@jini-ai/cms 0.5.2 → 0.5.4

package/dist/seo/seo.js

@@ -0,0 +1,230 @@
+import { resolveWorkspaceOrigin, toAbsoluteUrl } from "./absolute-url.js";
+import { SeoEntryNotFoundError } from "./errors.js";
+import { resolveSeoImageRef } from "./media.js";
+/** Featured image (2026-10-05) as a share-image ref: the core "public" transform every `/m/` URL
+ *  already serves (`deps.ts`'s ADR-027 §4 registration). */
+function featuredImageRef(post) {
+    return post.featuredMediaId ? `${post.featuredMediaId}:public` : undefined;
+}
+/**
+ * @file `getEntryMeta`/`analyzeEntry` (ADR-PIPE-008 Decision, C-001/C-002) —
+ * the pure effective-meta evaluator, per-field precedence (behavior.spec.md
+ * §1.1): override ▸ site default ▸ derived. Consumed by the
+ * admin preview, the public render (via `page-head-contributor.ts`), and
+ * `analyzeEntry` — the one evaluator, no back door (INV-09). Never writes
+ * anything — reads only, via injected deps.
+ * The public home render supplies its configured site title as a fallback below explicit SEO
+ * overrides; consumers without that render context retain the entry-title template.
+ */
+export const SEO_NAMESPACE = "site.seo";
+/** Content-type -> JSON-LD `@type` map (behavior.spec.md §1.1/§3; REQ-07). */
+const CONTENT_TYPE_SCHEMA_MAP = {
+    post: "Article",
+    page: "WebPage",
+};
+function isJsonObjectLike(value) {
+    return typeof value === "object" && value !== null;
+}
+/** Plain-text extraction over a TipTap/ProseMirror-style doc (for the derived-excerpt fallback). */
+function extractPlainText(node) {
+    if (!isJsonObjectLike(node))
+        return "";
+    const parts = [];
+    if (typeof node.text === "string")
+        parts.push(node.text);
+    if (Array.isArray(node.content)) {
+        for (const child of node.content)
+            parts.push(extractPlainText(child));
+    }
+    return parts.join(" ");
+}
+const EXCERPT_MAX_LENGTH = 160;
+/** override > site default > derived excerpt (behavior.spec.md §1.1). Derivation reads whichever
+ *  body column `bodyFormat` says is live — `bodyJson` (TipTap doc) or `bodyHtml` (bespoke-HTML
+ *  Page, SPEC-047/ADR-056 Decision 3) — so an html-format Page gets a real excerpt instead of
+ *  silently resolving to `undefined`. Exported for the RSS feed (`feed.ts`), whose item description
+ *  is the post's own excerpt, never the site-wide default. */
+export function deriveExcerpt(required, _optional = {}) {
+    const { post, postRepo } = required;
+    const rawText = post.bodyFormat === "html" ? postRepo.extractPlainText({ html: post.bodyHtml ?? "" }) : extractPlainText(post.bodyJson);
+    const text = rawText.replace(/\s+/g, " ").trim();
+    if (!text)
+        return undefined;
+    return text.length > EXCERPT_MAX_LENGTH ? `${text.slice(0, EXCERPT_MAX_LENGTH).trim()}…` : text;
+}
+function parseOverrides(post) {
+    if (!post.seoExtJson)
+        return {};
+    try {
+        return JSON.parse(post.seoExtJson);
+    }
+    catch {
+        return {};
+    }
+}
+/** canonical: override (accepted cross-domain as-is, EC-10) > routing-resolved > bare path — then
+ *  joined onto the workspace's verified origin ({@link toAbsoluteUrl}) so the result is always an
+ *  absolute URL. A relative override (an author who typed `/pricing` rather than a full URL) is
+ *  absolutized the same way; an already-absolute override (the intended EC-10 case) passes through
+ *  {@link toAbsoluteUrl} unchanged. No local origin is ever invented (INV-07's real intent — the
+ *  origin comes only from `OriginRegistryPort`, never a guess): with no verified origin registered
+ *  yet, `origin` is `undefined` and this degrades to the bare relative path, same as before this
+ *  fix existed. */
+async function resolveCanonical(deps, post, overrides, workspaceId, origin) {
+    const routed = await deps.urls.urlFor({
+        target: { kind: "entryRef", entryId: post.id, contentType: post.kind },
+        ctx: { workspaceId },
+    });
+    return toAbsoluteUrl({ origin, path: overrides.canonical ?? routed?.canonicalUrl ?? deps.urls.postPublicPath({ slug: post.slug }) });
+}
+/** robots: override > site default > derived (draft-safety fallback for noindex, EC-11). */
+async function resolveRobots(deps, post, overrides, settings, workspaceId) {
+    let noindex;
+    if (overrides.noindex !== undefined) {
+        noindex = overrides.noindex;
+    }
+    else if (await deps.settings.isDefaultRobotsNoindexExplicitlySet({ workspaceId })) {
+        noindex = settings.defaultRobots.noindex;
+    }
+    else {
+        // 2026-09-05 fix: `softDelete` (post.ts) stamps only `deletedAt`/`updatedAt`/`version` — it
+        // never clears `status`, so a post that was `published` when trashed stays `status:
+        // "published"` forever and the status check alone can't catch it. `postRepo.findById` (this
+        // function's own read, above) is documented trash-BLIND, so this derived fallback must check
+        // `isTrashed` itself, same as `computeIndexableEntries` (sitemap.ts) and
+        // `scanEntriesForAsset` (media-rendition.ts) already do at their own read
+        // boundaries. `getEntryMeta` is "the one evaluator, no back door" for admin preview, public
+        // render, and `analyzeEntry` alike (this file's header) — a trashed entry must resolve
+        // noindex:true through every one of those consumers, not just the ones that happen to gate
+        // trash upstream before calling in.
+        // Scheduled publishing (2026-10-05): a not-yet-live scheduled row is noindex like a draft.
+        noindex = post.status !== "published" || deps.postRepo.isTrashed({ post }) || deps.liveness.isScheduledAt({ post, nowIso: deps.clock.nowIso() });
+    }
+    const nofollow = overrides.nofollow ?? settings.defaultRobots.nofollow ?? false;
+    return { noindex, nofollow };
+}
+/** The first of `refs` that resolves through media, or `undefined`. @complexity O(r) resolves. */
+async function firstResolvedImage(deps, workspaceId, refs) {
+    for (const ref of refs) {
+        const resolved = ref ? await resolveSeoImageRef({ deps: deps.media, input: { workspaceId, ref } }) : undefined;
+        if (resolved)
+            return resolved;
+    }
+    return undefined;
+}
+/** openGraph/twitter image refs resolve through media (fail-soft, EC-07), then joined onto the
+ *  workspace's verified origin ({@link toAbsoluteUrl}) — `resolveSeoImageRef` returns either an
+ *  already-absolute ref (passed through unchanged) or the site-relative `/m/{assetId}/...` URL
+ *  contract (ADR-027 §4), which needs the same absolutizing every other SEO URL does; crawlers
+ *  require `og:image` to be absolute, same as `og:url`. */
+async function resolveShareImages(deps, post, overrides, settings, workspaceId, origin) {
+    // Precedence: explicit per-entry override > the entry's featured image > the site default. An
+    // override is final (unresolved means no image, as before); a featured image that no longer
+    // resolves (trashed, deleted) falls through to the site default rather than leaving none.
+    const fallbacks = [featuredImageRef(post), settings.defaultOgImage];
+    const ogImageResolved = await firstResolvedImage(deps, workspaceId, overrides.ogImage ? [overrides.ogImage] : fallbacks);
+    const twitterImageResolved = await firstResolvedImage(deps, workspaceId, overrides.twitterImage ? [overrides.twitterImage] : fallbacks);
+    return {
+        ogImage: ogImageResolved ? toAbsoluteUrl({ origin, path: ogImageResolved }) : undefined,
+        twitterImage: twitterImageResolved ? toAbsoluteUrl({ origin, path: twitterImageResolved }) : undefined,
+    };
+}
+/** title: override, else titleTemplate applied to entry.title. description: override > site default >
+ *  derived excerpt > omitted. */
+function resolveTitleAndDescription(post, overrides, settings, postRepo) {
+    // title is never empty — entry.title is itself validated non-empty at the post write
+    // chokepoint, and %s substitution never drops it.
+    const title = overrides.title ?? settings.titleTemplate.replaceAll("%s", post.title);
+    const description = overrides.description ?? settings.defaultDescription ?? deriveExcerpt({ post, postRepo });
+    return { title, description };
+}
+/** ogType/schemaType (REQ-07): override, else derived from the entry's content kind. */
+function resolveContentTypeFields(post, overrides) {
+    const ogType = overrides.ogType ?? (post.kind === "page" ? "website" : "article");
+    const schemaType = overrides.schemaType ?? CONTENT_TYPE_SCHEMA_MAP[post.kind];
+    return { ogType, schemaType };
+}
+function buildOpenGraph(overrides, title, description, ogType, canonical, ogImage) {
+    return {
+        title: overrides.ogTitle ?? title,
+        description: overrides.ogDescription ?? description,
+        type: ogType,
+        url: canonical,
+        image: ogImage,
+        siteName: undefined,
+    };
+}
+function buildTwitter(overrides, title, description, twitterImage, settings) {
+    return {
+        card: overrides.twitterCard ?? "summary_large_image",
+        title: overrides.twitterTitle ?? title,
+        description: overrides.twitterDescription ?? description,
+        image: twitterImage,
+        site: settings.twitterSite,
+    };
+}
+/** JSON-LD `@type` (REQ-07) plus the headline/name field, which differs by content kind. */
+function buildJsonLdEntry(post, schemaType, title, description) {
+    const jsonLdEntry = {
+        "@context": "https://schema.org",
+        "@type": schemaType,
+        ...(post.kind === "post" ? { headline: title } : { name: title }),
+    };
+    if (description)
+        jsonLdEntry.description = description;
+    return jsonLdEntry;
+}
+/**
+ * Resolves the effective `SeoMeta` for one entry (override ▸ site default ▸
+ * derived, per field — behavior.spec.md §1.1). Never partial.
+ * The public head contributor can supply `homeTitle` for the root page; callers that omit it
+ * retain the entry-title template. Explicit SEO/share-title overrides still win.
+ *
+ * @complexity O(1) — one post read, one settings resolution (8 bounded
+ * `getEffective` reads), up to 2 media lookups, one origin lookup (2026-09-03,
+ * absolute-URL fix — {@link resolveWorkspaceOrigin}).
+ */
+export async function getEntryMeta(required, _optional = {}) {
+    const { deps, input } = required;
+    const post = await deps.postRepo.findById({ workspaceId: input.workspaceId, id: input.entryId });
+    if (!post)
+        throw new SeoEntryNotFoundError(`entry '${input.entryId}' was not found`);
+    const overrides = parseOverrides(post);
+    const settings = await deps.settings.getSeoSettings({ workspaceId: input.workspaceId });
+    const origin = await resolveWorkspaceOrigin({ originRegistry: deps.originRegistry, workspaceId: input.workspaceId, runtimeMode: deps.runtimeMode });
+    const { title: entryTitle, description } = resolveTitleAndDescription(post, overrides, settings, deps.postRepo);
+    const title = overrides.title ?? input.homeTitle ?? entryTitle;
+    const canonical = await resolveCanonical(deps, post, overrides, input.workspaceId, origin);
+    const { noindex, nofollow } = await resolveRobots(deps, post, overrides, settings, input.workspaceId);
+    const { ogImage, twitterImage } = await resolveShareImages(deps, post, overrides, settings, input.workspaceId, origin);
+    const { ogType, schemaType } = resolveContentTypeFields(post, overrides);
+    return {
+        title,
+        description,
+        canonical,
+        robots: { noindex, nofollow },
+        openGraph: buildOpenGraph(overrides, title, description, ogType, canonical, ogImage),
+        twitter: buildTwitter(overrides, title, description, twitterImage, settings),
+        jsonLd: [buildJsonLdEntry(post, schemaType, title, description)],
+    };
+}
+/** REQ-14 — SEO analysis over `getEntryMeta`'s resolved result (pure decision, no additional I/O). */
+export async function analyzeEntry(required, _optional = {}) {
+    const { deps, input } = required;
+    const resolved = await getEntryMeta({ deps, input });
+    const issues = [];
+    if (!resolved.title) {
+        issues.push({ code: "missing_title", severity: "error", message: "Title is missing.", field: "title" });
+    }
+    if (!resolved.description) {
+        issues.push({
+            code: "missing_description",
+            severity: "warning",
+            message: "Description is missing.",
+            field: "description",
+        });
+    }
+    const score = issues.length === 0 ? 100 : Math.max(0, 100 - issues.length * 20);
+    return { entryId: input.entryId, score, issues, resolved };
+}
+//# sourceMappingURL=seo.js.map

package/dist/seo/sitemap.d.ts

@@ -0,0 +1,139 @@
+import type { EventBusPort, OutboxPort } from "../core/index.js";
+import type { UUID } from "@jini-ai/core/primitives";
+import type { SeoPostRecord as PostRecord, SeoPostListPort, SeoSettingsReaderPort } from "./ports.js";
+import type { OriginRegistryPort } from "@jini-ai/http-kit/verified-origin";
+import { type GetEntryMetaDeps } from "./seo.js";
+import type { RobotsPolicy, SeoMeta, SitemapEntry } from "./types.js";
+import type { SeoEventSubscriptions, SitemapCollectHook } from "./ports.js";
+export interface SeoSitemapDeps extends GetEntryMetaDeps {
+    postRepo: SeoPostListPort;
+    /**
+     * Whether an anonymous, unauthenticated crawler could actually read this post — the sitemap's own
+     * visibility bar. `sitemap.xml` has no per-visitor concept at all (it is a single cache-backed
+     * document served identically to every requester, ADR-PIPE-008 Decision §5/§7 above), so "would
+     * THIS caller be let in" collapses to the one case that matters here: would ANY anonymous caller.
+     * `resolvePostMemberAccess(json).visibility === "public"` is exactly that: every other visibility
+     * (`members`/`paid`/`tiers`, and the fail-closed `unknown_visibility` default for malformed JSON)
+     * denies an unauthenticated `MemberContext` in `access-resolver.ts`'s own `decide()` — this is the
+     * same decision restated without needing that resolver's session/subscription/tier repo ports,
+     * which this cache-backed, session-blind build path has no reason to carry.
+     *
+     * @complexity O(1) — `resolvePostMemberAccess` is one `JSON.parse` of a small, editorial string.
+     */
+    isPubliclyAccessible(required: {
+        post: PostRecord;
+    }): boolean;
+}
+/** One publish-eligible, indexable entry: the raw post row plus its fully-resolved `SeoMeta`
+ *  (title/description/canonical/robots — everything {@link getEntryMeta} computes). */
+export interface IndexableEntry {
+    readonly post: PostRecord;
+    readonly meta: SeoMeta;
+}
+/**
+ * The single publish/visibility/indexability filter every public SEO document is built from
+ * (INV-04/05): never a non-`published` post, never a members/paid/tiers-gated one
+ * ({@link isPubliclyVisible}, ADR-030 §4), never an effective-`noindex` one. Returns the full
+ * resolved `SeoMeta` per entry (not just `loc`/`lastmod`) so a consumer that needs a title or
+ * description — `llms.txt` (`routes/site/llms.ts`), which `SitemapEntry` can't supply one for —
+ * reads it from the same evaluator `sitemap.xml` does, instead of re-deriving a second, subtly
+ * different notion of "published and indexable."
+ *
+ * @complexity O(n) in the workspace's post count, each with one bounded `getEntryMeta` resolution
+ *   (see that function's own complexity note).
+ */
+export declare function computeIndexableEntries(required: {
+    deps: SeoSitemapDeps;
+    input: {
+        workspaceId: UUID;
+        nowIso?: string;
+    };
+}, _optional?: Record<string, never>): Promise<IndexableEntry[]>;
+/**
+ * REQ-09 — composes `RobotsPolicy` from `SeoSettings.robotsRules` +
+ * computed `sitemapUrls` (never persisted as one shape — computed fresh at
+ * read time). `sitemapUrls` is `[]` when `sitemapEnabled` is `false`.
+ *
+ * 2026-09-04 fix: the advertised sitemap URL is joined onto the workspace's
+ * verified origin ({@link toAbsoluteUrl}, via {@link resolveWorkspaceOrigin}),
+ * the same wiring `getEntryMeta`'s `canonical`/`og:url` already use (the
+ * `ADR-040` origin-resolution source this doc used to say didn't exist yet —
+ * `features/origin`'s `OriginRegistryPort` — landed on 2026-09-03). Google
+ * ignores a relative `Sitemap:` directive, so a bare `/sitemap.xml` made the
+ * sitemap undiscoverable to crawlers even though `<loc>` entries inside it
+ * were already absolute. Degrades to the same bare relative path as before
+ * when no verified origin is registered yet — SEO still never fabricates a
+ * local origin (INV-07), consistent with `getEntryMeta`'s own fallback.
+ */
+export declare function buildRobots(required: {
+    deps: {
+        settings: SeoSettingsReaderPort;
+        originRegistry: OriginRegistryPort;
+        runtimeMode: string;
+    };
+    input: {
+        workspaceId: UUID;
+    };
+}, _optional?: Record<string, never>): Promise<RobotsPolicy>;
+export declare const SITEMAP_INVALIDATED_EVENT = "seo.sitemap_invalidated";
+/** The daemon enqueues through its enqueue-only outbox; the web process owns delivery.
+ * Local invalidation also prevents reads in this process from seeing the old snapshot. */
+export interface SitemapInvalidationDeps {
+    outbox: OutboxPort;
+    bus: EventBusPort;
+    clock: {
+        nowIso(): string;
+    };
+    idGen: {
+        newId(): string;
+    };
+    dispatch(required: {
+        outbox: OutboxPort;
+        bus: EventBusPort;
+        clock: {
+            nowMs(): number;
+        };
+    }): Promise<unknown>;
+    invalidateSitemapCache(required: {
+        workspaceId: UUID;
+    }): void | Promise<void>;
+}
+export declare function requestSitemapInvalidation(required: {
+    deps: SitemapInvalidationDeps;
+    input: {
+        workspaceId: UUID;
+    };
+}, _optional?: Record<string, never>): Promise<void>;
+/** Each service owns its hooks, build generations, cache and scheduled expiry; hosts never share state accidentally. */
+export declare function createSitemapService(required: {
+    deps: SeoSitemapDeps;
+}, _optional?: Record<string, never>): {
+    registerSitemapCollectHook: (required: {
+        hook: SitemapCollectHook;
+    }, _optional?: Record<string, never>) => () => void;
+    resetSitemapCollectHooksForTests: (_required: Record<string, never>, _optional?: Record<string, never>) => void;
+    buildSitemap: (input: {
+        workspaceId: UUID;
+    }, _optional?: Record<string, never>) => Promise<SitemapEntry[]>;
+    regenerateSitemapCache: (input: {
+        workspaceId: UUID;
+    }, _optional?: Record<string, never>) => Promise<void>;
+    invalidateSitemapCache: (input: {
+        workspaceId: UUID;
+    }, _optional?: Record<string, never>) => void;
+    createSeoEventSubscriptions: (_required: Record<string, never>, _optional?: Record<string, never>) => SeoEventSubscriptions;
+    computeIndexableEntries: (input: {
+        workspaceId: UUID;
+        nowIso?: string;
+    }, optional?: Record<string, never>) => Promise<IndexableEntry[]>;
+    buildRobots: (input: {
+        workspaceId: UUID;
+    }, optional?: Record<string, never>) => Promise<RobotsPolicy>;
+    requestSitemapInvalidation: (required: {
+        deps: Omit<SitemapInvalidationDeps, "invalidateSitemapCache">;
+        input: {
+            workspaceId: UUID;
+        };
+    }, optional?: Record<string, never>) => Promise<void>;
+};
+//# sourceMappingURL=sitemap.d.ts.map

package/dist/seo/sitemap.js

@@ -0,0 +1,217 @@
+import { resolveWorkspaceOrigin, toAbsoluteUrl } from "./absolute-url.js";
+import { getEntryMeta } from "./seo.js";
+/**
+ * @file `buildSitemap`/`buildRobots`/`regenerateSitemapCache`/
+ * `invalidateSitemapCache` (ADR-PIPE-008 Decision §5/§7, C-008..C-011) — a
+ * cache-backed sitemap/robots build over an in-module `Map<string,string>`
+ * (no new `CachePort` — none exists in this codebase and none is warranted
+ * for a single workspace-keyed value, ADR-006). Never leaks non-published or
+ * `noindex` entries (INV-04/05). The empty `seo.sitemap.collect` registry
+ * (OQ-01) ships live-but-empty — a real seam, zero real registrants in v1.
+ */
+/** INV-08 — always this shape; the only file that constructs the cache key. */
+function cacheKey(workspaceId) {
+    return `ws:${workspaceId}:seo:sitemap`;
+}
+/**
+ * The single publish/visibility/indexability filter every public SEO document is built from
+ * (INV-04/05): never a non-`published` post, never a members/paid/tiers-gated one
+ * ({@link isPubliclyVisible}, ADR-030 §4), never an effective-`noindex` one. Returns the full
+ * resolved `SeoMeta` per entry (not just `loc`/`lastmod`) so a consumer that needs a title or
+ * description — `llms.txt` (`routes/site/llms.ts`), which `SitemapEntry` can't supply one for —
+ * reads it from the same evaluator `sitemap.xml` does, instead of re-deriving a second, subtly
+ * different notion of "published and indexable."
+ *
+ * @complexity O(n) in the workspace's post count, each with one bounded `getEntryMeta` resolution
+ *   (see that function's own complexity note).
+ */
+export async function computeIndexableEntries(required, _optional = {}) {
+    const { deps, input } = required;
+    const { workspaceId } = input;
+    const nowIso = input.nowIso ?? deps.clock.nowIso();
+    const posts = [...(await deps.postRepo.list({ workspaceId }))].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const entries = [];
+    for (const post of posts) {
+        if (post.status !== "published")
+            continue;
+        // Scheduled publishing (2026-10-05): not in sitemap/feed/llms.txt until its go-live time.
+        if (deps.liveness.isScheduledAt({ post, nowIso }))
+            continue;
+        // 2026-09-04 fix: `softDelete` (post.ts) stamps only `deletedAt`/`updatedAt`/`version` — it
+        // never clears `status`, so a post that was `published` when trashed stays `status:
+        // "published"` forever and the guard above alone can't catch it. `PostRepoPort.list()` is
+        // documented (and deliberately kept) trash-BLIND (see `PostRecord.deletedAt`'s own doc: "every
+        // trash-AWARE read filter lives in this file's own domain functions"), the same contract
+        // `listAdminPosts`/`listPublishedPosts`/`listAdminPages` (post.ts) already honor with their own
+        // `!isTrashed(post)` filter — this is that same filter, applied at this domain function's own
+        // trash-aware read boundary rather than widening the shared repo port.
+        if (deps.postRepo.isTrashed({ post }))
+            continue;
+        // ADR-030 §4 (2026-09-03 sweep): a members/paid/tiers-gated post must not advertise its
+        // canonical URL or existence to crawlers here, the same way it was already excluded from the
+        // ungated home-page listing (`pages.ts`'s `filterVisiblePosts`).
+        if (!deps.isPubliclyAccessible({ post }))
+            continue;
+        const meta = await getEntryMeta({ deps, input: { workspaceId, entryId: post.id } });
+        if (meta.robots.noindex)
+            continue;
+        entries.push({ post, meta });
+    }
+    return entries;
+}
+/**
+ * REQ-09 — composes `RobotsPolicy` from `SeoSettings.robotsRules` +
+ * computed `sitemapUrls` (never persisted as one shape — computed fresh at
+ * read time). `sitemapUrls` is `[]` when `sitemapEnabled` is `false`.
+ *
+ * 2026-09-04 fix: the advertised sitemap URL is joined onto the workspace's
+ * verified origin ({@link toAbsoluteUrl}, via {@link resolveWorkspaceOrigin}),
+ * the same wiring `getEntryMeta`'s `canonical`/`og:url` already use (the
+ * `ADR-040` origin-resolution source this doc used to say didn't exist yet —
+ * `features/origin`'s `OriginRegistryPort` — landed on 2026-09-03). Google
+ * ignores a relative `Sitemap:` directive, so a bare `/sitemap.xml` made the
+ * sitemap undiscoverable to crawlers even though `<loc>` entries inside it
+ * were already absolute. Degrades to the same bare relative path as before
+ * when no verified origin is registered yet — SEO still never fabricates a
+ * local origin (INV-07), consistent with `getEntryMeta`'s own fallback.
+ */
+export async function buildRobots(required, _optional = {}) {
+    const { deps, input } = required;
+    const settings = await deps.settings.getSeoSettings({ workspaceId: input.workspaceId });
+    const origin = await resolveWorkspaceOrigin({ originRegistry: deps.originRegistry, workspaceId: input.workspaceId, runtimeMode: deps.runtimeMode });
+    return {
+        rules: settings.robotsRules,
+        sitemapUrls: settings.sitemapEnabled ? [toAbsoluteUrl({ origin, path: "/sitemap.xml" })] : [],
+    };
+}
+export const SITEMAP_INVALIDATED_EVENT = "seo.sitemap_invalidated";
+export async function requestSitemapInvalidation(required, _optional = {}) {
+    const { deps, input } = required;
+    await deps.invalidateSitemapCache(input);
+    await deps.outbox.enqueue({ id: deps.idGen.newId(), name: SITEMAP_INVALIDATED_EVENT,
+        occurredAt: deps.clock.nowIso(), aggregateId: input.workspaceId, workspaceId: input.workspaceId, payload: {} });
+    await deps.dispatch({ outbox: deps.outbox, bus: deps.bus, clock: { nowMs: () => Date.parse(deps.clock.nowIso()) } });
+}
+/** Each service owns its hooks, build generations, cache and scheduled expiry; hosts never share state accidentally. */
+export function createSitemapService(required, _optional = {}) {
+    const { deps } = required;
+    /** Cached value is the `JSON.stringify`d `SitemapEntry[]` for that workspace. */
+    const sitemapCache = new Map();
+    /** Only the most recently started build may publish into a workspace cache. */
+    const sitemapBuilds = new Map();
+    /**
+     * Scheduled publishing (2026-10-05): the earliest future `publishAt` seen when a workspace's entry
+     * was built. Nothing emits an event when a scheduled post goes live (there is no job — see
+     * `contracts/core/scheduled-publish.ts`), so the cached sitemap simply stops being trusted at that
+     * instant and the next read rebuilds it.
+     */
+    const sitemapExpiry = new Map();
+    // ---------------------------------------------------------------------------
+    // `seo.sitemap.collect` (OQ-01) — a real, empty, in-module ordered registry.
+    // ---------------------------------------------------------------------------
+    const sitemapCollectHooks = [];
+    /** Registers a `seo.sitemap.collect` contributor. Live-but-empty in v1 (OQ-01) — no real registrant ships with this feature. */
+    function registerSitemapCollectHook(required, _optional = {}) {
+        const { hook } = required;
+        sitemapCollectHooks.push(hook);
+        return () => {
+            const index = sitemapCollectHooks.indexOf(hook);
+            if (index !== -1)
+                sitemapCollectHooks.splice(index, 1);
+        };
+    }
+    /** Test-only reset of this service's registry. */
+    function resetSitemapCollectHooksForTests(_required, _optional = {}) {
+        sitemapCollectHooks.length = 0;
+    }
+    /** The earliest go-live instant still ahead of `nowIso`, or `undefined` when nothing is scheduled.
+     *  @complexity O(n) in the workspace's post count. */
+    function nextScheduledGoLive(posts, nowIso) {
+        let next;
+        for (const post of posts) {
+            if (deps.postRepo.isTrashed({ post }) || !deps.liveness.isScheduledAt({ post, nowIso }))
+                continue;
+            if (next === undefined || post.publishAt < next)
+                next = post.publishAt;
+        }
+        return next;
+    }
+    /** Builds and (when still the latest build) caches one workspace's sitemap, with its expiry. */
+    async function rebuildSitemapCache(workspaceId) {
+        const key = cacheKey(workspaceId);
+        const build = Symbol();
+        sitemapBuilds.set(key, build);
+        const nowIso = deps.clock.nowIso();
+        const entries = await computeSitemapEntries(workspaceId, nowIso);
+        const expiry = nextScheduledGoLive(await deps.postRepo.list({ workspaceId }), nowIso);
+        if (sitemapBuilds.get(key) === build) {
+            sitemapCache.set(key, JSON.stringify(entries));
+            if (expiry === undefined)
+                sitemapExpiry.delete(key);
+            else
+                sitemapExpiry.set(key, expiry);
+        }
+        return entries;
+    }
+    async function computeSitemapEntries(workspaceId, nowIso) {
+        // `meta.canonical` is absolute when the workspace has a verified origin (2026-09-03 fix,
+        // `getEntryMeta`'s own `resolveCanonical`) — sitemap `loc` entries are required to be absolute
+        // by the sitemap protocol, same requirement `og:url` has. Falls back to the bare relative path
+        // for the same disclosed no-origin degradation `getEntryMeta` documents; unchanged from before
+        // this fix for a workspace with no verified origin yet.
+        const entries = (await computeIndexableEntries({ deps, input: { workspaceId, nowIso } })).map(({ post, meta }) => ({
+            loc: meta.canonical,
+            lastmod: post.updatedAt,
+        }));
+        for (const hook of [...sitemapCollectHooks].sort((a, b) => a.priority - b.priority)) {
+            const collected = await hook.handle({ workspaceId, baseUrl: "" });
+            entries.push(...collected);
+        }
+        return entries;
+    }
+    /**
+     * REQ-08/10 — cache-checked build of `SitemapEntry[]`. Never `null`; `[]`
+     * when empty (EC-04). Never includes a non-published or effective-`noindex`
+     * entry (INV-04/05).
+     */
+    async function buildSitemap(input, _optional = {}) {
+        const key = cacheKey(input.workspaceId);
+        const cached = sitemapCache.get(key);
+        const expiry = sitemapExpiry.get(key);
+        const expired = expiry !== undefined && deps.clock.nowIso() >= expiry;
+        if (cached !== undefined && !expired)
+            return JSON.parse(cached);
+        return rebuildSitemapCache(input.workspaceId);
+    }
+    /** REQ-13 — force-rebuilds the cache entry now, bypassing the cache-hit path. */
+    async function regenerateSitemapCache(input, _optional = {}) {
+        await rebuildSitemapCache(input.workspaceId);
+    }
+    /** REQ-10/INV-08 — clears the workspace's cache entry. Idempotent: a repeat call on an already-clear key is a no-op. */
+    function invalidateSitemapCache(input, _optional = {}) {
+        sitemapCache.delete(cacheKey(input.workspaceId));
+        sitemapBuilds.delete(cacheKey(input.workspaceId));
+        sitemapExpiry.delete(cacheKey(input.workspaceId));
+    }
+    /**
+     * REQ-10 — the 3 outbox-event subscription handlers (idempotent per
+     * ADR-009): any `entry.published`/`entry.updated`/`entry.unpublished`
+     * delivery invalidates that workspace's sitemap cache entry. Wired to
+     * `bus.subscribe` at `server/app.ts` boot (T038).
+     */
+    function createSeoEventSubscriptions(_required, _optional = {}) {
+        const handler = async (event, _optional = {}) => {
+            invalidateSitemapCache({ workspaceId: event.workspaceId });
+        };
+        return { onEntryPublished: handler, onEntryUpdated: handler, onEntryUnpublished: handler,
+            onSitemapInvalidated: async (event, _optional = {}) => { invalidateSitemapCache({ workspaceId: event.workspaceId }); } };
+    }
+    return {
+        registerSitemapCollectHook, resetSitemapCollectHooksForTests,
+        buildSitemap, regenerateSitemapCache, invalidateSitemapCache, createSeoEventSubscriptions,
+        computeIndexableEntries: (input, optional = {}) => computeIndexableEntries({ deps, input }, optional),
+        buildRobots: (input, optional = {}) => buildRobots({ deps, input }, optional),
+        requestSitemapInvalidation: (required, optional = {}) => requestSitemapInvalidation({ deps: { ...required.deps, invalidateSitemapCache }, input: required.input }, optional),
+    };
+}
+//# sourceMappingURL=sitemap.js.map