emdash 1.3.0 → 1.3.1

package/src/astro/middleware/redirect.ts

@@ -25,6 +25,13 @@ import type { CachedRedirects, RedirectRule } from "../../redirects/cache.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
 import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
+import { peekRequestCache } from "../../request-cache.js";
+import {
+	getRequestContext,
+	runWithContext,
+	type EmDashRequestContext,
+} from "../../request-context.js";
+import { invalidateSiteSettingsSnapshot, peekSiteSettingsSnapshot } from "../../settings/index.js";
 
 /** Paths that should never be intercepted by redirects */
 const SKIP_PREFIXES = ["/_emdash", "/_image"];
@@ -123,81 +130,169 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 	}
 
-	try {
-		const repo = new RedirectRepository(db);
-		const source = createRedirectSource(db);
-		const routeCache: APIContext["cache"] | undefined = context.cache;
-
-		// One query loads the published rules into the cache; warm requests
-		// issue zero queries, and an expired cache checks the published version
-		// in the background. Empty-redirect sites cache an empty Map + array.
-		// A response the route cache stores is served to every visitor until it
-		// is purged, so before one is returned the rules are verified current.
-		let cached = await loadCachedRedirects(source);
-		let match = matchRedirect(cached, pathname);
-		let verified = false;
-		if (match && routeCacheStores(routeCache)) {
-			cached = await loadCachedRedirects(source, { verify: true });
-			verified = true;
-			match = matchRedirect(cached, pathname);
+	const routeCache: APIContext["cache"] | undefined = context.cache;
+	const renderedSettings = new Set<string>();
+	let currentSettingsVersion: string | null | undefined;
+	const checkSettings = () => {
+		if (currentSettingsVersion === undefined || renderedSettings.size === 0) return;
+		if (currentSettingsVersion === null) {
+			routeCache?.set(false);
+		} else if ([...renderedSettings].some((v) => v !== currentSettingsVersion)) {
+			routeCache?.set(false);
+			invalidateSiteSettingsSnapshot();
+		}
+	};
+	const requestSettings: NonNullable<EmDashRequestContext["siteSettings"]> = {
+		onRead(version) {
+			renderedSettings.add(version);
+			checkSettings();
+		},
+	};
+	const finalizeSettings = async () => {
+		if (!routeCacheStores(routeCache)) return;
+		if (requestSettings.live) {
+			if (currentSettingsVersion == null) routeCache?.set(false);
+			return;
+		}
+		const prefetched =
+			await peekRequestCache<NonNullable<ReturnType<typeof peekSiteSettingsSnapshot>>>(
+				"siteSettingsSnapshot",
+			);
+		if (prefetched) requestSettings.onRead(prefetched.version);
+		const snapshot = peekSiteSettingsSnapshot();
+		// Layouts and head components can first read settings after cache headers
+		// are sent. Pin the verified snapshot before handing off the stream.
+		if (currentSettingsVersion == null) {
+			routeCache?.set(false);
+		} else if (!snapshot) {
+			requestSettings.version = currentSettingsVersion;
+		} else if (snapshot.version !== currentSettingsVersion) {
+			routeCache?.set(false);
+			invalidateSiteSettingsSnapshot();
+		} else {
+			requestSettings.snapshot = snapshot;
 		}
-		if (match) return redirectResponse(context, repo, match) ?? next();
+	};
+	const run = async () => {
+		let repo: RedirectRepository | undefined;
+		let source: ReturnType<typeof createRedirectSource> | undefined;
+		let cached: CachedRedirects | undefined;
+		let match: RedirectMatch | null = null;
+		let verified = false;
 
-		// No redirect matched -- proceed and check for 404
-		const response = await next();
+		try {
+			repo = new RedirectRepository(db);
+			source = createRedirectSource(
+				db,
+				routeCache?.enabled
+					? (version) => {
+							currentSettingsVersion = version;
+							checkSettings();
+						}
+					: undefined,
+			);
 
-		// Keep a 404 out of the route cache: publishing the missing entry later
-		// purges content tags, not the missed path, so a cached 404 would outlive
-		// the fix. Astro has no cache handle for URLs that match no route, but a
-		// page answering a content miss with Astro.rewrite("/404") has one.
-		if (response.status === 404) {
+			// One query loads the published rules into the cache; warm requests
+			// issue zero queries, and an expired cache checks the published version
+			// in the background. Empty-redirect sites cache an empty Map + array.
+			// A response the route cache stores is served to every visitor until it
+			// is purged, so before one is returned the rules are verified current.
+			cached = await loadCachedRedirects(source);
+			match = matchRedirect(cached, pathname);
+			if (match && routeCacheStores(routeCache)) {
+				cached = await loadCachedRedirects(source, { verify: true });
+				verified = true;
+				match = matchRedirect(cached, pathname);
+			}
+		} catch {
+			// If the redirects table doesn't exist yet (pre-migration), skip silently.
+			// Without a freshness check, a settings snapshot must not be edge-cached.
+			currentSettingsVersion = null;
 			routeCache?.set(false);
+			return next();
 		}
 
-		if (!verified && routeCacheStores(routeCache)) {
-			const current = await loadCachedRedirects(source, { verify: true }).catch(() => cached);
-			const late = current === cached ? null : matchRedirect(current, pathname);
-			const redirected = late && redirectResponse(context, repo, late);
-			if (redirected) {
+		if (match) {
+			const redirected = redirectResponse(context, repo, match);
+			if (redirected) return redirected;
+		}
+
+		// No redirect matched -- proceed and check for 404.
+		const response = await next();
+
+		// Post-response work must not re-run the route either. Swallow errors here
+		// and return the response the route already produced.
+		try {
+			// Keep a 404 out of the route cache: publishing the missing entry later
+			// purges content tags, not the missed path, so a cached 404 would outlive
+			// the fix. Astro has no cache handle for URLs that match no route, but a
+			// page answering a content miss with Astro.rewrite("/404") has one.
+			if (response.status === 404) {
 				routeCache?.set(false);
-				// Finish the discarded render instead of cancelling it: a render cut off
-				// with its request never settles an isolate-wide fetch it started, and
-				// every later render awaiting that fetch hangs.
-				after(() => response.body?.pipeTo(new WritableStream()));
-				return redirected;
 			}
-		}
 
-		// Log misses under the path the visitor requested.
-		// Two shapes count as a miss: a 404 response (an unmatched route, or a
-		// page answering a content miss with Astro.rewrite("/404")), and a
-		// matched route answering a content miss with a redirect to /404 —
-		// there the missed path exists only on this first pass, before the
-		// browser follows the redirect. The error page itself is never logged: /404
-		// answers 404 by design and carries no path information.
-		const location = response.headers.get("location");
-		const missedByRedirect =
-			isRedirectCode(response.status) && (location === "/404" || location === "/404/");
-		const missedDirectly = response.status === 404 && pathname !== "/404" && pathname !== "/404/";
-		if (missedDirectly || missedByRedirect) {
-			const referrer = context.request.headers.get("referer") ?? null;
-			const userAgent = context.request.headers.get("user-agent") ?? null;
-			after(async () => {
-				try {
-					await repo.log404({
-						path: pathname,
-						referrer,
-						userAgent,
-					});
-				} catch (error) {
-					console.error("[emdash:redirects] failed to log 404:", error);
+			if (!verified && routeCacheStores(routeCache) && source && cached) {
+				currentSettingsVersion = undefined;
+				const current = await loadCachedRedirects(source, { verify: true }).catch(() => cached);
+				if (currentSettingsVersion === undefined) {
+					currentSettingsVersion = null;
+					checkSettings();
 				}
-			});
+				const late = current === cached ? null : matchRedirect(current, pathname);
+				const redirected = late && redirectResponse(context, repo, late);
+				if (redirected) {
+					routeCache?.set(false);
+					// Finish the discarded render instead of cancelling it: a render cut off
+					// with its request never settles an isolate-wide fetch it started, and
+					// every later render awaiting that fetch hangs.
+					after(() => response.body?.pipeTo(new WritableStream()));
+					return redirected;
+				}
+			}
+
+			try {
+				await finalizeSettings();
+			} catch {
+				routeCache?.set(false);
+			}
+
+			// Log misses under the path the visitor requested.
+			// Two shapes count as a miss: a 404 response (an unmatched route, or a
+			// page answering a content miss with Astro.rewrite("/404")), and a
+			// matched route answering a content miss with a redirect to /404 —
+			// there the missed path exists only on this first pass, before the
+			// browser follows the redirect. The error page itself is never logged: /404
+			// answers 404 by design and carries no path information.
+			const location = response.headers.get("location");
+			const missedByRedirect =
+				isRedirectCode(response.status) && (location === "/404" || location === "/404/");
+			const missedDirectly = response.status === 404 && pathname !== "/404" && pathname !== "/404/";
+			if (missedDirectly || missedByRedirect) {
+				const referrer = context.request.headers.get("referer") ?? null;
+				const userAgent = context.request.headers.get("user-agent") ?? null;
+				after(async () => {
+					try {
+						await repo.log404({
+							path: pathname,
+							referrer,
+							userAgent,
+						});
+					} catch (error) {
+						console.error("[emdash:redirects] failed to log 404:", error);
+					}
+				});
+			}
+		} catch (error) {
+			console.error("[emdash:redirects] post-response step failed:", error);
 		}
 
 		return response;
-	} catch {
-		// If the redirects table doesn't exist yet (pre-migration), skip silently
-		return next();
+	};
+	if (!routeCache?.enabled) return run();
+	const parent = getRequestContext();
+	if (parent) {
+		parent.siteSettings = requestSettings;
+		return run();
 	}
+	return runWithContext({ editMode: false, siteSettings: requestSettings }, run);
 });

package/src/astro/middleware/request-context.ts

@@ -252,6 +252,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		};
 		if (virtualConfig?.objectCacheEnabled && context.cache?.enabled) {
 			const parent = getRequestContext();
+			if (parent?.siteSettings) parent.siteSettings.live = true;
 			return runWithContext({ ...parent, editMode: false, routeCacheFill: true }, render);
 		}
 		return render();

package/src/astro/middleware.ts

@@ -42,6 +42,7 @@ import {
 	isInstrumentationEnabled,
 } from "../database/instrumentation.js";
 import {
+	isMigrationRequiredError,
 	PendingMigrationsError,
 	resolveRuntimeMigrationMode,
 	type RuntimeMigrationMode,
@@ -484,6 +485,18 @@ function pendingMigrationsResponse(error: PendingMigrationsError): Response {
 	return migrationRequiredResponse();
 }
 
+function migrationRequiredErrorResponse(error: unknown): Response {
+	if (error instanceof PendingMigrationsError) return pendingMigrationsResponse(error);
+	if (Date.now() - lastRuntimeInitErrorLogAt >= RUNTIME_INIT_ERROR_LOG_INTERVAL_MS) {
+		lastRuntimeInitErrorLogAt = Date.now();
+		console.error(
+			"[emdash] database migrations are required:",
+			error instanceof Error ? error.message : error,
+		);
+	}
+	return migrationRequiredResponse();
+}
+
 function migrationRequiredResponse(): Response {
 	return new Response(
 		"Database migrations are required. Apply the deployment migration manifest and retry.",
@@ -906,8 +919,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							storage: runtime.storage,
 						} as EmDashHandlers;
 					} catch (error) {
-						if (error instanceof PendingMigrationsError) {
-							return pendingMigrationsResponse(error);
+						if (isMigrationRequiredError(error)) {
+							return migrationRequiredErrorResponse(error);
 						}
 						if (migrationMode === "manual" && isMissingTableError(error)) {
 							console.error(
@@ -1176,8 +1189,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					setPluginStatus: runtime.setPluginStatus.bind(runtime),
 				};
 			} catch (error) {
-				if (error instanceof PendingMigrationsError) {
-					return pendingMigrationsResponse(error);
+				if (isMigrationRequiredError(error)) {
+					return migrationRequiredErrorResponse(error);
 				}
 				if (migrationMode === "manual" && isMissingTableError(error)) {
 					console.error("[emdash] database schema is unavailable in manual migration mode:", error);

package/src/astro/routes/api/content/[collection]/[id]/terms/[taxonomy].ts

@@ -5,6 +5,7 @@
  * POST /_emdash/api/content/:collection/:id/terms/:taxonomy - Set terms for an entry
  */
 
+import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
 import { requireAnyPerm, requireEntryEditPerm, requirePerm } from "#api/authorize.js";
@@ -80,7 +81,9 @@ export const GET: APIRoute = async ({ params, locals }) => {
 		// entry's locale server-side so the response includes only that locale's
 		// term variant.
 		const entry = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);
-		if (!entry) return apiError("NOT_FOUND", "Content not found", 404);
+		if (!entry || (entry.status !== "published" && !hasPermission(user, "content:read_drafts"))) {
+			return apiError("NOT_FOUND", "Content not found", 404);
+		}
 		const locale = entry.locale || getI18nConfig()?.defaultLocale || "en";
 		const defaultLocale = getI18nConfig()?.defaultLocale ?? "en";
 

package/src/astro/routes/api/content/[collection]/[id]/translations.ts

@@ -23,6 +23,14 @@ function isPublished(t: unknown): boolean {
 	);
 }
 
+function isEntry(t: unknown, idOrSlug: string): boolean {
+	return (
+		typeof t === "object" &&
+		t !== null &&
+		(("id" in t && t.id === idOrSlug) || ("slug" in t && t.slug === idOrSlug))
+	);
+}
+
 export const GET: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
 	if (!emdash?.handleContentTranslations) {
@@ -36,7 +44,9 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const result = await emdash.handleContentTranslations(collection, id);
 
 	// Filter out non-published translations for users without read_drafts so a
-	// subscriber can't enumerate locales that aren't yet live.
+	// subscriber can't enumerate locales that aren't yet live. The requested
+	// entry is one of the translations; if it isn't published, return 404 so
+	// its id or slug can't be probed either.
 	if (result.success && !hasPermission(user, "content:read_drafts")) {
 		const data =
 			result.data && typeof result.data === "object"
@@ -45,6 +55,9 @@ export const GET: APIRoute = async ({ params, locals }) => {
 				: undefined;
 		const translations = Array.isArray(data?.translations) ? data.translations : [];
 		const filtered = translations.filter(isPublished);
+		if (!filtered.some((t) => isEntry(t, id))) {
+			return apiError("NOT_FOUND", `Content item not found: ${id}`, 404);
+		}
 		return unwrapResult({
 			success: true,
 			data: { ...data, translations: filtered },

package/src/astro/routes/api/dashboard.ts

@@ -26,6 +26,8 @@ export const GET: APIRoute = async ({ locals }) => {
 	try {
 		const result = await handleDashboardStats(emdash.db, {
 			includeDrafts: hasPermission(user, "content:read_drafts"),
+			includeMediaCount: hasPermission(user, "media:read"),
+			includeUserCount: hasPermission(user, "users:read"),
 		});
 
 		return unwrapResult(result);

package/src/astro/routes/api/media/file/[...key].ts

@@ -80,6 +80,8 @@ export const GET: APIRoute = async ({ params, locals, request, cache }) => {
 		return apiError("NOT_CONFIGURED", "Storage not configured", 500);
 	}
 
+	// An unread download retains its storage connection even for a bodyless response.
+	let unusedBody: ReadableStream<Uint8Array> | undefined;
 	try {
 		// Range requests that include If-Range are served as whole-file responses
 		// because this route does not compare If-Range validators.
@@ -92,12 +94,12 @@ export const GET: APIRoute = async ({ params, locals, request, cache }) => {
 		const result = range
 			? await emdash.storage.download(key, { range })
 			: await emdash.storage.download(key);
+		unusedBody = result.body;
 		const served = range ? result.range : undefined;
 
 		// Adapters return the whole file for a range they don't serve, including
 		// one past the end. A size of 0 may be unknown, so it rules nothing out.
 		if (range && !served && result.size > 0 && !resolveByteRange(range, result.size)) {
-			await result.body.cancel().catch(() => undefined);
 			const response = apiError("RANGE_NOT_SATISFIABLE", "Range not satisfiable", 416);
 			response.headers.set("Content-Range", `bytes */${result.size}`);
 			return response;
@@ -138,18 +140,24 @@ export const GET: APIRoute = async ({ params, locals, request, cache }) => {
 			headers["Content-Disposition"] = "attachment";
 		}
 
+		const body = request.method === "HEAD" ? null : result.body;
+
 		if (served) {
 			const end = served.offset + served.length - 1;
 			headers["Content-Range"] = `bytes ${served.offset}-${end}/${result.size}`;
 			headers["Content-Length"] = String(served.length);
-			return new Response(result.body, { status: 206, headers });
+			const response = new Response(body, { status: 206, headers });
+			if (body) unusedBody = undefined;
+			return response;
 		}
 
 		if (result.size) {
 			headers["Content-Length"] = String(result.size);
 		}
 
-		return new Response(result.body, { status: 200, headers });
+		const response = new Response(body, { status: 200, headers });
+		if (body) unusedBody = undefined;
+		return response;
 	} catch (error) {
 		// Check if it's a "not found" error
 		if (
@@ -159,5 +167,7 @@ export const GET: APIRoute = async ({ params, locals, request, cache }) => {
 			return apiError("NOT_FOUND", "File not found", 404);
 		}
 		return handleError(error, "Failed to serve file", "FILE_SERVE_ERROR");
+	} finally {
+		if (unusedBody && !unusedBody.locked) await unusedBody.cancel().catch(() => undefined);
 	}
 };

package/src/auth/types.ts

@@ -166,6 +166,12 @@ export interface AuthProviderAdminExports {
 	 */
 	LoginForm?: import("react").ComponentType;
 
+	/**
+	 * Optional help text shown below the provider's LoginForm. Providers can
+	 * export a string or a component; components keep text localisable.
+	 */
+	loginHelp?: string | import("react").ComponentType;
+
 	/**
 	 * Setup wizard step for creating the admin account via this provider.
 	 * When present, this provider appears as an option in the setup wizard's

package/src/cli/commands/export-seed.ts

@@ -26,6 +26,7 @@ import type { ContentItem } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
 import { validateIdentifier } from "../../database/validate.js";
 import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
+import { getMediaCaption } from "../../media/caption.js";
 import { BlockTypeRegistry } from "../../schema/block-type-registry.js";
 import { SchemaRegistry } from "../../schema/registry.js";
 import type { FieldType } from "../../schema/types.js";
@@ -1076,7 +1077,7 @@ interface MediaInfo {
 	url: string;
 	filename: string;
 	alt?: string;
-	caption?: string;
+	caption?: string | null;
 }
 
 interface ExportedContent {
@@ -1118,7 +1119,7 @@ async function exportContent(
 					url: `${mediaUrlPrefix}${media.storageKey}`,
 					filename: media.filename,
 					alt: media.alt || undefined,
-					caption: media.caption || undefined,
+					caption: typeof media.caption === "string" ? media.caption : null,
 				});
 			}
 			cursor = result.nextCursor;
@@ -1374,7 +1375,7 @@ function toSeedMedia(
 	mediaCounter: { count: number },
 ): unknown {
 	if (!value || typeof value !== "object") return value;
-	const mediaValue = value as { id?: unknown; alt?: unknown };
+	const mediaValue = value as { id?: unknown; alt?: unknown; caption?: unknown; meta?: unknown };
 	const mediaInfo = typeof mediaValue.id === "string" ? mediaMap.get(mediaValue.id) : undefined;
 	if (!mediaInfo) return value;
 
@@ -1384,7 +1385,8 @@ function toSeedMedia(
 			url: mediaInfo.url,
 			filename: mediaInfo.filename,
 			alt: (typeof mediaValue.alt === "string" && mediaValue.alt) || mediaInfo.alt,
-			caption: mediaInfo.caption,
+			caption: getMediaCaption(mediaValue) ?? mediaInfo.caption,
+			libraryCaption: mediaInfo.caption ?? null,
 		},
 	};
 }

package/src/cli/commands/login.ts

@@ -189,7 +189,6 @@ export const loginCommand = defineCommand({
 			type: "string",
 			alias: "u",
 			description: "EmDash instance URL",
-			default: "http://localhost:4321",
 		},
 		header: {
 			type: "string",
@@ -198,7 +197,7 @@ export const loginCommand = defineCommand({
 		},
 	},
 	async run({ args }) {
-		const baseUrl = args.url || "http://localhost:4321";
+		const baseUrl = resolveBaseUrl(args);
 		consola.start(`Connecting to ${baseUrl}...`);
 
 		// Resolve custom headers from --header flags and EMDASH_HEADERS env
@@ -371,11 +370,10 @@ export const logoutCommand = defineCommand({
 			type: "string",
 			alias: "u",
 			description: "EmDash instance URL",
-			default: "http://localhost:4321",
 		},
 	},
 	async run({ args }) {
-		const baseUrl = args.url || "http://localhost:4321";
+		const baseUrl = resolveBaseUrl(args);
 
 		// Get stored credentials
 		const cred = getCredentials(baseUrl);

package/src/client/index.ts

@@ -620,6 +620,7 @@ export class EmDashClient {
 								options.onTokenRefresh!(accessToken, expiresIn);
 							}
 						: undefined,
+					fetch: createTransport({ interceptors: options.interceptors }).fetch,
 				}),
 			);
 		}

package/src/client/transport.ts

@@ -140,18 +140,22 @@ export function refreshInterceptor(options: {
 	refreshToken: string;
 	tokenEndpoint: string;
 	onTokenRefreshed?: (accessToken: string, refreshToken: string, expiresAt: string) => void;
+	fetch?: (request: Request) => Promise<Response>;
 }): Interceptor {
+	const send = options.fetch ?? baseFetch;
 	let refreshing: Promise<string | null> | null = null;
 
 	async function refresh(): Promise<string | null> {
-		const res = await globalThis.fetch(options.tokenEndpoint, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({
-				grant_type: "refresh_token",
-				refresh_token: options.refreshToken,
+		const res = await send(
+			new Request(options.tokenEndpoint, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					grant_type: "refresh_token",
+					refresh_token: options.refreshToken,
+				}),
 			}),
-		});
+		);
 
 		if (!res.ok) return null;
 

package/src/components/EmDashImage.astro

@@ -22,6 +22,7 @@
  */
 import type { ImageValue, MediaValue } from "../fields/types.js";
 import type { HTMLAttributes } from "astro/types";
+import type { LocalImageProps } from "astro:assets";
 import { Image as AstroImage, getImage } from "astro:assets";
 import type { ImageEmbed } from "../media/types.js";
 import { getMediaProvider } from "../media/provider-loader.js";
@@ -52,6 +53,8 @@ interface Props extends Omit<
 	width?: number;
 	/** Override height (uses image.height by default) */
 	height?: number;
+	/** Output quality for Astro's image service or providers that support it. */
+	quality?: LocalImageProps["quality"];
 	/** Priority loading (disables lazy loading) */
 	priority?: boolean;
 	/** Render the LQIP placeholder as an inline background. Disable for strict CSP. */
@@ -64,6 +67,7 @@ const {
 	alt,
 	width,
 	height,
+	quality,
 	priority,
 	placeholder = true,
 	class: className,
@@ -105,7 +109,7 @@ function generateSrcset(
 	return responsiveWidths(maxWidth, originalWidth)
 		.map((w) => {
 			const h = aspectRatio ? Math.round(w / aspectRatio) : undefined;
-			return `${getSrc({ width: w, height: h })} ${w}w`;
+			return `${getSrc({ width: w, height: h, quality })} ${w}w`;
 		})
 		.join(", ");
 }
@@ -149,6 +153,7 @@ async function resolveImage(img: MediaValue): Promise<ResolvedImage> {
 				width: finalWidth,
 				height: finalHeight,
 				originalWidth: img.width,
+				quality,
 			});
 			if (optimized) {
 				src = optimized.src;
@@ -164,6 +169,7 @@ async function resolveImage(img: MediaValue): Promise<ResolvedImage> {
 				const result = provider.getEmbed(img, {
 					width: finalWidth,
 					height: finalHeight,
+					quality,
 				});
 				const embed = result instanceof Promise ? await result : result;
 				if (embed.type === "image") {
@@ -212,8 +218,12 @@ async function resolveImage(img: MediaValue): Promise<ResolvedImage> {
 	// The focal point travels with the media value, so the dark variant gets
 	// its own object-position rather than inheriting the light image's.
 	const objectPosition = focalPointToObjectPosition(img.focalX, img.focalY);
+	const normalizedPlaceholder =
+		placeholderStyle && !placeholderStyle.endsWith(";")
+			? `${placeholderStyle};`
+			: placeholderStyle;
 	const generatedStyle = [
-		placeholderStyle,
+		normalizedPlaceholder,
 		objectPosition ? `object-position: ${objectPosition};` : "",
 	]
 		.filter(Boolean)
@@ -277,6 +287,7 @@ const astroClass = (variantClass: string | undefined) =>
 			alt={finalAlt}
 			width={resolved.width}
 			height={resolved.height}
+			quality={quality}
 			priority={priority}
 			layout="constrained"
 			loading={priority ? "eager" : "lazy"}
@@ -297,6 +308,7 @@ const astroClass = (variantClass: string | undefined) =>
 			alt={finalAlt}
 			width={resolvedDark.width}
 			height={resolvedDark.height}
+			quality={quality}
 			priority={priority}
 			layout="constrained"
 			loading={priority ? "eager" : "lazy"}

package/src/components/InlinePortableTextEditor.tsx

@@ -1244,7 +1244,10 @@ export function InlinePortableTextEditor({
 			Superscript,
 			Link.configure({
 				openOnClick: false,
-				HTMLAttributes: { class: "underline text-blue-600 dark:text-blue-400" },
+				// TipTap's Link extension defaults target to "_blank". Without an
+				// explicit override it would deep-merge that default in, causing every
+				// link created via setLink to serialize as blank: true.
+				HTMLAttributes: { target: null, class: "underline text-blue-600 dark:text-blue-400" },
 			}),
 			Placeholder.configure({
 				includeChildren: true,