@jant/core 0.6.16 → 0.7.1

package/src/routes/dash/settings.tsx

@@ -13,19 +13,35 @@ import { z } from "zod";
 import type { Bindings } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
 import { sse, dsRedirect, dsToast } from "../../lib/sse.js";
-import { getI18n, isLocale, resolveCatalogLocale } from "../../i18n/index.js";
+import { getI18n, isLocale } from "../../i18n/index.js";
 import { renderPublicPage } from "../../lib/render.js";
 import { getNavigationData } from "../../lib/navigation.js";
 import { buildPageTitle } from "../../lib/page-title.js";
 import { AdminBreadcrumb } from "../../ui/shared/AdminBreadcrumb.js";
 import { getTimeZoneOptions } from "../../lib/timezones.js";
-import { ValidationError } from "../../lib/errors.js";
+import { getOrBuildEntry } from "../../i18n/supported-locales.js";
+import {
+  DomainError,
+  LanguageInUseError,
+  UnauthorizedError,
+  ValidationError,
+} from "../../lib/errors.js";
 import { SETTINGS_KEYS } from "../../lib/constants.js";
+import { announceInBackground } from "../discover-announce.js";
+import {
+  DISCOVER_FIRST_READ_MAX_HOURS,
+  DISCOVER_MIN_PUBLIC_POSTS,
+  getDiscoverPageUrls,
+  getDiscoverSubmitUrl,
+  measureDiscoverMaturity,
+  parseDiscoverSetting,
+} from "../../lib/discover.js";
 import { getAvailableThemes } from "../../lib/theme.js";
 import { THEME_MODES, type ThemeMode } from "../../types/config.js";
 import { BUILTIN_FONT_THEMES } from "../../ui/font-themes.js";
 import { SettingsRootContent } from "../../ui/dash/settings/SettingsRootContent.js";
 import { GeneralContent } from "../../ui/dash/settings/GeneralContent.js";
+import { LanguageContent } from "../../ui/dash/settings/LanguageContent.js";
 import { AvatarContent } from "../../ui/dash/settings/AvatarContent.js";
 import { AccountMenuContent } from "../../ui/dash/settings/AccountMenuContent.js";
 import { AccountContent } from "../../ui/dash/settings/AccountContent.js";
@@ -52,16 +68,24 @@ import {
 } from "../../lib/telegram-settings-status.js";
 import { TelegramContent } from "../../ui/dash/settings/TelegramContent.js";
 import { toAbsoluteSiteUrl, toPublicPath } from "../../lib/url.js";
-import { parseValidated, UpdateSiteSettingsSchema } from "../../lib/schemas.js";
+import {
+  ContentLanguageSchema,
+  parseValidated,
+  UpdateSiteSettingsSchema,
+} from "../../lib/schemas.js";
 import {
   getHostedControlPlaneAccountPasswordUrl,
   getHostedControlPlaneAccountUrl,
   getHostedControlPlaneProviderLabel,
   getHostedControlPlaneSiteDeleteUrl,
   getHostedControlPlaneSiteSettingsUrl,
+  isHostedControlPlaneEnabled,
 } from "../../lib/hosted-signin.js";
 import { syncHostedControlPlaneSiteAvatar } from "../../lib/hosted-control-plane-sync.js";
 import {
+  getDiscoverDefault,
+  getDiscoverDirectoryBaseUrl,
+  getDiscoverPingUrl,
   getGitHubAppConfig,
   getHostedControlPlaneSsoSecret,
   getTelegramBotPool,
@@ -71,6 +95,7 @@ import {
   getInstallation,
   listInstallationReposPage,
   searchInstallationRepos,
+  type InstallationAccount,
 } from "../../lib/github-app.js";
 import {
   isSyncPending,
@@ -79,6 +104,7 @@ import {
   triggerGitHubSyncInline,
 } from "../../lib/github-sync-trigger.js";
 import { buildSyncSiteConfig } from "../../lib/github-sync-site-config.js";
+import { suggestSyncRepoName } from "../../lib/github-sync-repo-name.js";
 import { buildConfigEditorFields } from "../../lib/api-settings.js";
 import {
   readGitHubSyncStatus,
@@ -95,15 +121,26 @@ type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const settingsRoutes = new Hono<Env>();
 
-const UpdateLocaleSettingsSchema = z.object({
-  siteLanguage: z.string(),
-  // Optional for back-compat: absent = leave the dashboard language untouched,
-  // "" = clear it (follow content language).
-  dashboardLanguage: z.string().optional(),
-  cjkSerifFont: z.string(),
+const UpdateTimeSettingsSchema = z.object({
   timeZone: z.string(),
 });
 
+// Both fields are optional: the language page saves one control at a time, and
+// an absent field means "leave it alone" rather than "clear it".
+const UpdateLanguageSettingsSchema = z.object({
+  contentLanguage: ContentLanguageSchema.optional(),
+  dashboardLanguage: z.string().optional(),
+});
+
+const LanguageTagSchema = z.object({
+  language: ContentLanguageSchema,
+});
+
+const EnableMultilingualSchema = z.object({
+  primary: ContentLanguageSchema,
+  additional: z.array(ContentLanguageSchema),
+});
+
 const UpdateFeedSettingsSchema = z.object({
   mainRssFeed: z.enum(["featured", "latest"]),
 });
@@ -116,6 +153,13 @@ const UpdateSearchSettingsSchema = z.object({
   allowIndexing: z.boolean(),
 });
 
+// Only the two values the control writes. `featured` is still a stored value
+// older releases wrote and the feed still declares, but nothing writes it any
+// more: which of a blog's posts reach which list is the directory's rule.
+const UpdateDiscoverSettingsSchema = z.object({
+  discover: z.enum(["latest", "off"]),
+});
+
 function publicPath(c: Context<Env>, path: string): string {
   return toPublicPath(path, c.var.appConfig.sitePathPrefix);
 }
@@ -124,6 +168,39 @@ function aboutEditPath(c: Context<Env>): string {
   return `${publicPath(c, "/about")}?edit=1`;
 }
 
+/**
+ * The session id behind the current request.
+ *
+ * Every `/settings` route sits behind `requireAuth`, so a missing session here
+ * is a wiring mistake rather than a signed-out visitor — hence a throw instead
+ * of a redirect.
+ */
+function requireSessionId(c: Context<Env>): string {
+  const sessionId = c.var.session?.session?.id;
+  if (!sessionId) {
+    throw new UnauthorizedError();
+  }
+
+  return sessionId;
+}
+
+/**
+ * The user behind the current request.
+ *
+ * Same contract as `requireSessionId`: `requireAuth` has already proven the
+ * session belongs to a member of this site, so an absent user is a wiring
+ * mistake. Used wherever a decision is scoped to the person rather than to
+ * the site — the GitHub App installations they may reuse, most of all.
+ */
+function requireSessionUserId(c: Context<Env>): string {
+  const userId = c.var.session?.user?.id;
+  if (!userId) {
+    throw new UnauthorizedError();
+  }
+
+  return userId;
+}
+
 /**
  * Breadcrumb labels for admin settings pages.
  *
@@ -138,6 +215,7 @@ function breadcrumbLabel(
   key:
     | "settings"
     | "general"
+    | "language"
     | "avatar"
     | "navigation"
     | "colorTheme"
@@ -163,6 +241,10 @@ function breadcrumbLabel(
       return i18n._(
         msg({ message: "General", comment: "@context: Breadcrumb label" }),
       );
+    case "language":
+      return i18n._(
+        msg({ message: "Language", comment: "@context: Breadcrumb label" }),
+      );
     case "avatar":
       return i18n._(
         msg({ message: "Avatar", comment: "@context: Breadcrumb label" }),
@@ -318,11 +400,44 @@ settingsRoutes.get("/general", async (c) => {
 
   const dbSiteName = allSettings["SITE_NAME"] ?? "";
   const dbSiteDescription = allSettings["SITE_DESCRIPTION"] ?? "";
+  // The stored choice, not the effective mode: the control has to be able to
+  // show "never chosen", which is what lets `noindex` and then the deployment
+  // default decide instead.
+  const discoverSetting = parseDiscoverSetting(allSettings["DISCOVER"]);
+  // The deployment's own answer, and nothing else folded into it: `latest` on
+  // a deployment that lists its fleet, absent on an ordinary self-hosted site.
+  // The gates that sit above it — `noindex` most of all — are applied in the
+  // browser instead, because they are controls on this same page and a value
+  // resolved here would freeze at page load. The component runs the same
+  // `resolveDiscoverMode` this route would have.
+  const discoverDefault = parseDiscoverSetting(getDiscoverDefault(c.env)) ?? "";
 
   const saved = c.req.query("saved") !== undefined;
-  const [navData, aboutPage] = await Promise.all([
+  // What the site can answer about its own standing in the directory, without
+  // asking one. The directory deliberately does not take status queries, so
+  // everything shown here is local evidence.
+  const publicPostFilters = {
+    status: "published" as const,
+    excludeReplies: true,
+    excludeLatestHidden: true,
+    excludePrivate: true,
+  };
+  const [
+    navData,
+    aboutPage,
+    announceState,
+    publicPostCount,
+    featuredPostCount,
+  ] = await Promise.all([
     getNavigationData(c),
     c.var.services.aboutPage.getStatus(),
+    c.var.services.settings.getDiscoverAnnounceState(),
+    c.var.services.posts.count(publicPostFilters),
+    c.var.services.posts.countFeaturedThreadRoots({
+      status: "published",
+      excludePrivate: true,
+      excludeLatestHidden: true,
+    }),
   ]);
   const siteUrlForDisplay =
     appConfig.siteUrl || new URL(publicPath(c, "/"), c.req.url).toString();
@@ -341,13 +456,6 @@ settingsRoutes.get("/general", async (c) => {
         <GeneralContent
           siteName={dbSiteName || ""}
           siteDescription={dbSiteDescription || ""}
-          siteLanguage={appConfig.siteLanguage}
-          dashboardLanguage={
-            isLocale(appConfig.dashboardLanguage)
-              ? appConfig.dashboardLanguage
-              : resolveCatalogLocale(appConfig.siteLanguage)
-          }
-          cjkSerifFont={appConfig.cjkSerifFont}
           siteNameFallback={appConfig.fallbacks.siteName}
           siteDescriptionFallback={appConfig.fallbacks.siteDescription}
           mainRssFeed={appConfig.mainRssFeed}
@@ -375,6 +483,32 @@ settingsRoutes.get("/general", async (c) => {
           siteFooter={appConfig.siteFooter}
           showJantBrandingOnHome={appConfig.showJantBrandingOnHome}
           noindex={appConfig.noindex}
+          discover={discoverSetting ?? ""}
+          discoverDefault={discoverDefault}
+          discoverPages={getDiscoverPageUrls(
+            getDiscoverDirectoryBaseUrl(c.env),
+          )}
+          discoverStatus={{
+            announced: announceState?.ok ?? null,
+            announceError: announceState?.error ?? null,
+            announceAt: announceState?.at ?? null,
+            // No directory configured means nothing to announce to, and the
+            // whole announcement block is beside the point.
+            hasDirectory: getDiscoverPingUrl(c.env) !== undefined,
+            // A hosted fleet is enrolled by its control plane, so there is no
+            // announcement for the owner to make, chase, or retry.
+            managedByHost: isHostedControlPlaneEnabled(c.env),
+            submitUrl: getDiscoverSubmitUrl(getDiscoverDirectoryBaseUrl(c.env)),
+            // The mode the feeds actually declare, already derived once on
+            // `appConfig` — re-deriving it here is how this block used to
+            // miss the deployment default.
+            declaredMode: appConfig.discover,
+            ...measureDiscoverMaturity({ publicPostCount }),
+            featuredPostCount,
+            minPublicPosts: DISCOVER_MIN_PUBLIC_POSTS,
+            firstReadMaxHours: DISCOVER_FIRST_READ_MAX_HOURS,
+          }}
+          rssFeedsEnabled={appConfig.rssFeedsEnabled}
           demoMode={appConfig.demoMode}
           timezones={getTimeZoneOptions(appConfig.timeZone)}
           aboutPage={aboutPage}
@@ -451,42 +585,286 @@ settingsRoutes.post("/general", async (c) => {
   }
 });
 
-settingsRoutes.post("/general/language-time", async (c) => {
+// Time zone only. Language moved to its own page, so this no longer sends —
+// and must not clear — the language fields.
+settingsRoutes.post("/general/time", async (c) => {
   const i18n = getI18n(c);
-  const body = parseValidated(UpdateLocaleSettingsSchema, await c.req.json());
+  const body = parseValidated(UpdateTimeSettingsSchema, await c.req.json());
   const toast = i18n._(
     msg({
-      message: "Language and time updated.",
-      comment: "@context: Toast after saving language and time settings",
+      message: "Time zone updated.",
+      comment: "@context: Toast after saving the time zone",
     }),
   );
-  const { languageChanged } =
-    await c.var.services.settings.updateLocaleSettings(body, {
-      oldLanguage: c.var.appConfig.siteLanguage,
-      oldCjkSerifFont: c.var.appConfig.cjkSerifFont,
-      oldDashboardLanguage: c.var.appConfig.dashboardLanguage,
-    });
+  await c.var.services.settings.updateLocaleSettings(body, {
+    oldLanguage: c.var.appConfig.siteLanguage,
+  });
 
   const wantsJson = c.req.header("accept")?.includes("application/json");
   if (wantsJson) {
-    if (languageChanged) {
-      return c.json({
-        status: "redirect" as const,
-        url: publicPath(c, "/settings/general?saved"),
-      });
-    }
+    return c.json({ status: "ok" as const, toast });
+  }
+
+  return dsToast(toast);
+});
+
+// ===========================================================================
+// Language
+//
+// Every language setting lives on one page, and every write goes through the
+// language service — the multilingual keys are DB-only precisely so this is the
+// only door.
+// ===========================================================================
 
+settingsRoutes.get("/language", async (c) => {
+  const { appConfig } = c.var;
+  const navData = await getNavigationData(c);
+  const [state, preview] = await Promise.all([
+    c.var.services.language.getState(),
+    c.var.services.language.getEnablePreview(),
+  ]);
+
+  return renderPublicPage(c, {
+    title: buildPageTitle("Language", navData.siteName),
+    navData,
+    content: (
+      <>
+        <AdminBreadcrumb
+          parent={breadcrumbLabel(c, "settings")}
+          parentHref={publicPath(c, "/settings")}
+          current={breadcrumbLabel(c, "language")}
+        />
+        <LanguageContent
+          contentLanguage={state.primary}
+          // Unset stays unset rather than being shown as the locale it
+          // currently resolves to: "Follow content language" is a real choice
+          // on this page, and it is the one most sites are on.
+          dashboardLanguage={
+            isLocale(appConfig.dashboardLanguage)
+              ? appConfig.dashboardLanguage
+              : ""
+          }
+          multilingualEnabled={state.enabled}
+          additionalLanguages={state.additional}
+          unmarkedPostCount={preview.pendingCount}
+          sitePathPrefix={appConfig.sitePathPrefix}
+        />
+      </>
+    ),
+  });
+});
+
+/**
+ * Run a language mutation and report it as JSON.
+ *
+ * Every language endpoint has the same shape — do the thing, or explain in one
+ * sentence why it could not be done — so they share one wrapper rather than
+ * repeating the try/catch. The toast may be built from what the action
+ * returned, for the one operation whose outcome is not known until it runs.
+ */
+async function respondToLanguageAction<T>(
+  c: Context<Env>,
+  toast: string | ((result: T) => string),
+  action: () => Promise<T>,
+): Promise<Response> {
+  try {
+    const result = await action();
     return c.json({
       status: "ok" as const,
-      toast,
+      toast: typeof toast === "function" ? toast(result) : toast,
     });
+  } catch (error) {
+    // The one refusal an author will actually meet — removing or dropping a
+    // language that posts still use — gets a localized sentence naming the
+    // language; the settings page pairs it with a link to those posts.
+    if (error instanceof LanguageInUseError) {
+      const i18n = getI18n(c);
+      return c.json(
+        {
+          error: i18n._(
+            msg({
+              message:
+                "{count, plural, one {# post is} other {# posts are}} still written in {language}. Change their language, or keep the language.",
+              comment:
+                "@context: Error when a content language that posts still use would be dropped",
+            }),
+            {
+              count: error.postCount,
+              language: getOrBuildEntry(error.language).native,
+            },
+          ),
+          code: error.code,
+          language: error.language,
+        },
+        400,
+      );
+    }
+    if (error instanceof DomainError) {
+      return c.json({ error: error.message, code: error.code }, 400);
+    }
+    throw error;
   }
+}
+
+settingsRoutes.post("/language", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(UpdateLanguageSettingsSchema, await c.req.json());
+
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Language updated.",
+        comment: "@context: Toast after saving a language setting",
+      }),
+    ),
+    async () => {
+      await c.var.services.settings.updateLocaleSettings(
+        {
+          siteLanguage: body.contentLanguage,
+          dashboardLanguage: body.dashboardLanguage,
+        },
+        {
+          oldLanguage: c.var.appConfig.siteLanguage,
+          oldDashboardLanguage: c.var.appConfig.dashboardLanguage,
+        },
+      );
+    },
+  );
+});
+
+settingsRoutes.post("/language/enable", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(EnableMultilingualSchema, await c.req.json());
 
-  if (languageChanged) {
-    return dsRedirect(publicPath(c, "/settings/general?saved"));
+  try {
+    const { markedCount } = await c.var.services.language.enable(body);
+    return c.json({
+      status: "ok" as const,
+      toast:
+        markedCount > 0
+          ? i18n._(
+              msg({
+                message:
+                  "Multilingual content is on. {count, plural, one {# post was marked} other {# posts were marked}} as {language}.",
+                comment:
+                  "@context: Toast after turning multilingual content on with existing posts",
+              }),
+              // The language's own name, not its tag — the author picked
+              // "繁體中文" in the dialog, not "zh-Hant".
+              {
+                count: markedCount,
+                language: getOrBuildEntry(body.primary).native,
+              },
+            )
+          : i18n._(
+              msg({
+                message: "Multilingual content is on.",
+                comment:
+                  "@context: Toast after turning multilingual content on with no existing posts",
+              }),
+            ),
+    });
+  } catch (error) {
+    if (error instanceof LanguageInUseError) {
+      // Worded for the dialog it lands in: the fix is putting the language
+      // back on the list right there, and the response carries the tag so
+      // the dialog can offer that as one click.
+      return c.json(
+        {
+          error: i18n._(
+            msg({
+              message:
+                "{count, plural, one {# post is} other {# posts are}} written in {language}, which is not on this list. Add it back, or change their language first.",
+              comment:
+                "@context: Refusal in the multilingual dialog when the list drops a language that posts still use",
+            }),
+            {
+              count: error.postCount,
+              language: getOrBuildEntry(error.language).native,
+            },
+          ),
+          code: error.code,
+          language: error.language,
+        },
+        400,
+      );
+    }
+    if (error instanceof DomainError) {
+      return c.json({ error: error.message, code: error.code }, 400);
+    }
+    throw error;
   }
+});
 
-  return dsToast(toast);
+settingsRoutes.post("/language/disable", async (c) => {
+  const i18n = getI18n(c);
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Multilingual content is off. Your languages are still saved.",
+        comment: "@context: Toast after turning multilingual content off",
+      }),
+    ),
+    () => c.var.services.language.disable(),
+  );
+});
+
+settingsRoutes.post("/language/primary", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(LanguageTagSchema, await c.req.json());
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Primary language changed.",
+        comment: "@context: Toast after changing the primary language",
+      }),
+    ),
+    () => c.var.services.language.setPrimary(body.language),
+  );
+});
+
+settingsRoutes.post("/language/add", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(LanguageTagSchema, await c.req.json());
+  return respondToLanguageAction(
+    c,
+    i18n._(
+      msg({
+        message: "Language added.",
+        comment: "@context: Toast after adding a content language",
+      }),
+    ),
+    () => c.var.services.language.addLanguage(body.language),
+  );
+});
+
+settingsRoutes.post("/language/remove", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(LanguageTagSchema, await c.req.json());
+  return respondToLanguageAction(
+    c,
+    // The last language takes the feature with it, and that is the larger of
+    // the two facts — the author leaves this page single-language.
+    ({ multilingualDisabled }) =>
+      multilingualDisabled
+        ? i18n._(
+            msg({
+              message: "Language removed. Multilingual content is off.",
+              comment:
+                "@context: Toast after removing the last additional content language",
+            }),
+          )
+        : i18n._(
+            msg({
+              message: "Language removed.",
+              comment: "@context: Toast after removing a content language",
+            }),
+          ),
+    () => c.var.services.language.removeLanguage(body.language),
+  );
 });
 
 settingsRoutes.post("/general/feeds", async (c) => {
@@ -527,6 +905,88 @@ settingsRoutes.post("/general/home", async (c) => {
   return dsToast(toast);
 });
 
+/**
+ * Announce, because the owner asked.
+ *
+ * The route the settings page offers whenever the directory has not heard from
+ * this site: an announcement that failed, and one that was never made at all.
+ * Sending it is safe at any time — the receiving end treats a repeat as a
+ * no-op for a site it already knows, and it carries nothing but the feed
+ * address.
+ */
+settingsRoutes.post("/general/discover/announce", async (c) => {
+  const i18n = getI18n(c);
+  const { appConfig } = c.var;
+
+  const started =
+    !appConfig.demoMode &&
+    announceInBackground(c, c.var.allSettings["DISCOVER"]);
+
+  const toast = started
+    ? i18n._(
+        msg({
+          message: "Announcing your site. Reload to see the result.",
+          comment:
+            "@context: Toast after sending the Discover announcement. It runs in the background, so the page does not yet know how it went.",
+        }),
+      )
+    : i18n._(
+        msg({
+          message: "This site has no directory to announce to.",
+          comment:
+            "@context: Toast when the Discover announcement cannot be sent because no directory is configured, or the site cannot be listed at all",
+        }),
+      );
+
+  // The settings bridge is the only caller, and it always asks for JSON — a
+  // Datastar toast reaches it as a body it cannot parse, which it reports as a
+  // failed save whatever the server actually did. Every other settings route
+  // answers both shapes; this one has to as well.
+  const wantsJson = c.req.header("accept")?.includes("application/json");
+  if (wantsJson) {
+    return c.json({ status: "ok" as const, toast });
+  }
+
+  return dsToast(toast);
+});
+
+settingsRoutes.post("/general/discover", async (c) => {
+  const i18n = getI18n(c);
+  const body = parseValidated(UpdateDiscoverSettingsSchema, await c.req.json());
+  const { appConfig } = c.var;
+
+  const { shouldAnnounce } =
+    await c.var.services.settings.updateDiscoverSetting(body.discover, {
+      demoMode: appConfig.demoMode,
+    });
+
+  if (shouldAnnounce) {
+    announceInBackground(c, body.discover);
+  }
+
+  const wantsJson = c.req.header("accept")?.includes("application/json");
+  if (wantsJson) {
+    return c.json({
+      status: "ok" as const,
+      toast: i18n._(
+        msg({
+          message: "Site visibility updated.",
+          comment: "@context: Toast after saving the site visibility settings",
+        }),
+      ),
+    });
+  }
+
+  return dsToast(
+    i18n._(
+      msg({
+        message: "Site visibility updated.",
+        comment: "@context: Toast after saving the site visibility settings",
+      }),
+    ),
+  );
+});
+
 settingsRoutes.post("/general/search", async (c) => {
   const i18n = getI18n(c);
   const body = parseValidated(UpdateSearchSettingsSchema, await c.req.json());
@@ -795,7 +1255,7 @@ settingsRoutes.post("/avatar/display", async (c) => {
 settingsRoutes.get("/navigation", async (c) => {
   const [navItems, directoryData, suggestedLinks] = await Promise.all([
     c.var.services.navItems.list(),
-    c.var.services.collections.listDirectoryData(),
+    c.var.services.collections.listDirectoryData({ isAuthenticated: true }),
     c.var.services.navItems.listSuggestedLinks({
       siteOrigin: c.var.appConfig.siteOrigin,
       sitePathPrefix: c.var.appConfig.sitePathPrefix,
@@ -1332,7 +1792,9 @@ settingsRoutes.get("/account/delete-account", async (c) => {
   }
 
   const navData = await getNavigationData(c);
-  const csrfToken = await c.var.services.auth.generateDeleteCsrfToken();
+  const csrfToken = await c.var.services.auth.generateDeleteCsrfToken(
+    requireSessionId(c),
+  );
 
   return renderPublicPage(c, {
     title: buildPageTitle("Delete Account", navData.siteName),
@@ -1390,7 +1852,10 @@ settingsRoutes.post("/account/delete-account", async (c) => {
     );
   }
 
-  const isValid = await c.var.services.auth.validateDeleteCsrfToken(csrfToken);
+  const isValid = await c.var.services.auth.validateDeleteCsrfToken(
+    csrfToken,
+    requireSessionId(c),
+  );
   if (!isValid) {
     return dsToast(
       i18n._(
@@ -1404,11 +1869,26 @@ settingsRoutes.post("/account/delete-account", async (c) => {
     );
   }
 
+  // Sign the browser out first. Every row behind this session is about to
+  // disappear, and better-auth's cookie cache would keep answering "signed in"
+  // from the browser's own copy for minutes afterwards — a ticket to a site
+  // that no longer exists, handed to whoever completes the next setup.
+  let signOutHeaders: Headers | undefined;
+  try {
+    const signedOut = await c.var.auth.api.signOut({
+      headers: c.req.raw.headers,
+      asResponse: true,
+    });
+    signOutHeaders = signedOut.headers;
+  } catch {
+    // The wipe below removes the session either way.
+  }
+
   await c.var.services.auth.deleteAllData({
     storage: c.var.storage,
   });
 
-  return dsRedirect(publicPath(c, "/setup"));
+  return dsRedirect(publicPath(c, "/setup"), { headers: signOutHeaders });
 });
 
 // ===========================================================================
@@ -1619,6 +2099,49 @@ settingsRoutes.post("/github-sync/disconnect", async (c) => {
 // GitHub App install flow
 // ---------------------------------------------------------------------------
 
+/**
+ * Recreate installation bindings for sites that sync through the App
+ * but have no row to prove it.
+ *
+ * GitHub is the only source for the account behind an installation id,
+ * so the repair costs one call per distinct id — bounded by how many
+ * sites the author has, and only ever reached when they would otherwise
+ * be shown a GitHub page that cannot lead anywhere. Ids GitHub no longer
+ * recognizes are skipped: an uninstalled App has nothing to rebuild.
+ */
+async function rebuildInstallationBindings(
+  c: Context<Env>,
+  app: import("../../lib/env.js").GitHubAppEnvConfig,
+  userId: string,
+): Promise<void> {
+  const syncing =
+    await c.var.services.githubAppInstallations.listSyncingInstallationsForUser(
+      userId,
+    );
+  if (syncing.length === 0) return;
+
+  const accounts = new Map<string, InstallationAccount>();
+  for (const { installationId } of syncing) {
+    if (accounts.has(installationId)) continue;
+    try {
+      const installation = await getInstallation(app, installationId);
+      accounts.set(installationId, installation.account);
+    } catch {
+      continue;
+    }
+  }
+
+  for (const { siteId, installationId } of syncing) {
+    const account = accounts.get(installationId);
+    if (!account) continue;
+    await c.var.services.githubAppInstallations.upsertInstallation(
+      installationId,
+      siteId,
+      account,
+    );
+  }
+}
+
 /**
  * Redirect the user to GitHub to install the App on their account/org.
  *
@@ -1631,26 +2154,46 @@ settingsRoutes.get("/github-sync/app/install", async (c) => {
     return c.text("GitHub App is not configured on this deployment.", 404);
   }
 
-  // Reinstall-same-account predicate (§5): when this site already has at
-  // least one authorized installation, skip the GitHub round-trip and
-  // render the picker directly. The GitHub redirect is a dead end when
-  // the App is already installed on the chosen account — GitHub shows
-  // its Configure page and never comes back with installation_id.
+  // Reinstall-same-account predicate: when the signed-in author has
+  // already authorized an installation — on this site or on any other
+  // site they belong to — skip the GitHub round-trip and render the
+  // picker directly. The GitHub redirect is a dead end once the App is
+  // installed on the chosen account: GitHub shows its Configure page
+  // and never comes back with installation_id.
+  //
+  // The scope is the user's sites rather than this one because a GitHub
+  // App installs once per GitHub account. An author connecting their
+  // second blog to the same account has no binding here yet and cannot
+  // create one through GitHub, so site-scoping this check would leave
+  // them with no way in at all.
   //
   // `?force=new` bypasses the predicate so the picker's "Install on
   // another account" action can still reach GitHub to add a fresh
   // install.
   const forceNew = c.req.query("force") === "new";
   if (!forceNew) {
-    const existing =
-      await c.var.services.githubAppInstallations.listInstallationsForSite(
-        c.var.currentSite.id,
+    const userId = requireSessionUserId(c);
+    let existing =
+      await c.var.services.githubAppInstallations.listInstallationsForUser(
+        userId,
       );
+    // An author with nothing to show but a site already syncing through
+    // the App is in the one state the redirect cannot rescue: GitHub
+    // will not install the App a second time on that account. Rebuild
+    // the binding from the sync settings instead of sending them into
+    // the dead end.
+    if (existing.length === 0) {
+      await rebuildInstallationBindings(c, app, userId);
+      existing =
+        await c.var.services.githubAppInstallations.listInstallationsForUser(
+          userId,
+        );
+    }
     if (existing.length > 0) {
       const navData = await getNavigationData(c);
       const base = publicPath(c, "/settings/github-sync");
-      const labels = buildRepoPickerLabels(c);
-      const suggestedRepoName = buildSuggestedRepoName(c);
+      const suggestedRepoName = suggestSyncRepoName(c.var.appConfig.siteUrl);
+      const labels = buildRepoPickerLabels(c, suggestedRepoName);
       return renderPublicPage(c, {
         title: buildPageTitle(
           "GitHub Sync — Pick Repository",
@@ -1748,19 +2291,17 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
     }
   }
 
-  // One-shot: clear the cookie so it can't be replayed.
-  setCookie(c, "jant_gh_app_state", "", {
-    httpOnly: true,
-    sameSite: "Lax",
-    path: "/",
-    maxAge: 0,
-  });
-
   // Fetch the account info for this installation and remember it. The
-  // picker's owner dropdown reads the stored list, so subsequent visits
-  // can switch between accounts without re-running the install flow.
-  // Failures are non-fatal: this callback must still render the picker
-  // so the user isn't locked out right after a successful install.
+  // binding is what every later step reads: the picker's account
+  // dropdown, the endpoints that authorize an installation id, and the
+  // App webhook's fan-out. Rendering the picker without it would show an
+  // empty account list and nothing to pick.
+  //
+  // So a failure here has to stay recoverable, and the only thing that
+  // makes this page replayable is the state cookie — GitHub will not
+  // hand out a second callback for an App that is now installed. Hence
+  // the clearing below sits *after* the binding is written: until then,
+  // reloading this URL is the whole retry.
   try {
     const installation = await getInstallation(app, installationId);
     await c.var.services.githubAppInstallations.upsertInstallation(
@@ -1769,14 +2310,24 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
       installation.account,
     );
   } catch {
-    // Swallow — the legacy inline picker still works with just the
-    // installation_id from the URL, just without the owner list.
+    return c.text(
+      "The App was installed, but GitHub did not answer with the account details. Reload this page to try again.",
+      502,
+    );
   }
 
+  // One-shot: clear the cookie so it can't be replayed.
+  setCookie(c, "jant_gh_app_state", "", {
+    httpOnly: true,
+    sameSite: "Lax",
+    path: "/",
+    maxAge: 0,
+  });
+
   const navData = await getNavigationData(c);
   const base = publicPath(c, "/settings/github-sync");
-  const labels = buildRepoPickerLabels(c);
-  const suggestedRepoName = buildSuggestedRepoName(c);
+  const suggestedRepoName = suggestSyncRepoName(c.var.appConfig.siteUrl);
+  const labels = buildRepoPickerLabels(c, suggestedRepoName);
 
   return renderPublicPage(c, {
     title: buildPageTitle("GitHub Sync — Pick Repository", navData.siteName),
@@ -1792,7 +2343,7 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
           labels={labels}
           api-base={`${base}/app`}
           connect-url={`${base}/app/connect`}
-          install-url={`${base}/app/install`}
+          install-url={`${base}/app/install?force=new`}
           cancel-url={publicPath(c, "/settings")}
           create-repo-name-hint={suggestedRepoName}
         >
@@ -1810,29 +2361,36 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
 });
 
 /**
- * Derive a default repository name to prefill on github.com/new.
+ * Values that keep a placeholder literal for the client to fill in.
  *
- * Uses the site's host — the first DNS label is a stable, URL-safe
- * identifier tied to this specific Jant instance. Fallback to
- * "jant-site-sync" when the host parse fails so we never hand GitHub an
- * empty `name=`. The `-jant-sync` suffix disambiguates the sync mirror
- * from a user's own `{slug}-jant` source repo.
+ * `i18n._()` renders a placeholder it has no value for as an empty string, so
+ * a label whose value only exists in the browser — a repo count, the picked
+ * repo — must be formatted with the placeholder's own token as its value.
+ * `{repo}` then survives into the serialized labels and the component's
+ * `.replace("{repo}", …)` finds it.
+ *
+ * @param names - Placeholder names the client interpolates.
+ * @returns A values object mapping each name to its own `{name}` token.
+ * @example
+ * i18n._(msg({ message: "Type {repo} to confirm" }), keepForClient("repo"));
+ * // "Type {repo} to confirm"
  */
-function buildSuggestedRepoName(c: Context<Env>): string {
-  let firstLabel = "";
-  try {
-    firstLabel = new URL(c.var.appConfig.siteUrl).host.split(".")[0] ?? "";
-  } catch {
-    /* fall through */
-  }
-  const slug = firstLabel
-    .toLowerCase()
-    .replace(/[^a-z0-9-_]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-  return slug ? `${slug}-jant-sync` : "jant-site-sync";
+function keepForClient(...names: string[]): Record<string, string> {
+  return Object.fromEntries(names.map((name) => [name, `{${name}}`]));
 }
 
-function buildRepoPickerLabels(c: Context<Env>): string {
+/**
+ * Serialize the picker's strings for the client component.
+ *
+ * @param c - Request context, for the active locale.
+ * @param suggestedRepoName - Repository name prefilled on github.com/new;
+ *   interpolated here because the client cannot format ICU messages.
+ * @returns The labels as a JSON string for the `labels` attribute.
+ */
+function buildRepoPickerLabels(
+  c: Context<Env>,
+  suggestedRepoName: string,
+): string {
   const i18n = getI18n(c);
   return JSON.stringify({
     pageTitle: i18n._(
@@ -1919,6 +2477,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — paginated repo count hint. Placeholders {shown} and {total} are integers.",
       }),
+      keepForClient("shown", "total"),
     ),
     repoSearchHint: i18n._(
       msg({
@@ -1943,10 +2502,12 @@ function buildRepoPickerLabels(c: Context<Env>): string {
     ),
     createOnGitHubHint: i18n._(
       msg({
-        message: "We'll prefill the name {name}. The list refreshes on return.",
+        message:
+          "Name prefilled as {name}. The list refreshes when you return.",
         comment:
           "@context: GitHub sync picker — hint under the create-on-github entry. Placeholder {name} is the suggested repo name.",
       }),
+      { name: suggestedRepoName },
     ),
     classifyLoading: i18n._(
       msg({
@@ -1976,6 +2537,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — blocking message when marker belongs to another site. Placeholder {host} is the other site's host.",
       }),
+      keepForClient("host"),
     ),
     classificationForeign: i18n._(
       msg({
@@ -1998,6 +2560,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — explanatory body for foreign-repo confirmation. Placeholder {repo} is the owner/repo slug.",
       }),
+      keepForClient("repo"),
     ),
     confirmInputLabel: i18n._(
       msg({
@@ -2005,6 +2568,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — label above the typed-confirmation input",
       }),
+      keepForClient("repo"),
     ),
     confirmInputPlaceholder: i18n._(
       msg({
@@ -2083,6 +2647,16 @@ settingsRoutes.post("/github-sync/app/connect", async (c) => {
       : c.text("Missing installationId or repo.", 400);
   }
 
+  // The installation has to be one the author already authorized, here
+  // or on another of their sites. The account snapshot also spares us a
+  // GitHub round-trip when recording the binding further down.
+  const installation = await findVisibleInstallation(c, installationId);
+  if (!installation) {
+    return wantsJson
+      ? c.json({ error: "Unknown installation." }, 404)
+      : c.text("Unknown installation.", 404);
+  }
+
   const { parseRepoSlug, createGitHubClient } =
     await import("../../lib/github-api.js");
   const parsed = parseRepoSlug(repo);
@@ -2143,6 +2717,18 @@ settingsRoutes.post("/github-sync/app/connect", async (c) => {
       : c.text(msg, 409);
   }
 
+  // Bind the installation to this site. The callback does this too, but
+  // only for the site that ran the install; connecting a second site to
+  // an installation the author already has is exactly the case that
+  // never passes through there. Without the row, the App-level webhook's
+  // fan-out (uninstall, suspend, repository removed) skips this site
+  // while it happily keeps syncing.
+  await c.var.services.githubAppInstallations.upsertInstallation(
+    installationId,
+    c.var.currentSite.id,
+    installation.account,
+  );
+
   // Persist config before creating webhook so the sync service can load it.
   await c.var.services.settings.set("GITHUB_SYNC_AUTH_MODE", "app");
   await c.var.services.settings.set(
@@ -2227,21 +2813,38 @@ async function getInstallationTokenFromApp(
   return getInstallationToken(app, installationId);
 }
 
-/** List GitHub App installations authorized for this site. */
+/**
+ * List the GitHub App installations the signed-in author may connect
+ * this site to: everything authorized on any site they belong to, this
+ * one included.
+ */
 settingsRoutes.get("/github-sync/app/installations", async (c) => {
   const installations =
-    await c.var.services.githubAppInstallations.listInstallationsForSite(
-      c.var.currentSite.id,
+    await c.var.services.githubAppInstallations.listInstallationsForUser(
+      requireSessionUserId(c),
     );
-  return c.json({
-    installations: installations.map((entry) => ({
-      installationId: entry.installationId,
-      account: entry.account,
-      addedAt: entry.addedAt,
-    })),
-  });
+  return c.json({ installations });
 });
 
+/**
+ * Resolve an `installationId` that arrived in a request into an
+ * installation the caller is allowed to act on.
+ *
+ * Every endpoint below takes the id from the client, and an installation
+ * id is a small integer — without this check a signed-in author on one
+ * site could name another tenant's installation and read their private
+ * repository names, or push this site's content into one of their repos.
+ */
+async function findVisibleInstallation(
+  c: Context<Env>,
+  installationId: string,
+) {
+  return c.var.services.githubAppInstallations.findInstallationForUser(
+    installationId,
+    requireSessionUserId(c),
+  );
+}
+
 /**
  * List (or search) repositories accessible via an installation.
  *
@@ -2266,18 +2869,13 @@ settingsRoutes.get("/github-sync/app/repos", async (c) => {
   const page =
     Number.isFinite(pageParam) && pageParam > 0 ? Math.floor(pageParam) : 1;
 
+  const installation = await findVisibleInstallation(c, installationId);
+  if (!installation) {
+    return c.json({ error: "Unknown installation." }, 404);
+  }
+
   try {
     if (q) {
-      const installations =
-        await c.var.services.githubAppInstallations.listInstallationsForSite(
-          c.var.currentSite.id,
-        );
-      const installation = installations.find(
-        (i) => i.installationId === installationId,
-      );
-      if (!installation) {
-        return c.json({ error: "Unknown installation." }, 404);
-      }
       const result = await searchInstallationRepos(
         app,
         installationId,
@@ -2304,11 +2902,13 @@ settingsRoutes.get("/github-sync/app/repos", async (c) => {
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     // GitHub returns 401 when an installation was uninstalled on their
-    // side. Clean up our cached entry so the UI stops showing a dead owner.
+    // side. Clean up our cached entries so the UI stops showing a dead
+    // owner — across the user's sites, since the binding that surfaced
+    // this account may well belong to another one of them.
     if (/\b401\b/.test(detail) || /\b404\b/.test(detail)) {
-      await c.var.services.githubAppInstallations.removeInstallation(
+      await c.var.services.githubAppInstallations.removeInstallationForUser(
         installationId,
-        c.var.currentSite.id,
+        requireSessionUserId(c),
       );
       return c.json(
         { error: "Installation is no longer accessible.", removed: true },
@@ -2338,6 +2938,9 @@ settingsRoutes.post("/github-sync/app/classify", async (c) => {
   if (!installationId || !repo) {
     return c.json({ error: "Missing installationId or repo." }, 400);
   }
+  if (!(await findVisibleInstallation(c, installationId))) {
+    return c.json({ error: "Unknown installation." }, 404);
+  }
 
   const { parseRepoSlug, createGitHubClient } =
     await import("../../lib/github-api.js");