emdash 1.1.0 → 1.3.0

package/src/astro/middleware/redirect.ts

@@ -17,9 +17,11 @@
 import type { APIContext } from "astro";
 import { defineMiddleware } from "astro:middleware";
 
+import { after } from "../../after.js";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
 import { createRedirectSource } from "../../redirects/artifacts.js";
+import type { CachedRedirects, RedirectRule } from "../../redirects/cache.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
 import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
@@ -42,6 +44,60 @@ function warnUnsafeDestination(id: string): void {
 	);
 }
 
+function recordHitInBackground(repo: RedirectRepository, id: string): void {
+	after(async () => {
+		try {
+			await repo.recordHit(id);
+		} catch (error) {
+			console.error("[emdash:redirects] failed to record redirect hit:", error);
+		}
+	});
+}
+
+interface RedirectMatch {
+	redirect: RedirectRule;
+	destination: string;
+}
+
+/** Exact rules first, with or without a trailing slash, then patterns in precedence order. */
+function matchRedirect(cached: CachedRedirects, pathname: string): RedirectMatch | null {
+	let exact = cached.exact.get(pathname);
+	if (!exact && pathname.length > 1) {
+		const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
+		exact = cached.exact.get(alt);
+	}
+	if (exact) return { redirect: exact, destination: exact.destination };
+	return matchCachedPatterns(cached.patterns, pathname);
+}
+
+/** The response for a matched rule, or null when its destination is not safe to send. */
+function redirectResponse(
+	context: APIContext,
+	repo: RedirectRepository,
+	{ redirect, destination }: RedirectMatch,
+): Response | null {
+	// Terminal statuses (410 Gone / 451): serve the status directly,
+	// with no Location header.
+	if (isTerminalStatus(redirect.type)) {
+		recordHitInBackground(repo, redirect.id);
+		return new Response(null, { status: redirect.type });
+	}
+	if (!isSiteRelativeDestination(destination)) {
+		warnUnsafeDestination(redirect.id);
+		return null;
+	}
+	recordHitInBackground(repo, redirect.id);
+	const code = isRedirectCode(redirect.type) ? redirect.type : 301;
+	return context.redirect(destination, code);
+}
+
+/** Whether Astro's route cache will store the response: it does once a max age or a tag is set. */
+function routeCacheStores(cache: APIContext["cache"] | undefined): boolean {
+	if (!cache?.enabled) return false;
+	const { maxAge, tags } = cache.options;
+	return maxAge !== undefined || (tags?.length ?? 0) > 0;
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 
@@ -69,52 +125,23 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 	try {
 		const repo = new RedirectRepository(db);
+		const source = createRedirectSource(db);
+		const routeCache: APIContext["cache"] | undefined = context.cache;
 
 		// One query loads the published rules into the cache; warm requests
 		// issue zero queries, and an expired cache checks the published version
 		// in the background. Empty-redirect sites cache an empty Map + array.
-		const cached = await loadCachedRedirects(createRedirectSource(db));
-
-		// 1. Exact match (O(1) Map lookup)
-		let exact = cached.exact.get(pathname);
-		if (!exact && pathname.length > 1) {
-			const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
-			exact = cached.exact.get(alt);
-		}
-		if (exact) {
-			// Terminal statuses (410 Gone / 451): serve the status directly,
-			// with no Location header.
-			if (isTerminalStatus(exact.type)) {
-				repo.recordHit(exact.id).catch(() => {});
-				return new Response(null, { status: exact.type });
-			}
-			const dest = exact.destination;
-			if (!isSiteRelativeDestination(dest)) {
-				warnUnsafeDestination(exact.id);
-				return next();
-			}
-			repo.recordHit(exact.id).catch(() => {});
-			const code = isRedirectCode(exact.type) ? exact.type : 301;
-			return context.redirect(dest, code);
-		}
-
-		// 2. Pattern match (compile once, match every request)
-		const patternMatch = matchCachedPatterns(cached.patterns, pathname);
-		if (patternMatch) {
-			const { redirect, destination } = patternMatch;
-			// Terminal statuses (410 Gone / 451): serve the status directly.
-			if (isTerminalStatus(redirect.type)) {
-				repo.recordHit(redirect.id).catch(() => {});
-				return new Response(null, { status: redirect.type });
-			}
-			if (!isSiteRelativeDestination(destination)) {
-				warnUnsafeDestination(redirect.id);
-				return next();
-			}
-			repo.recordHit(redirect.id).catch(() => {});
-			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
-			return context.redirect(destination, code);
+		// A response the route cache stores is served to every visitor until it
+		// is purged, so before one is returned the rules are verified current.
+		let cached = await loadCachedRedirects(source);
+		let match = matchRedirect(cached, pathname);
+		let verified = false;
+		if (match && routeCacheStores(routeCache)) {
+			cached = await loadCachedRedirects(source, { verify: true });
+			verified = true;
+			match = matchRedirect(cached, pathname);
 		}
+		if (match) return redirectResponse(context, repo, match) ?? next();
 
 		// No redirect matched -- proceed and check for 404
 		const response = await next();
@@ -124,11 +151,24 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// the fix. Astro has no cache handle for URLs that match no route, but a
 		// page answering a content miss with Astro.rewrite("/404") has one.
 		if (response.status === 404) {
-			const routeCache: APIContext["cache"] | undefined = context.cache;
 			routeCache?.set(false);
 		}
 
-		// Log misses (fire-and-forget) under the path the visitor requested.
+		if (!verified && routeCacheStores(routeCache)) {
+			const current = await loadCachedRedirects(source, { verify: true }).catch(() => cached);
+			const late = current === cached ? null : matchRedirect(current, pathname);
+			const redirected = late && redirectResponse(context, repo, late);
+			if (redirected) {
+				routeCache?.set(false);
+				// Finish the discarded render instead of cancelling it: a render cut off
+				// with its request never settles an isolate-wide fetch it started, and
+				// every later render awaiting that fetch hangs.
+				after(() => response.body?.pipeTo(new WritableStream()));
+				return redirected;
+			}
+		}
+
+		// Log misses under the path the visitor requested.
 		// Two shapes count as a miss: a 404 response (an unmatched route, or a
 		// page answering a content miss with Astro.rewrite("/404")), and a
 		// matched route answering a content miss with a redirect to /404 —
@@ -142,13 +182,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		if (missedDirectly || missedByRedirect) {
 			const referrer = context.request.headers.get("referer") ?? null;
 			const userAgent = context.request.headers.get("user-agent") ?? null;
-			repo
-				.log404({
-					path: pathname,
-					referrer,
-					userAgent,
-				})
-				.catch(() => {});
+			after(async () => {
+				try {
+					await repo.log404({
+						path: pathname,
+						referrer,
+						userAgent,
+					});
+				} catch (error) {
+					console.error("[emdash:redirects] failed to log 404:", error);
+				}
+			});
 		}
 
 		return response;

package/src/astro/middleware/request-context.ts

@@ -68,11 +68,13 @@ function isHtmlResponse(response: Response): boolean {
 	return response.headers.get("content-type")?.includes("text/html") ?? false;
 }
 
+const DOCUMENT_START_RE = /^\s*<(?:!doctype|html)\b/i;
+
 /**
- * Inject HTML before `</body>` if the response is an HTML page with a body
- * end tag. Does not touch cache headers — callers decide whether the result
- * is still shareable. `injected` tells the caller whether the result carries
- * the injected HTML.
+ * Inject HTML before the page's closing `</body>` if the response is a whole
+ * HTML document with one. Does not touch cache headers — callers decide
+ * whether the result is still shareable. `injected` tells the caller whether
+ * the result carries the injected HTML.
  *
  * `Astro.rewrite()` runs this middleware again for the rewritten route inside
  * the original request, so the response can already contain the HTML; `marker`
@@ -89,12 +91,16 @@ async function injectBeforeBodyEnd(
 	if (html.includes(marker)) {
 		return { response: new Response(html, response), injected: true };
 	}
-	if (!html.includes("</body>")) {
+	// The page's own closing tag is its last `</body>`. Astro leaves `<` and `>`
+	// unescaped in attribute values, so an earlier one, or one in a fragment
+	// such as a server island, can be author text inside an attribute.
+	const bodyEnd = DOCUMENT_START_RE.test(html) ? html.lastIndexOf("</body>") : -1;
+	if (bodyEnd === -1) {
 		// Body already consumed — rebuild the response unchanged.
 		return { response: new Response(html, response), injected: false };
 	}
 
-	const injected = html.replace("</body>", `${htmlToInject}</body>`);
+	const injected = html.slice(0, bodyEnd) + htmlToInject + html.slice(bodyEnd);
 	return {
 		response: new Response(injected, {
 			status: response.status,

package/src/astro/middleware.ts

@@ -71,6 +71,7 @@ import {
 	runWithContext,
 } from "../request-context.js";
 import type { PublishedRef } from "../scheduled-publish.js";
+import { parseCollectionSitemapName } from "../seo/sitemap-name.js";
 import { EmDashStorageError } from "../storage/types.js";
 import { isMissingTableError } from "../utils/db-errors.js";
 import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
@@ -83,7 +84,10 @@ import {
 } from "./middleware/scoped-db.js";
 import { wrapBodyForStreamMetrics } from "./middleware/stream-end-metrics.js";
 import { prefetchLayoutData } from "./prefetch.js";
-import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
+import {
+	createPublicPluginApiRouteHandler,
+	getPublicPluginRouteMeta,
+} from "./public-plugin-api-routes.js";
 import { resolveSessionUser } from "./session-user.js";
 import type { EmDashHandlers } from "./types.js";
 
@@ -590,7 +594,13 @@ function pushMetricsTimings(
 
 /** Public routes that require the runtime (sitemap, robots.txt, etc.) */
 const PUBLIC_RUNTIME_ROUTES = new Set(["/sitemap.xml", "/robots.txt"]);
-const SITEMAP_COLLECTION_RE = /^\/sitemap-[a-z][a-z0-9_]*\.xml$/;
+const SITEMAP_COLLECTION_RE = /^\/sitemap-([^/]+)\.xml$/;
+
+/** Whether `pathname` is a per-collection sitemap a collection could have. */
+function isCollectionSitemapPath(pathname: string): boolean {
+	const match = SITEMAP_COLLECTION_RE.exec(pathname);
+	return match !== null && parseCollectionSitemapName(match[1]!) !== null;
+}
 
 function isImageEndpointRequest(context: APIContext): boolean {
 	const route = virtualConfig?.imageEndpointRoute;
@@ -711,6 +721,26 @@ function applyBuildValidator(context: APIContext): void {
 	context.cache.set({ lastModified: buildDate });
 }
 
+const UNSHARED_CACHE_CONTROL_RE = /\b(?:private|no-store)\b/i;
+
+/**
+ * Route rules match by path, so a rule can cover responses rendered for a
+ * signed-in user or marked private by the route itself. Opting them out of the
+ * route cache keeps the shared edge cache from serving them to anyone else.
+ *
+ * Must run after next(): the route and its layout call `cache.set()` while
+ * rendering, which turns caching back on.
+ */
+function keepUnsharedResponsesOutOfRouteCache(context: APIContext, response: Response): void {
+	if (!context.cache?.enabled) return;
+	if (
+		context.locals.user ||
+		UNSHARED_CACHE_CONTROL_RE.test(response.headers.get("Cache-Control") ?? "")
+	) {
+		context.cache.set(false);
+	}
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { request, locals, cookies } = context;
 	const url = context.url;
@@ -742,7 +772,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// (logged-in editors need the runtime for toolbar/visual editing on public pages)
 		const isEmDashRoute = url.pathname.startsWith("/_emdash");
 		const isPublicRuntimeRoute =
-			PUBLIC_RUNTIME_ROUTES.has(url.pathname) || SITEMAP_COLLECTION_RE.test(url.pathname);
+			PUBLIC_RUNTIME_ROUTES.has(url.pathname) || isCollectionSitemapPath(url.pathname);
 
 		// Check for edit mode cookie - editors viewing public pages need the runtime
 		// so auth middleware can verify their session for visual editing
@@ -812,12 +842,21 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// bypasses runtime init and would crash with "no such table: options".
 				// Do a one-time lightweight probe using the same getDb() instance the
 				// page will use: if the migrations table doesn't exist, no migrations
-				// have ever run, and the page may only render once runtime init below
-				// has migrated the database.
+				// have ever run, and the page may only render once runtime init has
+				// migrated the database.
 				// Skip the probe when prerendering: the build database is legitimately
 				// empty in CI, and a response derived from it would be baked into the
 				// static page (session reads are already skipped for prerender above
 				// for the same reason).
+				// Runtime init starts before the probe so the two round trips overlap.
+				// Sub-phase timings are populated only on the cold init. Warm
+				// requests hit the cached runtime and leave this empty.
+				const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
+				const runtimeInitStart = performance.now();
+				const runtimeInit = config ? getRuntime(config, migrationMode, initSubTimings) : undefined;
+				// Awaited below unless the probe fails; then it settles in the background.
+				runtimeInit?.catch(() => {});
+
 				let unmigrated = false;
 				let probeFailed = false;
 				if (migrationMode === "auto" && !isSetupVerified() && !context.isPrerendered) {
@@ -835,8 +874,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							// race, locked SQLite) must NOT be read as "fresh install". Leave the
 							// flag unset so a later request can re-verify, and fall through to
 							// render the page normally. Unless a runtime is already running,
-							// skip runtime init for this request: it would connect to the same
-							// database again and make the visitor wait through a second timeout.
+							// don't wait for runtime init on this request: it connects to the
+							// same database and would make the visitor wait through a second
+							// timeout. getRuntime anchors it with after(), so it can still
+							// finish for later requests.
 							probeFailed = !getRuntimeHolder().instance;
 							console.error("Setup probe failed (non-fatal):", error);
 						}
@@ -844,23 +885,21 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					timings.push({ name: "setup", dur: performance.now() - t0, desc: "Setup probe" });
 				}
 
-				// Initialize the runtime for page:metadata and page:fragments hooks.
+				// Wait for the runtime for page:metadata and page:fragments hooks.
 				// The runtime is a cached singleton — after the first request,
 				// getRuntime() is just a null-check. This enables SEO plugins to
 				// contribute meta tags for all visitors, not just logged-in editors,
 				// except on a request whose setup probe just failed.
-				if (config && !probeFailed) {
-					// Sub-phase timings are populated only on the cold init. Warm
-					// requests hit the cached runtime and leave this empty.
-					const initSubTimings: Array<{ name: string; dur: number; desc?: string }> = [];
-					const t0 = performance.now();
+				if (runtimeInit && !probeFailed) {
 					try {
-						const runtime = await getRuntime(config, migrationMode, initSubTimings);
+						const runtime = await runtimeInit;
 						markSetupVerified();
 						const handlePublicPluginApiRoute = createPublicPluginApiRouteHandler(runtime);
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
 						locals.emdash = {
 							handlePublicPluginApiRoute,
+							getPublicPluginRouteMeta: (pluginId, path) =>
+								getPublicPluginRouteMeta(runtime, pluginId, path),
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
@@ -886,7 +925,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							console.error("[emdash] runtime init failed (page renders without CMS data):", error);
 						}
 					}
-					timings.push({ name: "rt", dur: performance.now() - t0, desc: "Runtime init" });
+					timings.push({
+						name: "rt",
+						dur: performance.now() - runtimeInitStart,
+						desc: "Runtime init",
+					});
 					// Append cold-only sub-phase timings so the breakdown is visible
 					// in Server-Timing (rt.db, rt.fts, rt.plugins, rt.site,
 					// rt.sandbox, rt.market, rt.hooks, rt.cron).
@@ -933,9 +976,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					// Eagerly warm site-global layout data (menus, widget areas,
 					// taxonomy terms, settings) concurrently so the layout's
 					// per-component reads overlap into ~one wall-clock round trip and
-					// hit a warm cache instead of serializing. Three guards:
+					// hit a warm cache instead of serializing. Four guards:
 					//  - request-scoped (remote) backend only -- this branch implies it;
 					//    pointless on synchronous local SQLite.
+					//  - an adapter that can overlap queries -- without that, Kysely's
+					//    connection mutex (D1 sessions without `coalesce`) queues the
+					//    prefetch ahead of the page's own first query.
 					//  - HTML navigations only -- feeds/sitemaps/JSON don't render the
 					//    layout, so prefetching their chrome is pure waste.
 					//  - the work starts immediately, then after() keeps both it and the
@@ -949,7 +995,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						.trim()
 						.startsWith("text/html");
 					return runWithContext(ctx, async () => {
-						if (acceptsHtml) after(() => prefetchLayoutData());
+						if (
+							acceptsHtml &&
+							anonScoped.db.getExecutor().adapter.supportsMultipleConnections !== false
+						) {
+							after(() => prefetchLayoutData());
+						}
 						// commit() persists per-request state (e.g. the D1 bookmark cookie)
 						// before the response is returned, even if render throws; close()
 						// waits for stream-end and request-owned deferred work. See finishScoped.
@@ -1054,6 +1105,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					getPluginEditorExtension: runtime.getPluginEditorExtension.bind(runtime),
 					getPluginEditorDraftSchema: runtime.getPluginEditorDraftSchema.bind(runtime),
 					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
+					getPublicPluginRouteMeta: (pluginId, path) =>
+						getPublicPluginRouteMeta(runtime, pluginId, path),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
 					getPluginMcpTools: runtime.getPluginMcpTools.bind(runtime),
 					getEnabledPluginMcpTools: runtime.getEnabledPluginMcpTools.bind(runtime),
@@ -1202,6 +1255,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	try {
 		const response = await runWithContext({ editMode: false, queryRecorder, metrics }, run);
 		applyBuildValidator(context);
+		keepUnsharedResponsesOutOfRouteCache(context, response);
 		return response;
 	} finally {
 		// Streamed responses defer the flush to stream end (see

package/src/astro/prefetch.ts

@@ -7,17 +7,19 @@
  * execute as serial DB round trips. This fires them all CONCURRENTLY at the
  * very start of the request, before `next()`:
  *
- *   - On remote backends (D1, Durable Objects) the round trips overlap instead
- *     of serializing, collapsing ~N sequential RTTs into ~1 wall-clock RTT. On
- *     a coalescing backend they additionally batch into a single round trip.
+ *   - On remote backends whose adapter can overlap queries the round trips
+ *     overlap instead of serializing, collapsing ~N sequential RTTs into ~1
+ *     wall-clock RTT. On a coalescing backend they additionally batch into a
+ *     single round trip.
  *   - The results land in the per-request `requestCached` store under the exact
  *     keys the layout helpers use, so when the components render they hit a warm
  *     (in-flight or resolved) cache entry instead of issuing their own query.
  *
  * Nothing here changes what templates call -- it warms the real helpers, so the
  * cache keys and value shapes are guaranteed identical. The caller gates this to
- * the public-page path on a request-scoped (remote) backend; it is a no-op-ish
- * waste on synchronous local SQLite, so don't call it there.
+ * the public-page path on a request-scoped (remote) backend that can overlap
+ * queries; it is a no-op-ish waste on synchronous local SQLite and only delays
+ * the page on a handle that runs one query at a time, so don't call it there.
  *
  * Fire-and-forget: never awaited by middleware, never throws (a prefetch failure
  * must not affect the request -- the helpers will simply run on demand).

package/src/astro/public-plugin-api-routes.ts

@@ -18,6 +18,15 @@ interface PublicPluginApiRouteRuntime {
 	): Promise<HandlerResponse>;
 }
 
+export function getPublicPluginRouteMeta(
+	runtime: Pick<PublicPluginApiRouteRuntime, "getPluginRouteMeta">,
+	pluginId: string,
+	path: string,
+): RouteMeta | null {
+	const meta = runtime.getPluginRouteMeta(pluginId, path);
+	return meta?.public === true ? meta : null;
+}
+
 function pluginRouteNotFound(): HandlerResponse {
 	return {
 		success: false,
@@ -32,8 +41,7 @@ export function createPublicPluginApiRouteHandler(
 	runtime: PublicPluginApiRouteRuntime,
 ): PublicPluginApiRouteHandler {
 	return async (pluginId, method, path, request) => {
-		const meta = runtime.getPluginRouteMeta(pluginId, path);
-		if (meta?.public !== true) {
+		if (!getPublicPluginRouteMeta(runtime, pluginId, path)) {
 			return pluginRouteNotFound();
 		}
 

package/src/astro/routes/api/admin/plugins/registry/artifact.ts

@@ -423,7 +423,7 @@ async function resolveArtifact(
 			.map(recordScopedCacheEndpoint)
 			.find((value) => value !== null);
 		if (serviceEndpoint) {
-			const preset = kind === "icon" ? "avatar" : kind === "banner" ? "banner" : "feed_thumbnail";
+			const preset = kind === "icon" ? "avatar" : kind === "banner" ? "banner" : "feed_fullsize";
 			const cacheUrl = recordScopedImageCacheUrl(
 				serviceEndpoint,
 				preset,

package/src/astro/routes/api/auth/handover.ts

@@ -0,0 +1,58 @@
+/**
+ * POST /_emdash/api/auth/handover
+ *
+ * Returns a single-use sign-in link for the current user at the site's
+ * chosen address: the configured `siteUrl`, otherwise the **Site URL**.
+ * After a domain change, passkeys created on the old address don't work on
+ * the new one, so this is how a signed-in user moves their session there.
+ * The link expires after 5 minutes and opens Security settings ready to add
+ * a passkey.
+ *
+ * Signed-in sessions only: bearer tokens are refused.
+ */
+
+import { createMagicLinkUrl } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import type { APIRoute } from "astro";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { checkRateLimit } from "#auth/rate-limit.js";
+
+export const prerender = false;
+
+const HANDOVER_EXPIRY_MS = 5 * 60 * 1000;
+const HANDOVER_REDIRECT = "/_emdash/admin/settings/security?addPasskey=1";
+
+export const POST: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	if (!user) {
+		return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	}
+	if (locals.tokenScopes !== undefined) {
+		return apiError("FORBIDDEN", "Sign-in handover requires a signed-in session", 403);
+	}
+
+	try {
+		const rateLimit = await checkRateLimit(emdash.db, user.id, "auth/handover", 5, 300);
+		if (!rateLimit.allowed) {
+			return apiError("RATE_LIMITED", "Too many sign-in links. Try again in a few minutes.", 429);
+		}
+
+		const origin = await getChosenSiteOrigin(emdash.db, emdash.config);
+		if (!origin) {
+			return apiError("NO_SITE_URL", "Set a Site URL before continuing at another address", 409);
+		}
+
+		const url = await createMagicLinkUrl(createKyselyAdapter(emdash.db), user, origin, {
+			expiresInMs: HANDOVER_EXPIRY_MS,
+			redirect: HANDOVER_REDIRECT,
+		});
+		return apiSuccess({ url });
+	} catch (error) {
+		return handleError(error, "Failed to create a sign-in link", "SIGN_IN_HANDOVER_ERROR");
+	}
+};

package/src/astro/routes/api/auth/magic-link/verify.ts

@@ -7,7 +7,8 @@
  * otherwise use up the single-use token before the recipient clicks.
  *
  * POST verifies the token and creates the session.
- * Tokens are single-use and expire after 15 minutes.
+ * Tokens are single-use and expire after 15 minutes, or 5 minutes for
+ * sign-in handover links.
  */
 
 import type { APIRoute } from "astro";
@@ -21,6 +22,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { magicLinkVerifyBody } from "#api/schemas.js";
 
+import { after } from "../../../../../after.js";
 import { sessionUnavailableError } from "../../../../session-user.js";
 
 export const GET: APIRoute = async ({ url, redirect }) => {
@@ -50,8 +52,14 @@ export const POST: APIRoute = async ({ request, locals, session }) => {
 		const adapter = createKyselyAdapter(emdash.db);
 		const user = await verifyMagicLink(adapter, body.token);
 
-		// Fire-and-forget cleanup of expired tokens -- prevents accumulation
-		void adapter.deleteExpiredTokens().catch(() => {});
+		// Cleanup of expired tokens -- prevents accumulation
+		after(async () => {
+			try {
+				await adapter.deleteExpiredTokens();
+			} catch (error) {
+				console.error("[magic-link] failed to delete expired tokens:", error);
+			}
+		});
 
 		session.set("user", { id: user.id });
 

package/src/astro/routes/api/auth/passkey/options.ts

@@ -22,6 +22,8 @@ import { checkRateLimit, getClientIp, rateLimitResponse } from "#auth/rate-limit
 import { getTrustedProxyHeaders } from "#auth/trusted-proxy.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
+import { after } from "../../../../../after.js";
+
 export const POST: APIRoute = async ({ request, locals }) => {
 	const { emdash } = locals;
 
@@ -30,8 +32,14 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	}
 
 	try {
-		// Fire-and-forget cleanup of expired challenges -- prevents accumulation
-		void cleanupExpiredChallenges(emdash.db).catch(() => {});
+		// Cleanup of expired challenges -- prevents accumulation
+		after(async () => {
+			try {
+				await cleanupExpiredChallenges(emdash.db);
+			} catch (error) {
+				console.error("[passkey] failed to delete expired challenges:", error);
+			}
+		});
 
 		// Parse body before rate limiting so malformed requests don't consume slots
 		const body = await parseOptionalBody(request, passkeyOptionsBody, {});

package/src/astro/routes/api/content/[collection]/[id]/discard-draft.ts

@@ -11,6 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentRevisionConditionBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -68,7 +69,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/duplicate.ts

@@ -11,7 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, locals, cache }) => {
+export const POST: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
 	const collection = params.collection!;
 	const id = params.id!;
@@ -52,9 +52,5 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 	const result = await emdash.handleContentDuplicate(collection, resolvedId, user?.id);
 
-	if (!result.success) return unwrapResult(result);
-
-	if (cache?.enabled) await cache.invalidate({ tags: [collection] });
-
 	return unwrapResult(result, 201);
 };

package/src/astro/routes/api/content/[collection]/[id]/lock.ts

@@ -8,7 +8,7 @@
 
 import type { APIRoute } from "astro";
 
-import { requireOwnerPerm } from "#api/authorize.js";
+import { requireEntryEditPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import {
 	handleEntryLockAcquire,
@@ -60,7 +60,7 @@ async function resolveEntry(
 				(existingData.item as Record<string, unknown>)
 			: existingData;
 	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
-	const denied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	const denied = requireEntryEditPerm(user, { authorId, status: existingItem?.status });
 	if (denied) return denied;
 
 	return {