("//") || destination.startsWith("/\\")) return next();
+			if (!isSiteRelativeDestination(destination)) {
+				warnUnsafeDestination(redirect.id);
+				return next();
+			}
 			repo.recordHit(redirect.id).catch(() => {});
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
 			return context.redirect(destination, code);

package/src/astro/middleware/request-context.ts

@@ -2,7 +2,8 @@
  * EmDash Request Context Middleware
  *
  * Sets up AsyncLocalStorage-based request context for query functions.
- * Skips ALS entirely for logged-out users with no CMS signals (fast path).
+ * Skips ALS for logged-out users with no CMS signals unless a configured
+ * object cache must be fenced off during a route-cache render.
  *
  * Handles:
  * - Preview tokens: _preview query param with signed HMAC token
@@ -209,13 +210,19 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
-	// No CMS signals and not an editor → skip everything (zero overhead in
-	// server mode; client mode injects the identical-for-everyone bootstrap)
+	// No CMS signals and not an editor. Route-cache renders get a context so
+	// object-cache reads cannot seed a fresh response with stale data; other
+	// requests retain the anonymous fast path.
 	if (!hasEditCookie && !hasPreviewToken && !isEditor) {
-		if (toolbarMode === "client") {
-			return injectBootstrap(await next());
+		const render = async () => {
+			const response = await next();
+			return toolbarMode === "client" ? injectBootstrap(response) : response;
+		};
+		if (virtualConfig?.objectCacheEnabled && context.cache?.enabled) {
+			const parent = getRequestContext();
+			return runWithContext({ ...parent, editMode: false, routeCacheFill: true }, render);
 		}
-		return next();
+		return render();
 	}
 
 	// Determine edit mode: cookie AND authenticated editor

package/src/astro/routes/api/admin/bylines/[id]/index.ts

@@ -8,6 +8,8 @@ import { bylineUpdateBody } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { after } from "../../../../../../after.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ params, locals }) => {
@@ -58,7 +60,11 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 		customFields: body.customFields,
 	});
 
-	if (result.success) invalidateBylineCache();
+	if (result.success) {
+		invalidateBylineCache();
+		const byline = result.data;
+		after(() => emdash.hooks.runBylineAfterSave(byline, false));
+	}
 	return unwrapResult(result);
 };
 
@@ -73,9 +79,13 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 
 	try {
 		const repo = new BylineRepository(emdash.db);
+		const existing = emdash.hooks.hasHooks("byline:afterDelete")
+			? await repo.findById(params.id!)
+			: null;
 		const deleted = await repo.delete(params.id!);
 		if (!deleted) return apiError("NOT_FOUND", "Byline not found", 404);
 		invalidateBylineCache();
+		if (existing) after(() => emdash.hooks.runBylineAfterDelete(existing));
 		return apiSuccess({ deleted: true });
 	} catch (error) {
 		return handleError(error, "Failed to delete byline", "BYLINE_DELETE_ERROR");

package/src/astro/routes/api/admin/bylines/[id]/translations.ts

@@ -22,6 +22,8 @@ import { bylineTranslationCreateBody } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { after } from "../../../../../../after.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ params, locals }) => {
@@ -84,7 +86,11 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			translationOf: id,
 		});
 
-		if (result.success) invalidateBylineCache();
+		if (result.success) {
+			invalidateBylineCache();
+			const byline = result.data;
+			after(() => emdash.hooks.runBylineAfterSave(byline, true));
+		}
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(

package/src/astro/routes/api/admin/bylines/index.ts

@@ -8,6 +8,7 @@ import { bylineCreateBody, bylinesListQuery } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { after } from "../../../../../after.js";
 import { getI18nConfig, resolveConfiguredLocale } from "../../../../../i18n/config.js";
 
 export const prerender = false;
@@ -75,7 +76,11 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			customFields: body.customFields,
 		});
 
-		if (result.success) invalidateBylineCache();
+		if (result.success) {
+			invalidateBylineCache();
+			const byline = result.data;
+			after(() => emdash.hooks.runBylineAfterSave(byline, true));
+		}
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create byline", "BYLINE_CREATE_ERROR");

package/src/astro/routes/api/admin/core-update.ts

@@ -0,0 +1,34 @@
+/**
+ * Core update status endpoint
+ *
+ * GET /_emdash/api/admin/core-update - Cached "is a newer EmDash
+ * version available?" status for the admin dashboard banner. Serves
+ * the options-table cache and defers the (at most daily) npm registry
+ * refresh via `after()`, so it never blocks on the network.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+import { handleCoreUpdateStatus, minimumReleaseAgeSeconds } from "#api/handlers/update-check.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "updates:read");
+	if (denied) return denied;
+
+	const { updateCheck } = emdash.config;
+	const result = await handleCoreUpdateStatus(emdash.db, {
+		enabled: updateCheck !== false,
+		minimumReleaseAgeSeconds: minimumReleaseAgeSeconds(updateCheck),
+	});
+	return unwrapResult(result);
+};

package/src/astro/routes/api/admin/plugins/marketplace/[id]/icon.ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError } from "#api/error.js";
+import { fetchWithinOrigin, MarketplaceError } from "#plugins/marketplace.js";
 
 export const prerender = false;
 
@@ -35,7 +36,7 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	if (width) target.searchParams.set("w", width);
 
 	try {
-		const resp = await fetch(target.href);
+		const resp = await fetchWithinOrigin(target.href, "Icon fetch", "PROXY");
 		if (!resp.ok) {
 			// Allowlist: only forward Content-Type from upstream.
 			// Never copy all upstream headers (denylist approach leaks
@@ -55,7 +56,10 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 				"Cache-Control": "private, no-store",
 			},
 		});
-	} catch {
+	} catch (error) {
+		if (error instanceof MarketplaceError && error.code) {
+			return apiError(error.code, "Icon redirect was not followed", 502);
+		}
 		return apiError("PROXY_ERROR", "Failed to fetch icon", 502);
 	}
 };

package/src/astro/routes/api/admin/themes/marketplace/[id]/thumbnail.ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError } from "#api/error.js";
+import { fetchWithinOrigin, MarketplaceError } from "#plugins/marketplace.js";
 
 export const prerender = false;
 
@@ -35,7 +36,7 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	if (width) target.searchParams.set("w", width);
 
 	try {
-		const resp = await fetch(target.href);
+		const resp = await fetchWithinOrigin(target.href, "Thumbnail fetch", "PROXY");
 		if (!resp.ok) {
 			// Allowlist: only forward Content-Type from upstream.
 			// Never copy all upstream headers (denylist approach leaks
@@ -55,7 +56,10 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 				"Cache-Control": "private, no-store",
 			},
 		});
-	} catch {
+	} catch (error) {
+		if (error instanceof MarketplaceError && error.code) {
+			return apiError(error.code, "Thumbnail redirect was not followed", 502);
+		}
 		return apiError("PROXY_ERROR", "Failed to fetch thumbnail", 502);
 	}
 };

package/src/astro/routes/api/auth/invite/complete.ts

@@ -22,12 +22,15 @@ import { createChallengeStore } from "#auth/challenge-store.js";
 import { getPasskeyConfig } from "#auth/passkey-config.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
+import { sessionUnavailableError } from "../../../../session-user.js";
+
 export const POST: APIRoute = async ({ request, locals, session }) => {
 	const { emdash } = locals;
 
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	if (!session) return sessionUnavailableError();
 
 	try {
 		const body = await parseBody(request, inviteCompleteBody);
@@ -62,10 +65,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		// Register the passkey for the new user
 		await registerPasskey(adapter, user.id, verified, "Initial passkey");
 
-		// Create session
-		if (session) {
-			session.set("user", { id: user.id });
-		}
+		session.set("user", { id: user.id });
 
 		return apiSuccess({
 			success: true,

package/src/astro/routes/api/auth/magic-link/verify.ts

@@ -21,6 +21,8 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { magicLinkVerifyBody } from "#api/schemas.js";
 
+import { sessionUnavailableError } from "../../../../session-user.js";
+
 export const GET: APIRoute = async ({ url, redirect }) => {
 	const token = url.searchParams.get("token");
 	if (!token) {
@@ -39,6 +41,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	if (!session) return sessionUnavailableError();
 
 	try {
 		const body = await parseBody(request, magicLinkVerifyBody);
@@ -50,7 +53,7 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		// Fire-and-forget cleanup of expired tokens -- prevents accumulation
 		void adapter.deleteExpiredTokens().catch(() => {});
 
-		session?.set("user", { id: user.id });
+		session.set("user", { id: user.id });
 
 		return apiSuccess({ success: true });
 	} catch (error) {