domma-cms 0.88.0 → 0.89.0

package/server/services/renderer.js

@@ -292,10 +292,16 @@ export async function renderPage(page, opts = {}) {
     }
     const pageBodyStyle = pageBodyStyleParts.join(';');
 
-    const seoTitle = escapeHtml(page.seo?.title || `${page.title}${site.seo?.titleSeparator || ' | '}${site.seo?.defaultTitle || site.title}`);
-    const seoDescription = escapeHtml(page.seo?.description || site.seo?.defaultDescription || '');
-    const ogImage = escapeHtml(page.seo?.image || site.seo?.defaultImage || '');
-    const seoTags = buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage});
+    const seoMeta = transformSeoMeta(buildSeoMeta({
+        page, site, baseUrl,
+        title: page.seo?.title || `${page.title}${site.seo?.titleSeparator || ' | '}${site.seo?.defaultTitle || site.title}`,
+        description: page.seo?.description || site.seo?.defaultDescription || '',
+        image: page.seo?.image || site.seo?.defaultImage || ''
+    }), {page, site, baseUrl, kind: 'page'});
+    const seoTitle = escapeHtml(seoMeta.title);
+    const seoDescription = escapeHtml(seoMeta.description);
+    const ogImage = escapeHtml(seoMeta.og?.image || seoMeta.image || '');
+    const seoTags = renderSeoTags(seoMeta);
 
     const dconfig = page.dconfig || null;
     // Escape </script> to prevent injection via dconfig values in the inline script block
@@ -510,63 +516,43 @@ function toTitleCase(str) {
 }
 
 /**
- * Build the consolidated SEO `<meta>` tag block: canonical link, Open Graph,
- * Twitter cards, JSON-LD, and a noindex hint when requested.
+ * The SEO facts of one render, raw (not escaped): what the `<title>`, the
+ * description and the tag block are built from. Plugins change it through the
+ * 'seo:meta' transform (0.89) - the SEO plugin's overrides, JSON-LD presets and
+ * social variants - before anything is escaped.
  *
- * All values are HTML-escaped at the call site (seoTitle/Description/ogImage)
- * or here (canonicalUrl). JSON-LD is JSON.stringify'd and `</script>` is
- * escaped to prevent breaking out of the script context.
+ * Shape: {title, description, image, ogType, noindex, canonical, siteName,
+ *   twitterSite, og: {title?, description?, image?}, twitter: {title?,
+ *   description?, image?, card?}, robots?, jsonLd: object[], extra: [{tag:
+ *   'meta'|'link', attrs}]}
  *
  * @param {object} args
  * @param {object} args.page - Parsed page (urlPath, seo, title)
  * @param {object} args.site - Site config (seo defaults)
- * @param {string} args.baseUrl - Absolute origin for this request, derived by
- *   the route handler. Pass empty string to skip canonical/og:url emission.
- * @param {string} args.seoTitle - Already HTML-escaped
- * @param {string} args.seoDescription - Already HTML-escaped
- * @param {string} args.ogImage - Already HTML-escaped (may be empty)
- * @returns {string}
+ * @param {string} args.baseUrl - Absolute origin for this request. Empty skips
+ *   canonical/og:url and makes no URL absolute.
+ * @param {string} args.title - The document title (raw)
+ * @param {string} args.description - Raw
+ * @param {string} args.image - Raw, may be empty
+ * @returns {object}
  */
-function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage}) {
+function buildSeoMeta({page, site, baseUrl, title, description, image}) {
     const origin = (baseUrl || '').toString().trim().replace(/\/+$/, '');
     const urlPath = page.urlPath || '/';
-    const canonicalUrl = origin ? escapeHtml(`${origin}${urlPath}`) : '';
-    const ogType = escapeHtml(page.seo?.ogType || 'article');
-    const siteName = escapeHtml(site.title || '');
-    const twitterHandle = escapeHtml(site.social?.twitter || '');
-    const noindex = page.seo?.noindex === true;
-
-    const tags = [];
-    if (canonicalUrl) tags.push(`<link rel="canonical" href="${canonicalUrl}">`);
-    if (noindex) tags.push('<meta name="robots" content="noindex, nofollow">');
-
-    tags.push(`<meta property="og:title" content="${seoTitle}">`);
-    tags.push(`<meta property="og:description" content="${seoDescription}">`);
-    tags.push(`<meta property="og:type" content="${ogType}">`);
-    if (siteName) tags.push(`<meta property="og:site_name" content="${siteName}">`);
-    if (canonicalUrl) tags.push(`<meta property="og:url" content="${canonicalUrl}">`);
-    if (ogImage) tags.push(`<meta property="og:image" content="${ogImage}">`);
-
-    tags.push(`<meta name="twitter:card" content="${ogImage ? 'summary_large_image' : 'summary'}">`);
-    tags.push(`<meta name="twitter:title" content="${seoTitle}">`);
-    tags.push(`<meta name="twitter:description" content="${seoDescription}">`);
-    if (ogImage) tags.push(`<meta name="twitter:image" content="${ogImage}">`);
-    if (twitterHandle) tags.push(`<meta name="twitter:site" content="${twitterHandle}">`);
+    const canonical = origin ? `${origin}${urlPath}` : '';
+    const absImage = absoluteUrl(image, origin);
 
     // JSON-LD WebPage schema - gives search engines a structured summary.
     // Omit `url` when no baseUrl, since a relative URL in JSON-LD is invalid.
-    const jsonLd = {
+    const webPage = {
         '@context': 'https://schema.org',
         '@type': 'WebPage',
         name: page.title || '',
         description: page.seo?.description || site.seo?.defaultDescription || ''
     };
-    if (canonicalUrl) jsonLd.url = origin + urlPath;
-    if (page.seo?.image || site.seo?.defaultImage) {
-        jsonLd.image = page.seo?.image || site.seo?.defaultImage;
-    }
-    const jsonLdString = JSON.stringify(jsonLd).replace(/<\/script>/gi, '<\\/script>');
-    tags.push(`<script type="application/ld+json">${jsonLdString}</script>`);
+    if (canonical) webPage.url = canonical;
+    if (absImage) webPage.image = absImage;
+    const jsonLd = [webPage];
 
     // BreadcrumbList JSON-LD - emit whenever the page has a non-trivial path
     // and an origin is known (Schema.org requires absolute URLs in `item`).
@@ -574,7 +560,7 @@ function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage})
     // even when the on-page nav hides it.
     const breadcrumbItems = buildBreadcrumbItems(page, site);
     if (origin && breadcrumbItems.length > 1) {
-        const breadcrumbJsonLd = {
+        jsonLd.push({
             '@context': 'https://schema.org',
             '@type': 'BreadcrumbList',
             itemListElement: breadcrumbItems.map((item, i) => ({
@@ -583,9 +569,96 @@ function buildSeoTags({page, site, baseUrl, seoTitle, seoDescription, ogImage})
                 name: item.name,
                 item: origin + item.urlPath
             }))
-        };
-        const breadcrumbString = JSON.stringify(breadcrumbJsonLd).replace(/<\/script>/gi, '<\\/script>');
-        tags.push(`<script type="application/ld+json">${breadcrumbString}</script>`);
+        });
+    }
+
+    return {
+        title,
+        description,
+        image: absImage,
+        ogType: page.seo?.ogType || 'article',
+        noindex: page.seo?.noindex === true,
+        canonical,
+        siteName: site.title || '',
+        twitterSite: site.social?.twitter || '',
+        og: {},
+        twitter: {},
+        jsonLd,
+        extra: []
+    };
+}
+
+/** An absolute URL for og:image and JSON-LD: crawlers ignore relative ones. */
+function absoluteUrl(url, origin) {
+    const u = String(url || '').trim();
+    if (!u || !origin || /^[a-z][a-z0-9+.-]*:/i.test(u) || u.startsWith('//')) return u;
+    return `${origin}${u.startsWith('/') ? '' : '/'}${u}`;
+}
+
+/**
+ * Run the 'seo:meta' transforms. A transform that throws is logged and
+ * skipped: SEO extras never take a page down.
+ */
+function transformSeoMeta(meta, context) {
+    try {
+        const out = applyTransforms('seo:meta', meta, context);
+        return out && typeof out === 'object' ? out : meta;
+    } catch (err) {
+        console.warn(`[seo] a seo:meta transform failed, using the page's own: ${err.message}`);
+        return meta;
+    }
+}
+
+const SAFE_ATTR = /^[a-z][a-z0-9:_-]*$/i;
+
+/**
+ * Build the consolidated SEO `<meta>` tag block from buildSeoMeta()'s model:
+ * canonical link, Open Graph, Twitter cards, JSON-LD, and a robots hint.
+ *
+ * Every value is escaped here. JSON-LD is JSON.stringify'd with `<` escaped,
+ * so no `</script>` or `<!--` can break out of the script context.
+ *
+ * @param {object} meta
+ * @returns {string}
+ */
+function renderSeoTags(meta) {
+    const e = escapeHtml;
+    const ogTitle = meta.og?.title || meta.title;
+    const ogDescription = meta.og?.description ?? meta.description;
+    const ogImage = meta.og?.image || meta.image;
+    const twTitle = meta.twitter?.title || ogTitle;
+    const twDescription = meta.twitter?.description ?? ogDescription;
+    const twImage = meta.twitter?.image || ogImage;
+    const robots = meta.robots || (meta.noindex ? 'noindex, nofollow' : '');
+
+    const tags = [];
+    if (meta.canonical) tags.push(`<link rel="canonical" href="${e(meta.canonical)}">`);
+    if (robots) tags.push(`<meta name="robots" content="${e(robots)}">`);
+
+    tags.push(`<meta property="og:title" content="${e(ogTitle)}">`);
+    tags.push(`<meta property="og:description" content="${e(ogDescription)}">`);
+    tags.push(`<meta property="og:type" content="${e(meta.ogType)}">`);
+    if (meta.siteName) tags.push(`<meta property="og:site_name" content="${e(meta.siteName)}">`);
+    if (meta.canonical) tags.push(`<meta property="og:url" content="${e(meta.canonical)}">`);
+    if (ogImage) tags.push(`<meta property="og:image" content="${e(ogImage)}">`);
+
+    tags.push(`<meta name="twitter:card" content="${e(meta.twitter?.card || (twImage ? 'summary_large_image' : 'summary'))}">`);
+    tags.push(`<meta name="twitter:title" content="${e(twTitle)}">`);
+    tags.push(`<meta name="twitter:description" content="${e(twDescription)}">`);
+    if (twImage) tags.push(`<meta name="twitter:image" content="${e(twImage)}">`);
+    if (meta.twitterSite) tags.push(`<meta name="twitter:site" content="${e(meta.twitterSite)}">`);
+
+    for (const x of Array.isArray(meta.extra) ? meta.extra : []) {
+        if (!x || (x.tag !== 'meta' && x.tag !== 'link') || !x.attrs || typeof x.attrs !== 'object') continue;
+        const attrs = Object.entries(x.attrs).filter(([k, v]) => SAFE_ATTR.test(k) && v !== undefined && v !== null)
+            .map(([k, v]) => `${k}="${e(v)}"`).join(' ');
+        if (attrs) tags.push(`<${x.tag} ${attrs}>`);
+    }
+
+    for (const block of Array.isArray(meta.jsonLd) ? meta.jsonLd : []) {
+        if (!block || typeof block !== 'object') continue;
+        const json = JSON.stringify(block).replace(/</g, '\\u003c');
+        tags.push(`<script type="application/ld+json">${json}</script>`);
     }
 
     return tags.join('\n    ');
@@ -926,11 +999,9 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
         return String(val);
     });
 
-    const seoTitle = escapeHtml(seoMeta.title ?? site.seo?.defaultTitle ?? site.title ?? 'Blog');
-    const seoDescription = escapeHtml(seoMeta.description ?? site.seo?.defaultDescription ?? '');
-    const ogImage = escapeHtml(seoMeta.ogImage ?? '');
-
     // Plugin fragments use the unified SEO builder with a synthetic page object.
+    // `item` ({type, id}) lets the 'seo:meta' transform know WHAT is being
+    // shown, not just where - optional; the SEO plugin keys its overrides by URL.
     const syntheticPage = {
         urlPath: seoMeta.urlPath || '/',
         title: seoMeta.title || site.title || '',
@@ -939,9 +1010,19 @@ export async function renderBlogPage(templatePath, data = {}, seoMeta = {}) {
             image: seoMeta.ogImage,
             ogType: seoMeta.ogType || 'website',
             noindex: seoMeta.noindex === true
-        }
+        },
+        ...(seoMeta.item && {item: seoMeta.item})
     };
-    const seoTags = buildSeoTags({page: syntheticPage, site, baseUrl, seoTitle, seoDescription, ogImage});
+    const meta = transformSeoMeta(buildSeoMeta({
+        page: syntheticPage, site, baseUrl,
+        title: seoMeta.title ?? site.seo?.defaultTitle ?? site.title ?? 'Blog',
+        description: seoMeta.description ?? site.seo?.defaultDescription ?? '',
+        image: seoMeta.ogImage ?? ''
+    }), {page: syntheticPage, site, baseUrl, kind: 'plugin'});
+    const seoTitle = escapeHtml(meta.title);
+    const seoDescription = escapeHtml(meta.description);
+    const ogImage = escapeHtml(meta.og?.image || meta.image || '');
+    const seoTags = renderSeoTags(meta);
 
     // Both render paths resolve the theme the same way. Wiring one and not the
     // other is the standing trap in this file.

package/server/services/siteGitignore.js

@@ -84,9 +84,114 @@ export const PRIVATE_DATA = [
     'contacts', 'contacts-contacts', 'contacts-groups', 'roles', 'user-profiles',
     'user-messages', 'user-message-threads', 'analytics-events', 'enquiries',
     'blog-comments', 'invoices', 'invoice-receivers', 'invoice-issuers',
-    'surveys-contacts', 'surveys-invites'
+    'surveys-contacts', 'surveys-invites',
+    // Paid plugins' visitor and customer records (0.88.1): Cart Pro's orders and
+    // discount codes, Calendar's RSVPs, the job board's people and applications.
+    'shop-orders', 'shop-pro-codes', 'calendar-rsvps',
+    'jb-applications', 'jb-candidate-profiles', 'jb-signups'
 ];
 
+/**
+ * The collection a form stores its submissions in - the same choice as the
+ * submit route (routes/api/forms.js): the collection action's slug when it is
+ * on, otherwise the form's own slug. An action slug set but switched off is
+ * kept out too: ensureCollectionForForm provisions into it.
+ *
+ * @param {object} form - Parsed content/forms/<slug>.json
+ * @returns {string[]} collection slugs
+ */
+export function formDataCollections(form) {
+    const action = form?.actions?.collection;
+    const safe = (v) => (typeof v === 'string' && /^[a-z0-9][a-z0-9_-]*$/i.test(v) ? v : '');
+    return [...new Set([safe(action?.slug), safe(form?.slug)].filter(Boolean))];
+}
+
+/** `[form name="x" /]` (or slug="x") anywhere in a text. */
+function embeddedFormNames(text) {
+    const out = new Set();
+    for (const m of String(text).matchAll(/\[form\b([^\]]*)\]/gi)) {
+        const a = m[1].match(/\b(?:name|slug)\s*=\s*["']?([A-Za-z0-9_-]+)/);
+        if (a) out.add(a[1]);
+    }
+    return out;
+}
+
+function readTree(dir, exts, out = [], depth = 0) {
+    if (depth > 6) return out;
+    let entries = [];
+    try { entries = fs.readdirSync(dir, {withFileTypes: true}); } catch { return out; }
+    for (const e of entries) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) { if (e.name !== 'media' && e.name !== 'collections') readTree(full, exts, out, depth + 1); }
+        else if (exts.some(x => e.name.endsWith(x))) out.push(full);
+    }
+    return out;
+}
+
+/**
+ * The collections this site's VISITORS write to, from what is on disk - like
+ * PRIVATE_DATA, but only the site knows which they are. Before 0.88.1 nothing
+ * did this: a form storing in `find-a-tutor` had every enquiry - names, emails,
+ * phone numbers - committed to the site repo.
+ *
+ * "A form writes there" is not enough: every collection created in the admin
+ * gets a form of its own (ensureFormForCollection), and a content collection
+ * (FAQs, testimonials) must stay tracked. So a collection counts when
+ *   - a form storing in it is EMBEDDED somewhere in content ([form name=...]), or
+ *   - it was made by a form (schema meta.generatedFromForm).
+ * The submit route adds the rest the moment a visitor's entry is stored
+ * (keepFormDataOut) - the one signal that is never wrong.
+ *
+ * @param {string} siteRoot
+ * @returns {string[]} sorted, de-duplicated
+ */
+export function siteFormDataCollections(siteRoot) {
+    const content = path.join(siteRoot, 'content');
+    const embedded = new Set();
+    for (const f of readTree(content, ['.md', '.html', '.json'])) {
+        if (f.startsWith(path.join(content, 'forms') + path.sep)) continue;
+        try { for (const n of embeddedFormNames(fs.readFileSync(f, 'utf8'))) embedded.add(n); } catch { /* skip */ }
+    }
+    const out = new Set();
+    const formsDir = path.join(content, 'forms');
+    let files = [];
+    try { files = fs.readdirSync(formsDir).filter(f => f.endsWith('.json')); } catch { /* no forms */ }
+    for (const f of files) {
+        try {
+            const form = JSON.parse(fs.readFileSync(path.join(formsDir, f), 'utf8'));
+            if (embedded.has(form.slug) || embedded.has(f.replace(/\.json$/, ''))) for (const c of formDataCollections(form)) out.add(c);
+        } catch { /* an unreadable form keeps nothing out - and breaks nothing */ }
+    }
+    const colDir = path.join(content, 'collections');
+    let cols = [];
+    try { cols = fs.readdirSync(colDir); } catch { /* none */ }
+    for (const c of cols) {
+        try {
+            const schema = JSON.parse(fs.readFileSync(path.join(colDir, c, 'schema.json'), 'utf8'));
+            if (schema?.meta?.generatedFromForm) out.add(c);
+        } catch { /* no schema */ }
+    }
+    return [...out].sort();
+}
+
+/** The rule that keeps one collection's entries out. */
+export const collectionDataRule = (slug) => `/content/collections/${slug}/data.json`;
+
+/**
+ * Keep a collection a visitor has just written to out of a managed .gitignore -
+ * called by the submit route once an entry is stored, so submissions never wait
+ * for the next regeneration to stop being committed. Same guard as
+ * allowInGitignore: a missing or hand-written file is left alone.
+ *
+ * @param {string} siteRoot
+ * @param {string} slug - The collection the entry went into
+ * @returns {string[]} The rules actually added
+ */
+export function keepSubmissionsOut(siteRoot, slug) {
+    if (!/^[a-z0-9][a-z0-9_-]*$/i.test(String(slug || '')) || PRIVATE_DATA.includes(slug)) return [];
+    return allowInGitignore(siteRoot, [collectionDataRule(slug)]);
+}
+
 /**
  * Lines bin/update.js appends when it cannot find them VERBATIM. They are
  * already ignored by `/*` and `/plugins/*`, but writing them out keeps the
@@ -151,10 +256,11 @@ export function pluginContentRules(name, rel) {
  * @param {Object<string,string[]>} [opts.pluginContent={}] - Extra content folders in distributed plugins
  * @param {string[]} [opts.sitePublic=[]] - Site-added entries directly under public/
  * @param {string[]} [opts.extras=[]] - Other site-owned top-level entries (docs, tools, README.md)
+ * @param {string[]} [opts.formData=[]] - Collections the site's forms store submissions in (siteFormDataCollections)
  * @param {string[]} [opts.siteRules=[]] - The site-specific section
  * @returns {string}
  */
-export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic = [], extras = [], siteRules = []} = {}) {
+export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic = [], extras = [], formData = [], siteRules = []} = {}) {
     const L = [
         MANAGED_HEADER,
         '# This repo holds the site\'s CONTENT only. Everything is ignored, then what',
@@ -192,7 +298,12 @@ export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic
     L.push('', '# Schemas the CMS rewrites on every boot - engine-owned, not authored');
     for (const c of ENGINE_SCHEMAS) L.push(`/content/collections/${c}/schema.json`);
     L.push('', '# Secrets, visitor-submitted and per-user data, runtime state');
-    for (const c of PRIVATE_DATA) L.push(`/content/collections/${c}/data.json`);
+    for (const c of PRIVATE_DATA) L.push(collectionDataRule(c));
+    const submitted = [...new Set(formData)].filter(c => !PRIVATE_DATA.includes(c)).sort();
+    if (submitted.length) {
+        L.push('', '# Form submissions - what visitors sent (siteFormDataCollections)');
+        for (const c of submitted) L.push(collectionDataRule(c));
+    }
     L.push(
         '/content/users/',
         '/content/sessions/',

package/server/services/sitemap.js

@@ -1,13 +1,18 @@
 /**
  * Sitemap Service
- * Builds sitemap.xml from the page list. Filter logic lives in
- * shouldIncludeInSitemap() - see the TODO below.
+ * Builds sitemap.xml from the page list plus every plugin sitemap source
+ * (hooks.registerSitemapSource, 0.89). Page filter logic lives in
+ * shouldIncludeInSitemap().
  *
  * Cache: callers should wrap generate() with the 'sitemap' tag so it
  * invalidates whenever a page is created, updated, renamed, or deleted.
  */
 import {listPages} from './content.js';
 import {getConfig} from '../config.js';
+import {applyTransforms, getSitemapSources} from './hooks.js';
+
+const CHANGEFREQ = new Set(['always', 'hourly', 'daily', 'weekly', 'monthly', 'yearly', 'never']);
+const validPriority = (p) => p !== undefined && p !== null && p !== '' && Number(p) >= 0 && Number(p) <= 1;
 
 /**
  * Decide whether a page should appear in sitemap.xml.
@@ -23,30 +28,84 @@ import {getConfig} from '../config.js';
  */
 function shouldIncludeInSitemap(page) {
     return page.status === 'published'
-        && page.visibility === 'public'
+        && (page.visibility || 'public') === 'public'
         && page.urlPath !== '/404'
         && !page.seo?.noindex;
 }
 
+/** The sitemap entry of a core page. */
+function pageEntry(page) {
+    return {urlPath: page.urlPath, title: page.title || '', lastmod: page.updatedAt || null, source: 'pages'};
+}
+
+/**
+ * Every URL the sitemap lists: core pages, then each plugin's sitemap source
+ * (hooks.registerSitemapSource), de-duplicated by path (the first wins), then
+ * the 'sitemap:entries' transform - where the SEO plugin drops or re-weights
+ * entries. Plain objects, so the SEO audit can use the same list.
+ *
+ * @param {string} baseUrl - Absolute origin (trailing slash stripped here)
+ * @param {{log?: {warn: Function}}} [opts]
+ * @returns {Promise<Array<{urlPath: string, title?: string, lastmod?: string|null,
+ *   changefreq?: string, priority?: number, image?: string, source: string}>>}
+ */
+export async function listSitemapEntries(baseUrl, {log = console} = {}) {
+    const normalised = normaliseBaseUrl(baseUrl);
+    const pages = await listPages();
+    const entries = pages.filter(shouldIncludeInSitemap).map(pageEntry);
+    const seen = new Set(entries.map(e => e.urlPath));
+
+    for (const source of getSitemapSources()) {
+        let items = [];
+        try {
+            items = await source.list({baseUrl: normalised});
+        } catch (err) {
+            log.warn?.(`[sitemap] source "${source.id}" skipped: ${err.message}`);
+            continue;
+        }
+        for (const item of Array.isArray(items) ? items : []) {
+            const urlPath = typeof item?.urlPath === 'string' ? item.urlPath.trim() : '';
+            if (!urlPath.startsWith('/') || urlPath.startsWith('//') || seen.has(urlPath)) continue;
+            seen.add(urlPath);
+            entries.push({
+                urlPath,
+                title: typeof item.title === 'string' ? item.title : '',
+                lastmod: item.lastmod || null,
+                ...(CHANGEFREQ.has(item.changefreq) && {changefreq: item.changefreq}),
+                ...(validPriority(item.priority) && {priority: Number(item.priority)}),
+                ...(typeof item.image === 'string' && item.image && {image: item.image}),
+                source: source.id
+            });
+        }
+    }
+
+    try {
+        const out = applyTransforms('sitemap:entries', entries, {baseUrl: normalised});
+        return Array.isArray(out) ? out.filter(e => e && typeof e.urlPath === 'string') : entries;
+    } catch (err) {
+        log.warn?.(`[sitemap] a sitemap:entries transform failed, using the plain list: ${err.message}`);
+        return entries;
+    }
+}
+
 /**
  * Build the full sitemap.xml document as a string.
  *
  * @param {string} baseUrl - Absolute origin (e.g. 'https://example.com'),
  *   typically derived from the incoming request. Trailing slash is stripped.
+ * @param {{log?: {warn: Function}}} [opts]
  * @returns {Promise<string>}
  */
-export async function generate(baseUrl) {
+export async function generate(baseUrl, opts = {}) {
     const normalised = normaliseBaseUrl(baseUrl);
-    const pages = await listPages();
-    const entries = pages
-        .filter(shouldIncludeInSitemap)
-        .map(page => buildUrlEntry(page, normalised));
-
-    return wrapInUrlset(entries);
+    const entries = await listSitemapEntries(normalised, opts);
+    const withImages = entries.some(e => e.image);
+    return wrapInUrlset(entries.map(e => buildUrlEntry(e, normalised)), {withImages});
 }
 
 /**
  * Build the robots.txt document. Points at /sitemap.xml on the given base URL.
+ * The 'robots:lines' transform may change the lines (the SEO plugin's editor).
  *
  * @param {string} baseUrl - Absolute origin, typically derived from the
  *   incoming request.
@@ -58,7 +117,7 @@ export function buildRobotsTxt(baseUrl) {
     const sitemapUrl = normalised ? `${normalised}/sitemap.xml` : '/sitemap.xml';
     const extra = (site.seo?.robotsExtra || '').toString().trim();
 
-    const lines = [
+    let lines = [
         'User-agent: *',
         'Allow: /',
         'Disallow: /admin/',
@@ -67,6 +126,12 @@ export function buildRobotsTxt(baseUrl) {
         `Sitemap: ${sitemapUrl}`
     ];
     if (extra) lines.push('', extra);
+    try {
+        const out = applyTransforms('robots:lines', lines, {baseUrl: normalised, sitemapUrl});
+        if (Array.isArray(out)) lines = out.map(l => String(l ?? ''));
+    } catch (err) {
+        console.warn(`[sitemap] a robots:lines transform failed, using the default: ${err.message}`);
+    }
     return lines.join('\n') + '\n';
 }
 
@@ -74,20 +139,26 @@ export function buildRobotsTxt(baseUrl) {
 // Helpers
 // ---------------------------------------------------------------------------
 
-function buildUrlEntry(page, baseUrl) {
-    const loc = escapeXml(baseUrl ? `${baseUrl}${page.urlPath}` : page.urlPath);
-    const lastmod = page.updatedAt
-        ? new Date(page.updatedAt).toISOString()
-        : null;
+function buildUrlEntry(entry, baseUrl) {
+    const loc = escapeXml(baseUrl ? `${baseUrl}${entry.urlPath}` : entry.urlPath);
+    const when = entry.lastmod ? new Date(entry.lastmod) : null;
+    const lastmod = when && !Number.isNaN(when.getTime()) ? when.toISOString() : null;
 
     const parts = [`<loc>${loc}</loc>`];
     if (lastmod) parts.push(`<lastmod>${lastmod}</lastmod>`);
+    if (entry.changefreq) parts.push(`<changefreq>${escapeXml(entry.changefreq)}</changefreq>`);
+    if (validPriority(entry.priority)) parts.push(`<priority>${Number(entry.priority).toFixed(1)}</priority>`);
+    if (entry.image) {
+        const img = /^https?:\/\//i.test(entry.image) ? entry.image : `${baseUrl}${entry.image.startsWith('/') ? '' : '/'}${entry.image}`;
+        parts.push(`<image:image><image:loc>${escapeXml(img)}</image:loc></image:image>`);
+    }
     return `  <url>\n    ${parts.join('\n    ')}\n  </url>`;
 }
 
-function wrapInUrlset(entries) {
+function wrapInUrlset(entries, {withImages = false} = {}) {
+    const ns = withImages ? ' xmlns:image="http://www.google.com/schemas/sitemap-image/1.1"' : '';
     return `<?xml version="1.0" encoding="UTF-8"?>
-<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${ns}>
 ${entries.join('\n')}
 </urlset>
 `;