@prenta/core 0.118.0

package/dist/api/routes/seo-public.js

@@ -0,0 +1,1366 @@
+import { logEvent } from '../../security/audit.js';
+import { safeFetch, SsrfBlockedError } from '../../security/safe-fetch.js';
+import { extractOutboundUrlsFromDocumentData, isLinkProbeIssueStatus, LINK_PROBE_HEADERS, } from '../../seo/link-probe.js';
+import { getPrentaConfig } from '../../config/runtime.js';
+import { guardedDb } from '../guarded-db.js';
+import { computeLightSeoScore } from './dashboard.js';
+import { resolveDocumentUrl } from '../../seo/page-meta.js';
+import { resolveSeoEnvironment, isDocumentNoIndex, } from '../../seo/robots.js';
+import { buildAiBotRobotsLines } from '../../seo/ai-bots.js';
+import { getSeoOverrides, resolveSeoModuleSettings, } from '../../seo/config-store.js';
+import { collectSectionImageUrls, featuredImageUrl } from '../../sections/index.js';
+import { collectionSitemapPublicUrl, parseCollectionSitemapFilename, resolveCollectionFromSitemapSlug, sitemapBaseName, sitemapStylesheetPi, SITEMAP_INDEX_XSL, SITEMAP_URLSET_XSL, } from '../../seo/sitemap-public.js';
+import { json, errorResponse, internalError, escapeXml, SITEMAP_PAGE_SIZE, renderOgSvg, safeFindMany, requireAuth, WRITE_ROLES, ADMIN_ROLES, requireRole, enforceDocumentReadAccess, } from '../route-helpers.js';
+/**
+ * Load the runtime config with DB-stored SEO overrides applied. Used by every
+ * public SEO surface (sitemap, robots, og.png) and by /resolve so admin edits
+ * in the Settings → SEO panel take effect without a redeploy.
+ *
+ * Falls back to the static config when no override row exists yet — first
+ * boot of a freshly-installed CMS keeps working.
+ */
+export async function loadEffectiveConfig() {
+    const base = getPrentaConfig();
+    if (!base)
+        return null;
+    try {
+        const { getSeoOverrides, applySeoOverrides } = await import('../../seo/config-store.js');
+        const overrides = await getSeoOverrides(guardedDb());
+        return applySeoOverrides(base, overrides);
+    }
+    catch {
+        return base;
+    }
+}
+/**
+ * Whether a published document resolves to `noindex` and therefore must be kept
+ * OUT of the sitemap. Listing a noindexed URL in the sitemap ("index me") while
+ * its page emits a `noindex` meta tag ("don't") sends crawlers conflicting
+ * signals and wastes crawl budget — Google explicitly flags this. Mirrors the
+ * robots inputs used by `composePageMeta` so the sitemap and the rendered meta
+ * tag always agree.
+ */
+function sitemapDocumentNoIndex(data, collectionSeo, siteSeo, environment) {
+    const pageSettings = (data.pageSettings ?? data._pageSettings ?? {});
+    return isDocumentNoIndex({
+        pageSettings,
+        data,
+        collectionSeo,
+        siteSeo,
+        environment,
+    });
+}
+/** Google image-sitemap extension namespace. */
+const SITEMAP_IMAGE_NS = 'http://www.google.com/schemas/sitemap-image/1.1';
+/** Cap image entries per URL — Google honors up to 1,000; we keep it modest. */
+const MAX_IMAGES_PER_URL = 50;
+/**
+ * Collect the public image URLs referenced by a document (featured image plus
+ * any `feature`/`hero`/`gallery` section images), absolutized against the site
+ * origin, deduped, and capped. Used to emit `<image:image>` entries when the
+ * "Include images in sitemap" crawl setting is on.
+ */
+function collectDocumentImageUrls(data, base) {
+    const urls = new Set();
+    const add = (u) => {
+        if (!u)
+            return;
+        const abs = u.startsWith('http://') || u.startsWith('https://')
+            ? u
+            : u.startsWith('/')
+                ? `${base}${u}`
+                : null;
+        if (abs)
+            urls.add(abs);
+    };
+    add(featuredImageUrl(data.featuredImage));
+    for (const u of collectSectionImageUrls(data.sections))
+        add(u);
+    return [...urls].slice(0, MAX_IMAGES_PER_URL);
+}
+export function siteUrlFromRequest(request, cfg) {
+    const seo = (cfg ?? getPrentaConfig())?.seo;
+    if (seo?.siteUrl)
+        return seo.siteUrl.replace(/\/+$/, '');
+    // Fall back to the request origin so the routes work on preview deploys
+    // before the integrator has configured siteUrl. On production hosts this
+    // is a serving-reality leak (absolute URLs become the CMS host) — log loud
+    // so Launch Gate E / ops catch it; still return a value so SEO routes do
+    // not 500 an entire site that forgot the env.
+    const isProd = process.env.NODE_ENV === 'production' ||
+        process.env.VERCEL_ENV === 'production' ||
+        process.env.VERCEL_ENV === 'preview';
+    try {
+        const u = new URL(request.url);
+        const fallback = `${u.protocol}//${u.host}`;
+        if (isProd && typeof console !== 'undefined') {
+            console.error('[prenta] seo.siteUrl / NEXT_PUBLIC_SITE_URL is unset; ' +
+                `falling back to request origin (${fallback}). Set the public apex ` +
+                'or absolute URLs in sitemap/robots/feeds will point at the wrong host.');
+        }
+        return fallback;
+    }
+    catch {
+        return '';
+    }
+}
+export function registerSeoPublicRoutes(router) {
+    const db = guardedDb;
+    // ---------------------------------------------------------------------------
+    // Public SEO surfaces: sitemap.xml, per-collection sitemaps, robots.txt,
+    // and the dynamic /og.png OG-image endpoint. These are unauthenticated by
+    // design — search engines and social crawlers will fetch them.
+    // ---------------------------------------------------------------------------
+    function sitemapEligibleCollections(cfg, opts) {
+        const resolved = cfg ?? getPrentaConfig();
+        if (!resolved)
+            return [];
+        const includePosts = opts?.includePosts ?? true;
+        const excluded = new Set(resolved.seo?.sitemap?.excludeCollections ?? []);
+        const out = [];
+        for (const [slug, col] of Object.entries(resolved.collections ?? {})) {
+            // Only publicly-rendered content types belong in the sitemap. Structural
+            // / utility collections (navigation menus, footers, tags, templates) have
+            // no `type` and must never produce indexable sitemap URLs.
+            if (col.type !== 'page' && col.type !== 'post')
+                continue;
+            // Honor the "Include posts in sitemap" crawl setting (Settings → SEO →
+            // Technical). When off, post-type collections are dropped entirely.
+            if (col.type === 'post' && !includePosts)
+                continue;
+            if (col.admin?.hidden)
+                continue;
+            if (excluded.has(slug))
+                continue;
+            if (col.seo?.excludeFromSitemap)
+                continue;
+            out.push({ slug, urlPrefix: col.urlPrefix, type: col.type, seo: col.seo });
+        }
+        return out;
+    }
+    router.get('/sitemap.xml', async (request) => {
+        try {
+            const cfg = await loadEffectiveConfig();
+            if (cfg?.seo?.sitemap?.disabled)
+                return errorResponse('Sitemap disabled', 404);
+            const base = siteUrlFromRequest(request, cfg);
+            const moduleSettings = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            if (!moduleSettings.sitemapEnabled)
+                return errorResponse('Sitemap disabled', 404);
+            // Master switch: when the whole public site is opted out of indexing, the
+            // sitemap (a positive "please index these" signal) must be empty so it
+            // doesn't contradict the `Disallow: /` we emit in robots.txt.
+            if (moduleSettings.indexEntireSite === false) {
+                const emptyIndex = [
+                    '<?xml version="1.0" encoding="UTF-8"?>',
+                    '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+                    '</sitemapindex>',
+                ].join('\n');
+                return new Response(emptyIndex, {
+                    status: 200,
+                    headers: {
+                        'Content-Type': 'application/xml; charset=utf-8',
+                        'Cache-Control': 'public, max-age=300, s-maxage=600',
+                    },
+                });
+            }
+            const cols = sitemapEligibleCollections(cfg, {
+                includePosts: moduleSettings.includePostsInSitemap,
+            });
+            // Sitemap index lists Yoast-style public URLs (`/post-sitemap.xml`,
+            // `/post-sitemap2.xml`, …). Collections larger than SITEMAP_PAGE_SIZE are
+            // split across numbered files (Google's limit is 50k URLs / 50 MB per file).
+            const now = new Date().toISOString();
+            const perCollection = await Promise.all(cols.map(async (c) => {
+                let count = 0;
+                // Report the newest published change in the collection as the child
+                // sitemap's <lastmod> instead of "now". A lastmod that changes on
+                // every fetch trains crawlers to ignore it; an accurate one is the
+                // single most useful signal we can give them.
+                let lastmod = now;
+                try {
+                    count = await db().document.count({
+                        where: { collection: c.slug, deletedAt: null, status: 'PUBLISHED' },
+                    });
+                    const newest = await db().document.findFirst({
+                        where: { collection: c.slug, deletedAt: null, status: 'PUBLISHED' },
+                        select: { updatedAt: true },
+                        orderBy: { updatedAt: 'desc' },
+                    });
+                    if (newest?.updatedAt)
+                        lastmod = newest.updatedAt.toISOString();
+                }
+                catch {
+                    count = 0;
+                }
+                // Skip collections that would render an empty `<urlset>`. A urlset with
+                // zero <url> entries violates the sitemaps.org schema and Search Console
+                // reports the child as an "empty sitemap", degrading trust in the whole
+                // index. A post-type collection with an archive path still renders that
+                // one self URL on page 0, so it is kept even at zero published docs.
+                const rendersArchiveUrl = c.type === 'post' && !!c.seo?.archivePath;
+                if (count === 0 && !rendersArchiveUrl)
+                    return '';
+                const pages = Math.max(1, Math.ceil(count / SITEMAP_PAGE_SIZE));
+                const baseName = sitemapBaseName(c);
+                const entries = [];
+                for (let page = 0; page < pages; page++) {
+                    const loc = collectionSitemapPublicUrl(base, baseName, page);
+                    entries.push([
+                        '  <sitemap>',
+                        `    <loc>${escapeXml(loc)}</loc>`,
+                        `    <lastmod>${lastmod}</lastmod>`,
+                        '  </sitemap>',
+                    ].join('\n'));
+                }
+                return entries.join('\n');
+            }));
+            const sitemaps = perCollection.filter(Boolean).join('\n');
+            const xml = [
+                '<?xml version="1.0" encoding="UTF-8"?>',
+                sitemapStylesheetPi(base, 'index'),
+                '<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+                sitemaps,
+                '</sitemapindex>',
+            ].join('\n');
+            return new Response(xml, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/xml; charset=utf-8',
+                    'Cache-Control': 'public, max-age=300, s-maxage=600',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'sitemap.xml');
+        }
+    });
+    // Human-readable XSLT stylesheets for browser viewing (Yoast-style layout).
+    router.get('/sitemap.xsl', async () => {
+        return new Response(SITEMAP_URLSET_XSL, {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/xslt+xml; charset=utf-8',
+                'Cache-Control': 'public, max-age=86400, s-maxage=86400',
+            },
+        });
+    });
+    router.get('/sitemap-index.xsl', async () => {
+        return new Response(SITEMAP_INDEX_XSL, {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/xslt+xml; charset=utf-8',
+                'Cache-Control': 'public, max-age=86400, s-maxage=86400',
+            },
+        });
+    });
+    // The router's path-param syntax (`:name`) greedily matches everything up
+    // to the next `/`, so registering as `/sitemaps/:slug.xml` would capture
+    // `slug.xml` into a single param. We register `/sitemaps/:slug` instead and
+    // require the `.xml` suffix in the handler. Accepts Yoast-style names
+    // (`post-sitemap.xml`, `post-sitemap2.xml`) and legacy `{slug}.xml`.
+    router.get('/sitemaps/:slug', async (request, params) => {
+        try {
+            const cfg = await loadEffectiveConfig();
+            if (cfg?.seo?.sitemap?.disabled)
+                return errorResponse('Sitemap disabled', 404);
+            const slugParam = params.slug ?? '';
+            if (!/\.xml$/i.test(slugParam))
+                return errorResponse('Sitemap not found', 404);
+            const moduleSettings = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            if (!moduleSettings.sitemapEnabled)
+                return errorResponse('Sitemap disabled', 404);
+            const eligible = sitemapEligibleCollections(cfg, {
+                includePosts: moduleSettings.includePostsInSitemap,
+            });
+            const resolved = resolveCollectionFromSitemapSlug(eligible, slugParam);
+            if (!resolved)
+                return errorResponse('Collection not found', 404);
+            const rawSlug = resolved.collection.slug;
+            const collection = cfg?.collections?.[rawSlug];
+            if (!collection)
+                return errorResponse('Collection not found', 404);
+            // Only publicly-rendered page/post collections are sitemap-eligible —
+            // structural/utility collections (menus, tags, templates) are not.
+            if (collection.type !== 'page' && collection.type !== 'post')
+                return errorResponse('Collection excluded from sitemap', 404);
+            if (collection.admin?.hidden)
+                return errorResponse('Collection excluded from sitemap', 404);
+            if (collection.seo?.excludeFromSitemap)
+                return errorResponse('Collection excluded from sitemap', 404);
+            // Master switch: whole public site opted out of indexing → empty urlset
+            // (mirrors the empty sitemap index + `Disallow: /` in robots.txt).
+            if (moduleSettings.indexEntireSite === false) {
+                const emptyUrlset = [
+                    '<?xml version="1.0" encoding="UTF-8"?>',
+                    '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+                    '</urlset>',
+                ].join('\n');
+                return new Response(emptyUrlset, {
+                    status: 200,
+                    headers: {
+                        'Content-Type': 'application/xml; charset=utf-8',
+                        'Cache-Control': 'public, max-age=300, s-maxage=600',
+                    },
+                });
+            }
+            // Honor the "Include posts in sitemap" crawl setting consistently with the
+            // sitemap index, so a post-type sitemap can't be reached when posts are
+            // excluded there.
+            if (collection.type === 'post' && !moduleSettings.includePostsInSitemap)
+                return errorResponse('Collection excluded from sitemap', 404);
+            const base = siteUrlFromRequest(request, cfg);
+            const environment = resolveSeoEnvironment();
+            // Yoast-style filenames encode the page (`post-sitemap2.xml` → page 1).
+            // Legacy `/sitemaps/posts.xml?page=N` still supported for backward compat.
+            let page = resolved.pageIndex;
+            if (!parseCollectionSitemapFilename(slugParam)) {
+                const pageParam = Number(new URL(request.url).searchParams.get('page') ?? '0');
+                if (Number.isFinite(pageParam) && pageParam > 0)
+                    page = Math.floor(pageParam);
+            }
+            const docs = await db().document.findMany({
+                where: { collection: rawSlug, deletedAt: null, status: 'PUBLISHED' },
+                select: { slug: true, updatedAt: true, data: true, locale: true, localeGroupId: true },
+                orderBy: { updatedAt: 'desc' },
+                skip: page * SITEMAP_PAGE_SIZE,
+                take: SITEMAP_PAGE_SIZE,
+            });
+            // hreflang: when the site runs i18n with more than one locale, emit
+            // `<xhtml:link rel="alternate">` annotations so search engines serve the
+            // right language variant. Each translation shares a `localeGroupId`; its
+            // own `data.path`/slug yields the localized URL via resolveDocumentUrl, so
+            // this works regardless of the locale routing strategy. Skipped entirely
+            // (zero extra queries) for single-locale sites.
+            const i18nLocales = cfg?.i18n?.locales ?? [];
+            const i18nEnabled = i18nLocales.length > 1;
+            const defaultLocale = cfg?.i18n?.defaultLocale;
+            const alternatesByGroup = new Map();
+            if (i18nEnabled) {
+                const groupIds = [
+                    ...new Set(docs.map((d) => d.localeGroupId).filter((g) => !!g)),
+                ];
+                if (groupIds.length > 0) {
+                    const siblings = await db().document.findMany({
+                        where: {
+                            collection: rawSlug,
+                            deletedAt: null,
+                            status: 'PUBLISHED',
+                            localeGroupId: { in: groupIds },
+                        },
+                        select: { slug: true, data: true, locale: true, localeGroupId: true },
+                    });
+                    for (const s of siblings) {
+                        if (!s.localeGroupId)
+                            continue;
+                        const sData = s.data || {};
+                        const loc = resolveDocumentUrl({
+                            siteUrl: base,
+                            urlPrefix: collection.urlPrefix,
+                            slug: s.slug,
+                            data: sData,
+                        });
+                        const list = alternatesByGroup.get(s.localeGroupId) ?? [];
+                        list.push({ locale: s.locale, loc });
+                        alternatesByGroup.set(s.localeGroupId, list);
+                    }
+                }
+            }
+            const defaultPriority = collection.seo?.sitemapPriority ??
+                cfg?.seo?.sitemap?.defaultPriority ??
+                (collection.type === 'page' ? 0.8 : 0.6);
+            const changefreq = collection.seo?.sitemapChangeFreq ?? cfg?.seo?.sitemap?.defaultChangeFreq ?? 'weekly';
+            const urls = [];
+            let hreflangUsed = false;
+            let imagesUsed = false;
+            const includeImages = moduleSettings.includeImagesInSitemap === true;
+            const renderImages = (data) => {
+                if (!includeImages)
+                    return [];
+                const imgs = collectDocumentImageUrls(data, base);
+                if (imgs.length === 0)
+                    return [];
+                imagesUsed = true;
+                return imgs.map((u) => `    <image:image><image:loc>${escapeXml(u)}</image:loc></image:image>`);
+            };
+            const renderAlternates = (groupId) => {
+                if (!i18nEnabled || !groupId)
+                    return [];
+                const alts = alternatesByGroup.get(groupId);
+                if (!alts || alts.length < 2)
+                    return [];
+                hreflangUsed = true;
+                const lines = alts.map((a) => `    <xhtml:link rel="alternate" hreflang="${escapeXml(a.locale ?? defaultLocale ?? 'und')}" href="${escapeXml(a.loc)}" />`);
+                const fallback = alts.find((a) => a.locale === defaultLocale) ?? alts[0];
+                if (fallback) {
+                    lines.push(`    <xhtml:link rel="alternate" hreflang="x-default" href="${escapeXml(fallback.loc)}" />`);
+                }
+                return lines;
+            };
+            // Archive page first (e.g. /blog) for post-type collections — only on
+            // the first page so it isn't duplicated across paginated sitemap files.
+            if (page === 0 && collection.seo?.archivePath && collection.type === 'post') {
+                const archive = collection.seo.archivePath.startsWith('http')
+                    ? collection.seo.archivePath
+                    : `${base}${collection.seo.archivePath}`;
+                // The archive reflects its newest post, so derive lastmod from the most
+                // recently updated published doc rather than the current time.
+                const archiveLastmod = docs.reduce((newest, d) => {
+                    const u = d.updatedAt instanceof Date ? d.updatedAt : null;
+                    return u && (!newest || u > newest) ? u : newest;
+                }, null) ?? new Date();
+                urls.push([
+                    '  <url>',
+                    `    <loc>${escapeXml(archive)}</loc>`,
+                    `    <lastmod>${archiveLastmod.toISOString()}</lastmod>`,
+                    `    <changefreq>${changefreq}</changefreq>`,
+                    '    <priority>0.6</priority>',
+                    '  </url>',
+                ].join('\n'));
+            }
+            for (const d of docs) {
+                const data = d.data || {};
+                const slug = d.slug ?? data.slug;
+                // An explicit `data.path` can stand on its own (e.g. the homepage at
+                // "/"), so only require a slug when there's no canonical path set.
+                const hasExplicitPath = typeof data.path === 'string' && data.path.trim() !== '';
+                if (!slug && !hasExplicitPath)
+                    continue;
+                // Never list a noindexed URL — it conflicts with the page's own robots
+                // meta tag and wastes crawl budget.
+                if (sitemapDocumentNoIndex(data, collection.seo, cfg?.seo, environment))
+                    continue;
+                const loc = resolveDocumentUrl({
+                    siteUrl: base,
+                    urlPrefix: collection.urlPrefix,
+                    slug,
+                    data,
+                });
+                urls.push([
+                    '  <url>',
+                    `    <loc>${escapeXml(loc)}</loc>`,
+                    `    <lastmod>${d.updatedAt?.toISOString() ?? new Date().toISOString()}</lastmod>`,
+                    `    <changefreq>${changefreq}</changefreq>`,
+                    `    <priority>${defaultPriority.toFixed(1)}</priority>`,
+                    ...renderAlternates(d.localeGroupId),
+                    ...renderImages(data),
+                    '  </url>',
+                ].join('\n'));
+            }
+            const urlsetOpen = [
+                '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"',
+                hreflangUsed ? ' xmlns:xhtml="http://www.w3.org/1999/xhtml"' : '',
+                imagesUsed ? ` xmlns:image="${SITEMAP_IMAGE_NS}"` : '',
+                '>',
+            ].join('');
+            const xml = [
+                '<?xml version="1.0" encoding="UTF-8"?>',
+                sitemapStylesheetPi(base, 'urlset'),
+                urlsetOpen,
+                urls.join('\n'),
+                '</urlset>',
+            ].join('\n');
+            return new Response(xml, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/xml; charset=utf-8',
+                    'Cache-Control': 'public, max-age=300, s-maxage=600',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'sitemaps/:slug.xml');
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Content feeds: RSS 2.0 (/feed.xml) + JSON Feed 1.1 (/feed.json).
+    //
+    // Newest published items across post-type collections (falling back to pages
+    // when a site has no post collections), excluding per-document noindex. Unlike
+    // the sitemap these are a subscription/distribution surface, not a crawl
+    // directive, so they are not gated by `indexEntireSite`.
+    // ---------------------------------------------------------------------------
+    const FEED_LIMIT = 50;
+    async function gatherFeedItems(cfg, base) {
+        const { resolveDocumentUrl } = await import('../../seo/page-meta.js');
+        const environment = resolveSeoEnvironment();
+        const siteSeo = cfg?.seo;
+        const all = sitemapEligibleCollections(cfg);
+        const posts = all.filter((c) => c.type === 'post');
+        const cols = posts.length > 0 ? posts : all;
+        const collected = [];
+        for (const c of cols) {
+            let docs = [];
+            try {
+                docs = await db().document.findMany({
+                    where: { collection: c.slug, deletedAt: null, status: 'PUBLISHED' },
+                    select: { slug: true, title: true, data: true, publishedAt: true, updatedAt: true },
+                    orderBy: { publishedAt: 'desc' },
+                    take: FEED_LIMIT,
+                });
+            }
+            catch {
+                docs = [];
+            }
+            for (const d of docs) {
+                const data = d.data || {};
+                if (sitemapDocumentNoIndex(data, c.seo, siteSeo, environment))
+                    continue;
+                const url = resolveDocumentUrl({
+                    siteUrl: base,
+                    urlPrefix: c.urlPrefix,
+                    slug: d.slug,
+                    data,
+                });
+                const { resolveEffectiveMeta } = await import('../../seo/page-meta.js');
+                const effective = resolveEffectiveMeta({
+                    data,
+                    docTitle: d.title,
+                    publishedAt: d.publishedAt,
+                    collection: c,
+                    collectionSlug: c.slug,
+                    site: siteSeo,
+                    siteUrl: base,
+                });
+                const title = effective.metaTitle ?? d.title ?? 'Untitled';
+                const description = (typeof data.keyTakeaway === 'string' && data.keyTakeaway) ||
+                    (typeof data.metaDescription === 'string' && data.metaDescription) ||
+                    (typeof data.excerpt === 'string' ? data.excerpt : '') ||
+                    undefined;
+                const date = (d.publishedAt ?? d.updatedAt)?.toISOString();
+                const modified = d.updatedAt?.toISOString();
+                // Only advertise a modification time when it is genuinely newer than
+                // publication, so unchanged posts don't look perpetually "updated".
+                const dateModified = modified && date && modified > date ? modified : undefined;
+                // Carry the rendered article body (HTML) when available so subscribers
+                // receive the whole post, not just a summary. Emitted as
+                // <content:encoded> / content_html by the feed builders.
+                const content = (typeof data.body === 'string' && data.body) ||
+                    (typeof data.content === 'string' && data.content) ||
+                    undefined;
+                collected.push({ url, title, description, content, date, dateModified });
+            }
+        }
+        // Merge collections and keep the globally newest items.
+        collected.sort((a, b) => (b.date ?? '').localeCompare(a.date ?? ''));
+        return collected.slice(0, FEED_LIMIT);
+    }
+    router.get('/feed.xml', async (request) => {
+        try {
+            const cfg = await loadEffectiveConfig();
+            const base = siteUrlFromRequest(request, cfg);
+            const items = await gatherFeedItems(cfg, base);
+            const { buildRssFeed } = await import('../../seo/feeds.js');
+            const xml = buildRssFeed({
+                title: cfg?.seo?.siteName || 'Site',
+                homeUrl: base || '/',
+                feedUrl: `${base}/feed.xml`,
+                description: cfg?.seo?.defaultMetaDescription,
+                updated: items[0]?.date,
+                language: cfg?.i18n?.defaultLocale,
+            }, items);
+            return new Response(xml, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/rss+xml; charset=utf-8',
+                    'Cache-Control': 'public, max-age=300, s-maxage=600',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'feed.xml');
+        }
+    });
+    router.get('/feed.json', async (request) => {
+        try {
+            const cfg = await loadEffectiveConfig();
+            const base = siteUrlFromRequest(request, cfg);
+            const items = await gatherFeedItems(cfg, base);
+            const { buildJsonFeed } = await import('../../seo/feeds.js');
+            const body = buildJsonFeed({
+                title: cfg?.seo?.siteName || 'Site',
+                homeUrl: base || '/',
+                feedUrl: `${base}/feed.json`,
+                description: cfg?.seo?.defaultMetaDescription,
+                updated: items[0]?.date,
+                language: cfg?.i18n?.defaultLocale,
+            }, items);
+            return new Response(body, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/feed+json; charset=utf-8',
+                    'Cache-Control': 'public, max-age=300, s-maxage=600',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'feed.json');
+        }
+    });
+    router.get('/robots.txt', async (request) => {
+        try {
+            const cfg = await loadEffectiveConfig();
+            const seo = cfg?.seo;
+            if (seo?.robots?.disabled)
+                return errorResponse('robots.txt disabled', 404);
+            // Read SEO module settings up-front: they drive the custom-body override,
+            // the `robotsEnabled` kill-switch, and the `indexEntireSite` master toggle.
+            let settings;
+            try {
+                settings = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            }
+            catch {
+                // Fall back to defaults (indexable) on any override-read failure.
+                settings = resolveSeoModuleSettings(null);
+            }
+            if (settings.robotsEnabled === false)
+                return errorResponse('robots.txt disabled', 404);
+            // Admin-edited custom robots.txt body (Technical tab) wins when set —
+            // the editor is the single source of truth for operators who want full
+            // control over directives.
+            const custom = settings.robotsTxt?.trim();
+            if (custom) {
+                return new Response(settings.robotsTxt, {
+                    status: 200,
+                    headers: {
+                        'Content-Type': 'text/plain; charset=utf-8',
+                        'Cache-Control': 'public, max-age=3600, s-maxage=3600',
+                    },
+                });
+            }
+            const base = siteUrlFromRequest(request, cfg);
+            // `indexEntireSite` is the public-site master switch. When OFF we emit a
+            // blanket `Disallow: /` for all crawlers (which already covers /admin and
+            // /api) and stop advertising the sitemap — the operator has opted the
+            // whole public site out of indexing. This only ever tightens crawling; it
+            // never affects CMS admin/API protection, which is enforced by auth + the
+            // admin's own `noindex` meta tag regardless of this file.
+            const indexable = settings.indexEntireSite !== false;
+            // Advertise the canonical public sitemap URL (`/sitemap.xml`), not the
+            // internal `/api/cms/sitemap.xml` mount. Consumer sites proxy the root
+            // path to the CMS route; the rest of the SEO subsystem (search-engine
+            // pings, index status, llms.txt) already standardizes on `/sitemap.xml`.
+            const sitemapUrl = !indexable || seo?.sitemap?.disabled ? undefined : `${base}/sitemap.xml`;
+            // Allow the default og:image endpoint (`/api/cms/og.png`) with a
+            // more-specific rule BEFORE the blanket /api/ disallow (Google & Bing
+            // honor the longest match) — otherwise the very crawlers that render
+            // share cards (Googlebot-Image, Twitterbot, facebookexternalhit,
+            // Slackbot) are told not to fetch it, so shared links show no card image.
+            const lines = indexable
+                ? [
+                    'User-agent: *',
+                    'Allow: /',
+                    'Disallow: /admin',
+                    'Allow: /api/cms/og.png',
+                    'Disallow: /api/',
+                    '',
+                ]
+                : ['User-agent: *', 'Disallow: /', ''];
+            for (const rule of seo?.robots?.additionalRules ?? []) {
+                lines.push(`User-agent: ${rule.userAgent}`);
+                for (const allow of rule.allow ?? [])
+                    lines.push(`Allow: ${allow}`);
+                for (const dis of rule.disallow ?? [])
+                    lines.push(`Disallow: ${dis}`);
+                // Per-UA rate limit (seconds). Honored by Bing/Yandex/Seznam; ignored by
+                // Google (which uses Search Console instead). Only emit a sane positive
+                // value so a stray 0/NaN can't produce a meaningless directive.
+                if (typeof rule.crawlDelay === 'number' &&
+                    Number.isFinite(rule.crawlDelay) &&
+                    rule.crawlDelay > 0)
+                    lines.push(`Crawl-delay: ${rule.crawlDelay}`);
+                lines.push('');
+            }
+            // Nuanced AI-crawler policy (training vs retrieval), falling back to the
+            // legacy `blockAIBots` boolean. Only emitted when the site is indexable —
+            // when the master switch is off, the blanket `Disallow: /` above already
+            // covers every crawler.
+            if (indexable) {
+                lines.push(...buildAiBotRobotsLines(seo?.robots?.aiPolicy, seo?.robots?.blockAIBots));
+            }
+            if (sitemapUrl)
+                lines.push(`Sitemap: ${sitemapUrl}`, '');
+            return new Response(lines.join('\n'), {
+                status: 200,
+                headers: {
+                    'Content-Type': 'text/plain; charset=utf-8',
+                    'Cache-Control': 'public, max-age=3600, s-maxage=3600',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'robots.txt');
+        }
+    });
+    // IndexNow key verification file. IndexNow (Bing, Yandex, Seznam, Naver, …)
+    // requires the submitting key to be retrievable from the same host; we serve
+    // it here and advertise this path as `keyLocation` when submitting. The key
+    // comes from the `INDEXNOW_KEY` env var — when unset, IndexNow is disabled and
+    // this returns 404. The key is a public verification token by design (it's
+    // embedded in every submission), so serving it is not a secret leak.
+    router.get('/indexnow-key.txt', async () => {
+        try {
+            const key = process.env.INDEXNOW_KEY?.trim();
+            if (!key)
+                return errorResponse('IndexNow not configured', 404);
+            return new Response(key, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'text/plain; charset=utf-8',
+                    'Cache-Control': 'public, max-age=3600, s-maxage=3600',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'indexnow-key.txt');
+        }
+    });
+    router.get('/og.png', async (request) => {
+        try {
+            const cfg = await loadEffectiveConfig();
+            if (cfg?.seo?.ogImage?.disabled)
+                return errorResponse('og.png disabled', 404);
+            const url = new URL(request.url);
+            const title = url.searchParams.get('title') ?? cfg?.seo?.siteName ?? 'Untitled';
+            const description = url.searchParams.get('description') ?? undefined;
+            const siteName = url.searchParams.get('siteName') ?? cfg?.seo?.siteName;
+            const theme = url.searchParams.get('theme') ?? cfg?.seo?.ogImage?.theme ?? 'light';
+            const bg = theme === 'dark' ? '#0a0a0a' : '#ffffff';
+            const fg = theme === 'dark' ? '#fafafa' : '#0a0a0a';
+            const muted = theme === 'dark' ? '#a1a1aa' : '#71717a';
+            // SVG OG image. Crawlers (Facebook, Twitter/X, LinkedIn, Slack, Discord)
+            // all accept image/svg+xml when served with the right Content-Type. We
+            // chose SVG over PNG to avoid forcing a Satori/resvg dependency on
+            // every integrator; sites that need PNG can override with `og:image`
+            // pointing at their own /og endpoint built with @vercel/og.
+            const svg = renderOgSvg({ title, description, siteName, theme, bg, fg, muted });
+            return new Response(svg, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'image/svg+xml; charset=utf-8',
+                    'Cache-Control': 'public, max-age=86400, s-maxage=86400',
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'og.png');
+        }
+    });
+    router.get('/seo/schema/:documentId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const doc = await db().document.findFirst({
+                where: { id: params.documentId, deletedAt: null },
+            });
+            if (!doc)
+                return errorResponse('Not found', 404);
+            const accessErr = await enforceDocumentReadAccess(auth.session, doc.collection);
+            if (accessErr)
+                return accessErr;
+            const { buildSchemaGraph } = await import('../../content/structured-data.js');
+            const data = doc.data || {};
+            const graph = buildSchemaGraph({
+                siteName: 'Prenta CMS',
+                siteUrl: '',
+            }, {
+                url: `/${doc.collection}/${doc.slug || ''}`,
+                title: doc.title || data.title || '',
+                description: data.metaDescription || data.seoDescription || '',
+                datePublished: (doc.publishedAt ?? doc.createdAt)?.toISOString(),
+                dateModified: doc.updatedAt?.toISOString(),
+                type: doc.collection === 'posts' ? 'post' : 'page',
+                keywords: data.tags || data.keywords,
+                featuredImage: data.featuredImage ? { url: data.featuredImage } : undefined,
+            });
+            return new Response(JSON.stringify(graph), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/schema');
+        }
+    });
+    router.get('/seo/meta/:documentId', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const doc = await db().document.findFirst({
+                where: { id: params.documentId, deletedAt: null },
+            });
+            if (!doc)
+                return errorResponse('Not found', 404);
+            const accessErr = await enforceDocumentReadAccess(auth.session, doc.collection);
+            if (accessErr)
+                return accessErr;
+            const { composePageMeta } = await import('../../seo/page-meta.js');
+            const { getSeoOverrides, applySeoOverrides } = await import('../../seo/config-store.js');
+            const data = doc.data || {};
+            const pageSettings = (data.pageSettings ?? data._pageSettings);
+            const cfg = applySeoOverrides(getPrentaConfig(), await getSeoOverrides(db()));
+            const collectionDef = cfg?.collections?.[doc.collection] ?? null;
+            const composed = composePageMeta({
+                doc: {
+                    id: doc.id,
+                    collection: doc.collection,
+                    slug: doc.slug,
+                    data,
+                    publishedAt: doc.publishedAt,
+                    updatedAt: doc.updatedAt,
+                    structuredData: doc.structuredData ?? null,
+                    pageSettings: pageSettings ?? null,
+                },
+                collection: collectionDef,
+                config: cfg ?? null,
+            });
+            return new Response(JSON.stringify(composed.meta), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/meta');
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // SEO summary (aggregated dashboard data)
+    // ---------------------------------------------------------------------------
+    router.get('/seo/summary', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            // EDITOR+ only — this endpoint issues outbound GET probes for link
+            // health, mirroring the role gate on /seo/link-health.
+            const roleErr = requireRole(auth.session.role, WRITE_ROLES);
+            if (roleErr)
+                return roleErr;
+            const docs = (await safeFindMany(db().document, {
+                where: { deletedAt: null, status: 'PUBLISHED' },
+                select: { id: true, title: true, collection: true, data: true, plainText: true },
+                orderBy: { updatedAt: 'desc' },
+                take: 50,
+            }));
+            let missingMetaDescriptions = 0;
+            let missingAltText = 0;
+            const topContent = [];
+            for (const doc of docs) {
+                const data = doc.data ?? {};
+                if (!data.metaDescription && !data.seoDescription)
+                    missingMetaDescriptions++;
+                const content = typeof data.body === 'string'
+                    ? data.body
+                    : typeof data.content === 'string'
+                        ? data.content
+                        : '';
+                if (content) {
+                    const imgMatches = content.match(/<img\b[^>]*>/gi) ?? [];
+                    const noAlt = imgMatches.filter((img) => !img.includes('alt=')).length;
+                    if (noAlt > 0)
+                        missingAltText += noAlt;
+                }
+                topContent.push({
+                    id: doc.id,
+                    title: doc.title ?? 'Untitled',
+                    collection: doc.collection,
+                    score: computeLightSeoScore(data),
+                });
+            }
+            topContent.sort((a, b) => b.score - a.score);
+            let brokenInternalLinks = 0;
+            try {
+                const siteUrl = (process.env.NEXT_PUBLIC_SITE_URL ?? '').replace(/\/+$/, '');
+                // Only probe internal links (same-origin as the configured site). When
+                // NEXT_PUBLIC_SITE_URL is unset we can't classify any URL as internal,
+                // so we skip all probing rather than issuing requests to arbitrary,
+                // document-controlled hosts — that would be an SSRF oracle.
+                if (siteUrl) {
+                    const linkDocs = docs.slice(0, 10);
+                    for (const doc of linkDocs) {
+                        const urls = extractOutboundUrlsFromDocumentData(doc.data ?? {});
+                        const seen = new Set();
+                        for (const clean of urls) {
+                            if (seen.has(clean) || !clean.startsWith(siteUrl))
+                                continue;
+                            seen.add(clean);
+                            try {
+                                // safeFetch rejects private/loopback IPs and disables redirect
+                                // following, so even an internal link can't smuggle the probe
+                                // onto the internal network.
+                                const resp = await safeFetch(clean, {
+                                    method: 'GET',
+                                    headers: { ...LINK_PROBE_HEADERS },
+                                    timeoutMs: 3000,
+                                });
+                                try {
+                                    await resp.body?.cancel();
+                                }
+                                catch {
+                                    /* noop */
+                                }
+                                if (isLinkProbeIssueStatus(resp.status)) {
+                                    brokenInternalLinks++;
+                                }
+                            }
+                            catch (err) {
+                                if (err instanceof SsrfBlockedError)
+                                    continue;
+                                brokenInternalLinks++;
+                            }
+                        }
+                    }
+                }
+            }
+            catch {
+                /* best effort */
+            }
+            return json({
+                data: {
+                    totalPages: docs.length,
+                    issuesSummary: { missingMetaDescriptions, brokenInternalLinks, missingAltText },
+                    topContent: topContent.slice(0, 10),
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err);
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // SEO config (admin-editable overrides for `prenta.config.ts` seo defaults)
+    // ---------------------------------------------------------------------------
+    /** Public apex for View live / View Site — any authenticated session. */
+    router.get('/site/public-url', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const { resolvePublicSiteUrl } = await import('../../seo/public-site-url.js');
+            const result = await resolvePublicSiteUrl();
+            return json({ data: result });
+        }
+        catch (err) {
+            return internalError(err, 'site/public-url GET');
+        }
+    });
+    /**
+     * Returns:
+     *   - `static`    → the SEO config from `prenta.config.ts` (read-only, code-level)
+     *   - `overrides` → the user-edited DB overrides (or null on first boot)
+     *   - `effective` → static + overrides merged (what the runtime actually uses)
+     *   - `collections` → list of collection slugs + labels the UI should iterate
+     *
+     * The UI uses `static` to show grey "default" placeholders, `overrides` to
+     * populate the form inputs, and writes back just the changed fields via PUT.
+     */
+    router.get('/seo/config', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { getSeoOverrides, applySeoOverrides } = await import('../../seo/config-store.js');
+            const staticCfg = getPrentaConfig();
+            const overrides = await getSeoOverrides(db());
+            const effective = applySeoOverrides(staticCfg, overrides);
+            const collections = Object.entries(staticCfg?.collections ?? {})
+                .map(([slug, col]) => ({
+                slug,
+                label: col.labels?.plural ?? slug,
+                type: col.type ?? 'page',
+                urlPrefix: col.urlPrefix,
+                staticSeo: col.seo ?? null,
+                effectiveSeo: effective?.collections?.[slug]?.seo ?? null,
+            }))
+                .sort((a, b) => a.label.localeCompare(b.label));
+            return json({
+                data: {
+                    static: { site: staticCfg?.seo ?? null },
+                    overrides: overrides ?? null,
+                    effective: { site: effective?.seo ?? null },
+                    collections,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/config GET');
+        }
+    });
+    router.put('/seo/config', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body !== 'object') {
+                return errorResponse('Request body must be an object', 400);
+            }
+            // Shallow shape validation — we don't want to mirror the entire type
+            // here (the config-store merger ignores unknown keys anyway), but we do
+            // want to reject obviously malformed payloads early so the UI gets a
+            // clear 400 instead of a silent no-op.
+            const site = body.site && typeof body.site === 'object' ? body.site : undefined;
+            const collections = body.collections && typeof body.collections === 'object' ? body.collections : undefined;
+            if (site === undefined && collections === undefined) {
+                return errorResponse('Body must include at least one of `site` or `collections`', 400);
+            }
+            // Validate the title template server-side so an unsupported token can't be
+            // persisted and then silently break public title rendering.
+            if (site && typeof site.titleTemplate === 'string') {
+                const { validateTitleTemplate } = await import('../../seo/title-templates.js');
+                const result = validateTitleTemplate(site.titleTemplate);
+                if (!result.valid) {
+                    return errorResponse(result.errors.join(' '), 400);
+                }
+            }
+            const { putSeoOverrides, getSeoOverrides } = await import('../../seo/config-store.js');
+            // Merge with whatever's currently stored so the UI can PATCH a single
+            // section without wiping the other — `PUT /seo/config { site: {...} }`
+            // shouldn't blow away per-collection settings.
+            const current = (await getSeoOverrides(db())) ?? {};
+            const next = {
+                site: site !== undefined ? site : current.site,
+                collections: collections !== undefined
+                    ? { ...(current.collections ?? {}), ...collections }
+                    : current.collections,
+                // Preserve Technical-tab module settings so editing site/collection
+                // defaults never silently wipes crawl/robots/sitemap configuration.
+                module: current.module,
+            };
+            const saved = await putSeoOverrides(db(), next, auth.session.userId);
+            // Audit so changes to public SEO surface are traceable. We log a
+            // field-level diff (previous → new) for the site defaults, but redact
+            // verification token VALUES — only record which providers changed, never
+            // the token itself, since those land in public <meta> tags and shouldn't
+            // be duplicated into the audit trail.
+            try {
+                const { resolveSeoEnvironment } = await import('../../seo/robots.js');
+                const prevSite = (current.site ?? {});
+                const nextSite = (site ?? prevSite);
+                const changedFields = [];
+                for (const key of new Set([...Object.keys(prevSite), ...Object.keys(nextSite)])) {
+                    if (key === 'verification')
+                        continue;
+                    if (JSON.stringify(prevSite[key]) !== JSON.stringify(nextSite[key])) {
+                        changedFields.push({
+                            field: key,
+                            from: prevSite[key] ?? null,
+                            to: nextSite[key] ?? null,
+                        });
+                    }
+                }
+                const prevVer = (prevSite.verification ?? {});
+                const nextVer = (nextSite.verification ?? {});
+                const verificationChanged = Object.keys({ ...prevVer, ...nextVer }).filter((k) => JSON.stringify(prevVer[k]) !== JSON.stringify(nextVer[k]));
+                await logEvent({
+                    event: 'update_seo_config',
+                    userId: auth.session.userId,
+                    details: {
+                        changedFields,
+                        verificationChanged,
+                        collectionKeys: Object.keys(collections ?? {}),
+                        environment: resolveSeoEnvironment(),
+                        source: 'settings.seo',
+                    },
+                });
+            }
+            catch {
+                // Audit failures must never block the write.
+            }
+            return json({ data: saved });
+        }
+        catch (err) {
+            return internalError(err, 'seo/config PUT');
+        }
+    });
+    // Effective, computed crawl/index status for the General Settings card.
+    // Reads the SAME effective SEO config the public renderer uses, so the badge
+    // shown to editors never drifts from what search engines actually see.
+    router.get('/seo/index-status', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { getSiteIndexStatus } = await import('../../seo/index-status.js');
+            const status = await getSiteIndexStatus(db());
+            return json({ data: status });
+        }
+        catch (err) {
+            return internalError(err, 'seo/index-status GET');
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Technical SEO — sitemap status, crawl settings, robots.txt editor.
+    // All backed by the `module` block of the SEO overrides document.
+    // ---------------------------------------------------------------------------
+    /** Persist a partial patch onto the SEO module settings, preserving the rest. */
+    async function patchSeoModule(patch, userId) {
+        const { getSeoOverrides, putSeoOverrides } = await import('../../seo/config-store.js');
+        const current = (await getSeoOverrides(db())) ?? {};
+        await putSeoOverrides(db(), {
+            site: current.site,
+            collections: current.collections,
+            module: { ...(current.module ?? {}), ...patch },
+        }, userId);
+    }
+    /** Build the default robots.txt body (mirrors the public /robots.txt route). */
+    function buildDefaultRobots(request, cfg, settings) {
+        const base = siteUrlFromRequest(request, cfg);
+        const indexable = settings.indexEntireSite !== false;
+        const sitemapUrl = !indexable || cfg?.seo?.sitemap?.disabled ? undefined : `${base}/sitemap.xml`;
+        const lines = indexable
+            ? ['User-agent: *', 'Allow: /', 'Disallow: /admin', 'Disallow: /api/', '']
+            : ['User-agent: *', 'Disallow: /', ''];
+        if (indexable) {
+            lines.push(...buildAiBotRobotsLines(cfg?.seo?.robots?.aiPolicy, cfg?.seo?.robots?.blockAIBots));
+        }
+        if (sitemapUrl)
+            lines.push(`Sitemap: ${sitemapUrl}`, '');
+        return lines.join('\n');
+    }
+    router.get('/seo/sitemap/status', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { getSeoOverrides, resolveSeoModuleSettings } = await import('../../seo/config-store.js');
+            const cfg = await loadEffectiveConfig();
+            const settings = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            const base = siteUrlFromRequest(request, cfg);
+            const environment = resolveSeoEnvironment();
+            const cols = sitemapEligibleCollections(cfg, { includePosts: settings.includePostsInSitemap });
+            // Run the SAME noindex resolution the sitemap renderer uses
+            // (sitemapDocumentNoIndex → pageSettings/robots/collection/site/env), so
+            // the "excluded" badge matches what search engines actually see. A single
+            // JSON path filter on `data.noindex` never agreed with the real exclusion
+            // logic and reported 0 even when many pages were correctly withheld.
+            let pagesIncluded = 0;
+            let pagesExcluded = 0;
+            for (const col of cols) {
+                const colSeo = cfg?.collections?.[col.slug]?.seo ?? col.seo;
+                try {
+                    const docs = await db().document.findMany({
+                        where: { collection: col.slug, deletedAt: null, status: 'PUBLISHED' },
+                        select: { data: true },
+                    });
+                    for (const d of docs) {
+                        const data = d.data || {};
+                        if (sitemapDocumentNoIndex(data, colSeo, cfg?.seo, environment))
+                            pagesExcluded++;
+                        else
+                            pagesIncluded++;
+                    }
+                }
+                catch {
+                    /* best-effort: leave counts as-is for this collection */
+                }
+            }
+            const warnings = [];
+            if (!settings.sitemapEnabled)
+                warnings.push('Sitemap generation is disabled in crawl settings.');
+            if (pagesIncluded === 0)
+                warnings.push('No published pages are eligible for the sitemap.');
+            return json({
+                data: {
+                    sitemapUrl: `${base}/sitemap.xml`,
+                    lastGeneratedAt: settings.sitemapLastGeneratedAt,
+                    pagesIncluded,
+                    pagesExcluded,
+                    autoRegenerateOnPublish: settings.autoRegenerateSitemapOnPublish,
+                    errors: [],
+                    warnings,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/sitemap/status');
+        }
+    });
+    router.post('/seo/sitemap/regenerate', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const now = new Date().toISOString();
+            await patchSeoModule({ sitemapLastGeneratedAt: now }, auth.session.userId);
+            const { getSeoOverrides, resolveSeoModuleSettings } = await import('../../seo/config-store.js');
+            const cfg = await loadEffectiveConfig();
+            const settings = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            const base = siteUrlFromRequest(request, cfg);
+            const cols = sitemapEligibleCollections(cfg, { includePosts: settings.includePostsInSitemap });
+            let pagesIncluded = 0;
+            for (const col of cols) {
+                pagesIncluded += await db().document.count({
+                    where: { collection: col.slug, deletedAt: null, status: 'PUBLISHED' },
+                });
+            }
+            return json({
+                data: {
+                    sitemapUrl: `${base}/sitemap.xml`,
+                    lastGeneratedAt: now,
+                    pagesIncluded,
+                    pagesExcluded: 0,
+                    autoRegenerateOnPublish: settings.autoRegenerateSitemapOnPublish,
+                    errors: [],
+                    warnings: [],
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/sitemap/regenerate');
+        }
+    });
+    router.get('/seo/crawl-settings', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { getSeoOverrides, resolveSeoModuleSettings } = await import('../../seo/config-store.js');
+            const s = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            return json({
+                data: {
+                    indexEntireSite: s.indexEntireSite,
+                    includeImagesInSitemap: s.includeImagesInSitemap,
+                    includePostsInSitemap: s.includePostsInSitemap,
+                    sitemapEnabled: s.sitemapEnabled,
+                    autoRegenerateSitemapOnPublish: s.autoRegenerateSitemapOnPublish,
+                    pingSearchEnginesOnPublish: s.pingSearchEnginesOnPublish,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'seo/crawl-settings GET');
+        }
+    });
+    router.put('/seo/crawl-settings', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body !== 'object') {
+                return errorResponse('Request body must be an object', 400);
+            }
+            const allowed = [
+                'indexEntireSite',
+                'includeImagesInSitemap',
+                'includePostsInSitemap',
+                'sitemapEnabled',
+                'autoRegenerateSitemapOnPublish',
+                'pingSearchEnginesOnPublish',
+            ];
+            const patch = {};
+            for (const key of allowed) {
+                if (typeof body[key] === 'boolean')
+                    patch[key] = body[key];
+            }
+            if (Object.keys(patch).length === 0) {
+                return errorResponse('No valid crawl settings provided', 400);
+            }
+            // Snapshot current values so the audit trail records prev → new.
+            const { getSeoOverrides, resolveSeoModuleSettings } = await import('../../seo/config-store.js');
+            const { resolveSeoEnvironment } = await import('../../seo/robots.js');
+            const before = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            await patchSeoModule(patch, auth.session.userId);
+            try {
+                const changedFields = Object.keys(patch).map((key) => ({
+                    field: key,
+                    from: before[key] ?? null,
+                    to: patch[key],
+                }));
+                await logEvent({
+                    event: 'update_seo_config',
+                    userId: auth.session.userId,
+                    details: {
+                        section: 'crawl-settings',
+                        changedFields,
+                        environment: resolveSeoEnvironment(),
+                        source: 'settings.seo',
+                    },
+                });
+            }
+            catch {
+                /* audit best-effort */
+            }
+            return json({ data: { ok: true } });
+        }
+        catch (err) {
+            return internalError(err, 'seo/crawl-settings PUT');
+        }
+    });
+    router.get('/seo/robots', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const { getSeoOverrides, resolveSeoModuleSettings } = await import('../../seo/config-store.js');
+            const cfg = await loadEffectiveConfig();
+            const settings = resolveSeoModuleSettings(await getSeoOverrides(db()));
+            const custom = settings.robotsTxt?.trim();
+            const body = custom ? settings.robotsTxt : buildDefaultRobots(request, cfg, settings);
+            return json({ data: { body, generated: !custom } });
+        }
+        catch (err) {
+            return internalError(err, 'seo/robots GET');
+        }
+    });
+    router.put('/seo/robots', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const roleErr = requireRole(auth.session.role, ADMIN_ROLES);
+            if (roleErr)
+                return roleErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body.body !== 'string') {
+                return errorResponse('`body` (string) is required', 400);
+            }
+            if (body.body.length > 50_000) {
+                return errorResponse('robots.txt is too large (max 50KB)', 400);
+            }
+            await patchSeoModule({ robotsTxt: body.body }, auth.session.userId);
+            try {
+                await logEvent({
+                    event: 'update_seo_config',
+                    userId: auth.session.userId,
+                    details: { section: 'robots.txt' },
+                });
+            }
+            catch {
+                /* audit best-effort */
+            }
+            return json({ data: { ok: true } });
+        }
+        catch (err) {
+            return internalError(err, 'seo/robots PUT');
+        }
+    });
+}
+//# sourceMappingURL=seo-public.js.map