emdash 1.1.0 → 1.3.0

package/dist/astro/index.mjs

@@ -1,23 +1,25 @@
-import "../runner-CskI4Hmq.mjs";
+import "../runner-C5NeAkBQ.mjs";
 import "../dialect-helpers-7_IqPdh9.mjs";
 import "../config-CvmjJcVw.mjs";
 import "../datetime-normalization-PeiEdcRY.mjs";
 import { t as INTERNAL_MEDIA_PREFIX } from "../normalize-BuWa0lvd.mjs";
-import { n as DEV_TYPEGEN_REFRESH_GLOBAL, t as DEV_TYPEGEN_REFRESH_EVENT } from "../dev-typegen-Dtl8AfS6.mjs";
-import { a as parseDurationSeconds, c as resolveRegistryConfigForSandbox, i as normalizeRegistryConfig } from "../config-BsJHiQxC.mjs";
-import { n as VERSION, t as COMMIT } from "../version-BaT8yKIT.mjs";
-import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-CFtudhyw.mjs";
-import { r as normalizeMigrationConfig } from "../policy-C5wrDXYV.mjs";
-import { c as normalizeAstroI18n, n as MIGRATION_CONFIG_SYMBOL, o as serializeMigrationManifest, r as createMigrationIntegrationMetadata, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-CTw4FmZk.mjs";
-import { r as getCoreMigrationIdentity } from "../identity-Dfrx2_Bc.mjs";
-import { A as VIRTUAL_SANDBOX_RUNNER_ID, B as generateConfigModule, C as VIRTUAL_CONFIG_ID, D as VIRTUAL_OBJECT_CACHE_ID, E as VIRTUAL_MEDIA_PROVIDERS_ID, F as generateAdminRegistryModule, G as generatePluginsModule, H as generateEnvModule, I as generateAuthModule, J as generateSchedulerModule, K as generateSandboxRunnerModule, L as generateAuthProvidersModule, M as VIRTUAL_SEED_ID, N as VIRTUAL_STORAGE_ID, O as VIRTUAL_PLUGINS_ID, P as VIRTUAL_WAIT_UNTIL_ID, R as generateBlockComponentsModule, S as VIRTUAL_BUILD_ID, T as VIRTUAL_ENV_ID, U as generateMediaProvidersModule, V as generateDialectModule, W as generateObjectCacheModule, X as generateStorageModule, Y as generateSeedModule, Z as generateWaitUntilModule, _ as RESOLVED_VIRTUAL_WAIT_UNTIL_ID, a as RESOLVED_VIRTUAL_BUILD_ID, b as VIRTUAL_AUTH_PROVIDERS_ID, c as RESOLVED_VIRTUAL_ENV_ID, d as RESOLVED_VIRTUAL_PLUGINS_ID, f as RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID, g as RESOLVED_VIRTUAL_STORAGE_ID, h as RESOLVED_VIRTUAL_SEED_ID, i as RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID, j as VIRTUAL_SCHEDULER_ID, k as VIRTUAL_SANDBOXED_PLUGINS_ID, l as RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID, m as RESOLVED_VIRTUAL_SCHEDULER_ID, n as RESOLVED_VIRTUAL_AUTH_ID, o as RESOLVED_VIRTUAL_CONFIG_ID, p as RESOLVED_VIRTUAL_SANDBOX_RUNNER_ID, q as generateSandboxedPluginsModule, r as RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID, s as RESOLVED_VIRTUAL_DIALECT_ID, t as RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID, u as RESOLVED_VIRTUAL_OBJECT_CACHE_ID, v as VIRTUAL_ADMIN_REGISTRY_ID, w as VIRTUAL_DIALECT_ID, x as VIRTUAL_BLOCK_COMPONENTS_ID, y as VIRTUAL_AUTH_ID, z as generateBuildModule } from "../virtual-modules-B6vJW15k.mjs";
+import { n as DEV_TYPEGEN_REFRESH_GLOBAL, t as DEV_TYPEGEN_REFRESH_EVENT } from "../dev-typegen-EBni_pOQ.mjs";
+import { a as parseDurationSeconds, c as resolveRegistryConfigForSandbox, i as normalizeRegistryConfig } from "../config-DBU6iUQB.mjs";
+import { n as VERSION, t as COMMIT } from "../version-DHmGpcch.mjs";
+import { r as getEnvSiteUrl } from "../public-url-Bt98vysr.mjs";
+import { n as validateAllowedOrigins, r as validateOriginShape } from "../allowed-origins-CEug-p0t.mjs";
+import { r as normalizeMigrationConfig } from "../policy-DLQ--Hnm.mjs";
+import { c as normalizeAstroI18n, n as MIGRATION_CONFIG_SYMBOL, o as serializeMigrationManifest, r as createMigrationIntegrationMetadata, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-B8zjuH3f.mjs";
+import { r as getCoreMigrationIdentity } from "../identity-Cael5uTT.mjs";
+import { A as VIRTUAL_SANDBOX_RUNNER_ID, B as generateConfigModule, C as VIRTUAL_CONFIG_ID, D as VIRTUAL_OBJECT_CACHE_ID, E as VIRTUAL_MEDIA_PROVIDERS_ID, F as generateAdminRegistryModule, G as generatePluginsModule, H as generateEnvModule, I as generateAuthModule, J as generateSchedulerModule, K as generateSandboxRunnerModule, L as generateAuthProvidersModule, M as VIRTUAL_SEED_ID, N as VIRTUAL_STORAGE_ID, O as VIRTUAL_PLUGINS_ID, P as VIRTUAL_WAIT_UNTIL_ID, R as generateBlockComponentsModule, S as VIRTUAL_BUILD_ID, T as VIRTUAL_ENV_ID, U as generateMediaProvidersModule, V as generateDialectModule, W as generateObjectCacheModule, X as generateStorageModule, Y as generateSeedModule, Z as generateWaitUntilModule, _ as RESOLVED_VIRTUAL_WAIT_UNTIL_ID, a as RESOLVED_VIRTUAL_BUILD_ID, b as VIRTUAL_AUTH_PROVIDERS_ID, c as RESOLVED_VIRTUAL_ENV_ID, d as RESOLVED_VIRTUAL_PLUGINS_ID, f as RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID, g as RESOLVED_VIRTUAL_STORAGE_ID, h as RESOLVED_VIRTUAL_SEED_ID, i as RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID, j as VIRTUAL_SCHEDULER_ID, k as VIRTUAL_SANDBOXED_PLUGINS_ID, l as RESOLVED_VIRTUAL_MEDIA_PROVIDERS_ID, m as RESOLVED_VIRTUAL_SCHEDULER_ID, n as RESOLVED_VIRTUAL_AUTH_ID, o as RESOLVED_VIRTUAL_CONFIG_ID, p as RESOLVED_VIRTUAL_SANDBOX_RUNNER_ID, q as generateSandboxedPluginsModule, r as RESOLVED_VIRTUAL_AUTH_PROVIDERS_ID, s as RESOLVED_VIRTUAL_DIALECT_ID, t as RESOLVED_VIRTUAL_ADMIN_REGISTRY_ID, u as RESOLVED_VIRTUAL_OBJECT_CACHE_ID, v as VIRTUAL_ADMIN_REGISTRY_ID, w as VIRTUAL_DIALECT_ID, x as VIRTUAL_BLOCK_COMPONENTS_ID, y as VIRTUAL_AUTH_ID, z as generateBuildModule } from "../virtual-modules-DO954n7P.mjs";
 import { createRequire } from "node:module";
-import { dirname, isAbsolute, join, relative, resolve, win32 } from "node:path";
+import { dirname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
 import { mkdir, rename, unlink, writeFile } from "node:fs/promises";
+import { request } from "node:https";
 import { fontProviders } from "astro/config";
-import { existsSync } from "node:fs";
 
 //#region src/astro/storage/adapters.ts
 /**
@@ -130,6 +132,223 @@ async function writeMigrationManifest(projectRoot, manifest, fileSystem = nodeFi
 	}
 }
 
+//#endregion
+//#region src/astro/integration/admin-locales.ts
+/**
+* Build-time support for the `admin.locales` allowlist: validates it against
+* the catalogs the installed admin package ships, and keeps excluded catalogs
+* out of the bundle by resolving their imports to the source-locale catalog.
+*/
+const SOURCE_LOCALE = "en";
+const MANIFEST_FILE = "locales-manifest.json";
+const QUERY_RE = /[?#].*$/;
+function isStringRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+/**
+* Read the locale manifest emitted by the `@emdash-cms/admin` build. Throws if
+* it is missing, malformed, lacks the source locale, or names a chunk that is
+* not in the dist directory.
+*/
+function readAdminLocaleManifest(adminDistPath) {
+	const manifestPath = resolve(adminDistPath, MANIFEST_FILE);
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch (error) {
+		throw new Error(`\`admin.locales\` needs the admin locale manifest at ${manifestPath}, but it could not be read. Reinstall or rebuild @emdash-cms/admin.`, { cause: error });
+	}
+	const locales = typeof parsed === "object" && parsed !== null && "locales" in parsed ? parsed.locales : void 0;
+	if (!isStringRecord(locales) || !Object.hasOwn(locales, SOURCE_LOCALE)) throw new Error(`The admin locale manifest at ${manifestPath} is invalid: expected a "locales" object mapping locale codes to chunk files, including "${SOURCE_LOCALE}". Reinstall or rebuild @emdash-cms/admin.`);
+	for (const [code, chunk] of Object.entries(locales)) if (!existsSync(resolve(adminDistPath, chunk))) throw new Error(`The admin locale manifest at ${manifestPath} lists "${chunk}" for "${code}", but that file does not exist. Reinstall or rebuild @emdash-cms/admin.`);
+	return locales;
+}
+function canonicalizeLocale(code) {
+	try {
+		return new Intl.Locale(code.trim()).baseName;
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve a user-supplied `admin.locales` list to the admin's own locale
+* codes. Matching ignores case and surrounding whitespace, the source locale
+* is always included first, and duplicates are dropped. Throws, naming every
+* unrecognized entry and listing the available codes, if any entry does not
+* match an available locale.
+*/
+function resolveAdminLocales(requested, available) {
+	if (!Array.isArray(requested)) throw new Error("`admin.locales` must be an array of locale codes.");
+	const entries = requested;
+	const byCanonical = /* @__PURE__ */ new Map();
+	for (const code of available) byCanonical.set(canonicalizeLocale(code) ?? code, code);
+	const resolved = new Set([SOURCE_LOCALE]);
+	const unknownEntries = [];
+	for (const entry of entries) {
+		const canonical = typeof entry === "string" ? canonicalizeLocale(entry) : void 0;
+		const code = canonical === void 0 ? void 0 : byCanonical.get(canonical);
+		if (code === void 0) unknownEntries.push(String(JSON.stringify(entry)));
+		else resolved.add(code);
+	}
+	if (unknownEntries.length > 0) {
+		const availableCodes = [...byCanonical.values()].toSorted().join(", ");
+		throw new Error(`Unknown admin locale${unknownEntries.length === 1 ? "" : "s"} in \`admin.locales\`: ${unknownEntries.join(", ")}. Available locales: ${availableCodes}.`);
+	}
+	return [...resolved];
+}
+function toVitePath(path) {
+	return path.replaceAll("\\", "/");
+}
+/**
+* Vite plugin that resolves imports of excluded admin catalogs to the source
+* locale's catalog, so the excluded catalogs are never bundled. Covers both
+* the built admin package (hashed chunks listed in the manifest) and, in dev,
+* the admin source (`./<code>/messages.mjs`).
+*/
+function createAdminLocaleResolverPlugin(options) {
+	const { manifest } = options;
+	const sourceLocaleChunk = manifest[SOURCE_LOCALE];
+	if (sourceLocaleChunk === void 0) throw new Error(`The admin locale manifest has no "${SOURCE_LOCALE}" catalog.`);
+	const allowed = new Set(options.locales);
+	const distDir = toVitePath(options.adminDistPath);
+	const sourceDir = options.adminSourcePath ? toVitePath(options.adminSourcePath) : void 0;
+	const redirects = /* @__PURE__ */ new Map();
+	for (const [code, chunk] of Object.entries(manifest)) {
+		if (code === SOURCE_LOCALE || allowed.has(code)) continue;
+		redirects.set(posix.join(distDir, chunk), posix.join(distDir, sourceLocaleChunk));
+		if (sourceDir) redirects.set(posix.join(sourceDir, "locales", code, "messages.mjs"), posix.join(distDir, "locales", SOURCE_LOCALE, "messages.mjs"));
+	}
+	return {
+		name: "emdash-admin-locales",
+		enforce: "pre",
+		resolveId(source, importer) {
+			if (!importer || !source.startsWith(".")) return;
+			const importerDir = posix.dirname(toVitePath(importer).replace(QUERY_RE, ""));
+			return redirects.get(posix.join(importerDir, source.replace(QUERY_RE, "")));
+		}
+	};
+}
+
+//#endregion
+//#region src/astro/integration/dev-env.ts
+const DEV_ENV_SECRET_VAR_NAMES = new Set(["EMDASH_ENCRYPTION_KEY"]);
+const NEWLINE_RE = /\r?\n/;
+/**
+* Parse a minimal subset of dotenv syntax, enough for the local secrets
+* scaffolder and common user edits. Inline comments, blank lines, and
+* lines without an `=` are ignored; leading/trailing whitespace is trimmed.
+* Single and double quotes are stripped; no variable expansion is performed.
+*/
+function parseDotenv(content) {
+	const result = {};
+	for (const rawLine of content.split(NEWLINE_RE)) {
+		const line = stripInlineComment(rawLine).trim();
+		if (line === "" || line.startsWith("#")) continue;
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		const key = line.slice(0, eq).trim();
+		let value = line.slice(eq + 1).trim();
+		if (value.length >= 2) {
+			const first = value[0];
+			const last = value.at(-1);
+			if ((first === "\"" || first === "'") && first === last) value = value.slice(1, -1).replaceAll(`\\${first}`, first);
+		}
+		result[key] = value;
+	}
+	return result;
+}
+/**
+* Remove an inline `#` comment only if it is not inside a quoted value. This
+* keeps values like `FOO="a # b"` intact while stripping trailing comments.
+*/
+function stripInlineComment(line) {
+	let inSingleQuote = false;
+	let inDoubleQuote = false;
+	for (let i = 0; i < line.length; i++) {
+		const char = line[i];
+		if (char === "'" && !inDoubleQuote) inSingleQuote = !inSingleQuote;
+		else if (char === "\"" && !inSingleQuote) inDoubleQuote = !inDoubleQuote;
+		else if (char === "#" && !inSingleQuote && !inDoubleQuote) return line.slice(0, i);
+	}
+	return line;
+}
+/**
+* Load the plugin-secret encryption key from the project's `.env` into
+* `process.env` during `astro dev`. Existing environment variables (e.g.
+* already exported in the shell, or set by the host platform) are honored and
+* never overwritten.
+*
+* This keeps the deliberate `process.env`-only rule in the secrets module
+* while letting freshly scaffolded Node sites use the generated encryption key
+* without a manual `export` step. Other EmDash variables are intentionally not
+* copied, so `.env` values intended for production do not accidentally replace
+* generated dev values (for example `SITE_URL`).
+*/
+function loadDevEnv(root) {
+	const envPath = join(typeof root === "string" ? root : fileURLToPath(root), ".env");
+	if (!existsSync(envPath)) return;
+	const parsed = parseDotenv(readFileSync(envPath, "utf-8"));
+	for (const [key, value] of Object.entries(parsed)) if (DEV_ENV_SECRET_VAR_NAMES.has(key) && !process.env[key]) process.env[key] = value;
+}
+
+//#endregion
+//#region src/astro/integration/dev-scheduler-bridge.ts
+const DEFAULT_INTERVAL_MS = 6e4;
+function postMaintenance(url) {
+	if (url.protocol !== "https:") return fetch(url, { method: "POST" });
+	return new Promise((resolve, reject) => {
+		const request$1 = request(url, {
+			method: "POST",
+			rejectUnauthorized: false,
+			agent: false
+		}, (response) => {
+			const status = response.statusCode ?? 500;
+			response.once("error", reject);
+			response.once("end", () => resolve({
+				ok: status >= 200 && status < 300,
+				status
+			}));
+			response.resume();
+		});
+		request$1.once("error", reject);
+		request$1.end();
+	});
+}
+function startDevSchedulerBridge(server, logger, options = {}) {
+	const httpServer = server.httpServer;
+	if (!httpServer) return;
+	const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+	let stopped = false;
+	let timer;
+	const schedule = () => {
+		if (stopped) return;
+		timer = setTimeout(() => void run(), intervalMs);
+		if (typeof timer === "object" && "unref" in timer) timer.unref();
+	};
+	const run = async () => {
+		try {
+			const origin = server.resolvedUrls?.local[0] ?? server.resolvedUrls?.network[0];
+			if (!origin) {
+				logger.warn("Dev scheduler bridge could not resolve the dev server origin.");
+				return;
+			}
+			const base = origin.endsWith("/") ? origin : `${origin}/`;
+			const url = new URL("_emdash/api/dev/scheduled-tasks", base);
+			const response = options.fetch ? await options.fetch(url, { method: "POST" }) : await postMaintenance(url);
+			if (!response.ok) logger.warn(`Dev scheduler bridge request failed with status ${response.status}. Verify that EmDash's dev maintenance route is available.`);
+		} catch (error) {
+			logger.warn(`Dev scheduler bridge request failed: ${error instanceof Error ? error.message : String(error)}`);
+		} finally {
+			schedule();
+		}
+	};
+	httpServer.once("listening", schedule);
+	httpServer.once("close", () => {
+		stopped = true;
+		if (timer !== void 0) clearTimeout(timer);
+	});
+}
+
 //#endregion
 //#region src/astro/integration/dev-typegen.ts
 /**
@@ -713,6 +932,18 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/settings/email",
 		entrypoint: resolveRoute("api/settings/email.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain",
+		entrypoint: resolveRoute("api/settings/domain.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain/notify",
+		entrypoint: resolveRoute("api/settings/domain-notify.ts")
+	});
+	injectRoute({
+		pattern: "/_emdash/api/site/domain-proof",
+		entrypoint: resolveRoute("api/site/domain-proof.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/settings/backups",
 		entrypoint: resolveRoute("api/settings/backups/index.ts")
@@ -1157,6 +1388,10 @@ function injectCoreRoutes(injectRoute, options = {}) {
 		pattern: "/_emdash/api/dev/emails",
 		entrypoint: resolveRoute("api/dev/emails.ts")
 	});
+	if (options.cloudflareDevScheduler) injectRoute({
+		pattern: "/_emdash/api/dev/scheduled-tasks",
+		entrypoint: resolveRoute("api/dev/scheduled-tasks.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/auth/me",
 		entrypoint: resolveRoute("api/auth/me.ts")
@@ -1245,6 +1480,10 @@ function injectBuiltinAuthRoutes(injectRoute) {
 		pattern: "/_emdash/api/auth/magic-link/verify",
 		entrypoint: resolveRoute("api/auth/magic-link/verify.ts")
 	});
+	injectRoute({
+		pattern: "/_emdash/api/auth/handover",
+		entrypoint: resolveRoute("api/auth/handover.ts")
+	});
 	injectRoute({
 		pattern: "/_emdash/api/auth/oauth/[provider]",
 		entrypoint: resolveRoute("api/auth/oauth/[provider].ts")
@@ -1359,7 +1598,7 @@ function resolveIntegrationShim(fileName) {
 /**
 * Creates the EmDash virtual modules Vite plugin.
 */
-function createVirtualModulesPlugin(options, astroCommand) {
+function createVirtualModulesPlugin(options) {
 	const { serializableConfig, resolvedConfig, pluginDescriptors, astroConfig } = options;
 	let viteCommand;
 	const buildTime = Date.now();
@@ -1415,10 +1654,7 @@ function createVirtualModulesPlugin(options, astroCommand) {
 			if (id === RESOLVED_VIRTUAL_BLOCK_COMPONENTS_ID) return generateBlockComponentsModule(pluginDescriptors);
 			if (id === RESOLVED_VIRTUAL_SEED_ID) return generateSeedModule(fileURLToPath(astroConfig.root), viteCommand === "serve");
 			if (id === RESOLVED_VIRTUAL_WAIT_UNTIL_ID) return generateWaitUntilModule(astroConfig.adapter?.name);
-			if (id === RESOLVED_VIRTUAL_SCHEDULER_ID) {
-				const schedulerCommand = astroCommand === "dev" ? "serve" : "build";
-				return generateSchedulerModule(astroConfig.adapter?.name, schedulerCommand);
-			}
+			if (id === RESOLVED_VIRTUAL_SCHEDULER_ID) return generateSchedulerModule(astroConfig.adapter?.name);
 			if (id === RESOLVED_VIRTUAL_ENV_ID) return generateEnvModule(astroConfig.adapter?.name);
 			if (id === RESOLVED_VIRTUAL_BUILD_ID) return generateBuildModule(buildTime);
 		}
@@ -1477,6 +1713,7 @@ function createViteConfig(options, command) {
 	const hasAstroConsoleLogger = canResolveProjectDependency(projectRoot, "astro/logger/console");
 	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : void 0;
 	const useSource = adminSourcePath !== void 0;
+	const adminLocales = options.resolvedConfig.admin?.locales;
 	const useSyncExternalStoreShimPath = resolveIntegrationShim("use-sync-external-store.js");
 	const useSyncExternalStoreWithSelectorShimPath = resolveIntegrationShim("use-sync-external-store-with-selector.js");
 	const configuredWatchIgnored = options.astroConfig.vite?.server?.watch?.ignored;
@@ -1485,7 +1722,8 @@ function createViteConfig(options, command) {
 		define: {
 			__EMDASH_VERSION__: JSON.stringify(VERSION),
 			__EMDASH_COMMIT__: JSON.stringify(COMMIT),
-			__EMDASH_PSEUDO_LOCALE__: JSON.stringify(isDev && process.env["EMDASH_PSEUDO_LOCALE"] === "1")
+			__EMDASH_PSEUDO_LOCALE__: JSON.stringify(isDev && process.env["EMDASH_PSEUDO_LOCALE"] === "1"),
+			__EMDASH_ADMIN_LOCALES__: JSON.stringify(adminLocales ?? null)
 		},
 		resolve: {
 			dedupe: [
@@ -1521,7 +1759,13 @@ function createViteConfig(options, command) {
 			]
 		},
 		plugins: [
-			createVirtualModulesPlugin(options, command),
+			createVirtualModulesPlugin(options),
+			...adminLocales ? [createAdminLocaleResolverPlugin({
+				adminDistPath,
+				adminSourcePath,
+				locales: adminLocales,
+				manifest: readAdminLocaleManifest(adminDistPath)
+			})] : [],
 			...cloudflare ? [] : [createWorkersBuiltinsExternalPlugin()],
 			...useSource ? [linguiMacroPlugin(adminSourcePath, adminDistPath)] : []
 		],
@@ -1626,7 +1870,8 @@ function createViteConfig(options, command) {
 				"emdash > @emdash-cms/admin > @codemirror/language",
 				"emdash > @emdash-cms/admin > @codemirror/state",
 				"emdash > @emdash-cms/admin > @codemirror/view",
-				"emdash > @emdash-cms/admin > @lezer/highlight"
+				"emdash > @emdash-cms/admin > @lezer/highlight",
+				"emdash > @emdash-cms/admin > react-day-picker/locale/*"
 			] : [
 				"@emdash-cms/admin",
 				"@astrojs/react/client.js",
@@ -1679,12 +1924,47 @@ function resolveAstroVersion() {
 		return;
 	}
 }
+/**
+* `@emdash-cms/cloudflare` depends on the exact `emdash` version it was
+* released with. A site that upgrades only one of the two installs a second
+* copy of `emdash` for the adapter, so warn when the installed adapter's
+* version differs from this one.
+*
+* @internal Exported for unit testing.
+*/
+function adapterVersionMismatchWarning(root, version = VERSION) {
+	if (version === "dev") return void 0;
+	for (let dir = fileURLToPath(root); dir !== dirname(dir); dir = dirname(dir)) {
+		const file = join(dir, "node_modules", "@emdash-cms", "cloudflare", "package.json");
+		if (!existsSync(file)) continue;
+		let pkg;
+		try {
+			pkg = JSON.parse(readFileSync(file, "utf8"));
+		} catch {
+			return;
+		}
+		if (typeof pkg.version !== "string" || pkg.version === version) return void 0;
+		return `@emdash-cms/cloudflare ${pkg.version} does not match emdash ${version}, so the adapter runs against its own copy of emdash ${pkg.version}. Install the same version of both packages, for example:\n\n  npm install emdash@${version} @emdash-cms/cloudflare@${version}`;
+	}
+}
 /** Default storage: Local filesystem in .emdash directory */
 const DEFAULT_STORAGE = local({
 	directory: "./.emdash/uploads",
 	baseUrl: "/_emdash/api/media/file"
 });
 /**
+* Resolve the site origin for `image.remotePatterns`: the configured `siteUrl`,
+* then `EMDASH_SITE_URL` / `SITE_URL`. Astro bakes `remotePatterns` into the
+* build output, so the env vars only take effect if they are set when
+* `astro build` runs.
+*
+* @internal Exported for unit testing.
+*/
+function resolveBuildTimeSiteUrl(configuredSiteUrl) {
+	if (configuredSiteUrl) return configuredSiteUrl;
+	return getEnvSiteUrl();
+}
+/**
 * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
 *
 * Astro's image services only build a transform URL for sources allowed via
@@ -1722,8 +2002,9 @@ function buildImageRemotePatterns(storage, siteUrl, command) {
 		}
 	} catch {}
 	if (siteUrl) try {
-		patterns.push({
-			hostname: new URL(siteUrl).hostname,
+		const { hostname } = new URL(siteUrl);
+		if (!hostname.includes("*")) patterns.push({
+			hostname,
 			pathname: `${INTERNAL_MEDIA_PREFIX}**`
 		});
 	} catch {}
@@ -1951,9 +2232,17 @@ function emdash(config = {}) {
 		if (descriptor.componentsEntry) throw new Error(`Plugin "${descriptor.id}" is standard format but declares componentsEntry. Portable Text block components require native format. Remove componentsEntry or change format to "native".`);
 	}
 	for (const descriptor of sandboxedDescriptors) if (descriptor.format !== "standard") throw new Error(`Plugin "${descriptor.id}" uses the native format and cannot be placed in \`sandboxed: []\`. Native plugins can only run in \`plugins: []\`. To sandbox this plugin, convert it to the standard format.`);
+	if (config.admin?.locales !== void 0) {
+		const manifest = readAdminLocaleManifest(resolveAdminDist());
+		resolvedConfig.admin = {
+			...config.admin,
+			locales: resolveAdminLocales(config.admin.locales, Object.keys(manifest))
+		};
+	}
 	const serializableConfig = buildSerializableConfig(resolvedConfig);
 	const useExternalAuth = !!(resolvedConfig.auth && "entrypoint" in resolvedConfig.auth);
 	let astroCommand;
+	let usesCloudflareAdapter = false;
 	let normalizedI18n = null;
 	const migrationMetadata = createMigrationIntegrationMetadata(resolvedConfig.database);
 	const integration = {
@@ -1961,8 +2250,14 @@ function emdash(config = {}) {
 		hooks: {
 			"astro:config:setup": ({ injectRoute: astroInjectRoute, addMiddleware, logger, updateConfig, config: astroConfig, command }) => {
 				astroCommand = command;
+				usesCloudflareAdapter = astroConfig.adapter?.name === "@astrojs/cloudflare";
 				normalizeRegistryConfig(registry, { allowLocalhost: command === "dev" || command === "sync" });
 				printBanner(logger);
+				if (command === "dev") try {
+					loadDevEnv(astroConfig.root);
+				} catch (error) {
+					logger.warn(`Failed to load EMDASH_ENCRYPTION_KEY from .env: ${String(error)}`);
+				}
 				const astroVersion = resolveAstroVersion();
 				if (astroVersion !== void 0) serializableConfig.astroVersion = astroVersion;
 				serializableConfig.astroCspEnabled = Boolean(astroConfig.security.csp);
@@ -1996,7 +2291,7 @@ function emdash(config = {}) {
 						"sans-serif"
 					]
 				}];
-				const imageRemotePatterns = buildImageRemotePatterns(resolvedConfig.storage, resolvedConfig.siteUrl, command);
+				const imageRemotePatterns = buildImageRemotePatterns(resolvedConfig.storage, resolveBuildTimeSiteUrl(resolvedConfig.siteUrl), command);
 				const { entrypoint: imageEndpoint, warn: imageEndpointWarning } = resolveImageEndpoint({
 					imagesDisabled: resolvedConfig.images === false,
 					currentEntrypoint: astroConfig.image?.endpoint?.entrypoint,
@@ -2024,7 +2319,10 @@ function emdash(config = {}) {
 					...route,
 					prerender: false
 				});
-				injectCoreRoutes(injectRoute, { srcDir: astroConfig.srcDir });
+				injectCoreRoutes(injectRoute, {
+					srcDir: astroConfig.srcDir,
+					cloudflareDevScheduler: command === "dev" && usesCloudflareAdapter
+				});
 				if (resolvedConfig.authProviders?.length) injectAuthProviderRoutes(injectRoute, resolvedConfig.authProviders);
 				if (!useExternalAuth) injectBuiltinAuthRoutes(injectRoute);
 				if (resolvedConfig.mcp !== false) injectMcpRoute(injectRoute);
@@ -2033,6 +2331,8 @@ function emdash(config = {}) {
 			"astro:config:done": async ({ config: finalConfig, logger }) => {
 				const warning = missingReactIntegrationWarning(finalConfig.integrations);
 				if (warning) logger.warn(warning);
+				const adapterWarning = adapterVersionMismatchWarning(finalConfig.root);
+				if (adapterWarning) logger.warn(adapterWarning);
 				const sessionWarning = useExternalAuth ? void 0 : missingSessionDriverWarning(finalConfig.session);
 				if (sessionWarning) logger.warn(sessionWarning);
 				if (astroCommand !== "build" && astroCommand !== "sync") return;
@@ -2052,6 +2352,7 @@ function emdash(config = {}) {
 				await writeMigrationManifest(fileURLToPath(finalConfig.root), manifest);
 			},
 			"astro:server:setup": ({ server, logger }) => {
+				if (astroCommand === "dev" && usesCloudflareAdapter) startDevSchedulerBridge(server, logger);
 				if (astroCommand === "dev") server.httpServer?.once("listening", () => {
 					const address = server.httpServer?.address();
 					if (!address || typeof address === "string") return;