@emplugins/emprivacy 3.1.0 → 3.2.1

package/README.md

@@ -27,7 +27,7 @@
 
 ## Requirements
 
-- **EmDash** `^1.0.1` (**tested with `1.0.1`**). EmDash 0.x is not supported.
+- **EmDash** `^1.0.1` (**CI-tested with `1.0.1` and `1.4.0`**). EmDash 0.x is not supported.
 - **Node.js** `>= 22.16` (matches EmDash’s engine requirement).
 - Register as a **native** plugin in **`astro.config`** via `plugins: []` (not `sandboxed: []`). EmPrivacy uses `page:fragments` for the public banner and `componentsEntry` for embed placeholders. See [Page fragments](https://docs.emdashcms.com/plugins/creating-native-plugins/page-fragments/) and [Plugin overview](https://docs.emdashcms.com/plugins/overview/).
 
@@ -114,7 +114,7 @@ stop();
 |--------|-------------|
 | Categories | Essential (always on), **Functional**, **Analytics**, **Marketing** |
 | Privacy / cookie links | EmDash **Page** path or `https://` URL; resolved with `ctx.url()` |
-| Analytics presets | Cloudflare Web Analytics, Plausible, Fathom, Umami, Simple Analytics, GA4, **GTM (Marketing)**, **Microsoft Clarity (Analytics)**, **Microsoft UET (Marketing)**, None, Custom `https` URLs (+ optional SRI / host allowlist) |
+| Analytics presets | Cloudflare Web Analytics, Plausible, Fathom, Umami, Simple Analytics, GA4, **GTM (Marketing)**, **Microsoft Clarity (Analytics)**, **Microsoft UET (Marketing)**, None, Custom `https` URLs (SRI and script host allowlist required) |
 | Marketing scripts | Only **https** URLs you list, injected as `<script src>` after marketing consent |
 | Official embeds | Optional placeholders for `@emdash-cms/plugin-embeds` block types; YouTube/Vimeo use allowlisted player URLs (`youtube-nocookie`, `player.vimeo.com`); client re-checks URLs before mount |
 | Re-open preferences | Cookie button (bottom-left); saving reloads so script loading matches the latest choice |

package/dist/index.d.mts

@@ -171,10 +171,15 @@ interface EmprivacyConfig {
   /** Optional SRI hashes keyed by script src (sha256/384/512-…) */
   scriptIntegrity: Record<string, string>;
   /**
-   * When non-empty, Custom analytics and marketing script hosts must be on this list.
-   * Preset CDN hosts remain allowed for built-in providers.
+   * Hostnames allowed for Custom analytics, Umami, and marketing scripts.
+   * An empty list denies those URLs. Preset CDN hosts stay allowed for built-in providers.
    */
   scriptHostAllowlist: string[];
+  /**
+   * Hosts that may become https links for Mastodon and link previews.
+   * X, Bluesky, Gist, YouTube, and Vimeo do not use this list.
+   */
+  embedHostAllowlist: string[];
   /** Consent cookie Max-Age in days (1–365, default 180) */
   cookieMaxAgeDays: number;
   /** Emit Google Consent Mode v2 defaults (denied) in head; updates after choice */
@@ -257,6 +262,7 @@ interface EmprivacyPublicRuntimeConfig {
     integrity: string | null;
   }[];
   scriptHostAllowlist: string[];
+  embedHostAllowlist: string[];
   scriptIntegrity: Record<string, string>;
   cookieMaxAge: number;
   vendors: VendorPublicRow[];

package/dist/index.mjs

@@ -271,6 +271,15 @@ function isUetId(s) {
 }
 //#endregion
 //#region src/security.ts
+/**
+* Shared URL / request guards used by admin validation and (via mirrored
+* logic) the public bootstrap. Keep client checks in sync with these helpers.
+*/
+const YT_IFRAME = /^https:\/\/(?:www\.)?youtube-nocookie\.com\/embed\/[A-Za-z0-9_-]{11}\/?$/;
+const VIMEO_IFRAME = /^https:\/\/player\.vimeo\.com\/video\/\d{6,12}\/?$/;
+/** Sandbox and feature policy for YouTube/Vimeo iframes. Kept beside the src regexes. */
+const EMBED_IFRAME_SANDBOX = "allow-scripts allow-same-origin allow-presentation";
+const EMBED_IFRAME_ALLOW = "accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture; web-share";
 /** Hosts EmPrivacy may load as <script src> for built-in presets. */
 const PRESET_SCRIPT_HOSTS = /* @__PURE__ */ new Set([
 	"static.cloudflareinsights.com",
@@ -302,6 +311,85 @@ function cookieMaxAgeSeconds(days) {
 function hasUnsafeUrlChars$1(s) {
 	return /[\u0000-\u001F\u007F\s]/.test(s);
 }
+/**
+* Browser copy of the non-public host check. `parseStrictHttpsUrl` calls the
+* same source so the inline bootstrap cannot drift from the server.
+* Hostnames are whatever `new URL` already normalized (decimal, hex, and
+* short IPv4 forms become dotted quads; IPv6 keeps brackets).
+*/
+function hostnameBlockScript() {
+	return `function hostBlocked(raw){
+var host=String(raw||"").trim().toLowerCase().replace(/^\\[|\\]$/g,"");
+if(!host)return true;
+if(host==="localhost"||endsWith(host,".localhost")||endsWith(host,".local")||endsWith(host,".internal")||endsWith(host,".arpa"))return true;
+if(host.indexOf(":")>=0)return ipv6Blocked(host);
+if(/^[0-9.]+$/.test(host)){
+var v4=parseV4(host);
+if(v4===null)return true;
+return v4Blocked(v4);
+}
+return false;
+}
+function endsWith(h,s){return h.length>=s.length&&h.slice(h.length-s.length)===s;}
+function parseV4(host){
+var p=host.split(".");
+if(p.length!==4)return null;
+var n=0;
+for(var i=0;i<p.length;i++){
+var part=p[i];
+if(!/^\\d{1,3}$/.test(part))return null;
+if(part.length>1&&part.charAt(0)==="0")return null;
+var v=+part;
+if(v>255)return null;
+n=n*256+v;
+}
+return n>>>0;
+}
+function v4Blocked(n){
+var a=n>>>24;
+var b=(n>>>16)&255;
+if(a===0||a===10||a===127)return true;
+if(a===100&&b>=64&&b<=127)return true;
+if(a===169&&b===254)return true;
+if(a===172&&b>=16&&b<=31)return true;
+if(a===192&&b===168)return true;
+if(a>=224)return true;
+return false;
+}
+function ipv6Blocked(host){
+if(host==="::"||host==="::1")return true;
+var dotted=/^::ffff:(\\d{1,3}(?:\\.\\d{1,3}){3})$/.exec(host);
+if(dotted){
+var d4=parseV4(dotted[1]);
+return d4===null||v4Blocked(d4);
+}
+var mapped=/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
+if(mapped){
+var hi=parseInt(mapped[1],16);
+var lo=parseInt(mapped[2],16);
+if(hi>65535||lo>65535)return true;
+return v4Blocked(((hi<<16)|lo)>>>0);
+}
+if(/\\d{1,3}(?:\\.\\d{1,3}){3}$/.test(host))return true;
+var first;
+if(host.slice(0,2)==="::")first=0;
+else{
+var head=host.split(":")[0];
+if(!/^[0-9a-f]{1,4}$/.test(head))return true;
+first=parseInt(head,16);
+}
+if((first&0xfe00)===0xfc00)return true;
+if((first&0xffc0)===0xfe80)return true;
+if((first&0xffc0)===0xfec0)return true;
+if((first&0xff00)===0xff00)return true;
+return false;
+}`;
+}
+const hostBlockedImpl = new Function(`${hostnameBlockScript()}\nreturn hostBlocked;`)();
+/** True for loopback, private, link-local, shared (CGNAT), and non-global addresses. */
+function isBlockedHostname(hostname) {
+	return hostBlockedImpl(hostname);
+}
 function parseStrictHttpsUrl(raw) {
 	const t = raw.trim();
 	if (!t || t.length > 2048 || hasUnsafeUrlChars$1(t)) return null;
@@ -310,9 +398,7 @@ function parseStrictHttpsUrl(raw) {
 		const u = new URL(t);
 		if (u.protocol !== "https:") return null;
 		if (u.username || u.password) return null;
-		const host = u.hostname.toLowerCase();
-		if (host === "localhost" || host.endsWith(".localhost")) return null;
-		if (host === "127.0.0.1" || host === "::1" || host.endsWith(".local")) return null;
+		if (isBlockedHostname(u.hostname)) return null;
 		return u;
 	} catch {
 		return null;
@@ -345,9 +431,18 @@ function isScriptHostAllowed(raw, opts) {
 	if (!u) return false;
 	const host = u.hostname.toLowerCase();
 	if (opts.allowPresets && PRESET_SCRIPT_HOSTS.has(host)) return true;
-	if (opts.allowlist.length === 0) return true;
 	return opts.allowlist.includes(host);
 }
+/** SRI required before a custom or marketing script may load. Empty is not valid. */
+function hasSri(s) {
+	return typeof s === "string" && /^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(s);
+}
+function isPublishableCustomScript(src, integrity, allowlist) {
+	return hasSri(integrity) && isScriptHostAllowed(src, {
+		allowlist: [...allowlist],
+		allowPresets: false
+	});
+}
 /** Optional SRI: `https://cdn.example/a.js sha384-...` or `... integrity=sha384-...`. */
 function parseScriptUrlWithIntegrity(line) {
 	const t = line.trim();
@@ -387,6 +482,29 @@ function assertSameOriginMutation(request, expectedOrigin) {
 	if ((request.headers.get("sec-fetch-site") ?? "").toLowerCase() === "same-origin") return null;
 	return new Response("forbidden", { status: 403 });
 }
+/**
+* Compare-and-set increment. Returns false when the bucket is full, the store
+* errors, or eight conflicts in a row fail to land a write.
+*/
+async function tryConsumeRateSlot(kv, key, limit) {
+	for (let attempt = 0; attempt < 8; attempt++) {
+		let current;
+		try {
+			current = await kv.getVersioned(key);
+		} catch {
+			return false;
+		}
+		const raw = current?.value;
+		const n = typeof raw === "string" && /^\d{1,6}$/.test(raw) ? Number(raw) : 0;
+		if (n >= limit) return false;
+		try {
+			if ((await kv.compareAndSet(key, current ? current.revision : null, String(n + 1))).applied) return true;
+		} catch {
+			return false;
+		}
+	}
+	return false;
+}
 /** Coarse hour bucket for rate limiting (UTC). */
 function rateHourKey(now = /* @__PURE__ */ new Date()) {
 	return `${now.getUTCFullYear()}${String(now.getUTCMonth() + 1).padStart(2, "0")}${String(now.getUTCDate()).padStart(2, "0")}${String(now.getUTCHours()).padStart(2, "0")}`;
@@ -512,6 +630,7 @@ const DEFAULT_CONFIG = {
 	marketingScriptUrls: [],
 	scriptIntegrity: {},
 	scriptHostAllowlist: [],
+	embedHostAllowlist: [],
 	cookieMaxAgeDays: 180,
 	googleConsentMode: false,
 	logConsentToServer: false,
@@ -656,6 +775,7 @@ function normalizeConfig(raw) {
 		if (Object.keys(scriptIntegrity).length >= 100) break;
 	}
 	const scriptHostAllowlist = (Array.isArray(o.scriptHostAllowlist) ? o.scriptHostAllowlist.filter((x) => typeof x === "string") : []).map((h) => h.trim().toLowerCase()).filter((h) => isHostname$1(h)).slice(0, 50);
+	const embedHostAllowlist = (Array.isArray(o.embedHostAllowlist) ? o.embedHostAllowlist.filter((x) => typeof x === "string") : []).map((h) => h.trim().toLowerCase()).filter((h) => isHostname$1(h)).slice(0, 50);
 	return {
 		bannerTitle: typeof o.bannerTitle === "string" ? o.bannerTitle : DEFAULT_CONFIG.bannerTitle,
 		bannerMessage: typeof o.bannerMessage === "string" ? o.bannerMessage : DEFAULT_CONFIG.bannerMessage,
@@ -671,6 +791,7 @@ function normalizeConfig(raw) {
 		marketingScriptUrls: marketing,
 		scriptIntegrity,
 		scriptHostAllowlist,
+		embedHostAllowlist,
 		cookieMaxAgeDays: normalizeCookieMaxAgeDays(o.cookieMaxAgeDays, DEFAULT_CONFIG.cookieMaxAgeDays),
 		googleConsentMode: typeof o.googleConsentMode === "boolean" ? o.googleConsentMode : DEFAULT_CONFIG.googleConsentMode,
 		logConsentToServer: typeof o.logConsentToServer === "boolean" ? o.logConsentToServer : DEFAULT_CONFIG.logConsentToServer,
@@ -701,7 +822,7 @@ function assertAnalyticsId(provider, id, umamiScriptUrl) {
 	}
 	if (provider === "umami") {
 		if (!isUmamiId(t)) throw new Error("Umami website ID looks invalid.");
-		if (!isHttpsUrl(umamiScriptUrl)) throw new Error("Umami requires the https script URL (Cloud or your self-hosted tracker).");
+		if (!isSafeHttpsScriptUrl(umamiScriptUrl)) throw new Error("Umami requires an https script URL on a public host (Cloud or your self-hosted tracker).");
 		return;
 	}
 	if (provider === "ga4") {
@@ -739,22 +860,23 @@ function assertValidSavedConfig(input) {
 	const tokenTrim = input.cloudflareToken.trim();
 	if (ap === "cloudflare") assertValidCloudflareToken(tokenTrim);
 	const umamiScriptUrl = input.umamiScriptUrl.trim();
-	if (ap === "umami" && umamiScriptUrl && !isHttpsUrl(umamiScriptUrl)) throw new Error(invalidScriptUrlError("umami", umamiScriptUrl));
+	if (ap === "umami" && umamiScriptUrl && !isSafeHttpsScriptUrl(umamiScriptUrl)) throw new Error(invalidScriptUrlError("umami", umamiScriptUrl));
 	if (ap !== "none" && ap !== "custom" && ap !== "cloudflare" && ap !== "simpleanalytics" && ap !== "gtm") assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
 	else if (ap === "simpleanalytics" && input.analyticsId.trim()) assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
 	else if (ap === "gtm") assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
 	const scriptHostAllowlist = parseHostnameAllowlist(input.scriptHostAllowlistText);
+	const embedHostAllowlist = parseHostnameAllowlist(input.embedHostAllowlistText);
 	const cookieMaxAgeDays = parseCookieMaxAgeDays(input.cookieMaxAgeDays, 180);
 	const scriptIntegrity = {};
 	const assertScriptLine = (kind, line) => {
 		const { src, integrity } = parseScriptUrlWithIntegrity(line);
 		if (!src || src.length > 2048) throw new Error(invalidScriptUrlError(kind, line));
 		if (!isSafeHttpsScriptUrl(src)) throw new Error(invalidScriptUrlError(kind, src));
-		if (integrity && !isValidIntegrity(integrity)) throw new Error(`Invalid SRI for ${kind} script (expected sha256-|sha384-|sha512-…).`);
+		if (!hasSri(integrity)) throw new Error(`${kind} scripts require Subresource Integrity (sha256-, sha384-, or sha512-) after the URL.`);
 		if (!isScriptHostAllowed(src, {
 			allowlist: scriptHostAllowlist,
 			allowPresets: false
-		})) throw new Error(`${kind} script host is not on the allowlist. Add the hostname or clear the allowlist.`);
+		})) throw new Error(`${kind} script host is not on the allowlist. Add the hostname under Script host allowlist.`);
 		if (integrity) scriptIntegrity[src] = integrity;
 		return src;
 	};
@@ -762,7 +884,7 @@ function assertValidSavedConfig(input) {
 		if (!isScriptHostAllowed(umamiScriptUrl, {
 			allowlist: scriptHostAllowlist,
 			allowPresets: false
-		})) throw new Error("Umami script host is not on the allowlist. Add the hostname or clear the allowlist.");
+		})) throw new Error("Umami script host is not on the allowlist. Add the hostname under Script host allowlist.");
 	}
 	const analyticsScriptUrls = [];
 	if (ap === "custom") {
@@ -809,6 +931,7 @@ function assertValidSavedConfig(input) {
 		marketingScriptUrls,
 		scriptIntegrity,
 		scriptHostAllowlist,
+		embedHostAllowlist,
 		cookieMaxAgeDays,
 		googleConsentMode: input.googleConsentMode,
 		logConsentToServer: input.logConsentToServer,
@@ -1015,9 +1138,10 @@ var C=${jsonLiteral};
 var CN="${COOKIE_NAME}";
 var PURGE=${purgeLiteral};
 var listeners=[];
-var PRESET_HOSTS={"static.cloudflareinsights.com":1,"plausible.io":1,"cdn.usefathom.com":1,"scripts.simpleanalyticscdn.com":1,"www.googletagmanager.com":1,"googletagmanager.com":1,"www.clarity.ms":1,"clarity.ms":1,"bat.bing.com":1};
-var YT_IFRAME=/^https:\\/\\/(?:www\\.)?youtube-nocookie\\.com\\/embed\\/[A-Za-z0-9_-]{11}\\/?$/;
-var VIMEO_IFRAME=/^https:\\/\\/player\\.vimeo\\.com\\/video\\/\\d{6,12}\\/?$/;
+var PRESET_HOSTS=${jsonForHtmlScript(Object.fromEntries([...PRESET_SCRIPT_HOSTS].map((host) => [host, 1])))};
+var YT_IFRAME=${YT_IFRAME.toString()};
+var VIMEO_IFRAME=${VIMEO_IFRAME.toString()};
+${hostnameBlockScript()}
 function readCookie(){
 try{
 var m=document.cookie.match(new RegExp("(?:^|;\\\\s*)"+CN+"=([^;]*)"));
@@ -1116,8 +1240,7 @@ if(/%0d|%0a|%09|%0b|%0c|%20/i.test(raw))return null;
 var u=new URL(raw);
 if(u.protocol!=="https:")return null;
 if(u.username||u.password)return null;
-var h=u.hostname.toLowerCase();
-if(h==="localhost"||h.endsWith(".localhost")||h==="127.0.0.1"||h==="::1")return null;
+if(hostBlocked(u.hostname))return null;
 return u;
 }catch(e){return null;}
 }
@@ -1125,7 +1248,6 @@ function hostAllowed(u,allowPresets){
 var h=u.hostname.toLowerCase();
 if(allowPresets&&PRESET_HOSTS[h])return true;
 var list=C.scriptHostAllowlist||[];
-if(!list.length)return true;
 return list.indexOf(h)>=0;
 }
 function safeScriptUrl(raw,allowPresets){
@@ -1135,7 +1257,7 @@ if(!hostAllowed(u,!!allowPresets))return null;
 return u.href;
 }
 function allowedIframe(src){return YT_IFRAME.test(src)||VIMEO_IFRAME.test(src);}
-function allowedLink(src,kind){
+function allowedLink(src){
 var u=parseHttps(src);
 if(!u)return false;
 var h=u.hostname.toLowerCase();
@@ -1148,20 +1270,22 @@ return /^\\/profile\\/[^/]+\\/post\\/[^/]+\\/?$/.test(u.pathname);
 if(h==="gist.github.com"){
 return /^\\/[A-Za-z0-9-]{1,39}\\/[a-f0-9]{8,64}\\/?$/i.test(u.pathname);
 }
-if(/^\\/@[^/]+\\/\\d+\\/?$/.test(u.pathname)||/^\\/users\\/[^/]+\\/statuses\\/\\d+\\/?$/.test(u.pathname))return true;
-return kind==="linkPreview";
+var list=C.embedHostAllowlist||[];
+return list.indexOf(h)>=0;
 }
 function alreadyScriptSrc(u){
 try{
 return Array.prototype.some.call(document.getElementsByTagName("script"),function(s){return s.src===u;});
 }catch(e){return false;}
 }
-function loadScript(src, attrs, integrity, allowPresets){
+function loadScript(src, attrs, integrity, allowPresets, requireIntegrity){
 var safe=safeScriptUrl(src,allowPresets);
 if(!safe||alreadyScriptSrc(safe))return;
+var sriOk=integrity&&/^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(integrity);
+if(requireIntegrity&&!sriOk)return;
 var e=document.createElement("script");
 e.src=safe;e.async=true;e.referrerPolicy="no-referrer-when-downgrade";
-if(integrity&&/^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(integrity)){
+if(sriOk){
 e.integrity=integrity;
 e.crossOrigin="anonymous";
 }
@@ -1186,7 +1310,7 @@ document.head.appendChild(e);
 function applyAnalytics(st){
 var L=C.loader||{type:"none"};
 if(L.type==="cloudflare") loadCloudflareBeacon(L.token);
-else if(L.type==="custom") (L.scripts||[]).forEach(function(s){loadScript(s.src,null,s.integrity,false);});
+else if(L.type==="custom") (L.scripts||[]).forEach(function(s){loadScript(s.src,null,s.integrity,false,true);});
 else if(L.type==="plausible") loadScript(L.src,{"data-domain":L.domain},null,true);
 else if(L.type==="fathom") loadScript(L.src,{"data-site":L.siteId},null,true);
 else if(L.type==="umami") loadScript(L.src,{"data-website-id":L.websiteId},null,false);
@@ -1208,7 +1332,7 @@ loadScript("https://www.clarity.ms/tag/"+encodeURIComponent(id),null,null,true);
 }
 function applyMarketing(){
 var urls=C.marketingScripts||[];
-urls.forEach(function(s){loadScript(s.src,null,s.integrity,false);});
+urls.forEach(function(s){loadScript(s.src,null,s.integrity,false,true);});
 var L=C.loader||{type:"none"};
 if(L.type==="gtm"){
 window.dataLayer=window.dataLayer||[];
@@ -1274,17 +1398,17 @@ var f=document.createElement("iframe");
 f.src=src;
 f.setAttribute("loading","lazy");
 f.setAttribute("referrerpolicy","strict-origin-when-cross-origin");
-f.setAttribute("allow","accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share");
+f.setAttribute("allow",${JSON.stringify(EMBED_IFRAME_ALLOW)});
 f.setAttribute("allowfullscreen","");
-f.setAttribute("sandbox","allow-scripts allow-same-origin allow-presentation");
+f.setAttribute("sandbox",${JSON.stringify(EMBED_IFRAME_SANDBOX)});
 f.setAttribute("title",box.getAttribute("data-label")||"Embed");
 f.style.width="100%";
 f.style.aspectRatio="16/9";
 f.style.border="0";
 box.replaceWith(f);
 }
-function mountLink(box,src,label,kind){
-if(!allowedLink(src,kind))return;
+function mountLink(box,src,label){
+if(!allowedLink(src))return;
 var a=document.createElement("a");
 a.href=src;
 a.rel="noopener noreferrer nofollow";
@@ -1303,9 +1427,8 @@ if(loadBtn) loadBtn.textContent=C.ui.loadEmbed;
 if(!embedAllowed(st))return;
 var src=box.getAttribute("data-src")||"";
 var mode=box.getAttribute("data-mode")||"";
-var kind=box.getAttribute("data-emprivacy-embed")||"";
 if(mode==="iframe") mountIframe(box,src);
-else mountLink(box,src,box.getAttribute("data-label")||"",kind);
+else mountLink(box,src,box.getAttribute("data-label")||"");
 });
 }
 function persist(a,m,f,opts){
@@ -1641,13 +1764,16 @@ function buildAnalyticsLoader(cfg) {
 			type: "cloudflare",
 			token: cfg.cloudflareWebAnalyticsToken
 		} : { type: "none" };
-		case "custom": return cfg.analyticsScriptUrls.length ? {
-			type: "custom",
-			scripts: cfg.analyticsScriptUrls.map((src) => ({
+		case "custom": {
+			const scripts = cfg.analyticsScriptUrls.filter((src) => isPublishableCustomScript(src, cfg.scriptIntegrity[src], cfg.scriptHostAllowlist)).map((src) => ({
 				src,
 				integrity: cfg.scriptIntegrity[src] ?? null
-			}))
-		} : { type: "none" };
+			}));
+			return scripts.length ? {
+				type: "custom",
+				scripts
+			} : { type: "none" };
+		}
 		case "plausible": return isHostname$1(cfg.analyticsId) ? {
 			type: "plausible",
 			src: PLAUSIBLE_SCRIPT,
@@ -1658,7 +1784,10 @@ function buildAnalyticsLoader(cfg) {
 			src: FATHOM_SCRIPT,
 			siteId: cfg.analyticsId.trim()
 		} : { type: "none" };
-		case "umami": return isUmamiId(cfg.analyticsId) && cfg.umamiScriptUrl ? {
+		case "umami": return isUmamiId(cfg.analyticsId) && cfg.umamiScriptUrl && isScriptHostAllowed(cfg.umamiScriptUrl, {
+			allowlist: cfg.scriptHostAllowlist,
+			allowPresets: false
+		}) ? {
 			type: "umami",
 			src: cfg.umamiScriptUrl,
 			websiteId: cfg.analyticsId.trim()
@@ -1798,11 +1927,13 @@ function buildVendorList(cfg) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION = "3.1.0";
+const VERSION = "3.2.1";
 //#endregion
 //#region src/runtime.ts
-/** Soft cap for anonymous consent POSTs per client fingerprint per UTC hour. */
+/** Soft cap for anonymous consent POSTs per trusted client address per UTC hour. */
 const RECORD_RATE_LIMIT = 30;
+/** Site-wide cap so one client cannot fill the consent log in a single hour. */
+const RECORD_GLOBAL_LIMIT = 60;
 const RECORD_LOG_CAP = 500;
 const ADMIN_SETTINGS_PATH = "/settings";
 const SAVE_ACTION_ID = "emprivacy-save";
@@ -1839,28 +1970,17 @@ function absolutePolicyHref(stored, ctx) {
 		return null;
 	}
 }
-function clientFingerKey(request) {
-	const cf = request.headers.get("cf-connecting-ip")?.trim();
-	const xff = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-	const ua = (request.headers.get("user-agent") ?? "").slice(0, 120);
-	return `${cf || xff || "unknown"}|${ua}`;
-}
 async function hashFinger(s) {
 	const data = new TextEncoder().encode(`emprivacy-rl:${s}`);
 	const dig = await crypto.subtle.digest("SHA-256", data);
 	return Array.from(new Uint8Array(dig)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 32);
 }
-async function allowRecordWrite(ctx, request) {
-	const key = `consent:rl:${rateHourKey()}:${await hashFinger(clientFingerKey(request))}`;
-	try {
-		const raw = await ctx.kv.get(key);
-		const n = raw && /^\d{1,6}$/.test(raw) ? Number(raw) : 0;
-		if (n >= RECORD_RATE_LIMIT) return false;
-		await ctx.kv.set(key, String(n + 1));
-		return true;
-	} catch {
-		return false;
-	}
+async function allowRecordWrite(ctx) {
+	const hour = rateHourKey();
+	const ip = ctx.requestMeta?.ip?.trim() ?? "";
+	const bucket = ip ? `ip:${await hashFinger(ip)}` : "untrusted";
+	if (!await tryConsumeRateSlot(ctx.kv, `consent:rl:${hour}:global`, RECORD_GLOBAL_LIMIT)) return false;
+	return tryConsumeRateSlot(ctx.kv, `consent:rl:${hour}:${bucket}`, RECORD_RATE_LIMIT);
 }
 function publicRuntime(cfg, ctx, page) {
 	const copy = resolvePublicCopy(cfg, page.locale);
@@ -1882,11 +2002,12 @@ function publicRuntime(cfg, ctx, page) {
 		theme: cfg.theme,
 		ui: copy.ui,
 		loader: buildAnalyticsLoader(cfg),
-		marketingScripts: cfg.marketingScriptUrls.map((src) => ({
+		marketingScripts: cfg.marketingScriptUrls.filter((src) => isPublishableCustomScript(src, cfg.scriptIntegrity[src], cfg.scriptHostAllowlist)).map((src) => ({
 			src,
 			integrity: cfg.scriptIntegrity[src] ?? null
 		})),
 		scriptHostAllowlist: cfg.scriptHostAllowlist,
+		embedHostAllowlist: cfg.embedHostAllowlist,
 		scriptIntegrity: cfg.scriptIntegrity,
 		cookieMaxAge: cookieMaxAgeSeconds(cfg.cookieMaxAgeDays),
 		vendors: buildVendorList(cfg)
@@ -1999,6 +2120,7 @@ function createPlugin() {
 		},
 		routes: {
 			admin: { handler: async (ctx) => {
+				if (!ctx.user) return new Response("unauthorized", { status: 401 });
 				const interaction = ctx.input;
 				if (interaction?.type === "page_load" && interaction.page === ADMIN_SETTINGS_PATH) return buildSettingsPage(ctx);
 				if (interaction?.type === "form_submit" && interaction.action_id === SAVE_ACTION_ID) {
@@ -2024,6 +2146,7 @@ function createPlugin() {
 							analyticsUrlsText: String(v.analytics_urls ?? ""),
 							marketingUrlsText: String(v.marketing_urls ?? ""),
 							scriptHostAllowlistText: String(v.script_host_allowlist ?? ""),
+							embedHostAllowlistText: String(v.embed_host_allowlist ?? ""),
 							cookieMaxAgeDays: String(v.cookie_max_age_days ?? "180"),
 							googleConsentMode: asBool(v.google_cm),
 							logConsentToServer: asBool(v.log_server),
@@ -2081,7 +2204,7 @@ function createPlugin() {
 					};
 					const input = ctx.input;
 					if (input.policyVersion !== cfg.policyVersion) return new Response("policy_version_mismatch", { status: 400 });
-					if (!await allowRecordWrite(ctx, ctx.request)) return new Response("rate_limited", { status: 429 });
+					if (!await allowRecordWrite(ctx)) return new Response("rate_limited", { status: 429 });
 					const gpc = input.gpc === true;
 					const row = {
 						createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2144,7 +2267,7 @@ function createPlugin() {
 }
 async function buildSettingsPage(ctx) {
 	const [cfg, latestPublished] = await Promise.all([loadConfig(ctx), fetchLatestPublishedVersion({ fetch: ctx.http?.fetch ?? globalThis.fetch })]);
-	const installedVersion = ctx.plugin?.version ?? "3.1.0";
+	const installedVersion = ctx.plugin?.version ?? "3.2.1";
 	const analyticsText = cfg.analyticsScriptUrls.map((src) => {
 		const i = cfg.scriptIntegrity[src];
 		return i ? `${src} ${i}` : src;
@@ -2365,7 +2488,7 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "analytics_urls",
-					label: "Custom analytics script URLs (one https URL per line; optional trailing SRI: … sha384-…)",
+					label: "Custom analytics script URLs (one https URL per line, SRI required: … sha384-…)",
 					placeholder: "https://cdn.example/a.js sha384-…",
 					multiline: true,
 					initial_value: analyticsText,
@@ -2377,7 +2500,7 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "marketing_urls",
-					label: "Marketing script URLs (one https URL per line; optional trailing SRI: … sha384-…)",
+					label: "Marketing script URLs (one https URL per line, SRI required: … sha384-…)",
 					placeholder: "https://… (one per line)",
 					multiline: true,
 					initial_value: marketingText
@@ -2385,11 +2508,19 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "script_host_allowlist",
-					label: "Script host allowlist (optional; one hostname per line). When set, Custom analytics and marketing URLs must match.",
+					label: "Script host allowlist (required for Custom, Umami, and marketing URLs; one hostname per line)",
 					placeholder: "cdn.example.com\njs.stripe.com",
 					multiline: true,
 					initial_value: cfg.scriptHostAllowlist.join("\n")
 				},
+				{
+					type: "text_input",
+					action_id: "embed_host_allowlist",
+					label: "Embed link hosts (one hostname per line). Mastodon and link previews become links only when listed. X, Bluesky, Gist, YouTube, and Vimeo stay built in.",
+					placeholder: "mastodon.social\nexample.com",
+					multiline: true,
+					initial_value: cfg.embedHostAllowlist.join("\n")
+				},
 				{
 					type: "text_input",
 					action_id: "cookie_max_age_days",
@@ -2589,22 +2720,9 @@ const POSTER_HOSTS = /* @__PURE__ */ new Set([
 	"img.youtube.com",
 	"i.vimeocdn.com"
 ]);
-function hasUnsafeChars(s) {
-	return /[\u0000-\u001F\u007F\s]/.test(s);
-}
+/** Same non-public host rules as script URLs. */
 function parseHttpsUrl(raw) {
-	const t = raw.trim();
-	if (!t || t.length > 2048 || hasUnsafeChars(t)) return null;
-	if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return null;
-	try {
-		const u = new URL(t);
-		if (u.protocol !== "https:") return null;
-		if (u.username || u.password) return null;
-		if (u.hostname === "localhost" || u.hostname.endsWith(".localhost")) return null;
-		return u;
-	} catch {
-		return null;
-	}
+	return parseStrictHttpsUrl(raw);
 }
 function hostOf(u) {
 	return u.hostname.toLowerCase();

package/docs/DEVELOPMENT.md

@@ -21,11 +21,11 @@ pnpm run build
 
 ## `pnpm audit` and the Kysely override
 
-`pnpm run audit` runs **`pnpm audit --prod`**, so it reflects **published runtime** dependencies only (currently `zod` 4.6.5).
+`pnpm run audit` runs **`pnpm audit --prod`**, so it reflects **published runtime** dependencies only (currently `zod` 4.6.7).
 
 The full install (including the `emdash` **dev** tree) can report transitive advisories from EmDash’s tooling stack. Those are owned by the site’s EmDash upgrade path, not by EmPrivacy’s published tarball.
 
-**This repository pins Kysely** via `pnpm.overrides` in `package.json` (currently `0.29.6`, aligned with EmDash 1.0.1). Regenerate the lockfile with `pnpm install` after changing overrides.
+**This repository pins Kysely** via `pnpm.overrides` in `package.json` (currently `0.29.6`). EmDash 1.x declares Kysely as `^0.29.0`. Regenerate the lockfile with `pnpm install` after changing overrides.
 
 ## Deprecation warnings you may still see
 

package/docs/PLUGIN_SETTINGS.md

@@ -100,30 +100,30 @@ Scripts for **Analytics** presets load only after **Analytics** consent — exce
 | Microsoft Clarity | Project ID, 7–20 letters or digits | `https://www.clarity.ms/tag/…` after **Analytics** consent. A denied `consentv2` signal is queued in `<head>` first. `ad_Storage` stays denied until Marketing is also allowed. |
 | Microsoft UET | Tag ID, 6–12 digits | `https://bat.bing.com/bat.js` after **Marketing** consent. `ad_storage` defaults to denied in `<head>`. The tag is not injected before that consent. Automatic SPA tracking is off. |
 | None | — | No analytics scripts |
-| Custom | One https script `src` per line (optional trailing SRI) | Those URLs only |
+| Custom | One https script `src` per line, plus SRI (`sha256-`, `sha384-`, or `sha512-`) | Those URLs only, and only if the host is on the script host allowlist |
 
 IDs and URLs are validated on save and again in the browser before inject. Tokens are never shown in the public vendor list.
 
-### Script host allowlist (optional)
+### Script host allowlist
 
-One hostname per line (e.g. `cdn.example.com`). When non-empty, **Custom** analytics, **Umami**, and **Marketing** script hosts must appear on the list. Built-in preset CDNs (Plausible, Fathom, GTM, Clarity, UET, and so on) stay allowed for their presets.
+One hostname per line (e.g. `cdn.example.com`). **Custom** analytics, **Umami**, and **Marketing** script hosts must appear on the list. An empty list does not load those scripts. Built-in preset CDNs (Plausible, Fathom, GTM, Clarity, UET, and so on) stay allowed for their presets.
 
-### Optional Subresource Integrity (SRI)
+### Subresource Integrity (SRI)
 
-Append a hash after the URL on Custom or Marketing lines:
+Custom and marketing lines require a hash after the URL:
 
 ```
 https://cdn.example/a.js sha384-…
 https://cdn.example/b.js integrity=sha256-…
 ```
 
-The browser sets `integrity` + `crossorigin=anonymous` when the hash is valid. Prefer pinning Custom scripts; many preset CDNs do not publish stable hashes.
+The browser sets `integrity` + `crossorigin=anonymous`. A line without a `sha256-`, `sha384-`, or `sha512-` hash is rejected on save and is not injected. Preset CDNs are not pinned this way; many do not publish stable hashes. Umami needs a hostname on the allowlist and does not require SRI.
 
 ---
 
 ## Marketing scripts
 
-One **https** URL per line, `src` only (optional SRI as above). Loaded after **Marketing** consent. Max 50 lines, 2048 characters each. No HTML.
+One **https** URL per line, with SRI as above, and the host on the script host allowlist. Loaded after **Marketing** consent. Max 50 lines, 2048 characters each. No HTML.
 
 ---
 
@@ -141,7 +141,7 @@ Put EmPrivacy **first** in `plugins` if other plugins also inject Google tags.
 
 When on (default), EmPrivacy’s Portable Text components replace YouTube, Vimeo, tweet, Bluesky, Mastodon, Gist, and link-preview blocks with a placeholder until the selected category is allowed.
 
-YouTube / Vimeo become allowlisted iframes (`youtube-nocookie.com`, `player.vimeo.com`). Social posts, Gists, and link previews become **https links** — EmPrivacy will not iframe an arbitrary Mastodon or unknown host.
+YouTube / Vimeo become allowlisted iframes (`youtube-nocookie.com`, `player.vimeo.com`). X, Bluesky, and GitHub Gist posts become **https links** when the URL matches those hosts. Mastodon and link previews become links only when the hostname is on **Embed link hosts**. An empty list leaves those placeholders in place. EmPrivacy will not iframe a Mastodon instance or an unknown host. A `data-emprivacy-embed` value in the page is not enough to allow an arbitrary URL.
 
 This does **not** rewrite raw HTML `<iframe>` tags you paste in the theme or in an HTML block.
 
@@ -198,7 +198,9 @@ When Analytics or Marketing is denied (including the first visit, before a choic
 
 ## Server-side logging
 
-When enabled, each save POSTs `{ policyVersion, functional, analytics, marketing, gpc }` to `/_emdash/api/plugins/emprivacy/record` (same origin, JSON). The handler requires a matching `Origin` **or** `Sec-Fetch-Site: same-origin`, fails closed if storage capacity cannot be checked, and rate-limits anonymous clients (~30/hour fingerprint). No IP is stored in the consent row. If `gpc` is true, the stored `marketing` flag is false. The page shows up to 15 recent rows. Logging stops at 500 rows.
+When enabled, each save POSTs `{ policyVersion, functional, analytics, marketing, gpc }` to `/_emdash/api/plugins/emprivacy/record` (same origin, JSON). The handler requires a matching `Origin` **or** `Sec-Fetch-Site: same-origin`, fails closed if storage capacity cannot be checked, and rate-limits writes. The limit uses EmDash’s platform client address (`requestMeta.ip`), about 30 writes per address per UTC hour, plus about 60 writes per hour for the whole site. Requests with no platform address share one 30/hour bucket. Counters use compare-and-set. No IP is stored in the consent row. If `gpc` is true, the stored `marketing` flag is false. The page shows up to 15 recent rows. Logging stops at 500 rows.
+
+Saving settings requires a signed-in admin. A settings request with no user is rejected.
 
 Signed-in admins (the plugin settings permission) can download those rows as CSV from `/_emdash/api/plugins/emprivacy/consent-export`. The file is `Cache-Control: private, no-store`. It has no IP, user agent, or rate-limit fingerprint. A cell that starts with `=`, `+`, `-`, or `@` is prefixed with `'` so a spreadsheet does not run it as a formula. The route is not public. A request without a signed-in user is rejected.
 
@@ -211,7 +213,7 @@ EmPrivacy injects an **inline** bootstrap via EmDash `page:fragments`. Sites wit
 - `script-src 'unsafe-inline'` (or a hash/nonce of the emitted bootstrap if your host supports it), and
 - `script-src` / `connect-src` / `frame-src` entries for any presets and gated embeds you enable (e.g. `https://plausible.io`, `https://www.clarity.ms`, `https://bat.bing.com`, `https://www.youtube-nocookie.com`, `https://player.vimeo.com`).
 
-YouTube/Vimeo placeholders use a tight iframe `sandbox` (`allow-scripts allow-same-origin allow-presentation`) after consent. Client hydration also re-checks allowlisted `data-src` values so a planted evil URL cannot become an iframe.
+YouTube/Vimeo placeholders use a tight iframe `sandbox` (`allow-scripts allow-same-origin allow-presentation`) after consent. The iframe `allow` list does not include clipboard access. Client hydration re-checks `data-src` against the same YouTube, Vimeo, X, Bluesky, and Gist rules, and against **Embed link hosts** for every other link. A planted URL cannot become an iframe or an off-list link.
 
 A future hashed static bootstrap (no `'unsafe-inline'`) depends on EmDash fragment APIs exposing nonces or external script URLs.
 

package/docs/RELEASES.md

@@ -46,13 +46,16 @@ update to latest emdash release
 
 Uses [`.cursor/skills/emdash-release/`](../.cursor/skills/emdash-release/SKILL.md) and [`.cursor/emdash-release.json`](../.cursor/emdash-release.json): conformance → compat PR → Version Packages merge → `pnpm release:publish` (npm + GitHub Release). Details: [maintainer-release.md](./maintainer-release.md).
 
-### Automated feature release (Changesets)
+### Feature, minor, or patch release (agent-driven)
 
-1. On a feature PR, run `pnpm changeset` and commit the generated file under `.changeset/`.
-2. Merge to `main`. GitHub Actions opens a **Version Packages** PR when changesets are pending.
-3. Merge the Version Packages PR. CI runs `pnpm release:publish` and creates a GitHub Release.
+In Cursor, ask to publish a minor (or patch) release. The agent follows [`.cursor/skills/feature-release/`](../.cursor/skills/feature-release/SKILL.md):
 
-Requires **`NPM_TOKEN`** secret on the repo (publish rights for `@emplugins/emprivacy` on the [emplugins](https://www.npmjs.com/org/emplugins) org).
+1. Commit the work plus **one** `.changeset/*.md` file. Leave `package.json` `"version"`, `src/version.ts`, and `CHANGELOG.md` unchanged. Write the maintainer notes in [RELEASE_NOTES.md](./RELEASE_NOTES.md) for the version Changesets will create.
+2. Open a feature PR, squash-merge when its CI is green.
+3. Merge the **Version Packages** PR as soon as it opens. Its own CI often sits at `action_required` (the Release workflow opened it with `GITHUB_TOKEN`). `pnpm release:publish` on `main` is the publish-time test gate.
+4. Treat `+ @emplugins/emprivacy@<version>` in the Release log as a successful publish. The npm registry can 404 that version for several minutes while it scans the tarball. Poll `https://registry.npmjs.org/@emplugins/emprivacy/<version>` for up to 15 minutes. Do not publish again during that window.
+
+Release publishes with npm trusted publishing from `release.yml`. Details: [maintainer-release.md](./maintainer-release.md).
 
 ### Local (fallback)
 

package/docs/RELEASE_NOTES.md

@@ -6,6 +6,28 @@
 
 No unreleased changes.
 
+# emprivacy v3.2.1
+
+## Changes
+
+- **EmDash 1.4.0** — CI-tested with EmDash `1.0.1` and `1.4.0`. Peer dependency stays `emdash@^1.0.1`. No plugin API change.
+- **zod 4.6.7** — Runtime dependency updated from 4.6.5 so production audit clears GHSA-mrhx-c7xc-m3w5 (oversized constrained collections).
+- **Policy links on EmDash 1.2+** — Root-relative privacy and cookie policy paths resolve with `ctx.url()`, which follows the configured site origin (site URL setting, then the address the site was set up on). A site that moves domain sees the new origin in those links after the server restarts.
+- **Install hook** — EmDash 1.2+ runs `plugin:install` once for a plugin registered in `plugins: []`. EmPrivacy seeds default settings only when none are stored.
+
+# emprivacy v3.2.0
+
+## Changes
+
+- **Script host allowlist** — Custom, Umami, and marketing script hosts must be listed. An empty list does not load those scripts. Built-in presets (Cloudflare, Plausible, Fathom, Simple Analytics, GA4, GTM, Clarity, UET) are unchanged. Sites that already saved custom or marketing URLs need each hostname on the list before those scripts load again.
+- **Subresource Integrity** — Custom and marketing lines require a `sha256-`, `sha384-`, or `sha512-` hash. A line without one is rejected on save and is not injected. Umami needs an allowlisted host and does not require a hash.
+- **Embed link hosts** — Mastodon and link previews become links only when the hostname is listed. YouTube, Vimeo, X, Bluesky, and GitHub Gist keep their built-in checks. A `data-emprivacy-embed` attribute on the page is not enough to allow an arbitrary URL.
+- **Non-public hosts** — Loopback, private, link-local, and other non-public addresses are rejected for script and embed URLs.
+- **Settings** — Opening or saving EmPrivacy settings requires a signed-in admin.
+- **Consent log** — Anonymous writes use EmDash’s platform client address: about 30 per address per UTC hour, and about 60 per hour for the whole site. Requests with no platform address share one 30/hour bucket. No IP is stored in the consent row.
+- **Embed iframes** — YouTube and Vimeo `sandbox` is unchanged. The iframe `allow` list no longer includes clipboard access.
+- **Publish** — npm credentials are written to a temporary user config outside the repo. A project `.npmrc` is refused at publish time.
+
 # emprivacy v3.1.0
 
 ## Changes

package/docs/TESTING.md

@@ -23,7 +23,7 @@ Use a **staging** EmDash Astro app on **`emdash@^1.0.1`** with `emprivacyPlugin(
 1. **Banner** — Incognito: banner appears with no `emprivacy_cc` cookie, when **Policy / consent version** does not match `v`, or when a legacy cookie lacks `f`. **Banner position** Bottom keeps it on the bottom edge; Top pins it to the top. The reopen button stays bottom-left.
 2. **Categories** — Customize shows Essential (locked on), Functional, Analytics, Marketing. Reject non-essential: no configured analytics/marketing scripts in Network; embeds stay placeholders.
 3. **Re-open** — Cookie button (bottom-left). Save reloads. Turning a category off removes those scripts after reload and expires the known first-party cookie names for that category (`_ga` / `_ga_*` for Analytics; `_clck`, `_uetsid`, and the other fixed names for Marketing). `emprivacy_cc` remains.
-4. **Presets** — For the platform you ship, confirm the expected host loads only after the correct category (Analytics for most presets, including Clarity; **Marketing** for GTM and UET). Custom/marketing scripts must respect any host allowlist. Clarity and UET must not request their hosts before that consent.
+4. **Presets** — For the platform you ship, confirm the expected host loads only after the correct category (Analytics for most presets, including Clarity; **Marketing** for GTM and UET). Custom and marketing scripts load only with SRI and a script host allowlist entry. Umami loads only when its host is listed. Clarity and UET must not request their hosts before that consent. Mastodon and link previews stay placeholders until the host is on Embed link hosts.
 5. **Evil embed plant** — In DevTools, add a placeholder with `data-src="https://evil.example/x"` and grant marketing; assert no iframe is created.
 6. **Embed unlock** — “Allow embeds and load” opens preferences; it must not silently flip categories.
 7. **Embeds** — With `@emdash-cms/plugin-embeds` and EmPrivacy last (or site-level `blockComponents`): a YouTube block is a placeholder first; after allowing the embed category, the iframe `src` is `https://www.youtube-nocookie.com/embed/…`. A junk/javascript URL never becomes an iframe.

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "SPDX-License-Identifier: MIT",
   "name": "@emplugins/emprivacy",
-  "version": "3.1.0",
+  "version": "3.2.1",
   "description": "Cookie consent, gated embeds, and privacy notices for EmDash (GDPR, CCPA/CIPA-oriented configuration)",
   "type": "module",
   "main": "dist/index.mjs",
@@ -42,11 +42,11 @@
     "emdash": "^1.0.1"
   },
   "dependencies": {
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@changesets/cli": "^3.0.3",
-    "emdash": "^1.0.1",
+    "emdash": "^1.4.0",
     "tsdown": "^0.23.0",
     "typescript": "^5.9.3",
     "vitest": "^5.0.1"
@@ -66,7 +66,7 @@
   "pnpm": {
     "overrides": {
       "kysely": "0.29.6",
-      "zod": "4.6.5"
+      "zod": "4.6.7"
     }
   },
   "scripts": {

package/src/astro/embed-resolve.ts

@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: MIT
 
+import { parseStrictHttpsUrl } from "../security.js";
+
 /**
  * Validate official EmDash embed block payloads and produce a first-party
  * placeholder plan. Never returns a URL we did not construct or allowlist.
@@ -43,23 +45,9 @@ const BSKY_HOSTS = new Set(["bsky.app", "www.bsky.app"]);
 const GIST_HOSTS = new Set(["gist.github.com"]);
 const POSTER_HOSTS = new Set(["i.ytimg.com", "img.youtube.com", "i.vimeocdn.com"]);
 
-function hasUnsafeChars(s: string): boolean {
-	return /[\u0000-\u001F\u007F\s]/.test(s);
-}
-
+/** Same non-public host rules as script URLs. */
 export function parseHttpsUrl(raw: string): URL | null {
-	const t = raw.trim();
-	if (!t || t.length > 2048 || hasUnsafeChars(t)) return null;
-	if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return null;
-	try {
-		const u = new URL(t);
-		if (u.protocol !== "https:") return null;
-		if (u.username || u.password) return null;
-		if (u.hostname === "localhost" || u.hostname.endsWith(".localhost")) return null;
-		return u;
-	} catch {
-		return null;
-	}
+	return parseStrictHttpsUrl(raw);
 }
 
 function hostOf(u: URL): string {