@jant/core 0.6.16 → 0.7.0

package/src/routes/dash/settings.tsx

@@ -13,19 +13,35 @@ import { z } from "zod";
 import type { Bindings } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
 import { sse, dsRedirect, dsToast } from "../../lib/sse.js";
-import { getI18n, isLocale, resolveCatalogLocale } from "../../i18n/index.js";
+import { getI18n, isLocale } from "../../i18n/index.js";
 import { renderPublicPage } from "../../lib/render.js";
 import { getNavigationData } from "../../lib/navigation.js";
 import { buildPageTitle } from "../../lib/page-title.js";
 import { AdminBreadcrumb } from "../../ui/shared/AdminBreadcrumb.js";
 import { getTimeZoneOptions } from "../../lib/timezones.js";
-import { ValidationError } from "../../lib/errors.js";
+import { getOrBuildEntry } from "../../i18n/supported-locales.js";
+import {
+  DomainError,
+  LanguageInUseError,
+  UnauthorizedError,
+  ValidationError,
+} from "../../lib/errors.js";
 import { SETTINGS_KEYS } from "../../lib/constants.js";
+import { announceInBackground } from "../discover-announce.js";
+import {
+  DISCOVER_FIRST_READ_MAX_HOURS,
+  DISCOVER_MIN_PUBLIC_POSTS,
+  getDiscoverPageUrls,
+  getDiscoverSubmitUrl,
+  measureDiscoverMaturity,
+  parseDiscoverSetting,
+} from "../../lib/discover.js";
 import { getAvailableThemes } from "../../lib/theme.js";
 import { THEME_MODES, type ThemeMode } from "../../types/config.js";
 import { BUILTIN_FONT_THEMES } from "../../ui/font-themes.js";
 import { SettingsRootContent } from "../../ui/dash/settings/SettingsRootContent.js";
 import { GeneralContent } from "../../ui/dash/settings/GeneralContent.js";
+import { LanguageContent } from "../../ui/dash/settings/LanguageContent.js";
 import { AvatarContent } from "../../ui/dash/settings/AvatarContent.js";
 import { AccountMenuContent } from "../../ui/dash/settings/AccountMenuContent.js";
 import { AccountContent } from "../../ui/dash/settings/AccountContent.js";
@@ -52,16 +68,24 @@ import {
 } from "../../lib/telegram-settings-status.js";
 import { TelegramContent } from "../../ui/dash/settings/TelegramContent.js";
 import { toAbsoluteSiteUrl, toPublicPath } from "../../lib/url.js";
-import { parseValidated, UpdateSiteSettingsSchema } from "../../lib/schemas.js";
+import {
+  ContentLanguageSchema,
+  parseValidated,
+  UpdateSiteSettingsSchema,
+} from "../../lib/schemas.js";
 import {
   getHostedControlPlaneAccountPasswordUrl,
   getHostedControlPlaneAccountUrl,
   getHostedControlPlaneProviderLabel,
   getHostedControlPlaneSiteDeleteUrl,
   getHostedControlPlaneSiteSettingsUrl,
+  isHostedControlPlaneEnabled,
 } from "../../lib/hosted-signin.js";
 import { syncHostedControlPlaneSiteAvatar } from "../../lib/hosted-control-plane-sync.js";
 import {
+  getDiscoverDefault,
+  getDiscoverDirectoryBaseUrl,
+  getDiscoverPingUrl,
   getGitHubAppConfig,
   getHostedControlPlaneSsoSecret,
   getTelegramBotPool,
@@ -95,15 +119,26 @@ type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const settingsRoutes = new Hono<Env>();
 
-const UpdateLocaleSettingsSchema = z.object({
-  siteLanguage: z.string(),
-  // Optional for back-compat: absent = leave the dashboard language untouched,
-  // "" = clear it (follow content language).
-  dashboardLanguage: z.string().optional(),
-  cjkSerifFont: z.string(),
+const UpdateTimeSettingsSchema = z.object({
   timeZone: z.string(),
 });
 
+// Both fields are optional: the language page saves one control at a time, and
+// an absent field means "leave it alone" rather than "clear it".
+const UpdateLanguageSettingsSchema = z.object({
+  contentLanguage: ContentLanguageSchema.optional(),
+  dashboardLanguage: z.string().optional(),
+});
+
+const LanguageTagSchema = z.object({
+  language: ContentLanguageSchema,
+});
+
+const EnableMultilingualSchema = z.object({
+  primary: ContentLanguageSchema,
+  additional: z.array(ContentLanguageSchema),
+});
+
 const UpdateFeedSettingsSchema = z.object({
   mainRssFeed: z.enum(["featured", "latest"]),
 });
@@ -116,6 +151,13 @@ const UpdateSearchSettingsSchema = z.object({
   allowIndexing: z.boolean(),
 });
 
+// Only the two values the control writes. `featured` is still a stored value
+// older releases wrote and the feed still declares, but nothing writes it any
+// more: which of a blog's posts reach which list is the directory's rule.
+const UpdateDiscoverSettingsSchema = z.object({
+  discover: z.enum(["latest", "off"]),
+});
+
 function publicPath(c: Context<Env>, path: string): string {
   return toPublicPath(path, c.var.appConfig.sitePathPrefix);
 }
@@ -124,6 +166,22 @@ function aboutEditPath(c: Context<Env>): string {
   return `${publicPath(c, "/about")}?edit=1`;
 }
 
+/**
+ * The session id behind the current request.
+ *
+ * Every `/settings` route sits behind `requireAuth`, so a missing session here
+ * is a wiring mistake rather than a signed-out visitor — hence a throw instead
+ * of a redirect.
+ */
+function requireSessionId(c: Context<Env>): string {
+  const sessionId = c.var.session?.session?.id;
+  if (!sessionId) {
+    throw new UnauthorizedError();
+  }
+
+  return sessionId;
+}
+
 /**
  * Breadcrumb labels for admin settings pages.
  *
@@ -138,6 +196,7 @@ function breadcrumbLabel(
   key:
     | "settings"
     | "general"
+    | "language"
     | "avatar"
     | "navigation"
     | "colorTheme"
@@ -163,6 +222,10 @@ function breadcrumbLabel(
       return i18n._(
         msg({ message: "General", comment: "@context: Breadcrumb label" }),
       );
+    case "language":
+      return i18n._(
+        msg({ message: "Language", comment: "@context: Breadcrumb label" }),
+      );
     case "avatar":
       return i18n._(
         msg({ message: "Avatar", comment: "@context: Breadcrumb label" }),
@@ -318,11 +381,44 @@ settingsRoutes.get("/general", async (c) => {
 
   const dbSiteName = allSettings["SITE_NAME"] ?? "";
   const dbSiteDescription = allSettings["SITE_DESCRIPTION"] ?? "";
+  // The stored choice, not the effective mode: the control has to be able to
+  // show "never chosen", which is what lets `noindex` and then the deployment
+  // default decide instead.
+  const discoverSetting = parseDiscoverSetting(allSettings["DISCOVER"]);
+  // The deployment's own answer, and nothing else folded into it: `latest` on
+  // a deployment that lists its fleet, absent on an ordinary self-hosted site.
+  // The gates that sit above it — `noindex` most of all — are applied in the
+  // browser instead, because they are controls on this same page and a value
+  // resolved here would freeze at page load. The component runs the same
+  // `resolveDiscoverMode` this route would have.
+  const discoverDefault = parseDiscoverSetting(getDiscoverDefault(c.env)) ?? "";
 
   const saved = c.req.query("saved") !== undefined;
-  const [navData, aboutPage] = await Promise.all([
+  // What the site can answer about its own standing in the directory, without
+  // asking one. The directory deliberately does not take status queries, so
+  // everything shown here is local evidence.
+  const publicPostFilters = {
+    status: "published" as const,
+    excludeReplies: true,
+    excludeLatestHidden: true,
+    excludePrivate: true,
+  };
+  const [
+    navData,
+    aboutPage,
+    announceState,
+    publicPostCount,
+    featuredPostCount,
+  ] = await Promise.all([
     getNavigationData(c),
     c.var.services.aboutPage.getStatus(),
+    c.var.services.settings.getDiscoverAnnounceState(),
+    c.var.services.posts.count(publicPostFilters),
+    c.var.services.posts.countFeaturedThreadRoots({
+      status: "published",
+      excludePrivate: true,
+      excludeLatestHidden: true,
+    }),
   ]);
   const siteUrlForDisplay =
     appConfig.siteUrl || new URL(publicPath(c, "/"), c.req.url).toString();
@@ -341,13 +437,6 @@ settingsRoutes.get("/general", async (c) => {
         <GeneralContent
           siteName={dbSiteName || ""}
           siteDescription={dbSiteDescription || ""}
-          siteLanguage={appConfig.siteLanguage}
-          dashboardLanguage={
-            isLocale(appConfig.dashboardLanguage)
-              ? appConfig.dashboardLanguage
-              : resolveCatalogLocale(appConfig.siteLanguage)
-          }
-          cjkSerifFont={appConfig.cjkSerifFont}
           siteNameFallback={appConfig.fallbacks.siteName}
           siteDescriptionFallback={appConfig.fallbacks.siteDescription}
           mainRssFeed={appConfig.mainRssFeed}
@@ -375,6 +464,32 @@ settingsRoutes.get("/general", async (c) => {
           siteFooter={appConfig.siteFooter}
           showJantBrandingOnHome={appConfig.showJantBrandingOnHome}
           noindex={appConfig.noindex}
+          discover={discoverSetting ?? ""}
+          discoverDefault={discoverDefault}
+          discoverPages={getDiscoverPageUrls(
+            getDiscoverDirectoryBaseUrl(c.env),
+          )}
+          discoverStatus={{
+            announced: announceState?.ok ?? null,
+            announceError: announceState?.error ?? null,
+            announceAt: announceState?.at ?? null,
+            // No directory configured means nothing to announce to, and the
+            // whole announcement block is beside the point.
+            hasDirectory: getDiscoverPingUrl(c.env) !== undefined,
+            // A hosted fleet is enrolled by its control plane, so there is no
+            // announcement for the owner to make, chase, or retry.
+            managedByHost: isHostedControlPlaneEnabled(c.env),
+            submitUrl: getDiscoverSubmitUrl(getDiscoverDirectoryBaseUrl(c.env)),
+            // The mode the feeds actually declare, already derived once on
+            // `appConfig` — re-deriving it here is how this block used to
+            // miss the deployment default.
+            declaredMode: appConfig.discover,
+            ...measureDiscoverMaturity({ publicPostCount }),
+            featuredPostCount,
+            minPublicPosts: DISCOVER_MIN_PUBLIC_POSTS,
+            firstReadMaxHours: DISCOVER_FIRST_READ_MAX_HOURS,
+          }}
+          rssFeedsEnabled={appConfig.rssFeedsEnabled}
           demoMode={appConfig.demoMode}
           timezones={getTimeZoneOptions(appConfig.timeZone)}
           aboutPage={aboutPage}
@@ -451,42 +566,286 @@ settingsRoutes.post("/general", async (c) => {
   }
 });
 
-settingsRoutes.post("/general/language-time", async (c) => {
+// Time zone only. Language moved to its own page, so this no longer sends —
+// and must not clear — the language fields.
+settingsRoutes.post("/general/time", async (c) => {
   const i18n = getI18n(c);
-  const body = parseValidated(UpdateLocaleSettingsSchema, await c.req.json());
+  const body = parseValidated(UpdateTimeSettingsSchema, await c.req.json());
   const toast = i18n._(
     msg({
-      message: "Language and time updated.",
-      comment: "@context: Toast after saving language and time settings",
+      message: "Time zone updated.",
+      comment: "@context: Toast after saving the time zone",
     }),
   );
-  const { languageChanged } =
-    await c.var.services.settings.updateLocaleSettings(body, {
-      oldLanguage: c.var.appConfig.siteLanguage,
-      oldCjkSerifFont: c.var.appConfig.cjkSerifFont,
-      oldDashboardLanguage: c.var.appConfig.dashboardLanguage,
-    });
+  await c.var.services.settings.updateLocaleSettings(body, {
+    oldLanguage: c.var.appConfig.siteLanguage,
+  });
 
   const wantsJson = c.req.header("accept")?.includes("application/json");
   if (wantsJson) {
-    if (languageChanged) {
-      return c.json({
-        status: "redirect" as const,
-        url: publicPath(c, "/settings/general?saved"),
-      });
-    }
+    return c.json({ status: "ok" as const, toast });
+  }
+
+  return dsToast(toast);
+});
+
+// ===========================================================================
+// Language
+//
+// Every language setting lives on one page, and every write goes through the
+// language service — the multilingual keys are DB-only precisely so this is the
+// only door.
+// ===========================================================================
+
+settingsRoutes.get("/language", async (c) => {
+  const { appConfig } = c.var;
+  const navData = await getNavigationData(c);
+  const [state, preview] = await Promise.all([
+    c.var.services.language.getState(),
+    c.var.services.language.getEnablePreview(),
+  ]);
+
+  return renderPublicPage(c, {
+    title: buildPageTitle("Language", navData.siteName),
+    navData,
+    content: (
+      <>
+        <AdminBreadcrumb
+          parent={breadcrumbLabel(c, "settings")}
+          parentHref={publicPath(c, "/settings")}
+          current={breadcrumbLabel(c, "language")}
+        />
+        <LanguageContent
+          contentLanguage={state.primary}
+          // Unset stays unset rather than being shown as the locale it
+          // currently resolves to: "Follow content language" is a real choice
+          // on this page, and it is the one most sites are on.
+          dashboardLanguage={
+            isLocale(appConfig.dashboardLanguage)
+              ? appConfig.dashboardLanguage
+              : ""
+          }
+          multilingualEnabled={state.enabled}
+          additionalLanguages={state.additional}
+          unmarkedPostCount={preview.pendingCount}
+          sitePathPrefix={appConfig.sitePathPrefix}
+        />
+      </>
+    ),
+  });
+});
 
+/**
+ * Run a language mutation and report it as JSON.
+ *
+ * Every language endpoint has the same shape — do the thing, or explain in one
+ * sentence why it could not be done — so they share one wrapper rather than
+ * repeating the try/catch. The toast may be built from what the action
+ * returned, for the one operation whose outcome is not known until it runs.
+ */
+async function respondToLanguageAction<T>(
+  c: Context<Env>,
+  toast: string | ((result: T) => string),
+  action: () => Promise<T>,
+): Promise<Response> {
+  try {
+    const result = await action();
     return c.json({
       status: "ok" as const,
-      toast,
+      toast: typeof toast === "function" ? toast(result) : toast,
     });
+  } catch (error) {
+    // The one refusal an author will actually meet — removing or dropping a
+    // language that posts still use — gets a localized sentence naming the
+    // language; the settings page pairs it with a link to those posts.
+    if (error instanceof LanguageInUseError) {
+      const i18n = getI18n(c);
+      return c.json(
+        {
+          error: i18n._(
+            msg({
+              message:
+                "{count, plural, one {# post is} other {# posts are}} still written in {language}. Change their language, or keep the language.",
+              comment:
+                "@context: Error when a content language that posts still use would be dropped",
+            }),
+            {
+              count: error.postCount,
+              language: getOrBuildEntry(error.language).native,
+            },
+          ),
+          code: error.code,
+          language: error.language,
+        },
+        400,
+      );
+    }
+    if (error instanceof DomainError) {
+      return c.json({ error: error.message, code: error.code }, 400);
+    }
+    throw error;
   }
+}
+
+settingsRoutes.post("/language", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(UpdateLanguageSettingsSchema, await c.req.json());
+
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Language updated.",
+        comment: "@context: Toast after saving a language setting",
+      }),
+    ),
+    async () => {
+      await c.var.services.settings.updateLocaleSettings(
+        {
+          siteLanguage: body.contentLanguage,
+          dashboardLanguage: body.dashboardLanguage,
+        },
+        {
+          oldLanguage: c.var.appConfig.siteLanguage,
+          oldDashboardLanguage: c.var.appConfig.dashboardLanguage,
+        },
+      );
+    },
+  );
+});
+
+settingsRoutes.post("/language/enable", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(EnableMultilingualSchema, await c.req.json());
 
-  if (languageChanged) {
-    return dsRedirect(publicPath(c, "/settings/general?saved"));
+  try {
+    const { markedCount } = await c.var.services.language.enable(body);
+    return c.json({
+      status: "ok" as const,
+      toast:
+        markedCount > 0
+          ? i18n._(
+              msg({
+                message:
+                  "Multilingual content is on. {count, plural, one {# post was marked} other {# posts were marked}} as {language}.",
+                comment:
+                  "@context: Toast after turning multilingual content on with existing posts",
+              }),
+              // The language's own name, not its tag — the author picked
+              // "繁體中文" in the dialog, not "zh-Hant".
+              {
+                count: markedCount,
+                language: getOrBuildEntry(body.primary).native,
+              },
+            )
+          : i18n._(
+              msg({
+                message: "Multilingual content is on.",
+                comment:
+                  "@context: Toast after turning multilingual content on with no existing posts",
+              }),
+            ),
+    });
+  } catch (error) {
+    if (error instanceof LanguageInUseError) {
+      // Worded for the dialog it lands in: the fix is putting the language
+      // back on the list right there, and the response carries the tag so
+      // the dialog can offer that as one click.
+      return c.json(
+        {
+          error: i18n._(
+            msg({
+              message:
+                "{count, plural, one {# post is} other {# posts are}} written in {language}, which is not on this list. Add it back, or change their language first.",
+              comment:
+                "@context: Refusal in the multilingual dialog when the list drops a language that posts still use",
+            }),
+            {
+              count: error.postCount,
+              language: getOrBuildEntry(error.language).native,
+            },
+          ),
+          code: error.code,
+          language: error.language,
+        },
+        400,
+      );
+    }
+    if (error instanceof DomainError) {
+      return c.json({ error: error.message, code: error.code }, 400);
+    }
+    throw error;
   }
+});
 
-  return dsToast(toast);
+settingsRoutes.post("/language/disable", async (c) => {
+  const i18n = getI18n(c);
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Multilingual content is off. Your languages are still saved.",
+        comment: "@context: Toast after turning multilingual content off",
+      }),
+    ),
+    () => c.var.services.language.disable(),
+  );
+});
+
+settingsRoutes.post("/language/primary", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(LanguageTagSchema, await c.req.json());
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Primary language changed.",
+        comment: "@context: Toast after changing the primary language",
+      }),
+    ),
+    () => c.var.services.language.setPrimary(body.language),
+  );
+});
+
+settingsRoutes.post("/language/add", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(LanguageTagSchema, await c.req.json());
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Language added.",
+        comment: "@context: Toast after adding a content language",
+      }),
+    ),
+    () => c.var.services.language.addLanguage(body.language),
+  );
+});
+
+settingsRoutes.post("/language/remove", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(LanguageTagSchema, await c.req.json());
+  return respondToLanguageAction(
+    c,
+    // The last language takes the feature with it, and that is the larger of
+    // the two facts — the author leaves this page single-language.
+    ({ multilingualDisabled }) =>
+      multilingualDisabled
+        ? i18n._(
+            msg({
+              message: "Language removed. Multilingual content is off.",
+              comment:
+                "@context: Toast after removing the last additional content language",
+            }),
+          )
+        : i18n._(
+            msg({
+              message: "Language removed.",
+              comment: "@context: Toast after removing a content language",
+            }),
+          ),
+    () => c.var.services.language.removeLanguage(body.language),
+  );
 });
 
 settingsRoutes.post("/general/feeds", async (c) => {
@@ -527,6 +886,88 @@ settingsRoutes.post("/general/home", async (c) => {
   return dsToast(toast);
 });
 
+/**
+ * Announce, because the owner asked.
+ *
+ * The route the settings page offers whenever the directory has not heard from
+ * this site: an announcement that failed, and one that was never made at all.
+ * Sending it is safe at any time — the receiving end treats a repeat as a
+ * no-op for a site it already knows, and it carries nothing but the feed
+ * address.
+ */
+settingsRoutes.post("/general/discover/announce", async (c) => {
+  const i18n = getI18n(c);
+  const { appConfig } = c.var;
+
+  const started =
+    !appConfig.demoMode &&
+    announceInBackground(c, c.var.allSettings["DISCOVER"]);
+
+  const toast = started
+    ? i18n._(
+        msg({
+          message: "Announcing your site. Reload to see the result.",
+          comment:
+            "@context: Toast after sending the Discover announcement. It runs in the background, so the page does not yet know how it went.",
+        }),
+      )
+    : i18n._(
+        msg({
+          message: "This site has no directory to announce to.",
+          comment:
+            "@context: Toast when the Discover announcement cannot be sent because no directory is configured, or the site cannot be listed at all",
+        }),
+      );
+
+  // The settings bridge is the only caller, and it always asks for JSON — a
+  // Datastar toast reaches it as a body it cannot parse, which it reports as a
+  // failed save whatever the server actually did. Every other settings route
+  // answers both shapes; this one has to as well.
+  const wantsJson = c.req.header("accept")?.includes("application/json");
+  if (wantsJson) {
+    return c.json({ status: "ok" as const, toast });
+  }
+
+  return dsToast(toast);
+});
+
+settingsRoutes.post("/general/discover", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(UpdateDiscoverSettingsSchema, await c.req.json());
+  const { appConfig } = c.var;
+
+  const { shouldAnnounce } =
+    await c.var.services.settings.updateDiscoverSetting(body.discover, {
+      demoMode: appConfig.demoMode,
+    });
+
+  if (shouldAnnounce) {
+    announceInBackground(c, body.discover);
+  }
+
+  const wantsJson = c.req.header("accept")?.includes("application/json");
+  if (wantsJson) {
+    return c.json({
+      status: "ok" as const,
+      toast: i18n._(
+        msg({
+          message: "Site visibility updated.",
+          comment: "@context: Toast after saving the site visibility settings",
+        }),
+      ),
+    });
+  }
+
+  return dsToast(
+    i18n._(
+      msg({
+        message: "Site visibility updated.",
+        comment: "@context: Toast after saving the site visibility settings",
+      }),
+    ),
+  );
+});
+
 settingsRoutes.post("/general/search", async (c) => {
   const i18n = getI18n(c);
   const body = parseValidated(UpdateSearchSettingsSchema, await c.req.json());
@@ -795,7 +1236,7 @@ settingsRoutes.post("/avatar/display", async (c) => {
 settingsRoutes.get("/navigation", async (c) => {
   const [navItems, directoryData, suggestedLinks] = await Promise.all([
     c.var.services.navItems.list(),
-    c.var.services.collections.listDirectoryData(),
+    c.var.services.collections.listDirectoryData({ isAuthenticated: true }),
     c.var.services.navItems.listSuggestedLinks({
       siteOrigin: c.var.appConfig.siteOrigin,
       sitePathPrefix: c.var.appConfig.sitePathPrefix,
@@ -1332,7 +1773,9 @@ settingsRoutes.get("/account/delete-account", async (c) => {
   }
 
   const navData = await getNavigationData(c);
-  const csrfToken = await c.var.services.auth.generateDeleteCsrfToken();
+  const csrfToken = await c.var.services.auth.generateDeleteCsrfToken(
+    requireSessionId(c),
+  );
 
   return renderPublicPage(c, {
     title: buildPageTitle("Delete Account", navData.siteName),
@@ -1390,7 +1833,10 @@ settingsRoutes.post("/account/delete-account", async (c) => {
     );
   }
 
-  const isValid = await c.var.services.auth.validateDeleteCsrfToken(csrfToken);
+  const isValid = await c.var.services.auth.validateDeleteCsrfToken(
+    csrfToken,
+    requireSessionId(c),
+  );
   if (!isValid) {
     return dsToast(
       i18n._(
@@ -1404,11 +1850,26 @@ settingsRoutes.post("/account/delete-account", async (c) => {
     );
   }
 
+  // Sign the browser out first. Every row behind this session is about to
+  // disappear, and better-auth's cookie cache would keep answering "signed in"
+  // from the browser's own copy for minutes afterwards — a ticket to a site
+  // that no longer exists, handed to whoever completes the next setup.
+  let signOutHeaders: Headers | undefined;
+  try {
+    const signedOut = await c.var.auth.api.signOut({
+      headers: c.req.raw.headers,
+      asResponse: true,
+    });
+    signOutHeaders = signedOut.headers;
+  } catch {
+    // The wipe below removes the session either way.
+  }
+
   await c.var.services.auth.deleteAllData({
     storage: c.var.storage,
   });
 
-  return dsRedirect(publicPath(c, "/setup"));
+  return dsRedirect(publicPath(c, "/setup"), { headers: signOutHeaders });
 });
 
 // ===========================================================================