emdash 1.0.1 → 1.2.0

package/src/astro/middleware/request-context.ts

@@ -64,25 +64,43 @@ function optOutOfRouteCache(cache: RouteCache): void {
 	cache?.set(false);
 }
 
+function isHtmlResponse(response: Response): boolean {
+	return response.headers.get("content-type")?.includes("text/html") ?? false;
+}
+
+const DOCUMENT_START_RE = /^\s*<(?:!doctype|html)\b/i;
+
 /**
- * Inject HTML before `</body>` if the response is an HTML page with a body
- * end tag. Does not touch cache headers — callers decide whether the result
- * is still shareable. `injected` tells the caller whether anything changed.
+ * Inject HTML before the page's closing `</body>` if the response is a whole
+ * HTML document with one. Does not touch cache headers — callers decide
+ * whether the result is still shareable. `injected` tells the caller whether
+ * the result carries the injected HTML.
+ *
+ * `Astro.rewrite()` runs this middleware again for the rewritten route inside
+ * the original request, so the response can already contain the HTML; `marker`
+ * identifies it so it is injected only once.
  */
 async function injectBeforeBodyEnd(
 	response: Response,
 	htmlToInject: string,
+	marker: string,
 ): Promise<{ response: Response; injected: boolean }> {
-	const contentType = response.headers.get("content-type");
-	if (!contentType?.includes("text/html")) return { response, injected: false };
+	if (!isHtmlResponse(response)) return { response, injected: false };
 
 	const html = await response.text();
-	if (!html.includes("</body>")) {
+	if (html.includes(marker)) {
+		return { response: new Response(html, response), injected: true };
+	}
+	// The page's own closing tag is its last `</body>`. Astro leaves `<` and `>`
+	// unescaped in attribute values, so an earlier one, or one in a fragment
+	// such as a server island, can be author text inside an attribute.
+	const bodyEnd = DOCUMENT_START_RE.test(html) ? html.lastIndexOf("</body>") : -1;
+	if (bodyEnd === -1) {
 		// Body already consumed — rebuild the response unchanged.
 		return { response: new Response(html, response), injected: false };
 	}
 
-	const injected = html.replace("</body>", `${htmlToInject}</body>`);
+	const injected = html.slice(0, bodyEnd) + htmlToInject + html.slice(bodyEnd);
 	return {
 		response: new Response(injected, {
 			status: response.status,
@@ -94,14 +112,21 @@ async function injectBeforeBodyEnd(
 
 /**
  * Inject toolbar HTML into a response if it's an HTML page.
- * Returns the original response if not HTML.
+ * Returns the original response if not HTML, without calling
+ * `renderToolbarHtml`, which loads labels and, for an editor, resolves the
+ * preview secret.
  */
 async function injectToolbar(
 	response: Response,
-	toolbarHtml: string,
+	renderToolbarHtml: () => Promise<string>,
 	routeCache: RouteCache,
 ): Promise<Response> {
-	const result = await injectBeforeBodyEnd(response, toolbarHtml);
+	if (!isHtmlResponse(response)) return response;
+	const result = await injectBeforeBodyEnd(
+		response,
+		await renderToolbarHtml(),
+		'id="emdash-toolbar"',
+	);
 	if (result.injected) {
 		// Toolbar-injected HTML is session-specific (its presence reveals an
 		// active editor session); it must never be stored in a shared CDN cache
@@ -121,7 +146,11 @@ async function injectToolbar(
  * stays fully shareable.
  */
 async function injectBootstrap(response: Response): Promise<Response> {
-	const result = await injectBeforeBodyEnd(response, renderToolbarBootstrap());
+	const result = await injectBeforeBodyEnd(
+		response,
+		renderToolbarBootstrap(),
+		"<!-- EmDash Toolbar Bootstrap -->",
+	);
 	return result.response;
 }
 
@@ -177,14 +206,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				if (!hasEditCookie || toolbarMode === false) return response;
 				// The Playground shows its own bar, so the editor toolbar is hidden and
 				// only provides inline editing.
-				const labels = await loadVisualEditingToolbarLabels(context.request);
-				const toolbarHtml = renderToolbar({
-					editMode: true,
-					isPreview: false,
-					labels,
-					hidden: true,
-				});
-				return injectToolbar(response, toolbarHtml, context.cache);
+				return injectToolbar(
+					response,
+					async () =>
+						renderToolbar({
+							editMode: true,
+							isPreview: false,
+							labels: await loadVisualEditingToolbarLabels(context.request),
+							hidden: true,
+						}),
+					context.cache,
+				);
 			},
 		);
 	}
@@ -237,8 +269,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	// Verify preview token if present.
 	// The preview secret is resolved via `resolveSecretsCached`: env wins,
 	// otherwise a DB-stored value is read (or generated on first need).
-	// `emdash.db` is set by the runtime middleware which runs first; the
-	// only path where it's missing is a runtime-init failure.
+	// `emdash.db` is set by the runtime middleware which runs first; it is
+	// missing after a runtime-init failure and on signed-out requests to the
+	// image endpoint EmDash installs, which skip runtime init.
 	let preview: { collection: string; id: string } | undefined;
 	if (hasPreviewToken) {
 		const db = context.locals.emdash?.db;
@@ -289,11 +322,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			// opt-out) in every toolbar mode, so the server toolbar is safe to
 			// inject here even in client mode.
 			if (isEditor && toolbarMode !== false) {
-				const toolbarHtml = await renderEditorToolbar(context, {
-					editMode,
-					isPreview: !!preview,
-				});
-				return injectToolbar(response, toolbarHtml, routeCache);
+				return injectToolbar(
+					response,
+					() => renderEditorToolbar(context, { editMode, isPreview: !!preview }),
+					routeCache,
+				);
 			}
 
 			// Stale edit cookie without a session (client mode): still serve the
@@ -324,11 +357,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// toolbar (response becomes `private, no-store` and route-cache
 		// opted out).
 		const response = await next();
-		const toolbarHtml = await renderEditorToolbar(context, {
-			editMode: false,
-			isPreview: false,
-		});
-		return injectToolbar(response, toolbarHtml, routeCache);
+		return injectToolbar(
+			response,
+			() => renderEditorToolbar(context, { editMode: false, isPreview: false }),
+			routeCache,
+		);
 	}
 
 	return next();

package/src/astro/middleware.ts

@@ -46,6 +46,7 @@ import {
 	resolveRuntimeMigrationMode,
 	type RuntimeMigrationMode,
 } from "../database/migrations/policy.js";
+import { markRequestScopedDb } from "../database/request-scoped.js";
 import { createDeferredTaskTracker } from "../deferred-tasks.js";
 import {
 	DB_INIT_DEADLINE_MS,
@@ -70,6 +71,7 @@ import {
 	runWithContext,
 } from "../request-context.js";
 import type { PublishedRef } from "../scheduled-publish.js";
+import { parseCollectionSitemapName } from "../seo/sitemap-name.js";
 import { EmDashStorageError } from "../storage/types.js";
 import { isMissingTableError } from "../utils/db-errors.js";
 import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
@@ -589,13 +591,86 @@ function pushMetricsTimings(
 
 /** Public routes that require the runtime (sitemap, robots.txt, etc.) */
 const PUBLIC_RUNTIME_ROUTES = new Set(["/sitemap.xml", "/robots.txt"]);
-const SITEMAP_COLLECTION_RE = /^\/sitemap-[a-z][a-z0-9_]*\.xml$/;
+const SITEMAP_COLLECTION_RE = /^\/sitemap-([^/]+)\.xml$/;
+
+/** Whether `pathname` is a per-collection sitemap a collection could have. */
+function isCollectionSitemapPath(pathname: string): boolean {
+	const match = SITEMAP_COLLECTION_RE.exec(pathname);
+	return match !== null && parseCollectionSitemapName(match[1]!) !== null;
+}
+
+function isImageEndpointRequest(context: APIContext): boolean {
+	const route = virtualConfig?.imageEndpointRoute;
+	return typeof route === "string" && context.routePattern === route;
+}
+
+/** The runtime's storage adapter, or null when none is configured or it cannot be created. */
+function tryGetStorage(config: EmDashConfig, migrationMode: RuntimeMigrationMode): Storage | null {
+	try {
+		return EmDashRuntime.getStorage(buildDependencies(config, migrationMode));
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Run an image endpoint request on the adapter's request-scoped db. Anything
+ * on its path that queries (host middleware, the redirect middleware under a
+ * custom endpoint route) must not fall back to the per-isolate singleton: a
+ * request-bound connection (pg over Hyperdrive) reused by another request fails
+ * or hangs on workerd's cross-request I/O guard. A signed-in request also gets
+ * the db as `locals.emdash.db`, which the auth middleware resolves `locals.user`
+ * with.
+ *
+ * The adapter's `commit()` is skipped: on D1 it sets the bookmark cookie, and a
+ * response that sets a cookie is never stored by Workers Cache. This assumes
+ * nothing on the image path writes data the client must read back; the
+ * bookmark it sent still covers its earlier writes.
+ */
+async function runImageRequest(
+	config: EmDashConfig,
+	context: APIContext,
+	imageLocals: EmDashHandlers,
+	signedIn: boolean,
+	metrics: RequestMetrics,
+	next: () => Promise<Response>,
+): Promise<Response> {
+	const scoped = createRequestScopedDb({
+		config: config.database?.config,
+		isAuthenticated: signedIn,
+		isWrite: false,
+		canUseCachedBinding: false,
+		cookies: context.cookies,
+		url: context.url,
+	});
+	if (!scoped) {
+		if (signedIn) {
+			try {
+				const { getDb } = await import("../loader.js");
+				imageLocals.db = await getDb();
+			} catch (error) {
+				console.error("[emdash] image request could not open the database:", error);
+			}
+		}
+		return finalizeResponse(await next());
+	}
+	if (signedIn) imageLocals.db = scoped.db;
+	const { deferredTasks, lifecycle } = coordinateScopedDbLifecycle({ ...scoped, commit: () => {} });
+	const parent = getRequestContext();
+	const ctx = parent
+		? { ...parent, db: scoped.db, deferredTasks }
+		: { editMode: false, db: scoped.db, metrics, deferredTasks };
+	return runWithContext(ctx, () =>
+		finishScoped(lifecycle, async () => finalizeResponse(await next())),
+	);
+}
 
 /**
  * Ask the configured database adapter for a per-request scoped Kysely. The
  * adapter encapsulates any per-request semantics (D1 sessions, read-replica
  * routing, bookmark cookies, etc.); core just forwards the cookie jar and
- * request flags and wraps next() in ALS if a scope was returned.
+ * request flags, registers the returned handle as a view of the configured
+ * database, and wraps next() in ALS if a scope was returned.
  */
 function createRequestScopedDb(
 	opts: RequestScopedDbOpts,
@@ -605,7 +680,9 @@ function createRequestScopedDb(
 	const fn = virtualCreateRequestScopedDb as (
 		o: RequestScopedDbOpts,
 	) => { db: Kysely<Database>; commit: () => void; close?: () => void } | null;
-	return fn(opts);
+	const scoped = fn(opts);
+	if (scoped) markRequestScopedDb(scoped.db);
+	return scoped;
 }
 
 const buildDate = virtualBuildTime ? new Date(virtualBuildTime) : null;
@@ -619,6 +696,10 @@ const buildDate = virtualBuildTime ? new Date(virtualBuildTime) : null;
  * returning visitor's conditional request with 304, leaving them on HTML whose
  * assets 404.
  *
+ * Only a route that set a content validator gets the build dimension. The build
+ * alone does not move when content is published, so as a page's only validator
+ * it would answer every returning visitor with 304 until the next deploy.
+ *
  * Prerendered pages are served by the host's static layer, which manages its
  * own validators — only on-demand responses need the build dimension.
  *
@@ -626,16 +707,37 @@ const buildDate = virtualBuildTime ? new Date(virtualBuildTime) : null;
  * different, so after a rollback the earlier build still answers a conditional
  * request with 304 and the browser stays on the newer build's HTML.
  *
- * Must run before next(): Astro keeps the later of two dates, so a route's own
- * hint still wins when content is newer, and a route that opts out with
- * `Astro.cache.set(false)` stays opted out — calling set() afterwards would
- * clear that opt-out.
+ * Must run after next(), once the route has set its hint. Astro keeps the later
+ * of two dates, so a route's own hint still wins when content is newer.
+ * `Astro.cache.set(false)` also clears `lastModified`, so for an opted-out
+ * route the guard skips the build `set()` below, which would re-enable caching.
  */
 function applyBuildValidator(context: APIContext): void {
 	if (context.isPrerendered || !buildDate || !context.cache?.enabled) return;
+	if (!context.cache.options.lastModified) return;
 	context.cache.set({ lastModified: buildDate });
 }
 
+const UNSHARED_CACHE_CONTROL_RE = /\b(?:private|no-store)\b/i;
+
+/**
+ * Route rules match by path, so a rule can cover responses rendered for a
+ * signed-in user or marked private by the route itself. Opting them out of the
+ * route cache keeps the shared edge cache from serving them to anyone else.
+ *
+ * Must run after next(): the route and its layout call `cache.set()` while
+ * rendering, which turns caching back on.
+ */
+function keepUnsharedResponsesOutOfRouteCache(context: APIContext, response: Response): void {
+	if (!context.cache?.enabled) return;
+	if (
+		context.locals.user ||
+		UNSHARED_CACHE_CONTROL_RE.test(response.headers.get("Cache-Control") ?? "")
+	) {
+		context.cache.set(false);
+	}
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { request, locals, cookies } = context;
 	const url = context.url;
@@ -654,8 +756,6 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
-	applyBuildValidator(context);
-
 	const queryRecorder = isInstrumentationEnabled()
 		? createRecorder(url.pathname, request.method, request.headers.get("x-perf-phase") ?? "default")
 		: undefined;
@@ -669,7 +769,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// (logged-in editors need the runtime for toolbar/visual editing on public pages)
 		const isEmDashRoute = url.pathname.startsWith("/_emdash");
 		const isPublicRuntimeRoute =
-			PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
+			PUBLIC_RUNTIME_ROUTES.has(url.pathname) || isCollectionSitemapPath(url.pathname);
 
 		// Check for edit mode cookie - editors viewing public pages need the runtime
 		// so auth middleware can verify their session for visual editing
@@ -694,6 +794,19 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		const sessionUser =
 			context.isPrerendered || !hasSessionCookie ? null : await resolveSessionUser(context.session);
 
+		// The image endpoint EmDash installed reads media bytes from storage and
+		// nothing else, so it needs neither the setup probe nor runtime init.
+		const imageStorage =
+			config && !playgroundDb && isImageEndpointRequest(context)
+				? tryGetStorage(config, migrationMode)
+				: null;
+		if (imageStorage) {
+			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; the image endpoint reads only storage, the auth middleware db
+			const imageLocals = { storage: imageStorage } as EmDashHandlers;
+			locals.emdash = imageLocals;
+			return runImageRequest(config, context, imageLocals, !!sessionUser, metrics, next);
+		}
+
 		// Credentialed API requests (API tokens `ec_pat_*`, OAuth tokens
 		// `ec_oat_*`, and other Bearer credentials) carry no `astro-session`
 		// cookie, so `sessionUser` is null for them -- yet they still expect
@@ -726,12 +839,21 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// bypasses runtime init and would crash with "no such table: options".
 				// Do a one-time lightweight probe using the same getDb() instance the
 				// page will use: if the migrations table doesn't exist, no migrations
-				// have ever run, and the page may only render once runtime init below
-				// has migrated the database.
+				// have ever run, and the page may only render once runtime init has
+				// migrated the database.
 				// Skip the probe when prerendering: the build database is legitimately
 				// empty in CI, and a response derived from it would be baked into the
 				// static page (session reads are already skipped for prerender above
 				// for the same reason).
+				// Runtime init starts before the probe so the two round trips overlap.
+				// Sub-phase timings are populated only on the cold init. Warm
+				// requests hit the cached runtime and leave this empty.
+				const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
+				const runtimeInitStart = performance.now();
+				const runtimeInit = config ? getRuntime(config, migrationMode, initSubTimings) : undefined;
+				// Awaited below unless the probe fails; then it settles in the background.
+				runtimeInit?.catch(() => {});
+
 				let unmigrated = false;
 				let probeFailed = false;
 				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
@@ -749,8 +871,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							// race, locked SQLite) must NOT be read as "fresh install". Leave the
 							// flag unset so a later request can re-verify, and fall through to
 							// render the page normally. Unless a runtime is already running,
-							// skip runtime init for this request: it would connect to the same
-							// database again and make the visitor wait through a second timeout.
+							// don't wait for runtime init on this request: it connects to the
+							// same database and would make the visitor wait through a second
+							// timeout. getRuntime anchors it with after(), so it can still
+							// finish for later requests.
 							probeFailed = !getRuntimeHolder().instance;
 							console.error("Setup probe failed (non-fatal):", error);
 						}
@@ -758,18 +882,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					timings.push({ name: "setup", dur: performance.now() - t0, desc: "Setup probe" });
 				}
 
-				// Initialize the runtime for page:metadata and page:fragments hooks.
+				// Wait for the runtime for page:metadata and page:fragments hooks.
 				// The runtime is a cached singleton — after the first request,
 				// getRuntime() is just a null-check. This enables SEO plugins to
 				// contribute meta tags for all visitors, not just logged-in editors,
 				// except on a request whose setup probe just failed.
-				if (config && !probeFailed) {
-					// Sub-phase timings are populated only on the cold init. Warm
-					// requests hit the cached runtime and leave this empty.
-					const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
-					const t0 = performance.now();
+				if (runtimeInit && !probeFailed) {
 					try {
-						const runtime = await getRuntime(config, migrationMode, initSubTimings);
+						const runtime = await runtimeInit;
 						markSetupVerified();
 						const handlePublicPluginApiRoute = createPublicPluginApiRouteHandler(runtime);
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
@@ -778,9 +898,6 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
-							// Exposed so the wrapped image endpoint (`/_image`) can read media
-							// bytes from storage on the anonymous fast path -- public `<img>`
-							// requests carry no session.
 							storage: runtime.storage,
 						} as EmDashHandlers;
 					} catch (error) {
@@ -803,7 +920,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							console.error("[emdash] runtime init failed (page renders without CMS data):", error);
 						}
 					}
-					timings.push({ name: "rt", dur: performance.now() - t0, desc: "Runtime init" });
+					timings.push({
+						name: "rt",
+						dur: performance.now() - runtimeInitStart,
+						desc: "Runtime init",
+					});
 					// Append cold-only sub-phase timings so the breakdown is visible
 					// in Server-Timing (rt.db, rt.fts, rt.plugins, rt.site,
 					// rt.sandbox, rt.market, rt.hooks, rt.cron).
@@ -1117,7 +1238,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	};
 
 	try {
-		return await runWithContext({ editMode: false, queryRecorder, metrics }, run);
+		const response = await runWithContext({ editMode: false, queryRecorder, metrics }, run);
+		applyBuildValidator(context);
+		keepUnsharedResponsesOutOfRouteCache(context, response);
+		return response;
 	} finally {
 		// Streamed responses defer the flush to stream end (see
 		// wrapBodyForStreamMetrics) so the log captures queries issued while

package/src/astro/prefetch.ts

@@ -25,6 +25,7 @@
 
 import { getDb } from "../loader.js";
 import { getMenu } from "../menus/index.js";
+import { cachedQuery, CacheNamespace } from "../object-cache/index.js";
 import { requestCached, setRequestCacheEntry } from "../request-cache.js";
 import { getSiteSettings } from "../settings/index.js";
 import { getTaxonomyDefs, getTaxonomyTerms } from "../taxonomies/index.js";
@@ -53,11 +54,17 @@ async function prefetchTaxonomyTerms(): Promise<void> {
 
 /** Warm every menu via the real helper (primes `menu:${name}:${locale}`). */
 async function prefetchMenus(): Promise<void> {
-	const db = await getDb();
 	// The layout calls getMenu(name) with hardcoded names; we can't know them, so
 	// discover every menu name and warm them all (small, bounded chrome table).
-	const rows = await db.selectFrom("_emdash_menus").select("name").distinct().execute();
-	const names = [...new Set(rows.map((r) => r.name))];
+	const names = await cachedQuery({
+		namespace: CacheNamespace.MENUS,
+		key: "names",
+		load: async () => {
+			const db = await getDb();
+			const rows = await db.selectFrom("_emdash_menus").select("name").distinct().execute();
+			return [...new Set(rows.map((r) => r.name))];
+		},
+	});
 	await Promise.allSettled(names.map((name) => getMenu(name)));
 }
 

package/src/astro/routes/api/admin/bylines/[id]/translations.ts

@@ -76,11 +76,6 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			bio: body.bio ?? null,
 			avatarMediaId: body.avatarMediaId ?? source.avatarMediaId,
 			websiteUrl: body.websiteUrl ?? source.websiteUrl,
-			// Translations don't inherit the source's user_id or guest flag —
-			// the partial unique on (user_id, locale) means a single user can
-			// own one byline per locale, but the editor must opt into linking
-			// the new row by editing it after creation.
-			userId: null,
 			isGuest: source.isGuest,
 			locale: body.locale,
 			translationOf: id,

package/src/astro/routes/api/admin/bylines/index.ts

@@ -69,7 +69,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			bio: body.bio ?? null,
 			avatarMediaId: body.avatarMediaId ?? null,
 			websiteUrl: body.websiteUrl ?? null,
-			userId: body.userId ?? null,
+			userId: body.userId,
 			isGuest: body.isGuest,
 			locale: body.locale,
 			translationOf: body.translationOf,

package/src/astro/routes/api/admin/plugins/[id]/index.ts

@@ -33,6 +33,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 		emdash.sandboxedPluginEntries,
 		id,
 		emdash.config.marketplace,
+		(pluginId) => emdash.getRuntimePluginSettingsSchema(pluginId),
 	);
 	if (result.success) {
 		const tools = await emdash.getPluginMcpTools(id);

package/src/astro/routes/api/auth/handover.ts

@@ -0,0 +1,58 @@
+/**
+ * POST /_emdash/api/auth/handover
+ *
+ * Returns a single-use sign-in link for the current user at the site's
+ * chosen address: the configured `siteUrl`, otherwise the **Site URL**.
+ * After a domain change, passkeys created on the old address don't work on
+ * the new one, so this is how a signed-in user moves their session there.
+ * The link expires after 5 minutes and opens Security settings ready to add
+ * a passkey.
+ *
+ * Signed-in sessions only: bearer tokens are refused.
+ */
+
+import { createMagicLinkUrl } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import type { APIRoute } from "astro";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { checkRateLimit } from "#auth/rate-limit.js";
+
+export const prerender = false;
+
+const HANDOVER_EXPIRY_MS = 5 * 60 * 1000;
+const HANDOVER_REDIRECT = "/_emdash/admin/settings/security?addPasskey=1";
+
+export const POST: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	if (!user) {
+		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	}
+	if (locals.tokenScopes !== undefined) {
+		return apiError("FORBIDDEN", "Sign-in handover requires a signed-in session", 403);
+	}
+
+	try {
+		const rateLimit = await checkRateLimit(emdash.db, user.id, "auth/handover", 5, 300);
+		if (!rateLimit.allowed) {
+			return apiError("RATE_LIMITED", "Too many sign-in links. Try again in a few minutes.", 429);
+		}
+
+		const origin = await getChosenSiteOrigin(emdash.db, emdash.config);
+		if (!origin) {
+			return apiError("NO_SITE_URL", "Set a Site URL before continuing at another address", 409);
+		}
+
+		const url = await createMagicLinkUrl(createKyselyAdapter(emdash.db), user, origin, {
+			expiresInMs: HANDOVER_EXPIRY_MS,
+			redirect: HANDOVER_REDIRECT,
+		});
+		return apiSuccess({ url });
+	} catch (error) {
+		return handleError(error, "Failed to create a sign-in link", "SIGN_IN_HANDOVER_ERROR");
+	}
+};

package/src/astro/routes/api/auth/magic-link/verify.ts

@@ -7,7 +7,8 @@
  * otherwise use up the single-use token before the recipient clicks.
  *
  * POST verifies the token and creates the session.
- * Tokens are single-use and expire after 15 minutes.
+ * Tokens are single-use and expire after 15 minutes, or 5 minutes for
+ * sign-in handover links.
  */
 
 import type { APIRoute } from "astro";
@@ -21,6 +22,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { magicLinkVerifyBody } from "#api/schemas.js";
 
+import { after } from "../../../../../after.js";
 import { sessionUnavailableError } from "../../../../session-user.js";
 
 export const GET: APIRoute = async ({ url, redirect }) => {
@@ -50,8 +52,14 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		const adapter = createKyselyAdapter(emdash.db);
 		const user = await verifyMagicLink(adapter, body.token);
 
-		// Fire-and-forget cleanup of expired tokens -- prevents accumulation
-		void adapter.deleteExpiredTokens().catch(() => {});
+		// Cleanup of expired tokens -- prevents accumulation
+		after(async () => {
+			try {
+				await adapter.deleteExpiredTokens();
+			} catch (error) {
+				console.error("[magic-link] failed to delete expired tokens:", error);
+			}
+		});
 
 		session.set("user", { id: user.id });