emdash 1.2.0 → 1.3.0

package/src/api/authorize.ts

@@ -71,6 +71,48 @@ export function requireOwnerPerm(
 	return null;
 }
 
+/**
+ * How `user` may edit an entry: `"full"` through `content:edit_own` or
+ * `content:edit_any`, `"draft"` through `content:edit_own_drafts` only, or
+ * `null` when they can't edit it.
+ *
+ * A `"draft"` grant holds only while the entry is still a draft, so the caller
+ * must make its write fail if the entry changes after this check, for example
+ * by conditioning the update on the `_rev` it checked.
+ */
+export function entryEditAccess(
+	user: UserLike | null | undefined,
+	entry: { authorId: string; status: unknown },
+): "full" | "draft" | null {
+	if (canActOnOwn(user, entry.authorId, "content:edit_own", "content:edit_any")) return "full";
+	if (
+		entry.status === "draft" &&
+		canActOnOwn(user, entry.authorId, "content:edit_own_drafts", "content:edit_any")
+	) {
+		return "draft";
+	}
+	return null;
+}
+
+/**
+ * Check if user can edit an entry, including an owner editing their own draft
+ * through `content:edit_own_drafts`. Returns a 401/403 Response if not, or null
+ * if authorized. See {@link entryEditAccess} for what a draft-only grant requires
+ * of the caller.
+ */
+export function requireEntryEditPerm(
+	user: UserLike | null | undefined,
+	entry: { authorId: string; status: unknown },
+): Response | null {
+	if (!user) {
+		return apiError("UNAUTHORIZED", "Authentication required", 401);
+	}
+	if (!entryEditAccess(user, entry)) {
+		return apiError("FORBIDDEN", "Insufficient permissions", 403);
+	}
+	return null;
+}
+
 /**
  * Like {@link requirePerm}, but authorized when the user has any of
  * `permissions`.

package/src/api/handlers/dashboard.ts

@@ -20,6 +20,7 @@ import {
 	type ScheduledPolicyRejection,
 	type VersionedScheduledPolicyRejection,
 } from "../../plugins/content-policy.js";
+import type { VersionedValue } from "../../plugins/types.js";
 import { getSchedulerHealth, type SchedulerHealth } from "../../scheduler-health.js";
 import type { ApiResult } from "../types.js";
 
@@ -61,9 +62,14 @@ const POLICY_REJECTION_PREVIEW_LIMIT = 20;
  *
  * Queries are intentionally lightweight — counts use indexed columns,
  * and recent items are capped at 10.
+ *
+ * Without `includeDrafts` (callers lacking `content:read_drafts`), only
+ * published entries are counted or listed, and scheduled-publication policy
+ * rejections are omitted.
  */
 export async function handleDashboardStats(
 	db: Kysely<Database>,
+	{ includeDrafts }: { includeDrafts: boolean },
 	now = new Date(),
 ): Promise<ApiResult<DashboardStats>> {
 	try {
@@ -79,6 +85,17 @@ export async function handleDashboardStats(
 		const collectionStats: CollectionStats[] = await Promise.all(
 			collections.map(async (col) => {
 				const stats = await contentRepo.getStats(col.slug, now);
+				if (!includeDrafts) {
+					return {
+						slug: col.slug,
+						label: col.label,
+						total: stats.published,
+						published: stats.published,
+						draft: 0,
+						scheduled: 0,
+						overdueScheduled: 0,
+					};
+				}
 				return {
 					slug: col.slug,
 					label: col.label,
@@ -105,20 +122,22 @@ export async function handleDashboardStats(
 			mediaRepo.count(),
 			userRepo.count(),
 			getSchedulerHealth(db, now),
-			optionsRepo.countByPrefix(SCHEDULED_POLICY_REJECTION_PREFIX),
-			optionsRepo.getVersionedByPrefix<ScheduledPolicyRejection>(
-				SCHEDULED_POLICY_REJECTION_PREFIX,
-				{
-					limit: POLICY_REJECTION_PREVIEW_LIMIT,
-				},
-			),
+			includeDrafts ? optionsRepo.countByPrefix(SCHEDULED_POLICY_REJECTION_PREFIX) : 0,
+			includeDrafts
+				? optionsRepo.getVersionedByPrefix<ScheduledPolicyRejection>(
+						SCHEDULED_POLICY_REJECTION_PREFIX,
+						{
+							limit: POLICY_REJECTION_PREVIEW_LIMIT,
+						},
+					)
+				: new Map<string, VersionedValue<ScheduledPolicyRejection>>(),
 		]);
 		const policyRejections = [...versionedPolicyRejectionOptions.values()]
 			.filter(({ value }) => isScheduledPolicyRejection(value))
 			.map(({ value, revision }) => ({ ...value, _rev: revision }));
 
-		// Recent items across all collections (last 10 updated, any status)
-		const recentItems = await fetchRecentItems(db, collections);
+		// Recent items across all collections (last 10 updated)
+		const recentItems = await fetchRecentItems(db, collections, includeDrafts);
 
 		return {
 			success: true,
@@ -165,10 +184,13 @@ interface RecentItemRow {
  * `title` is not a standard column — it's a user-defined field. We query
  * `_emdash_fields` to discover which collections have one and fall back
  * to `slug` (which is always present) otherwise.
+ *
+ * Without `includeDrafts`, only published entries are considered.
  */
 async function fetchRecentItems(
 	db: Kysely<Database>,
 	collections: Array<{ slug: string; label: string }>,
+	includeDrafts: boolean,
 ): Promise<RecentItem[]> {
 	if (collections.length === 0) return [];
 
@@ -181,6 +203,7 @@ async function fetchRecentItems(
 		.execute();
 
 	const collectionsWithTitle = new Set(titleFields.map((r) => r.collection_slug));
+	const statusFilter = includeDrafts ? sql`` : sql`AND status = 'published'`;
 
 	// Issue one query per collection in parallel, then merge in JS.
 	// A single UNION ALL across N collections trips D1's
@@ -208,7 +231,7 @@ async function fetchRecentItems(
 					updated_at,
 					author_id
 				FROM ${sql.ref(table)}
-				WHERE deleted_at IS NULL
+				WHERE deleted_at IS NULL ${statusFilter}
 				ORDER BY updated_at DESC
 				LIMIT 10
 			`.execute(db);

package/src/api/handlers/manifest.ts

@@ -353,6 +353,7 @@ function dbFieldDescriptor(
 		id: field.id,
 	};
 	if (field.unsupportedType) entry.unsupportedType = field.unsupportedType;
+	if (field.type === "integer") entry.integer = true;
 	if (field.blockTypes) entry.blockTypes = field.blockTypes;
 	if (field.blockTypeFingerprint) entry.blockTypeFingerprint = field.blockTypeFingerprint;
 

package/src/api/handlers/plugins.ts

@@ -41,6 +41,7 @@ export interface PluginInfo {
 	mcpToolsEnabled: boolean;
 	mcpTools: Array<{
 		name: string;
+		mcpName?: string;
 		description: string;
 		route: string;
 		permission: string;

package/src/api/handlers/revision.ts

@@ -6,7 +6,11 @@ import type { Kysely } from "kysely";
 
 import { after } from "../../after.js";
 import { ContentRepository } from "../../database/repositories/content.js";
-import { RevisionRepository, type Revision } from "../../database/repositories/revision.js";
+import {
+	RevisionRepository,
+	type Revision,
+	type RevisionWithAuthor,
+} from "../../database/repositories/revision.js";
 import { ContentMutationConflictError } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
 import { encodeRev } from "../rev.js";
@@ -19,7 +23,7 @@ import {
 } from "./staged-references.js";
 
 export interface RevisionListResponse {
-	items: Revision[];
+	items: RevisionWithAuthor[];
 	total: number;
 }
 

package/src/api/handlers/site-domain.ts

@@ -47,8 +47,15 @@ export function parseSiteDomain(input: string): string | undefined {
 	return url.origin;
 }
 
-function checkFailed(message: string): ApiResult<never> {
-	return { success: false, error: { code: "DOMAIN_CHECK_FAILED", message } };
+/** Why a domain check failed, sent as `error.details` with the addresses its message names. */
+type DomainCheckFailure =
+	| { reason: "NO_PUBLIC_ADDRESS"; host: string }
+	| { reason: "UNREACHABLE"; origin: string }
+	| { reason: "REDIRECT"; origin: string; target?: string }
+	| { reason: "NOT_SERVING"; origin: string };
+
+function checkFailed(message: string, details: DomainCheckFailure): ApiResult<never> {
+	return { success: false, error: { code: "DOMAIN_CHECK_FAILED", message, details } };
 }
 
 /**
@@ -79,7 +86,11 @@ export async function handleSiteDomainChange(
 		try {
 			await resolveAndValidateExternalUrl(proofUrl);
 		} catch {
-			return checkFailed(`${new URL(origin).hostname} does not resolve to a public address`);
+			const host = new URL(origin).hostname;
+			return checkFailed(`${host} does not resolve to a public address`, {
+				reason: "NO_PUBLIC_ADDRESS",
+				host,
+			});
 		}
 
 		let response: Response;
@@ -91,18 +102,20 @@ export async function handleSiteDomainChange(
 				signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
 			});
 		} catch {
-			return checkFailed(`Could not reach ${origin}`);
+			return checkFailed(`Could not reach ${origin}`, { reason: "UNREACHABLE", origin });
 		}
 
 		if (response.status >= 300 && response.status < 400) {
 			const location = response.headers.get("Location");
 			const target =
 				location && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;
-			return checkFailed(
-				target
-					? `${origin} redirects to ${target.origin}. Enter that address instead.`
-					: `${origin} redirects elsewhere`,
-			);
+			return target
+				? checkFailed(`${origin} redirects to ${target.origin}. Enter that address instead.`, {
+						reason: "REDIRECT",
+						origin,
+						target: target.origin,
+					})
+				: checkFailed(`${origin} redirects elsewhere`, { reason: "REDIRECT", origin });
 		}
 
 		const body: unknown = response.ok ? await response.json().catch(() => null) : null;
@@ -115,7 +128,10 @@ export async function handleSiteDomainChange(
 				? (body.data as { token?: unknown }).token
 				: undefined;
 		if (received !== token) {
-			return checkFailed(`${origin} does not serve this site yet`);
+			return checkFailed(`${origin} does not serve this site yet`, {
+				reason: "NOT_SERVING",
+				origin,
+			});
 		}
 
 		await setSiteSettings({ url: origin }, db);

package/src/api/schemas/settings.ts

@@ -29,6 +29,7 @@ const seoSettingsInput = z.object({
 	titleSeparator: z.string().max(10).optional(),
 	defaultOgImage: mediaReferenceInput.nullable().optional(),
 	robotsTxt: z.string().max(5000).optional(),
+	disallowAiTraining: z.boolean().optional(),
 	googleVerification: z.string().max(100).optional(),
 	bingVerification: z.string().max(100).optional(),
 });
@@ -75,6 +76,7 @@ const seoSettingsResponse = z.object({
 	titleSeparator: z.string().max(10).optional(),
 	defaultOgImage: mediaReferenceResponse.optional(),
 	robotsTxt: z.string().max(5000).optional(),
+	disallowAiTraining: z.boolean().optional(),
 	googleVerification: z.string().max(100).optional(),
 	bingVerification: z.string().max(100).optional(),
 });

package/src/api/types.ts

@@ -76,6 +76,8 @@ export interface ManifestFieldDescriptor extends FieldDescriptor {
 	blockTypeFingerprint?: string;
 	/** Value a new entry starts with in the admin editor. */
 	defaultValue?: unknown;
+	/** Set on `integer` fields, which share the `number` kind. */
+	integer?: boolean;
 }
 
 export interface FieldDescriptor {

package/src/astro/integration/dev-scheduler-bridge.ts

@@ -0,0 +1,91 @@
+import type { Server } from "node:http";
+import { request as requestHttps } from "node:https";
+
+import type { AstroIntegrationLogger } from "astro";
+
+const DEFAULT_INTERVAL_MS = 60_000;
+
+interface DevServer {
+	httpServer: Pick<Server, "once"> | null;
+	resolvedUrls: { local: string[]; network: string[] } | null;
+}
+
+interface SchedulerOptions {
+	intervalMs?: number;
+	fetch?: typeof fetch;
+}
+
+function postMaintenance(url: URL): Promise<{ ok: boolean; status: number }> {
+	if (url.protocol !== "https:") return fetch(url, { method: "POST" });
+	// Dev servers commonly run on self-signed or host-mismatch certificates
+	// that Node would reject by default. This request stays inside the local
+	// dev server and the route is dev-only, so accept the certificate to keep
+	// maintenance running without requiring a matching SAN/CN or trusted CA.
+	return new Promise((resolve, reject) => {
+		const request = requestHttps(
+			url,
+			{ method: "POST", rejectUnauthorized: false, agent: false },
+			(response) => {
+				const status = response.statusCode ?? 500;
+				response.once("error", reject);
+				response.once("end", () => resolve({ ok: status >= 200 && status < 300, status }));
+				response.resume();
+			},
+		);
+		request.once("error", reject);
+		request.end();
+	});
+}
+
+export function startDevSchedulerBridge(
+	server: DevServer,
+	logger: Pick<AstroIntegrationLogger, "warn">,
+	options: SchedulerOptions = {},
+): void {
+	const httpServer = server.httpServer;
+	if (!httpServer) return;
+
+	const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+	let stopped = false;
+	let timer: ReturnType<typeof setTimeout> | undefined;
+
+	const schedule = () => {
+		if (stopped) return;
+		timer = setTimeout(() => void run(), intervalMs);
+		if (typeof timer === "object" && "unref" in timer) timer.unref();
+	};
+
+	const run = async () => {
+		try {
+			const origin = server.resolvedUrls?.local[0] ?? server.resolvedUrls?.network[0];
+			if (!origin) {
+				logger.warn("Dev scheduler bridge could not resolve the dev server origin.");
+				return;
+			}
+
+			const base = origin.endsWith("/") ? origin : `${origin}/`;
+			const url = new URL("_emdash/api/dev/scheduled-tasks", base);
+			const response = options.fetch
+				? await options.fetch(url, { method: "POST" })
+				: await postMaintenance(url);
+			if (!response.ok) {
+				logger.warn(
+					`Dev scheduler bridge request failed with status ${response.status}. ` +
+						"Verify that EmDash's dev maintenance route is available.",
+				);
+			}
+		} catch (error) {
+			logger.warn(
+				`Dev scheduler bridge request failed: ${error instanceof Error ? error.message : String(error)}`,
+			);
+		} finally {
+			schedule();
+		}
+	};
+
+	httpServer.once("listening", schedule);
+	httpServer.once("close", () => {
+		stopped = true;
+		if (timer !== undefined) clearTimeout(timer);
+	});
+}

package/src/astro/integration/index.ts

@@ -10,7 +10,9 @@
  * to avoid bundling Node.js-only code into the production build.
  */
 
+import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import type { AstroIntegration, AstroIntegrationLogger, AstroIntegrationMiddleware } from "astro";
@@ -37,6 +39,7 @@ import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
 import { readAdminLocaleManifest, resolveAdminLocales } from "./admin-locales.js";
 import { loadDevEnv } from "./dev-env.js";
+import { startDevSchedulerBridge } from "./dev-scheduler-bridge.js";
 import { createDebouncedTypegenRefresh, listenForDevTypegenRefresh } from "./dev-typegen.js";
 import { notoSans } from "./font-provider.js";
 import {
@@ -74,6 +77,39 @@ function resolveAstroVersion(): string | undefined {
 	}
 }
 
+/**
+ * `@emdash-cms/cloudflare` depends on the exact `emdash` version it was
+ * released with. A site that upgrades only one of the two installs a second
+ * copy of `emdash` for the adapter, so warn when the installed adapter's
+ * version differs from this one.
+ *
+ * @internal Exported for unit testing.
+ */
+export function adapterVersionMismatchWarning(
+	root: URL,
+	version: string = VERSION,
+): string | undefined {
+	if (version === "dev") return undefined;
+	for (let dir = fileURLToPath(root); dir !== dirname(dir); dir = dirname(dir)) {
+		const file = join(dir, "node_modules", "@emdash-cms", "cloudflare", "package.json");
+		if (!existsSync(file)) continue;
+		let pkg: { version?: unknown };
+		try {
+			pkg = JSON.parse(readFileSync(file, "utf8")) as { version?: unknown };
+		} catch {
+			return undefined;
+		}
+		if (typeof pkg.version !== "string" || pkg.version === version) return undefined;
+		return (
+			`@emdash-cms/cloudflare ${pkg.version} does not match emdash ${version}, ` +
+			`so the adapter runs against its own copy of emdash ${pkg.version}. ` +
+			`Install the same version of both packages, for example:\n\n` +
+			`  npm install emdash@${version} @emdash-cms/cloudflare@${version}`
+		);
+	}
+	return undefined;
+}
+
 /** Default storage: Local filesystem in .emdash directory */
 const DEFAULT_STORAGE = local({
 	directory: "./.emdash/uploads",
@@ -571,6 +607,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 	// Captured in astro:config:setup so the astro:server:setup hook can tell
 	// whether we're running `astro dev` (where the dev-bypass shortcut applies).
 	let astroCommand: "dev" | "build" | "preview" | "sync" | undefined;
+	let usesCloudflareAdapter = false;
 	let normalizedI18n: ReturnType<typeof normalizeAstroI18n> = null;
 	const migrationMetadata = createMigrationIntegrationMetadata(resolvedConfig.database);
 
@@ -586,6 +623,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				command,
 			}) => {
 				astroCommand = command;
+				usesCloudflareAdapter = astroConfig.adapter?.name === "@astrojs/cloudflare";
 				normalizeRegistryConfig(registry, {
 					allowLocalhost: command === "dev" || command === "sync",
 				});
@@ -728,7 +766,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					astroInjectRoute({ ...route, prerender: false });
 
 				// Inject all core routes
-				injectCoreRoutes(injectRoute, { srcDir: astroConfig.srcDir });
+				injectCoreRoutes(injectRoute, {
+					srcDir: astroConfig.srcDir,
+					cloudflareDevScheduler: command === "dev" && usesCloudflareAdapter,
+				});
 
 				// Inject routes from pluggable auth providers (authProviders config)
 				if (resolvedConfig.authProviders?.length) {
@@ -756,6 +797,8 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			"astro:config:done": async ({ config: finalConfig, logger }) => {
 				const warning = missingReactIntegrationWarning(finalConfig.integrations);
 				if (warning) logger.warn(warning);
+				const adapterWarning = adapterVersionMismatchWarning(finalConfig.root);
+				if (adapterWarning) logger.warn(adapterWarning);
 				const sessionWarning = useExternalAuth
 					? undefined
 					: missingSessionDriverWarning(finalConfig.session);
@@ -784,6 +827,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				await writeMigrationManifest(fileURLToPath(finalConfig.root), manifest);
 			},
 			"astro:server:setup": ({ server, logger }) => {
+				if (astroCommand === "dev" && usesCloudflareAdapter) {
+					startDevSchedulerBridge(server, logger);
+				}
+
 				// Print route info with absolute, clickable URLs once the server
 				// is listening. Only in `astro dev` -- the dev-bypass shortcut is
 				// dev-only and the port is unknown until now.

package/src/astro/integration/routes.ts

@@ -44,6 +44,7 @@ type InjectRoute = (route: { pattern: string; entrypoint: string }) => void;
 
 interface InjectCoreRoutesOptions {
 	srcDir?: URL;
+	cloudflareDevScheduler?: boolean;
 }
 
 const ROUTE_OVERRIDE_EXTENSIONS = [
@@ -1100,6 +1101,13 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/dev/emails.ts"),
 	});
 
+	if (options.cloudflareDevScheduler) {
+		injectRoute({
+			pattern: "/_emdash/api/dev/scheduled-tasks",
+			entrypoint: resolveRoute("api/dev/scheduled-tasks.ts"),
+		});
+	}
+
 	// Current user endpoint (always available)
 	injectRoute({
 		pattern: "/_emdash/api/auth/me",

package/src/astro/integration/runtime.ts

@@ -322,7 +322,8 @@ export interface EmDashConfig {
 	 *     audience: "abc123...",
 	 *     roleMapping: {
 	 *       "Admins": 50,
-	 *       "Editors": 30,
+	 *       "Editors": 40, // Editor
+	 *       "Authors": 30, // Author
 	 *     },
 	 *   }),
 	 * })

package/src/astro/integration/virtual-modules.ts

@@ -528,30 +528,23 @@ export function generateBuildModule(buildTime: number): string {
  * Generates the scheduler virtual module.
  *
  * Decides — at build time, from the Astro adapter — whether the runtime gets a
- * long-lived timer heartbeat. A *production* Cloudflare build has no persistent
- * timers, so the Worker's `scheduled()` handler (a Cron Trigger) drives
- * `runScheduledTasks()` instead and this exports `null`. Every other case — any
- * other adapter (Node, Bun), and crucially local `astro dev` even under the
- * Cloudflare adapter (no Cron Trigger fires in dev) — gets a `NodeCronScheduler`
- * factory so plugin cron, scheduled publishing, and cleanup still run.
+ * long-lived timer heartbeat. Cloudflare Workers have no persistent timers, so
+ * the Worker's `scheduled()` handler drives `runScheduledTasks()` instead. In
+ * local dev the long-lived Vite host invokes an EmDash-owned route that runs
+ * the same maintenance inside workerd. Other adapters (Node, Bun) get a
+ * `NodeCronScheduler` factory.
  *
  * Keeping the adapter check here — rather than in core's runtime — means the
  * runtime has no Cloudflare-specific code path; it just calls `createScheduler`
  * if one was injected. Mirrors the wait-until module's approach.
  */
-export function generateSchedulerModule(
-	adapterName: string | undefined,
-	command: "build" | "serve" | undefined,
-): string {
-	// Only suppress the timer for an actual Cloudflare *build* — that artifact
-	// runs in workerd where a Cron Trigger drives scheduled work. In `serve`
-	// (local dev) nothing fires the Cron Trigger, so fall through to the timer.
-	if (adapterName === "@astrojs/cloudflare" && command !== "serve") {
-		return `// Serverless build: an external Cron Trigger drives scheduled work.
+export function generateSchedulerModule(adapterName: string | undefined): string {
+	if (adapterName === "@astrojs/cloudflare") {
+		return `// Cloudflare: an external platform event drives scheduled work.
 export const createScheduler = null;
 `;
 	}
-	return `// Long-lived runtime (or local dev): drive scheduled work from an in-process timer.
+	return `// Long-lived runtime: drive scheduled work from an in-process timer.
 import { NodeCronScheduler } from "emdash";
 
 export function createScheduler(executor) {

package/src/astro/integration/vite-config.ts

@@ -183,10 +183,7 @@ export interface VitePluginOptions {
 /**
  * Creates the EmDash virtual modules Vite plugin.
  */
-export function createVirtualModulesPlugin(
-	options: VitePluginOptions,
-	astroCommand: "dev" | "build" | "preview" | "sync",
-): Plugin {
+export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 	const { serializableConfig, resolvedConfig, pluginDescriptors, astroConfig } = options;
 
 	let viteCommand: "build" | "serve" | undefined;
@@ -338,17 +335,9 @@ export function createVirtualModulesPlugin(
 			}
 			// Generate scheduler module — a NodeCronScheduler factory on
 			// long-lived runtimes, or null under the Cloudflare adapter where
-			// a Cron Trigger drives scheduled work instead.
-			//
-			// Decide from Astro's command, not Vite's config.command: the
-			// Cloudflare adapter builds the worker bundle via a nested Vite
-			// *build* pass even during `astro dev`, so viteCommand reports
-			// "build" and would wrongly suppress the in-process timer (#1635).
-			// Astro's command stays "dev", which is the only case that should
-			// fall through to a NodeCronScheduler.
+			// platform events drive scheduled work.
 			if (id === RESOLVED_VIRTUAL_SCHEDULER_ID) {
-				const schedulerCommand = astroCommand === "dev" ? "serve" : "build";
-				return generateSchedulerModule(astroConfig.adapter?.name, schedulerCommand);
+				return generateSchedulerModule(astroConfig.adapter?.name);
 			}
 			// Generate env module — re-exports cloudflare:workers' env under
 			// the Cloudflare adapter, undefined otherwise (#1736).
@@ -495,7 +484,7 @@ export function createViteConfig(
 		},
 		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Monorepo has both vite 6 (docs) and vite 7 (core). tsgo resolves correctly.
 		plugins: [
-			createVirtualModulesPlugin(options, command),
+			createVirtualModulesPlugin(options),
 			// Must precede the Lingui macro plugin, which redirects source
 			// catalog imports to dist/ in dev.
 			...(adminLocales

package/src/astro/middleware/auth.ts

@@ -126,6 +126,8 @@ const PUBLIC_API_EXACT = new Set([
 	"/_emdash/api/search/suggest",
 ]);
 
+const DEV_PUBLIC_API_EXACT = new Set(["/_emdash/api/typegen", "/_emdash/api/dev/scheduled-tasks"]);
+
 // Build merged public routes at module load from auth provider descriptors.
 // Routes ending with "/" are treated as prefixes; all others are exact matches.
 const { exact: _providerExactRoutes, prefixes: _providerPrefixRoutes } = (() => {
@@ -171,7 +173,7 @@ function isPublicEmDashRoute(pathname: string): boolean {
 	if (PUBLIC_API_PREFIXES.some((p) => pathname.startsWith(p))) return true;
 	if (_providerExactRoutes.has(pathname)) return true;
 	if (_providerPrefixRoutes.some((p) => pathname.startsWith(p))) return true;
-	if (import.meta.env.DEV && pathname === "/_emdash/api/typegen") return true;
+	if (import.meta.env.DEV && DEV_PUBLIC_API_EXACT.has(pathname)) return true;
 	return false;
 }