emdash 1.2.0 → 1.3.1

package/src/astro/middleware/redirect.ts

@@ -21,9 +21,17 @@ import { after } from "../../after.js";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
 import { createRedirectSource } from "../../redirects/artifacts.js";
+import type { CachedRedirects, RedirectRule } from "../../redirects/cache.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
 import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
+import { peekRequestCache } from "../../request-cache.js";
+import {
+	getRequestContext,
+	runWithContext,
+	type EmDashRequestContext,
+} from "../../request-context.js";
+import { invalidateSiteSettingsSnapshot, peekSiteSettingsSnapshot } from "../../settings/index.js";
 
 /** Paths that should never be intercepted by redirects */
 const SKIP_PREFIXES = ["/_emdash", "/_image"];
@@ -53,6 +61,50 @@ function recordHitInBackground(repo: RedirectRepository, id: string): void {
 	});
 }
 
+interface RedirectMatch {
+	redirect: RedirectRule;
+	destination: string;
+}
+
+/** Exact rules first, with or without a trailing slash, then patterns in precedence order. */
+function matchRedirect(cached: CachedRedirects, pathname: string): RedirectMatch | null {
+	let exact = cached.exact.get(pathname);
+	if (!exact && pathname.length > 1) {
+		const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
+		exact = cached.exact.get(alt);
+	}
+	if (exact) return { redirect: exact, destination: exact.destination };
+	return matchCachedPatterns(cached.patterns, pathname);
+}
+
+/** The response for a matched rule, or null when its destination is not safe to send. */
+function redirectResponse(
+	context: APIContext,
+	repo: RedirectRepository,
+	{ redirect, destination }: RedirectMatch,
+): Response | null {
+	// Terminal statuses (410 Gone / 451): serve the status directly,
+	// with no Location header.
+	if (isTerminalStatus(redirect.type)) {
+		recordHitInBackground(repo, redirect.id);
+		return new Response(null, { status: redirect.type });
+	}
+	if (!isSiteRelativeDestination(destination)) {
+		warnUnsafeDestination(redirect.id);
+		return null;
+	}
+	recordHitInBackground(repo, redirect.id);
+	const code = isRedirectCode(redirect.type) ? redirect.type : 301;
+	return context.redirect(destination, code);
+}
+
+/** Whether Astro's route cache will store the response: it does once a max age or a tag is set. */
+function routeCacheStores(cache: APIContext["cache"] | undefined): boolean {
+	if (!cache?.enabled) return false;
+	const { maxAge, tags } = cache.options;
+	return maxAge !== undefined || (tags?.length ?? 0) > 0;
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 
@@ -78,97 +130,169 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
-	try {
-		const repo = new RedirectRepository(db);
+	const routeCache: APIContext["cache"] | undefined = context.cache;
+	const renderedSettings = new Set<string>();
+	let currentSettingsVersion: string | null | undefined;
+	const checkSettings = () => {
+		if (currentSettingsVersion === undefined || renderedSettings.size === 0) return;
+		if (currentSettingsVersion === null) {
+			routeCache?.set(false);
+		} else if ([...renderedSettings].some((v) => v !== currentSettingsVersion)) {
+			routeCache?.set(false);
+			invalidateSiteSettingsSnapshot();
+		}
+	};
+	const requestSettings: NonNullable<EmDashRequestContext["siteSettings"]> = {
+		onRead(version) {
+			renderedSettings.add(version);
+			checkSettings();
+		},
+	};
+	const finalizeSettings = async () => {
+		if (!routeCacheStores(routeCache)) return;
+		if (requestSettings.live) {
+			if (currentSettingsVersion == null) routeCache?.set(false);
+			return;
+		}
+		const prefetched =
+			await peekRequestCache<NonNullable<ReturnType<typeof peekSiteSettingsSnapshot>>>(
+				"siteSettingsSnapshot",
+			);
+		if (prefetched) requestSettings.onRead(prefetched.version);
+		const snapshot = peekSiteSettingsSnapshot();
+		// Layouts and head components can first read settings after cache headers
+		// are sent. Pin the verified snapshot before handing off the stream.
+		if (currentSettingsVersion == null) {
+			routeCache?.set(false);
+		} else if (!snapshot) {
+			requestSettings.version = currentSettingsVersion;
+		} else if (snapshot.version !== currentSettingsVersion) {
+			routeCache?.set(false);
+			invalidateSiteSettingsSnapshot();
+		} else {
+			requestSettings.snapshot = snapshot;
+		}
+	};
+	const run = async () => {
+		let repo: RedirectRepository | undefined;
+		let source: ReturnType<typeof createRedirectSource> | undefined;
+		let cached: CachedRedirects | undefined;
+		let match: RedirectMatch | null = null;
+		let verified = false;
 
-		// One query loads the published rules into the cache; warm requests
-		// issue zero queries, and an expired cache checks the published version
-		// in the background. Empty-redirect sites cache an empty Map + array.
-		const cached = await loadCachedRedirects(createRedirectSource(db));
+		try {
+			repo = new RedirectRepository(db);
+			source = createRedirectSource(
+				db,
+				routeCache?.enabled
+					? (version) => {
+							currentSettingsVersion = version;
+							checkSettings();
+						}
+					: undefined,
+			);
 
-		// 1. Exact match (O(1) Map lookup)
-		let exact = cached.exact.get(pathname);
-		if (!exact && pathname.length > 1) {
-			const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
-			exact = cached.exact.get(alt);
-		}
-		if (exact) {
-			// Terminal statuses (410 Gone / 451): serve the status directly,
-			// with no Location header.
-			if (isTerminalStatus(exact.type)) {
-				recordHitInBackground(repo, exact.id);
-				return new Response(null, { status: exact.type });
-			}
-			const dest = exact.destination;
-			if (!isSiteRelativeDestination(dest)) {
-				warnUnsafeDestination(exact.id);
-				return next();
+			// One query loads the published rules into the cache; warm requests
+			// issue zero queries, and an expired cache checks the published version
+			// in the background. Empty-redirect sites cache an empty Map + array.
+			// A response the route cache stores is served to every visitor until it
+			// is purged, so before one is returned the rules are verified current.
+			cached = await loadCachedRedirects(source);
+			match = matchRedirect(cached, pathname);
+			if (match && routeCacheStores(routeCache)) {
+				cached = await loadCachedRedirects(source, { verify: true });
+				verified = true;
+				match = matchRedirect(cached, pathname);
 			}
-			recordHitInBackground(repo, exact.id);
-			const code = isRedirectCode(exact.type) ? exact.type : 301;
-			return context.redirect(dest, code);
+		} catch {
+			// If the redirects table doesn't exist yet (pre-migration), skip silently.
+			// Without a freshness check, a settings snapshot must not be edge-cached.
+			currentSettingsVersion = null;
+			routeCache?.set(false);
+			return next();
 		}
 
-		// 2. Pattern match (compile once, match every request)
-		const patternMatch = matchCachedPatterns(cached.patterns, pathname);
-		if (patternMatch) {
-			const { redirect, destination } = patternMatch;
-			// Terminal statuses (410 Gone / 451): serve the status directly.
-			if (isTerminalStatus(redirect.type)) {
-				recordHitInBackground(repo, redirect.id);
-				return new Response(null, { status: redirect.type });
-			}
-			if (!isSiteRelativeDestination(destination)) {
-				warnUnsafeDestination(redirect.id);
-				return next();
-			}
-			recordHitInBackground(repo, redirect.id);
-			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
-			return context.redirect(destination, code);
+		if (match) {
+			const redirected = redirectResponse(context, repo, match);
+			if (redirected) return redirected;
 		}
 
-		// No redirect matched -- proceed and check for 404
+		// No redirect matched -- proceed and check for 404.
 		const response = await next();
 
-		// Keep a 404 out of the route cache: publishing the missing entry later
-		// purges content tags, not the missed path, so a cached 404 would outlive
-		// the fix. Astro has no cache handle for URLs that match no route, but a
-		// page answering a content miss with Astro.rewrite("/404") has one.
-		if (response.status === 404) {
-			const routeCache: APIContext["cache"] | undefined = context.cache;
-			routeCache?.set(false);
-		}
+		// Post-response work must not re-run the route either. Swallow errors here
+		// and return the response the route already produced.
+		try {
+			// Keep a 404 out of the route cache: publishing the missing entry later
+			// purges content tags, not the missed path, so a cached 404 would outlive
+			// the fix. Astro has no cache handle for URLs that match no route, but a
+			// page answering a content miss with Astro.rewrite("/404") has one.
+			if (response.status === 404) {
+				routeCache?.set(false);
+			}
 
-		// Log misses under the path the visitor requested.
-		// Two shapes count as a miss: a 404 response (an unmatched route, or a
-		// page answering a content miss with Astro.rewrite("/404")), and a
-		// matched route answering a content miss with a redirect to /404 —
-		// there the missed path exists only on this first pass, before the
-		// browser follows the redirect. The error page itself is never logged: /404
-		// answers 404 by design and carries no path information.
-		const location = response.headers.get("location");
-		const missedByRedirect =
-			isRedirectCode(response.status) && (location === "/404" || location === "/404/");
-		const missedDirectly = response.status === 404 && pathname !== "/404" && pathname !== "/404/";
-		if (missedDirectly || missedByRedirect) {
-			const referrer = context.request.headers.get("referer") ?? null;
-			const userAgent = context.request.headers.get("user-agent") ?? null;
-			after(async () => {
-				try {
-					await repo.log404({
-						path: pathname,
-						referrer,
-						userAgent,
-					});
-				} catch (error) {
-					console.error("[emdash:redirects] failed to log 404:", error);
+			if (!verified && routeCacheStores(routeCache) && source && cached) {
+				currentSettingsVersion = undefined;
+				const current = await loadCachedRedirects(source, { verify: true }).catch(() => cached);
+				if (currentSettingsVersion === undefined) {
+					currentSettingsVersion = null;
+					checkSettings();
+				}
+				const late = current === cached ? null : matchRedirect(current, pathname);
+				const redirected = late && redirectResponse(context, repo, late);
+				if (redirected) {
+					routeCache?.set(false);
+					// Finish the discarded render instead of cancelling it: a render cut off
+					// with its request never settles an isolate-wide fetch it started, and
+					// every later render awaiting that fetch hangs.
+					after(() => response.body?.pipeTo(new WritableStream()));
+					return redirected;
 				}
-			});
+			}
+
+			try {
+				await finalizeSettings();
+			} catch {
+				routeCache?.set(false);
+			}
+
+			// Log misses under the path the visitor requested.
+			// Two shapes count as a miss: a 404 response (an unmatched route, or a
+			// page answering a content miss with Astro.rewrite("/404")), and a
+			// matched route answering a content miss with a redirect to /404 —
+			// there the missed path exists only on this first pass, before the
+			// browser follows the redirect. The error page itself is never logged: /404
+			// answers 404 by design and carries no path information.
+			const location = response.headers.get("location");
+			const missedByRedirect =
+				isRedirectCode(response.status) && (location === "/404" || location === "/404/");
+			const missedDirectly = response.status === 404 && pathname !== "/404" && pathname !== "/404/";
+			if (missedDirectly || missedByRedirect) {
+				const referrer = context.request.headers.get("referer") ?? null;
+				const userAgent = context.request.headers.get("user-agent") ?? null;
+				after(async () => {
+					try {
+						await repo.log404({
+							path: pathname,
+							referrer,
+							userAgent,
+						});
+					} catch (error) {
+						console.error("[emdash:redirects] failed to log 404:", error);
+					}
+				});
+			}
+		} catch (error) {
+			console.error("[emdash:redirects] post-response step failed:", error);
 		}
 
 		return response;
-	} catch {
-		// If the redirects table doesn't exist yet (pre-migration), skip silently
-		return next();
+	};
+	if (!routeCache?.enabled) return run();
+	const parent = getRequestContext();
+	if (parent) {
+		parent.siteSettings = requestSettings;
+		return run();
 	}
+	return runWithContext({ editMode: false, siteSettings: requestSettings }, run);
 });

package/src/astro/middleware/request-context.ts

@@ -252,6 +252,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		};
 		if (virtualConfig?.objectCacheEnabled && context.cache?.enabled) {
 			const parent = getRequestContext();
+			if (parent?.siteSettings) parent.siteSettings.live = true;
 			return runWithContext({ ...parent, editMode: false, routeCacheFill: true }, render);
 		}
 		return render();

package/src/astro/middleware.ts

@@ -42,6 +42,7 @@ import {
 	isInstrumentationEnabled,
 } from "../database/instrumentation.js";
 import {
+	isMigrationRequiredError,
 	PendingMigrationsError,
 	resolveRuntimeMigrationMode,
 	type RuntimeMigrationMode,
@@ -84,7 +85,10 @@ import {
 } from "./middleware/scoped-db.js";
 import { wrapBodyForStreamMetrics } from "./middleware/stream-end-metrics.js";
 import { prefetchLayoutData } from "./prefetch.js";
-import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
+import {
+	createPublicPluginApiRouteHandler,
+	getPublicPluginRouteMeta,
+} from "./public-plugin-api-routes.js";
 import { resolveSessionUser } from "./session-user.js";
 import type { EmDashHandlers } from "./types.js";
 
@@ -481,6 +485,18 @@ function pendingMigrationsResponse(error: PendingMigrationsError): Response {
 	return migrationRequiredResponse();
 }
 
+function migrationRequiredErrorResponse(error: unknown): Response {
+	if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+	if (Date.now() - lastRuntimeInitErrorLogAt >= RUNTIME_INIT_ERROR_LOG_INTERVAL_MS) {
+		lastRuntimeInitErrorLogAt = Date.now();
+		console.error(
+			"[emdash] database migrations are required:",
+			error instanceof Error ? error.message : error,
+		);
+	}
+	return migrationRequiredResponse();
+}
+
 function migrationRequiredResponse(): Response {
 	return new Response(
 		"Database migrations are required. Apply the deployment migration manifest and retry.",
@@ -895,14 +911,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
 						locals.emdash = {
 							handlePublicPluginApiRoute,
+							getPublicPluginRouteMeta: (pluginId, path) =>
+								getPublicPluginRouteMeta(runtime, pluginId, path),
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
 							storage: runtime.storage,
 						} as EmDashHandlers;
 					} catch (error) {
-						if (error instanceof PendingMigrationsError) {
-							return pendingMigrationsResponse(error);
+						if (isMigrationRequiredError(error)) {
+							return migrationRequiredErrorResponse(error);
 						}
 						if (migrationMode === "manual" && isMissingTableError(error)) {
 							console.error(
@@ -971,9 +989,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					// Eagerly warm site-global layout data (menus, widget areas,
 					// taxonomy terms, settings) concurrently so the layout's
 					// per-component reads overlap into ~one wall-clock round trip and
-					// hit a warm cache instead of serializing. Three guards:
+					// hit a warm cache instead of serializing. Four guards:
 					//  - request-scoped (remote) backend only -- this branch implies it;
 					//    pointless on synchronous local SQLite.
+					//  - an adapter that can overlap queries -- without that, Kysely's
+					//    connection mutex (D1 sessions without `coalesce`) queues the
+					//    prefetch ahead of the page's own first query.
 					//  - HTML navigations only -- feeds/sitemaps/JSON don't render the
 					//    layout, so prefetching their chrome is pure waste.
 					//  - the work starts immediately, then after() keeps both it and the
@@ -987,7 +1008,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						.trim()
 						.startsWith("text/html");
 					return runWithContext(ctx, async () => {
-						if (acceptsHtml) after(() => prefetchLayoutData());
+						if (
+							acceptsHtml &&
+							anonScoped.db.getExecutor().adapter.supportsMultipleConnections !== false
+						) {
+							after(() => prefetchLayoutData());
+						}
 						// commit() persists per-request state (e.g. the D1 bookmark cookie)
 						// before the response is returned, even if render throws; close()
 						// waits for stream-end and request-owned deferred work. See finishScoped.
@@ -1092,6 +1118,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					getPluginEditorExtension: runtime.getPluginEditorExtension.bind(runtime),
 					getPluginEditorDraftSchema: runtime.getPluginEditorDraftSchema.bind(runtime),
 					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
+					getPublicPluginRouteMeta: (pluginId, path) =>
+						getPublicPluginRouteMeta(runtime, pluginId, path),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
 					getPluginMcpTools: runtime.getPluginMcpTools.bind(runtime),
 					getEnabledPluginMcpTools: runtime.getEnabledPluginMcpTools.bind(runtime),
@@ -1161,8 +1189,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					setPluginStatus: runtime.setPluginStatus.bind(runtime),
 				};
 			} catch (error) {
-				if (error instanceof PendingMigrationsError) {
-					return pendingMigrationsResponse(error);
+				if (isMigrationRequiredError(error)) {
+					return migrationRequiredErrorResponse(error);
 				}
 				if (migrationMode === "manual" && isMissingTableError(error)) {
 					console.error("[emdash] database schema is unavailable in manual migration mode:", error);

package/src/astro/prefetch.ts

@@ -7,17 +7,19 @@
  * execute as serial DB round trips. This fires them all CONCURRENTLY at the
  * very start of the request, before `next()`:
  *
- *   - On remote backends (D1, Durable Objects) the round trips overlap instead
- *     of serializing, collapsing ~N sequential RTTs into ~1 wall-clock RTT. On
- *     a coalescing backend they additionally batch into a single round trip.
+ *   - On remote backends whose adapter can overlap queries the round trips
+ *     overlap instead of serializing, collapsing ~N sequential RTTs into ~1
+ *     wall-clock RTT. On a coalescing backend they additionally batch into a
+ *     single round trip.
  *   - The results land in the per-request `requestCached` store under the exact
  *     keys the layout helpers use, so when the components render they hit a warm
  *     (in-flight or resolved) cache entry instead of issuing their own query.
  *
  * Nothing here changes what templates call -- it warms the real helpers, so the
  * cache keys and value shapes are guaranteed identical. The caller gates this to
- * the public-page path on a request-scoped (remote) backend; it is a no-op-ish
- * waste on synchronous local SQLite, so don't call it there.
+ * the public-page path on a request-scoped (remote) backend that can overlap
+ * queries; it is a no-op-ish waste on synchronous local SQLite and only delays
+ * the page on a handle that runs one query at a time, so don't call it there.
  *
  * Fire-and-forget: never awaited by middleware, never throws (a prefetch failure
  * must not affect the request -- the helpers will simply run on demand).

package/src/astro/public-plugin-api-routes.ts

@@ -18,6 +18,15 @@ interface PublicPluginApiRouteRuntime {
 	): Promise<HandlerResponse>;
 }
 
+export function getPublicPluginRouteMeta(
+	runtime: Pick<PublicPluginApiRouteRuntime, "getPluginRouteMeta">,
+	pluginId: string,
+	path: string,
+): RouteMeta | null {
+	const meta = runtime.getPluginRouteMeta(pluginId, path);
+	return meta?.public === true ? meta : null;
+}
+
 function pluginRouteNotFound(): HandlerResponse {
 	return {
 		success: false,
@@ -32,8 +41,7 @@ export function createPublicPluginApiRouteHandler(
 	runtime: PublicPluginApiRouteRuntime,
 ): PublicPluginApiRouteHandler {
 	return async (pluginId, method, path, request) => {
-		const meta = runtime.getPluginRouteMeta(pluginId, path);
-		if (meta?.public !== true) {
+		if (!getPublicPluginRouteMeta(runtime, pluginId, path)) {
 			return pluginRouteNotFound();
 		}
 

package/src/astro/routes/api/admin/plugins/registry/artifact.ts

@@ -423,7 +423,7 @@ async function resolveArtifact(
 			.map(recordScopedCacheEndpoint)
 			.find((value) => value !== null);
 		if (serviceEndpoint) {
-			const preset = kind === "icon" ? "avatar" : kind === "banner" ? "banner" : "feed_thumbnail";
+			const preset = kind === "icon" ? "avatar" : kind === "banner" ? "banner" : "feed_fullsize";
 			const cacheUrl = recordScopedImageCacheUrl(
 				serviceEndpoint,
 				preset,

package/src/astro/routes/api/content/[collection]/[id]/discard-draft.ts

@@ -11,6 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentRevisionConditionBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -68,7 +69,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/duplicate.ts

@@ -11,7 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, locals, cache }) => {
+export const POST: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
 	const collection = params.collection!;
 	const id = params.id!;
@@ -52,9 +52,5 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 	const result = await emdash.handleContentDuplicate(collection, resolvedId, user?.id);
 
-	if (!result.success) return unwrapResult(result);
-
-	if (cache?.enabled) await cache.invalidate({ tags: [collection] });
-
 	return unwrapResult(result, 201);
 };

package/src/astro/routes/api/content/[collection]/[id]/lock.ts

@@ -8,7 +8,7 @@
 
 import type { APIRoute } from "astro";
 
-import { requireOwnerPerm } from "#api/authorize.js";
+import { requireEntryEditPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import {
 	handleEntryLockAcquire,
@@ -60,7 +60,7 @@ async function resolveEntry(
 				(existingData.item as Record<string, unknown>)
 			: existingData;
 	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
-	const denied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	const denied = requireEntryEditPerm(user, { authorId, status: existingItem?.status });
 	if (denied) return denied;
 
 	return {

package/src/astro/routes/api/content/[collection]/[id]/permanent.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -26,7 +27,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, id] });
+	await invalidateRouteCache(cache, [collection, id]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/publish.ts

@@ -18,6 +18,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentPublishBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -98,7 +99,7 @@ export async function publishContent(
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 }

package/src/astro/routes/api/content/[collection]/[id]/restore.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -50,7 +51,7 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/schedule.ts

@@ -12,6 +12,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentScheduleBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -84,7 +85,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+	await invalidateRouteCache(cache, [collection, resolvedId ?? id]);
 
 	return unwrapResult(result);
 };
@@ -128,7 +129,7 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+	await invalidateRouteCache(cache, [collection, resolvedId ?? id]);
 
 	return unwrapResult(result);
 };