fix(forms): render public form embeds via SSR plugin routes

.changeset/public-form-ssr-routes.md

@@ -0,0 +1,6 @@
+---
+"emdash": patch
+"@emdash-cms/plugin-forms": patch
+---
+
+Fixes public form embeds during SSR by allowing frontend plugin components to call public plugin routes without self-fetching.

packages/core/src/astro/middleware.ts

@@ -51,6 +51,7 @@ import {
 	runWithContext,
 } from "../request-context.js";
 import type { EmDashConfig } from "./integration/runtime.js";
+import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
 import type { EmDashHandlers } from "./types.js";
 
 // Cached runtime instance (persists across requests within worker)
@@ -368,8 +369,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					try {
 						const runtime = await getRuntime(config, initSubTimings);
 						setupVerified = true;
+						const handlePublicPluginApiRoute = createPublicPluginApiRouteHandler(runtime);
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
 						locals.emdash = {
+							handlePublicPluginApiRoute,
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
@@ -496,6 +499,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 					// Plugin routes
 					handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
+					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
 
 					// Media provider methods

packages/core/src/astro/public-plugin-api-routes.ts

@@ -0,0 +1,41 @@
+import type { HandlerResponse } from "./types.js";
+
+export type PublicPluginApiRouteHandler = (
+	pluginId: string,
+	method: string,
+	path: string,
+	request: Request,
+) => Promise<HandlerResponse>;
+
+interface PublicPluginApiRouteRuntime {
+	getPluginRouteMeta(pluginId: string, path: string): { public: boolean } | null;
+	handlePluginApiRoute(
+		pluginId: string,
+		method: string,
+		path: string,
+		request: Request,
+	): Promise<HandlerResponse>;
+}
+
+function pluginRouteNotFound(): HandlerResponse {
+	return {
+		success: false,
+		error: {
+			code: "NOT_FOUND",
+			message: "Plugin route not found",
+		},
+	};
+}
+
+export function createPublicPluginApiRouteHandler(
+	runtime: PublicPluginApiRouteRuntime,
+): PublicPluginApiRouteHandler {
+	return async (pluginId, method, path, request) => {
+		const meta = runtime.getPluginRouteMeta(pluginId, path);
+		if (meta?.public !== true) {
+			return pluginRouteNotFound();
+		}
+
+		return runtime.handlePluginApiRoute(pluginId, method, path, request);
+	};
+}

packages/core/src/astro/types.ts

@@ -385,6 +385,14 @@ export interface EmDashHandlers {
 		request: Request,
 	) => Promise<HandlerResponse>;
 
+	// Public-only plugin API route handler for SSR page components.
+	handlePublicPluginApiRoute: (
+		pluginId: string,
+		method: string,
+		path: string,
+		request: Request,
+	) => Promise<HandlerResponse>;
+
 	// Plugin route metadata (for auth decisions before dispatch)
 	getPluginRouteMeta: (pluginId: string, path: string) => { public: boolean } | null;
 

packages/core/src/plugin-utils.ts

@@ -8,6 +8,16 @@
  * Import as: `import { apiFetch, parseApiResponse, isRecord } from "emdash/plugin-utils";`
  */
 
+import type { EmDashHandlers } from "./astro/types.js";
+
+export type PublicPluginApiRouteHandler = EmDashHandlers["handlePublicPluginApiRoute"];
+
+export interface PublicPluginRuntimeLocals {
+	emdash?: {
+		handlePublicPluginApiRoute?: PublicPluginApiRouteHandler;
+	};
+}
+
 /**
  * Fetch wrapper that adds the `X-EmDash-Request` CSRF protection header.
  *
@@ -20,6 +30,19 @@ export function apiFetch(input: string | URL | Request, init?: RequestInit): Pro
 	return fetch(input, { ...init, headers });
 }
 
+/**
+ * Get the public-only plugin route dispatcher exposed to SSR page components.
+ *
+ * This intentionally reads `handlePublicPluginApiRoute`, not the raw
+ * `handlePluginApiRoute` used by core's authenticated plugin API route.
+ */
+export function getPublicPluginApiRouteHandler(
+	locals: PublicPluginRuntimeLocals | null | undefined,
+): PublicPluginApiRouteHandler | undefined {
+	const handler = locals?.emdash?.handlePublicPluginApiRoute;
+	return typeof handler === "function" ? handler : undefined;
+}
+
 /**
  * Parse an API response, unwrapping the `{ data: T }` envelope.
  *