emdash 1.1.0 → 1.3.0

package/src/astro/integration/index.ts

@@ -10,11 +10,14 @@
  * to avoid bundling Node.js-only code into the production build.
  */
 
+import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import type { AstroIntegration, AstroIntegrationLogger, AstroIntegrationMiddleware } from "astro";
 
+import { getEnvSiteUrl } from "../../api/public-url.js";
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
 import { normalizeMigrationConfig } from "../../database/migrations/policy.js";
 import { normalizeAstroI18n } from "../../i18n/normalize.js";
@@ -34,6 +37,9 @@ import {
 } from "../../registry/config.js";
 import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
+import { readAdminLocaleManifest, resolveAdminLocales } from "./admin-locales.js";
+import { loadDevEnv } from "./dev-env.js";
+import { startDevSchedulerBridge } from "./dev-scheduler-bridge.js";
 import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
 import { notoSans } from "./font-provider.js";
 import {
@@ -43,7 +49,7 @@ import {
 	injectMcpRoute,
 } from "./routes.js";
 import type { EmDashConfig } from "./runtime.js";
-import { createViteConfig } from "./vite-config.js";
+import { createViteConfig, resolveAdminDist } from "./vite-config.js";
 
 // Re-export runtime types and functions
 export type {
@@ -71,18 +77,64 @@ function resolveAstroVersion(): string | undefined {
 	}
 }
 
+/**
+ * `@emdash-cms/cloudflare` depends on the exact `emdash` version it was
+ * released with. A site that upgrades only one of the two installs a second
+ * copy of `emdash` for the adapter, so warn when the installed adapter's
+ * version differs from this one.
+ *
+ * @internal Exported for unit testing.
+ */
+export function adapterVersionMismatchWarning(
+	root: URL,
+	version: string = VERSION,
+): string | undefined {
+	if (version === "dev") return undefined;
+	for (let dir = fileURLToPath(root); dir !== dirname(dir); dir = dirname(dir)) {
+		const file = join(dir, "node_modules", "@emdash-cms", "cloudflare", "package.json");
+		if (!existsSync(file)) continue;
+		let pkg: { version?: unknown };
+		try {
+			pkg = JSON.parse(readFileSync(file, "utf8")) as { version?: unknown };
+		} catch {
+			return undefined;
+		}
+		if (typeof pkg.version !== "string" || pkg.version === version) return undefined;
+		return (
+			`@emdash-cms/cloudflare ${pkg.version} does not match emdash ${version}, ` +
+			`so the adapter runs against its own copy of emdash ${pkg.version}. ` +
+			`Install the same version of both packages, for example:\n\n` +
+			`  npm install emdash@${version} @emdash-cms/cloudflare@${version}`
+		);
+	}
+	return undefined;
+}
+
 /** Default storage: Local filesystem in .emdash directory */
 const DEFAULT_STORAGE = local({
 	directory: "./.emdash/uploads",
 	baseUrl: "/_emdash/api/media/file",
 });
 
-interface ImageRemotePattern {
+export interface ImageRemotePattern {
 	protocol?: "http" | "https";
 	hostname?: string;
 	pathname?: string;
 }
 
+/**
+ * Resolve the site origin for `image.remotePatterns`: the configured `siteUrl`,
+ * then `EMDASH_SITE_URL` / `SITE_URL`. Astro bakes `remotePatterns` into the
+ * build output, so the env vars only take effect if they are set when
+ * `astro build` runs.
+ *
+ * @internal Exported for unit testing.
+ */
+export function resolveBuildTimeSiteUrl(configuredSiteUrl: string | undefined): string | undefined {
+	if (configuredSiteUrl) return configuredSiteUrl;
+	return getEnvSiteUrl();
+}
+
 /**
  * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
  *
@@ -142,10 +194,12 @@ export function buildImageRemotePatterns(
 
 	if (siteUrl) {
 		try {
-			patterns.push({
-				hostname: new URL(siteUrl).hostname,
-				pathname: `${INTERNAL_MEDIA_PREFIX}**`,
-			});
+			const { hostname } = new URL(siteUrl);
+			// WHATWG URL accepts `*` in a hostname, which Astro's matcher treats
+			// as a wildcard that would allowlist other hosts.
+			if (!hostname.includes("*")) {
+				patterns.push({ hostname, pathname: `${INTERNAL_MEDIA_PREFIX}**` });
+			}
 		} catch {
 			// ignore an unparseable site URL
 		}
@@ -459,8 +513,9 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 
 	// Validate siteUrl if provided in astro.config.mjs.
 	// Env-var fallback (EMDASH_SITE_URL / SITE_URL) is handled at runtime by
-	// getPublicOrigin() in api/public-url.ts — NOT here — so Docker images built
-	// without a domain can pick it up at container start via process.env.
+	// getPublicOrigin() in api/public-url.ts — don't fold it into
+	// resolvedConfig.siteUrl here — so Docker images built without a domain can
+	// pick it up at container start via process.env.
 	if (resolvedConfig.siteUrl) {
 		const raw = resolvedConfig.siteUrl;
 		try {
@@ -530,6 +585,14 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		}
 	}
 
+	if (config.admin?.locales !== undefined) {
+		const manifest = readAdminLocaleManifest(resolveAdminDist());
+		resolvedConfig.admin = {
+			...config.admin,
+			locales: resolveAdminLocales(config.admin.locales, Object.keys(manifest)),
+		};
+	}
+
 	// Resolved plugins (populated at build time by importing entrypoints)
 	let _resolvedPlugins: ResolvedPlugin[] = [];
 
@@ -544,6 +607,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 	// Captured in astro:config:setup so the astro:server:setup hook can tell
 	// whether we're running `astro dev` (where the dev-bypass shortcut applies).
 	let astroCommand: "dev" | "build" | "preview" | "sync" | undefined;
+	let usesCloudflareAdapter = false;
 	let normalizedI18n: ReturnType<typeof normalizeAstroI18n> = null;
 	const migrationMetadata = createMigrationIntegrationMetadata(resolvedConfig.database);
 
@@ -559,10 +623,24 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				command,
 			}) => {
 				astroCommand = command;
+				usesCloudflareAdapter = astroConfig.adapter?.name === "@astrojs/cloudflare";
 				normalizeRegistryConfig(registry, {
 					allowLocalhost: command === "dev" || command === "sync",
 				});
 				printBanner(logger);
+				if (command === "dev") {
+					// In Node `astro dev`, Vite loads `.env` into `import.meta.env`
+					// but not `process.env`. The plugin-secret encryption key
+					// intentionally reads only `process.env`, so a freshly
+					// scaffolded site can't save secret plugin settings until the
+					// key is copied over. Load only `EMDASH_ENCRYPTION_KEY` here,
+					// honoring any value already present in the shell.
+					try {
+						loadDevEnv(astroConfig.root);
+					} catch (error: unknown) {
+						logger.warn(`Failed to load EMDASH_ENCRYPTION_KEY from .env: ${String(error)}`);
+					}
+				}
 				// Capture the host's Astro version so the runtime can expose it
 				// to the admin and the registry install gate for `env:astro`
 				// constraint checks.
@@ -641,7 +719,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				// merges arrays, so user-configured remotePatterns are preserved.
 				const imageRemotePatterns = buildImageRemotePatterns(
 					resolvedConfig.storage,
-					resolvedConfig.siteUrl,
+					resolveBuildTimeSiteUrl(resolvedConfig.siteUrl),
 					command,
 				);
 
@@ -688,7 +766,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					astroInjectRoute({ ...route, prerender: false });
 
 				// Inject all core routes
-				injectCoreRoutes(injectRoute, { srcDir: astroConfig.srcDir });
+				injectCoreRoutes(injectRoute, {
+					srcDir: astroConfig.srcDir,
+					cloudflareDevScheduler: command === "dev" && usesCloudflareAdapter,
+				});
 
 				// Inject routes from pluggable auth providers (authProviders config)
 				if (resolvedConfig.authProviders?.length) {
@@ -716,6 +797,8 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			"astro:config:done": async ({ config: finalConfig, logger }) => {
 				const warning = missingReactIntegrationWarning(finalConfig.integrations);
 				if (warning) logger.warn(warning);
+				const adapterWarning = adapterVersionMismatchWarning(finalConfig.root);
+				if (adapterWarning) logger.warn(adapterWarning);
 				const sessionWarning = useExternalAuth
 					? undefined
 					: missingSessionDriverWarning(finalConfig.session);
@@ -744,6 +827,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				await writeMigrationManifest(fileURLToPath(finalConfig.root), manifest);
 			},
 			"astro:server:setup": ({ server, logger }) => {
+				if (astroCommand === "dev" && usesCloudflareAdapter) {
+					startDevSchedulerBridge(server, logger);
+				}
+
 				// Print route info with absolute, clickable URLs once the server
 				// is listening. Only in `astro dev` -- the dev-bypass shortcut is
 				// dev-only and the port is unknown until now.

package/src/astro/integration/routes.ts

@@ -44,6 +44,7 @@ type InjectRoute = (route: { pattern: string; entrypoint: string }) => void;
 
 interface InjectCoreRoutesOptions {
 	srcDir?: URL;
+	cloudflareDevScheduler?: boolean;
 }
 
 const ROUTE_OVERRIDE_EXTENSIONS = [
@@ -485,6 +486,21 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/settings/email.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain",
+		entrypoint: resolveRoute("api/settings/domain.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/settings/domain/notify",
+		entrypoint: resolveRoute("api/settings/domain-notify.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/site/domain-proof",
+		entrypoint: resolveRoute("api/site/domain-proof.ts"),
+	});
+
 	// Backup routes
 	injectRoute({
 		pattern: "/_emdash/api/settings/backups",
@@ -1085,6 +1101,13 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/dev/emails.ts"),
 	});
 
+	if (options.cloudflareDevScheduler) {
+		injectRoute({
+			pattern: "/_emdash/api/dev/scheduled-tasks",
+			entrypoint: resolveRoute("api/dev/scheduled-tasks.ts"),
+		});
+	}
+
 	// Current user endpoint (always available)
 	injectRoute({
 		pattern: "/_emdash/api/auth/me",
@@ -1205,6 +1228,11 @@ export function injectBuiltinAuthRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/auth/magic-link/verify.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/auth/handover",
+		entrypoint: resolveRoute("api/auth/handover.ts"),
+	});
+
 	// OAuth routes
 	injectRoute({
 		pattern: "/_emdash/api/auth/oauth/[provider]",

package/src/astro/integration/runtime.ts

@@ -322,7 +322,8 @@ export interface EmDashConfig {
 	 *     audience: "abc123...",
 	 *     roleMapping: {
 	 *       "Admins": 50,
-	 *       "Editors": 30,
+	 *       "Editors": 40, // Editor
+	 *       "Authors": 30, // Author
 	 *     },
 	 *   }),
 	 * })
@@ -652,6 +653,21 @@ export interface EmDashConfig {
 		footerLabel?: string | false;
 		/** URL or path to a custom favicon for the admin panel. */
 		favicon?: string;
+		/**
+		 * Build-time allowlist of admin UI locales to ship.
+		 *
+		 * Only the listed locales are bundled and offered in the language
+		 * switcher; other locales fall back to English. `en` is always
+		 * included. Unknown codes fail the build.
+		 *
+		 * @example
+		 * ```ts
+		 * emdash({
+		 *   admin: { locales: ["en", "de"] },
+		 * })
+		 * ```
+		 */
+		locales?: string[];
 	};
 
 	/**

package/src/astro/integration/virtual-modules.ts

@@ -528,30 +528,23 @@ export function generateBuildModule(buildTime: number): string {
  * Generates the scheduler virtual module.
  *
  * Decides — at build time, from the Astro adapter — whether the runtime gets a
- * long-lived timer heartbeat. A *production* Cloudflare build has no persistent
- * timers, so the Worker's `scheduled()` handler (a Cron Trigger) drives
- * `runScheduledTasks()` instead and this exports `null`. Every other case — any
- * other adapter (Node, Bun), and crucially local `astro dev` even under the
- * Cloudflare adapter (no Cron Trigger fires in dev) — gets a `NodeCronScheduler`
- * factory so plugin cron, scheduled publishing, and cleanup still run.
+ * long-lived timer heartbeat. Cloudflare Workers have no persistent timers, so
+ * the Worker's `scheduled()` handler drives `runScheduledTasks()` instead. In
+ * local dev the long-lived Vite host invokes an EmDash-owned route that runs
+ * the same maintenance inside workerd. Other adapters (Node, Bun) get a
+ * `NodeCronScheduler` factory.
  *
  * Keeping the adapter check here — rather than in core's runtime — means the
  * runtime has no Cloudflare-specific code path; it just calls `createScheduler`
  * if one was injected. Mirrors the wait-until module's approach.
  */
-export function generateSchedulerModule(
-	adapterName: string | undefined,
-	command: "build" | "serve" | undefined,
-): string {
-	// Only suppress the timer for an actual Cloudflare *build* — that artifact
-	// runs in workerd where a Cron Trigger drives scheduled work. In `serve`
-	// (local dev) nothing fires the Cron Trigger, so fall through to the timer.
-	if (adapterName === "@astrojs/cloudflare" && command !== "serve") {
-		return `// Serverless build: an external Cron Trigger drives scheduled work.
+export function generateSchedulerModule(adapterName: string | undefined): string {
+	if (adapterName === "@astrojs/cloudflare") {
+		return `// Cloudflare: an external platform event drives scheduled work.
 export const createScheduler = null;
 `;
 	}
-	return `// Long-lived runtime (or local dev): drive scheduled work from an in-process timer.
+	return `// Long-lived runtime: drive scheduled work from an in-process timer.
 import { NodeCronScheduler } from "emdash";
 
 export function createScheduler(executor) {

package/src/astro/integration/vite-config.ts

@@ -14,6 +14,7 @@ import type { AstroConfig } from "astro";
 import type { Plugin } from "vite";
 
 import { COMMIT, VERSION } from "../../version.js";
+import { createAdminLocaleResolverPlugin, readAdminLocaleManifest } from "./admin-locales.js";
 import type { EmDashConfig, PluginDescriptor } from "./runtime.js";
 import {
 	VIRTUAL_CONFIG_ID,
@@ -120,7 +121,7 @@ export function linguiMacroPlugin(adminSourcePath: string, adminDistPath: string
  * Resolve path to the admin package dist directory.
  * Used for Vite alias to ensure the package is found in pnpm's isolated node_modules.
  */
-function resolveAdminDist(): string {
+export function resolveAdminDist(): string {
 	const require = createRequire(import.meta.url);
 	const adminPath = require.resolve("@emdash-cms/admin");
 	// Return the directory containing the built package (dist/)
@@ -182,10 +183,7 @@ export interface VitePluginOptions {
 /**
  * Creates the EmDash virtual modules Vite plugin.
  */
-export function createVirtualModulesPlugin(
-	options: VitePluginOptions,
-	astroCommand: "dev" | "build" | "preview" | "sync",
-): Plugin {
+export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 	const { serializableConfig, resolvedConfig, pluginDescriptors, astroConfig } = options;
 
 	let viteCommand: "build" | "serve" | undefined;
@@ -337,17 +335,9 @@ export function createVirtualModulesPlugin(
 			}
 			// Generate scheduler module — a NodeCronScheduler factory on
 			// long-lived runtimes, or null under the Cloudflare adapter where
-			// a Cron Trigger drives scheduled work instead.
-			//
-			// Decide from Astro's command, not Vite's config.command: the
-			// Cloudflare adapter builds the worker bundle via a nested Vite
-			// *build* pass even during `astro dev`, so viteCommand reports
-			// "build" and would wrongly suppress the in-process timer (#1635).
-			// Astro's command stays "dev", which is the only case that should
-			// fall through to a NodeCronScheduler.
+			// platform events drive scheduled work.
 			if (id === RESOLVED_VIRTUAL_SCHEDULER_ID) {
-				const schedulerCommand = astroCommand === "dev" ? "serve" : "build";
-				return generateSchedulerModule(astroConfig.adapter?.name, schedulerCommand);
+				return generateSchedulerModule(astroConfig.adapter?.name);
 			}
 			// Generate env module — re-exports cloudflare:workers' env under
 			// the Cloudflare adapter, undefined otherwise (#1736).
@@ -425,6 +415,7 @@ export function createViteConfig(
 
 	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : undefined;
 	const useSource = adminSourcePath !== undefined;
+	const adminLocales = options.resolvedConfig.admin?.locales;
 	const useSyncExternalStoreShimPath = resolveIntegrationShim("use-sync-external-store.js");
 	const useSyncExternalStoreWithSelectorShimPath = resolveIntegrationShim(
 		"use-sync-external-store-with-selector.js",
@@ -445,6 +436,7 @@ export function createViteConfig(
 			__EMDASH_PSEUDO_LOCALE__: JSON.stringify(
 				isDev && process.env["EMDASH_PSEUDO_LOCALE"] === "1",
 			),
+			__EMDASH_ADMIN_LOCALES__: JSON.stringify(adminLocales ?? null),
 		},
 		resolve: {
 			dedupe: ["@emdash-cms/admin", "react", "react-dom"],
@@ -492,7 +484,19 @@ export function createViteConfig(
 		},
 		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Monorepo has both vite 6 (docs) and vite 7 (core). tsgo resolves correctly.
 		plugins: [
-			createVirtualModulesPlugin(options, command),
+			createVirtualModulesPlugin(options),
+			// Must precede the Lingui macro plugin, which redirects source
+			// catalog imports to dist/ in dev.
+			...(adminLocales
+				? [
+						createAdminLocaleResolverPlugin({
+							adminDistPath,
+							adminSourcePath,
+							locales: adminLocales,
+							manifest: readAdminLocaleManifest(adminDistPath),
+						}),
+					]
+				: []),
 			...(cloudflare ? [] : [createWorkersBuiltinsExternalPlugin()]),
 			// In dev mode with source alias, compile Lingui macros on the fly
 			// and redirect locale .mjs imports to dist/.
@@ -657,6 +661,8 @@ export function createViteConfig(
 						"emdash > @emdash-cms/admin > @codemirror/state",
 						"emdash > @emdash-cms/admin > @codemirror/view",
 						"emdash > @emdash-cms/admin > @lezer/highlight",
+						// Each admin language loads its date locale on first use.
+						"emdash > @emdash-cms/admin > react-day-picker/locale/*",
 					]
 				: [
 						"@emdash-cms/admin",

package/src/astro/middleware/auth.ts

@@ -114,6 +114,7 @@ const PUBLIC_API_EXACT = new Set([
 	"/_emdash/api/auth/passkey/verify",
 	"/_emdash/api/auth/mode",
 	"/_emdash/api/health",
+	"/_emdash/api/site/domain-proof",
 	"/_emdash/api/oauth/token",
 	"/_emdash/api/snapshot",
 	"/_emdash/api/visual-editing/toolbar-labels",
@@ -125,6 +126,8 @@ const PUBLIC_API_EXACT = new Set([
 	"/_emdash/api/search/suggest",
 ]);
 
+const DEV_PUBLIC_API_EXACT = new Set(["/_emdash/api/typegen", "/_emdash/api/dev/scheduled-tasks"]);
+
 // Build merged public routes at module load from auth provider descriptors.
 // Routes ending with "/" are treated as prefixes; all others are exact matches.
 const { exact: _providerExactRoutes, prefixes: _providerPrefixRoutes } = (() => {
@@ -170,7 +173,7 @@ function isPublicEmDashRoute(pathname: string): boolean {
 	if (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;
 	if (_providerExactRoutes.has(pathname)) return true;
 	if (_providerPrefixRoutes.some((p) => pathname.startsWith(p))) return true;
-	if (import.meta.env.DEV && pathname === "/_emdash/api/typegen") return true;
+	if (import.meta.env.DEV && DEV_PUBLIC_API_EXACT.has(pathname)) return true;
 	return false;
 }
 
@@ -239,7 +242,20 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				return apiError("CSRF_REJECTED", "Missing required header", 403);
 			}
 		}
-		return next();
+		const response = await next();
+		if (!import.meta.env.DEV) {
+			response.headers.set(
+				"Content-Security-Policy",
+				buildEmDashCsp(
+					getRegistryConfigInput(context.locals.emdash?.config.registry),
+					getConfiguredStorageEndpoint(
+						context.locals.emdash?.config.storage,
+						context.locals.emdash?.storage,
+					),
+				),
+			);
+		}
+		return response;
 	}
 
 	// For public routes: soft auth check (set locals.user if session exists, but never block)
@@ -569,8 +585,7 @@ async function handleExternalAuth(
 			let newName: string | undefined;
 			let newRole: RoleLevel | undefined;
 
-			// Sync name from provider if provider provides one and local differs
-			if (authResult.name && user.name !== authResult.name) {
+			if (externalConfig.syncName !== false && authResult.name && user.name !== authResult.name) {
 				newName = authResult.name;
 				updates.name = newName;
 			}

package/src/astro/middleware/csp.ts

@@ -96,6 +96,7 @@ export function buildEmDashCsp(registry?: RegistryConfigInput, storageEndpoint?:
 		"frame-src 'self' https:",
 		"frame-ancestors 'none'",
 		"img-src 'self' https: data: blob:",
+		"media-src 'self' blob: https:",
 		"object-src 'none'",
 		"base-uri 'self'",
 	].join("; ");