emdash 1.1.0 → 1.2.0

package/src/astro/middleware/redirect.ts

@@ -17,6 +17,7 @@
 import type { APIContext } from "astro";
 import { defineMiddleware } from "astro:middleware";
 
+import { after } from "../../after.js";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
 import { createRedirectSource } from "../../redirects/artifacts.js";
@@ -42,6 +43,16 @@ function warnUnsafeDestination(id: string): void {
 	);
 }
 
+function recordHitInBackground(repo: RedirectRepository, id: string): void {
+	after(async () => {
+		try {
+			await repo.recordHit(id);
+		} catch (error) {
+			console.error("[emdash:redirects] failed to record redirect hit:", error);
+		}
+	});
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 
@@ -85,7 +96,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			// Terminal statuses (410 Gone / 451): serve the status directly,
 			// with no Location header.
 			if (isTerminalStatus(exact.type)) {
-				repo.recordHit(exact.id).catch(() => {});
+				recordHitInBackground(repo, exact.id);
 				return new Response(null, { status: exact.type });
 			}
 			const dest = exact.destination;
@@ -93,7 +104,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				warnUnsafeDestination(exact.id);
 				return next();
 			}
-			repo.recordHit(exact.id).catch(() => {});
+			recordHitInBackground(repo, exact.id);
 			const code = isRedirectCode(exact.type) ? exact.type : 301;
 			return context.redirect(dest, code);
 		}
@@ -104,14 +115,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			const { redirect, destination } = patternMatch;
 			// Terminal statuses (410 Gone / 451): serve the status directly.
 			if (isTerminalStatus(redirect.type)) {
-				repo.recordHit(redirect.id).catch(() => {});
+				recordHitInBackground(repo, redirect.id);
 				return new Response(null, { status: redirect.type });
 			}
 			if (!isSiteRelativeDestination(destination)) {
 				warnUnsafeDestination(redirect.id);
 				return next();
 			}
-			repo.recordHit(redirect.id).catch(() => {});
+			recordHitInBackground(repo, redirect.id);
 			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
 			return context.redirect(destination, code);
 		}
@@ -128,7 +139,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			routeCache?.set(false);
 		}
 
-		// Log misses (fire-and-forget) under the path the visitor requested.
+		// Log misses under the path the visitor requested.
 		// Two shapes count as a miss: a 404 response (an unmatched route, or a
 		// page answering a content miss with Astro.rewrite("/404")), and a
 		// matched route answering a content miss with a redirect to /404 —
@@ -142,13 +153,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		if (missedDirectly || missedByRedirect) {
 			const referrer = context.request.headers.get("referer") ?? null;
 			const userAgent = context.request.headers.get("user-agent") ?? null;
-			repo
-				.log404({
-					path: pathname,
-					referrer,
-					userAgent,
-				})
-				.catch(() => {});
+			after(async () => {
+				try {
+					await repo.log404({
+						path: pathname,
+						referrer,
+						userAgent,
+					});
+				} catch (error) {
+					console.error("[emdash:redirects] failed to log 404:", error);
+				}
+			});
 		}
 
 		return response;

package/src/astro/middleware/request-context.ts

@@ -68,11 +68,13 @@ function isHtmlResponse(response: Response): boolean {
 	return response.headers.get("content-type")?.includes("text/html") ?? false;
 }
 
+const DOCUMENT_START_RE = /^\s*<(?:!doctype|html)\b/i;
+
 /**
- * Inject HTML before `</body>` if the response is an HTML page with a body
- * end tag. Does not touch cache headers — callers decide whether the result
- * is still shareable. `injected` tells the caller whether the result carries
- * the injected HTML.
+ * Inject HTML before the page's closing `</body>` if the response is a whole
+ * HTML document with one. Does not touch cache headers — callers decide
+ * whether the result is still shareable. `injected` tells the caller whether
+ * the result carries the injected HTML.
  *
  * `Astro.rewrite()` runs this middleware again for the rewritten route inside
  * the original request, so the response can already contain the HTML; `marker`
@@ -89,12 +91,16 @@ async function injectBeforeBodyEnd(
 	if (html.includes(marker)) {
 		return { response: new Response(html, response), injected: true };
 	}
-	if (!html.includes("</body>")) {
+	// The page's own closing tag is its last `</body>`. Astro leaves `<` and `>`
+	// unescaped in attribute values, so an earlier one, or one in a fragment
+	// such as a server island, can be author text inside an attribute.
+	const bodyEnd = DOCUMENT_START_RE.test(html) ? html.lastIndexOf("</body>") : -1;
+	if (bodyEnd === -1) {
 		// Body already consumed — rebuild the response unchanged.
 		return { response: new Response(html, response), injected: false };
 	}
 
-	const injected = html.replace("</body>", `${htmlToInject}</body>`);
+	const injected = html.slice(0, bodyEnd) + htmlToInject + html.slice(bodyEnd);
 	return {
 		response: new Response(injected, {
 			status: response.status,

package/src/astro/middleware.ts

@@ -71,6 +71,7 @@ import {
 	runWithContext,
 } from "../request-context.js";
 import type { PublishedRef } from "../scheduled-publish.js";
+import { parseCollectionSitemapName } from "../seo/sitemap-name.js";
 import { EmDashStorageError } from "../storage/types.js";
 import { isMissingTableError } from "../utils/db-errors.js";
 import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
@@ -590,7 +591,13 @@ function pushMetricsTimings(
 
 /** Public routes that require the runtime (sitemap, robots.txt, etc.) */
 const PUBLIC_RUNTIME_ROUTES = new Set(["/sitemap.xml", "/robots.txt"]);
-const SITEMAP_COLLECTION_RE = /^\/sitemap-[a-z][a-z0-9_]*\.xml$/;
+const SITEMAP_COLLECTION_RE = /^\/sitemap-([^/]+)\.xml$/;
+
+/** Whether `pathname` is a per-collection sitemap a collection could have. */
+function isCollectionSitemapPath(pathname: string): boolean {
+	const match = SITEMAP_COLLECTION_RE.exec(pathname);
+	return match !== null && parseCollectionSitemapName(match[1]!) !== null;
+}
 
 function isImageEndpointRequest(context: APIContext): boolean {
 	const route = virtualConfig?.imageEndpointRoute;
@@ -711,6 +718,26 @@ function applyBuildValidator(context: APIContext): void {
 	context.cache.set({ lastModified: buildDate });
 }
 
+const UNSHARED_CACHE_CONTROL_RE = /\b(?:private|no-store)\b/i;
+
+/**
+ * Route rules match by path, so a rule can cover responses rendered for a
+ * signed-in user or marked private by the route itself. Opting them out of the
+ * route cache keeps the shared edge cache from serving them to anyone else.
+ *
+ * Must run after next(): the route and its layout call `cache.set()` while
+ * rendering, which turns caching back on.
+ */
+function keepUnsharedResponsesOutOfRouteCache(context: APIContext, response: Response): void {
+	if (!context.cache?.enabled) return;
+	if (
+		context.locals.user ||
+		UNSHARED_CACHE_CONTROL_RE.test(response.headers.get("Cache-Control") ?? "")
+	) {
+		context.cache.set(false);
+	}
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { request, locals, cookies } = context;
 	const url = context.url;
@@ -742,7 +769,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// (logged-in editors need the runtime for toolbar/visual editing on public pages)
 		const isEmDashRoute = url.pathname.startsWith("/_emdash");
 		const isPublicRuntimeRoute =
-			PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
+			PUBLIC_RUNTIME_ROUTES.has(url.pathname) || isCollectionSitemapPath(url.pathname);
 
 		// Check for edit mode cookie - editors viewing public pages need the runtime
 		// so auth middleware can verify their session for visual editing
@@ -812,12 +839,21 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// bypasses runtime init and would crash with "no such table: options".
 				// Do a one-time lightweight probe using the same getDb() instance the
 				// page will use: if the migrations table doesn't exist, no migrations
-				// have ever run, and the page may only render once runtime init below
-				// has migrated the database.
+				// have ever run, and the page may only render once runtime init has
+				// migrated the database.
 				// Skip the probe when prerendering: the build database is legitimately
 				// empty in CI, and a response derived from it would be baked into the
 				// static page (session reads are already skipped for prerender above
 				// for the same reason).
+				// Runtime init starts before the probe so the two round trips overlap.
+				// Sub-phase timings are populated only on the cold init. Warm
+				// requests hit the cached runtime and leave this empty.
+				const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
+				const runtimeInitStart = performance.now();
+				const runtimeInit = config ? getRuntime(config, migrationMode, initSubTimings) : undefined;
+				// Awaited below unless the probe fails; then it settles in the background.
+				runtimeInit?.catch(() => {});
+
 				let unmigrated = false;
 				let probeFailed = false;
 				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
@@ -835,8 +871,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							// race, locked SQLite) must NOT be read as "fresh install". Leave the
 							// flag unset so a later request can re-verify, and fall through to
 							// render the page normally. Unless a runtime is already running,
-							// skip runtime init for this request: it would connect to the same
-							// database again and make the visitor wait through a second timeout.
+							// don't wait for runtime init on this request: it connects to the
+							// same database and would make the visitor wait through a second
+							// timeout. getRuntime anchors it with after(), so it can still
+							// finish for later requests.
 							probeFailed = !getRuntimeHolder().instance;
 							console.error("Setup probe failed (non-fatal):", error);
 						}
@@ -844,18 +882,14 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					timings.push({ name: "setup", dur: performance.now() - t0, desc: "Setup probe" });
 				}
 
-				// Initialize the runtime for page:metadata and page:fragments hooks.
+				// Wait for the runtime for page:metadata and page:fragments hooks.
 				// The runtime is a cached singleton — after the first request,
 				// getRuntime() is just a null-check. This enables SEO plugins to
 				// contribute meta tags for all visitors, not just logged-in editors,
 				// except on a request whose setup probe just failed.
-				if (config && !probeFailed) {
-					// Sub-phase timings are populated only on the cold init. Warm
-					// requests hit the cached runtime and leave this empty.
-					const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
-					const t0 = performance.now();
+				if (runtimeInit && !probeFailed) {
 					try {
-						const runtime = await getRuntime(config, migrationMode, initSubTimings);
+						const runtime = await runtimeInit;
 						markSetupVerified();
 						const handlePublicPluginApiRoute = createPublicPluginApiRouteHandler(runtime);
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
@@ -886,7 +920,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							console.error("[emdash] runtime init failed (page renders without CMS data):", error);
 						}
 					}
-					timings.push({ name: "rt", dur: performance.now() - t0, desc: "Runtime init" });
+					timings.push({
+						name: "rt",
+						dur: performance.now() - runtimeInitStart,
+						desc: "Runtime init",
+					});
 					// Append cold-only sub-phase timings so the breakdown is visible
 					// in Server-Timing (rt.db, rt.fts, rt.plugins, rt.site,
 					// rt.sandbox, rt.market, rt.hooks, rt.cron).
@@ -1202,6 +1240,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	try {
 		const response = await runWithContext({ editMode: false, queryRecorder, metrics }, run);
 		applyBuildValidator(context);
+		keepUnsharedResponsesOutOfRouteCache(context, response);
 		return response;
 	} finally {
 		// Streamed responses defer the flush to stream end (see

package/src/astro/routes/api/auth/handover.ts

@@ -0,0 +1,58 @@
+/**
+ * POST /_emdash/api/auth/handover
+ *
+ * Returns a single-use sign-in link for the current user at the site's
+ * chosen address: the configured `siteUrl`, otherwise the **Site URL**.
+ * After a domain change, passkeys created on the old address don't work on
+ * the new one, so this is how a signed-in user moves their session there.
+ * The link expires after 5 minutes and opens Security settings ready to add
+ * a passkey.
+ *
+ * Signed-in sessions only: bearer tokens are refused.
+ */
+
+import { createMagicLinkUrl } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import type { APIRoute } from "astro";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { checkRateLimit } from "#auth/rate-limit.js";
+
+export const prerender = false;
+
+const HANDOVER_EXPIRY_MS = 5 * 60 * 1000;
+const HANDOVER_REDIRECT = "/_emdash/admin/settings/security?addPasskey=1";
+
+export const POST: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	if (!user) {
+		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	}
+	if (locals.tokenScopes !== undefined) {
+		return apiError("FORBIDDEN", "Sign-in handover requires a signed-in session", 403);
+	}
+
+	try {
+		const rateLimit = await checkRateLimit(emdash.db, user.id, "auth/handover", 5, 300);
+		if (!rateLimit.allowed) {
+			return apiError("RATE_LIMITED", "Too many sign-in links. Try again in a few minutes.", 429);
+		}
+
+		const origin = await getChosenSiteOrigin(emdash.db, emdash.config);
+		if (!origin) {
+			return apiError("NO_SITE_URL", "Set a Site URL before continuing at another address", 409);
+		}
+
+		const url = await createMagicLinkUrl(createKyselyAdapter(emdash.db), user, origin, {
+			expiresInMs: HANDOVER_EXPIRY_MS,
+			redirect: HANDOVER_REDIRECT,
+		});
+		return apiSuccess({ url });
+	} catch (error) {
+		return handleError(error, "Failed to create a sign-in link", "SIGN_IN_HANDOVER_ERROR");
+	}
+};

package/src/astro/routes/api/auth/magic-link/verify.ts

@@ -7,7 +7,8 @@
  * otherwise use up the single-use token before the recipient clicks.
  *
  * POST verifies the token and creates the session.
- * Tokens are single-use and expire after 15 minutes.
+ * Tokens are single-use and expire after 15 minutes, or 5 minutes for
+ * sign-in handover links.
  */
 
 import type { APIRoute } from "astro";
@@ -21,6 +22,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { magicLinkVerifyBody } from "#api/schemas.js";
 
+import { after } from "../../../../../after.js";
 import { sessionUnavailableError } from "../../../../session-user.js";
 
 export const GET: APIRoute = async ({ url, redirect }) => {
@@ -50,8 +52,14 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		const adapter = createKyselyAdapter(emdash.db);
 		const user = await verifyMagicLink(adapter, body.token);
 
-		// Fire-and-forget cleanup of expired tokens -- prevents accumulation
-		void adapter.deleteExpiredTokens().catch(() => {});
+		// Cleanup of expired tokens -- prevents accumulation
+		after(async () => {
+			try {
+				await adapter.deleteExpiredTokens();
+			} catch (error) {
+				console.error("[magic-link] failed to delete expired tokens:", error);
+			}
+		});
 
 		session.set("user", { id: user.id });
 

package/src/astro/routes/api/auth/passkey/options.ts

@@ -22,6 +22,8 @@ import { checkRateLimit, getClientIp, rateLimitResponse } from "#auth/rate-limit
 import { getTrustedProxyHeaders } from "#auth/trusted-proxy.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
+import { after } from "../../../../../after.js";
+
 export const POST: APIRoute = async ({ request, locals }) => {
 	const { emdash } = locals;
 
@@ -30,8 +32,14 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	}
 
 	try {
-		// Fire-and-forget cleanup of expired challenges -- prevents accumulation
-		void cleanupExpiredChallenges(emdash.db).catch(() => {});
+		// Cleanup of expired challenges -- prevents accumulation
+		after(async () => {
+			try {
+				await cleanupExpiredChallenges(emdash.db);
+			} catch (error) {
+				console.error("[passkey] failed to delete expired challenges:", error);
+			}
+		});
 
 		// Parse body before rate limiting so malformed requests don't consume slots
 		const body = await parseOptionalBody(request, passkeyOptionsBody, {});

package/src/astro/routes/api/import/wordpress/execute.ts

@@ -678,6 +678,25 @@ export async function importContent(
 						});
 					}
 				}
+
+				if (
+					createdItem &&
+					post.status === "future" &&
+					createdAt &&
+					Date.parse(createdAt) > Date.now()
+				) {
+					const scheduled = await emdash.handleContentSchedule(
+						collection,
+						createdItem.id,
+						createdAt,
+					);
+					if (!scheduled.success) {
+						result.errors.push({
+							title: post.title || "Untitled",
+							error: `Imported as draft but failed to schedule: ${scheduled.error?.message ?? "Unknown error"}`,
+						});
+					}
+				}
 			} else {
 				result.errors.push({
 					title: post.title || "Untitled",

package/src/astro/routes/api/import/wordpress/rewrite-url-helpers.ts

@@ -106,6 +106,10 @@ export interface PortableTextBlock {
 	// For nested content like galleries
 	images?: PortableTextBlock[];
 	columns?: Array<{ content?: PortableTextBlock[] }>;
+	content?: PortableTextBlock[];
+	markDefs?: Array<Record<string, unknown>>;
+	rows?: Array<{ cells?: Array<{ markDefs?: Array<Record<string, unknown>> }> }>;
+	buttons?: Array<Record<string, unknown>>;
 	[key: string]: unknown;
 }
 
@@ -120,54 +124,88 @@ export function rewritePortableTextUrls(
 	let changed = false;
 	let urlsRewritten = 0;
 
-	for (const block of blocks) {
-		// Handle image blocks
-		if (block._type === "image" && block.asset?.url) {
-			const newUrl = findMatchingUrl(block.asset.url, exactMap, baseMap);
-			if (newUrl) {
-				block.asset.url = newUrl;
-				block.asset._ref = newUrl; // Also update the reference
-				changed = true;
-				urlsRewritten++;
-			}
-		}
-
-		// Handle image link URLs (for linked images). The link is a bare string on
-		// freshly imported content and `{ href, blank? }` once edited in the editor.
-		if (block._type === "image" && block.link) {
-			const linkHref = typeof block.link === "string" ? block.link : block.link.href;
-			const newUrl = linkHref ? findMatchingUrl(linkHref, exactMap, baseMap) : null;
-			if (newUrl) {
-				if (typeof block.link === "string") {
-					block.link = newUrl;
-				} else {
-					block.link.href = newUrl;
-				}
-				changed = true;
-				urlsRewritten++;
-			}
+	const rewriteField = (target: Record<string, unknown>, key: string): boolean => {
+		const value = target[key];
+		const newUrl = typeof value === "string" ? findMatchingUrl(value, exactMap, baseMap) : null;
+		if (!newUrl) return false;
+		target[key] = newUrl;
+		changed = true;
+		urlsRewritten++;
+		return true;
+	};
+	const rewriteHtml = (target: Record<string, unknown>, count = true) => {
+		if (typeof target.html !== "string") return;
+		const result = rewriteStringUrls(target.html, exactMap, baseMap);
+		if (result.changed) {
+			target.html = result.newValue;
+			changed = true;
+			if (count) urlsRewritten += result.urlsRewritten;
 		}
-
-		// Handle gallery blocks with nested images
-		if (block._type === "gallery" && Array.isArray(block.images)) {
-			const result = rewritePortableTextUrls(block.images, exactMap, baseMap);
-			if (result.changed) {
-				changed = true;
-				urlsRewritten += result.urlsRewritten;
-			}
+	};
+	const rewriteMarkDefs = (markDefs: Array<Record<string, unknown>> | undefined) => {
+		for (const def of markDefs ?? []) rewriteField(def, "href");
+	};
+	const rewriteNested = (content: PortableTextBlock[] | undefined) => {
+		if (!Array.isArray(content)) return;
+		const result = rewritePortableTextUrls(content, exactMap, baseMap);
+		if (result.changed) {
+			changed = true;
+			urlsRewritten += result.urlsRewritten;
 		}
+	};
 
-		// Handle columns blocks with nested content
-		if (block._type === "columns" && Array.isArray(block.columns)) {
-			for (const column of block.columns) {
-				if (Array.isArray(column.content)) {
-					const result = rewritePortableTextUrls(column.content, exactMap, baseMap);
-					if (result.changed) {
+	for (const block of blocks) {
+		switch (block._type) {
+			case "image":
+				if (block.asset?.url) {
+					const newUrl = findMatchingUrl(block.asset.url, exactMap, baseMap);
+					if (newUrl) {
+						block.asset.url = newUrl;
+						block.asset._ref = newUrl; // Also update the reference
 						changed = true;
-						urlsRewritten += result.urlsRewritten;
+						urlsRewritten++;
 					}
 				}
-			}
+				// The link is a bare string on freshly imported content and
+				// `{ href, blank? }` once edited in the editor.
+				if (typeof block.link === "string") {
+					rewriteField(block, "link");
+				} else if (block.link) {
+					rewriteField(block.link, "href");
+				}
+				break;
+			case "gallery":
+				rewriteNested(block.images);
+				break;
+			case "columns":
+				for (const column of block.columns ?? []) rewriteNested(column.content);
+				break;
+			case "cover":
+				rewriteField(block, "backgroundImage");
+				rewriteNested(block.content);
+				break;
+			case "block":
+				rewriteMarkDefs(block.markDefs);
+				break;
+			case "table":
+				for (const row of block.rows ?? []) {
+					for (const cell of row.cells ?? []) rewriteMarkDefs(cell.markDefs);
+				}
+				break;
+			case "file":
+			case "button":
+				rewriteField(block, "url");
+				break;
+			case "embed":
+				// The html carries the same media URL; count it only when the url didn't match
+				rewriteHtml(block, !rewriteField(block, "url"));
+				break;
+			case "htmlBlock":
+				rewriteHtml(block);
+				break;
+			case "buttons":
+				for (const button of block.buttons ?? []) rewriteField(button, "url");
+				break;
 		}
 	}
 

package/src/astro/routes/api/import/wordpress-plugin/execute.ts

@@ -1068,6 +1068,21 @@ export async function importContent(
 				if (item.translationGroup && !translationGroupMap.has(item.translationGroup) && createdId) {
 					translationGroupMap.set(item.translationGroup, createdId);
 				}
+
+				if (
+					createdId &&
+					item.status === "future" &&
+					createdAt &&
+					Date.parse(createdAt) > Date.now()
+				) {
+					const scheduled = await emdash.handleContentSchedule(collection, createdId, createdAt);
+					if (!scheduled.success) {
+						result.errors.push({
+							title: item.title || "Untitled",
+							error: `Imported as draft but failed to schedule: ${scheduled.error?.message ?? "Unknown error"}`,
+						});
+					}
+				}
 			} else {
 				result.errors.push({
 					title: item.title || "Untitled",

package/src/astro/routes/api/manifest.ts

@@ -33,6 +33,14 @@ export const GET: APIRoute = async ({ locals }) => {
 
 		// Determine auth mode from config
 		const authMode = getAuthMode(emdash?.config);
+		const providerManagedName =
+			authMode.type === "external" &&
+			!(
+				typeof authMode.config === "object" &&
+				authMode.config !== null &&
+				"syncName" in authMode.config &&
+				authMode.config.syncName === false
+			);
 
 		// Read admin branding from the per-request config plumbed through middleware
 		// (same source admin.astro reads from). Reading from a build-time global
@@ -88,6 +96,7 @@ export const GET: APIRoute = async ({ locals }) => {
 					...emdashManifest,
 					timezone: siteTimezone,
 					authMode: authMode.type === "external" ? authMode.providerType : "passkey",
+					providerManagedName,
 					signupEnabled,
 					admin: adminBranding,
 				}
@@ -100,6 +109,7 @@ export const GET: APIRoute = async ({ locals }) => {
 					timezone: siteTimezone,
 					taxonomies: [],
 					authMode: "passkey",
+					providerManagedName,
 					signupEnabled,
 					admin: adminBranding,
 				};

package/src/astro/routes/api/media/[id]/confirm.ts

@@ -19,6 +19,8 @@ import { enrichImageMetadata } from "#media/enrich.js";
 import type { MediaItem } from "#types";
 import { computeContentHash, MAX_CONTENT_HASH_BYTES } from "#utils/hash.js";
 
+import { after } from "../../../../../after.js";
+
 export const prerender = false;
 
 /**
@@ -244,6 +246,23 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		// Add URL to the response (relative URL for portability)
 		const itemWithUrl = addUrlToMedia(item);
 
+		if (emdash.hooks?.hasHooks("media:afterUpload")) {
+			after(async () => {
+				try {
+					await emdash.hooks.runMediaAfterUpload({
+						id: itemWithUrl.id,
+						filename: itemWithUrl.filename,
+						mimeType: itemWithUrl.mimeType,
+						size: itemWithUrl.size,
+						url: itemWithUrl.url,
+						createdAt: itemWithUrl.createdAt,
+					});
+				} catch (error) {
+					console.error("[media] afterUpload hook failed:", error);
+				}
+			});
+		}
+
 		return apiSuccess({ item: itemWithUrl });
 	} catch (error) {
 		return handleError(error, "Failed to confirm upload", "CONFIRM_ERROR");