domma-cms 0.88.1 → 0.89.0

package/plugins/seo/server/registry.js

@@ -0,0 +1,57 @@
+/**
+ * SEO's door for extensions - how SEO Pro adds to the free SEO without
+ * replacing it (the Shopping Cart's pattern, lib/extensions.js there).
+ *
+ * It lives on `globalThis` under a registered symbol, so an extension reaches
+ * it WITHOUT importing a file from this plugin. An extension registers from its
+ * `onReady` hook, when every plugin has loaded:
+ *
+ *   const seo = globalThis[Symbol.for('domma.seo')];
+ *   if (seo?.version >= 1) seo.register('seo-pro', {
+ *       label: 'SEO Pro',
+ *       tabs: [{key, label, icon, module, help}]     // admin tabs in the SEO screen
+ *   });
+ *   seo.on('audit', (audit) => ...);                // after every audit
+ *
+ * and reads through `seo.services` (listEntries, auditList, fetchPage,
+ * scanHtml, analyse, audit {latest, summary, run}, redirects {list, match, add}).
+ * A lapsed licence means the extension never loads and SEO carries on alone.
+ */
+export const KEY = Symbol.for('domma.seo');
+export const VERSION = 1;
+
+export function seoRegistry() {
+    if (globalThis[KEY]?.version === VERSION) return globalThis[KEY];
+    const extensions = new Map();
+    const listeners = new Map();
+    const reg = {
+        version: VERSION,
+        services: {},
+        register(owner, ext = {}) {
+            if (!/^[a-z0-9-]{2,60}$/.test(String(owner))) throw new Error('An extension needs its plugin name.');
+            extensions.set(owner, {
+                owner,
+                label: String(ext.label || owner),
+                tabs: (Array.isArray(ext.tabs) ? ext.tabs : []).filter(t => t && /^[a-z0-9-]+$/.test(t.key) && typeof t.module === 'string' && t.module.startsWith('/plugins/')),
+                order: Number(ext.order) || 0
+            });
+        },
+        unregister(owner) {
+            extensions.delete(owner);
+            for (const set of listeners.values()) for (const l of [...set]) if (l.owner === owner) set.delete(l);
+        },
+        list() { return [...extensions.values()].sort((a, b) => a.order - b.order); },
+        on(event, fn, owner = '') {
+            if (typeof fn !== 'function') return;
+            if (!listeners.has(event)) listeners.set(event, new Set());
+            listeners.get(event).add({fn, owner});
+        },
+        emit(event, payload) {
+            for (const {fn} of listeners.get(event) || []) {
+                try { Promise.resolve(fn(payload)).catch(() => {}); } catch { /* an extension never breaks SEO */ }
+            }
+        }
+    };
+    globalThis[KEY] = reg;
+    return reg;
+}

package/plugins/seo/server/store.js

@@ -0,0 +1,76 @@
+/**
+ * SEO - the plugin's own data, in plugins/seo/data (kept by updates, never
+ * bundled). Held in memory - the redirect guard and the 'seo:meta' transform
+ * run on every request and must not touch the disk - and written back a moment
+ * after each change. A file changed on disk (a restore, another tool) is read
+ * again within a few seconds.
+ *
+ *   redirects.json  {rules: [...]}                       see admin/lib/redirects.js
+ *   overrides.json  {"/path": {title, description, image, noindex, focus}}
+ *   audit.json      {at, origin, results: [...]}          the last audit
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+function jsonFile(file, empty) {
+    let value = read();
+    let mtime = stat();
+    let timer = null;
+    let checked = Date.now();
+
+    function stat() { try { return fs.statSync(file).mtimeMs; } catch { return 0; } }
+    function read() {
+        try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return structuredClone(empty); }
+    }
+    function flush() {
+        timer = null;
+        try {
+            fs.mkdirSync(path.dirname(file), {recursive: true});
+            fs.writeFileSync(`${file}.tmp`, JSON.stringify(value, null, 1));
+            fs.renameSync(`${file}.tmp`, file);
+            mtime = stat();
+        } catch { /* tried again with the next change */ }
+    }
+    return {
+        get() {
+            const now = Date.now();
+            if (!timer && now - checked > 3000) {
+                checked = now;
+                const m = stat();
+                if (m && m !== mtime) { value = read(); mtime = m; }
+            }
+            return value;
+        },
+        set(next, {soon = 500} = {}) {
+            value = next;
+            if (timer) clearTimeout(timer);
+            timer = setTimeout(flush, soon);
+            timer.unref?.();
+            return value;
+        },
+        flush() { if (timer) { clearTimeout(timer); flush(); } }
+    };
+}
+
+export function createStore(dataDir) {
+    const redirects = jsonFile(path.join(dataDir, 'redirects.json'), {rules: []});
+    const overrides = jsonFile(path.join(dataDir, 'overrides.json'), {});
+    const audit = jsonFile(path.join(dataDir, 'audit.json'), {at: null, origin: '', results: []});
+    return {
+        rules: () => (Array.isArray(redirects.get().rules) ? redirects.get().rules : []),
+        setRules: (rules, opts) => redirects.set({rules}, opts),
+        overrides: () => overrides.get() || {},
+        override: (urlPath) => overrides.get()?.[urlPath] || null,
+        setOverride(urlPath, fields) {
+            const all = {...overrides.get()};
+            const clean = Object.fromEntries(Object.entries(fields || {}).filter(([, v]) => v !== '' && v !== null && v !== undefined && v !== false));
+            if (Object.keys(clean).length) all[urlPath] = clean;
+            else delete all[urlPath];
+            overrides.set(all);
+            return all[urlPath] || null;
+        },
+        audit: () => audit.get(),
+        setAudit: (a) => audit.set(a, {soon: 100}),
+        close() { redirects.flush(); overrides.flush(); audit.flush(); }
+    };
+}

package/plugins/seo/tests/seo.test.js

@@ -0,0 +1,192 @@
+/** SEO - the pure parts: redirects, reading and judging a page, settings, structured data, robots. */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {chains, checkRule, matchRedirect, normalisePath, onMoved} from '../admin/lib/redirects.js';
+import {analyse, attrs, decode, scanHtml, siteIssues, snippet} from '../admin/lib/analyse.js';
+import {checkSettings, DEFAULT_SETTINGS, excluded, mergeDefaults} from '../admin/lib/settings.js';
+import {applySeo, organisationLd, robotsLines} from '../admin/lib/schema.js';
+
+const rule = (from, to, code = 301, id = from) => ({id, from, to, code});
+
+test('paths: trailing slashes, case, doubled slashes and queries do not matter', () => {
+    assert.equal(normalisePath('/About/'), '/about');
+    assert.equal(normalisePath('about'), '/about');
+    assert.equal(normalisePath('//a///b/?x=1#y'), '/a/b');
+    assert.equal(normalisePath('/'), '/');
+    assert.equal(normalisePath(''), '');
+    assert.equal(normalisePath('/caf%C3%A9'), '/café');
+});
+
+test('redirects: exact before prefix, the longest prefix wins, the query travels', () => {
+    const rules = [rule('/old', '/new'), rule('/news/*', '/blog/*'), rule('/news/2019/*', '/archive', 302), rule('/gone', '', 410)];
+    assert.deepEqual(matchRedirect(rules, '/OLD/?utm=x').location, '/new?utm=x');
+    assert.equal(matchRedirect(rules, '/news/hello').location, '/blog/hello');
+    assert.equal(matchRedirect(rules, '/news').location, '/blog', 'the prefix itself goes to the target root');
+    assert.equal(matchRedirect(rules, '/news/2019/x').location, '/archive');
+    assert.equal(matchRedirect(rules, '/news/2019/x').code, 302);
+    assert.equal(matchRedirect(rules, '/gone').code, 410);
+    assert.equal(matchRedirect(rules, '/newsletter'), null, 'a prefix matches whole segments');
+    assert.equal(matchRedirect([rule('/a', '/b?ref=1')], '/a?x=2').location, '/b?ref=1', 'a target with its own query keeps it');
+    assert.equal(matchRedirect([rule('/a', 'https://ex.com/b')], '/a').location, 'https://ex.com/b');
+});
+
+test('redirect rules are checked: self, loops, duplicates, the admin, bad targets', () => {
+    const ok = checkRule({from: '/Old-Page/', to: '/new-page'});
+    assert.deepEqual(ok.errors, {});
+    assert.equal(ok.rule.from, '/old-page');
+    assert.equal(checkRule({from: '/a', to: '/a'}).errors.to, 'It would redirect to itself.');
+    assert.match(checkRule({from: '/b', to: '/a'}, [rule('/a', '/b')]).errors.to, /loop/);
+    assert.match(checkRule({from: '/c', to: '/a'}, [rule('/a', '/b'), rule('/b', '/c')]).errors.to, /loop/, 'a longer loop too');
+    assert.match(checkRule({from: '/a', to: '/x'}, [rule('/a', '/b')]).errors.from, /already/);
+    assert.ok(checkRule({from: '/admin/x', to: '/y'}).errors.from);
+    assert.ok(checkRule({from: '/*', to: '/y'}).errors.from);
+    assert.ok(checkRule({from: '/a', to: 'javascript:alert(1)'}).errors.to);
+    assert.ok(checkRule({from: '/a', to: '//evil.example'}).errors.to);
+    assert.ok(checkRule({from: '/a', to: '/b/*'}).errors.to, 'a * needs a prefix rule');
+    assert.deepEqual(checkRule({from: '/a/*', to: '/b/*'}).errors, {});
+    assert.deepEqual(checkRule({from: '/a', code: 410}).errors, {}, 'gone needs no target');
+    assert.ok(checkRule({from: '/a', to: '/b', code: 303}).errors.code);
+});
+
+test('a moved page: a redirect is added, older ones re-aimed, none from the new address', () => {
+    let rules = [rule('/older', '/old', 301, 'r1'), rule('/new', '/elsewhere', 301, 'r2')];
+    rules = onMoved(rules, '/old', '/new', {id: 'r3', now: 'T'});
+    assert.deepEqual(rules.map(r => [r.from, r.to]), [['/older', '/new'], ['/old', '/new']]);
+    assert.equal(rules.at(-1).auto, true);
+    assert.deepEqual(chains(rules), [], 'no chains left');
+    assert.deepEqual(chains([rule('/a', '/b', 301, 'a'), rule('/b', '/c', 301, 'b')]).map(c => [c.rule.id, c.via.id]), [['a', 'b']]);
+    assert.equal(onMoved(rules, '/x', '/x'), rules, 'no move, no change');
+});
+
+const PAGE = `<!doctype html><html lang="en"><head>
+<title>Garden tools &amp; seeds | Shop</title>
+<meta name="description" content="Everything for the garden: garden tools, seeds and advice from people who grow things for a living.">
+<link rel="canonical" href="https://ex.com/garden-tools">
+<meta property="og:image" content="https://ex.com/a.jpg">
+<script type="application/ld+json">{"@type":"WebPage"}</script>
+<script type="application/ld+json">{"@graph":[{"@type":"BreadcrumbList"}]}</script>
+</head><body>
+<!-- <h1>not this</h1> -->
+<script>document.write('<h1>nor this</h1>')</script>
+<h1>Garden tools</h1><p>Our garden tools are made to last. Choose from forks, spades and trowels.</p>
+<h2>Forks</h2><h4>Skipped a level</h4>
+<img src="/a.jpg" alt="A fork"><img src="/b.jpg"><img src="/c.jpg" alt=""><img src="/d.jpg" role="presentation">
+<a href="/spades">Spades</a> <a href="https://other.example/">Other</a> <a href="#top">Top</a>
+</body></html>`;
+
+test('scanHtml: what a crawler sees, ignoring scripts and comments', () => {
+    const f = scanHtml(PAGE);
+    assert.equal(f.title, 'Garden tools & seeds | Shop');
+    assert.match(f.description, /^Everything for the garden/);
+    assert.equal(f.canonical, 'https://ex.com/garden-tools');
+    assert.equal(f.lang, 'en');
+    assert.deepEqual(f.headings.map(h => `${h.level}:${h.text}`), ['1:Garden tools', '2:Forks', '4:Skipped a level']);
+    assert.deepEqual(f.images.map(i => i.alt), ['A fork', null, '', null]);
+    assert.equal(f.links.length, 3);
+    assert.deepEqual(f.jsonLdTypes, ['WebPage', 'BreadcrumbList']);
+    assert.ok(f.words > 10);
+    assert.match(f.firstPara, /made to last/);
+    assert.deepEqual(attrs('<meta name=x content=\'a "b"\' async>'), {name: 'x', content: 'a "b"', async: ''});
+    assert.equal(decode('&lt;a&gt; &#39;x&#x27; &pound;&nbsp;'), '<a> \'x\' £ ');
+});
+
+test('analyse: the checks, a focus keyphrase, and the score', () => {
+    const f = scanHtml(PAGE);
+    const r = analyse(f, {urlPath: '/garden-tools', focus: 'garden tools', origin: 'https://ex.com'});
+    const by = Object.fromEntries(r.checks.map(c => [c.id, c.status]));
+    assert.equal(by.title, 'warn', '27 characters is short');
+    assert.equal(by.h1, 'pass');
+    assert.equal(by.headings, 'warn', 'H2 -> H4 is a skip');
+    assert.equal(by.alt, 'fail', 'one image has no alt; decoration and alt="" are fine');
+    assert.equal(by.links, 'pass');
+    assert.equal(by.focus, 'pass');
+    assert.equal(by.canonical, 'pass');
+    assert.equal(by.schema, 'pass');
+    assert.equal(by.words, 'warn', 'a few dozen words');
+    assert.ok(r.score > 0 && r.score < 100);
+    assert.equal(r.failing, 1);
+
+    const bare = analyse(scanHtml('<html><head></head><body><p>hi</p></body></html>'), {urlPath: '/x'});
+    const b = Object.fromEntries(bare.checks.map(c => [c.id, c.status]));
+    assert.equal(b.title, 'fail');
+    assert.equal(b.description, 'fail');
+    assert.equal(b.h1, 'fail');
+    assert.equal(b.lang, 'warn');
+    assert.equal(b.focus, 'info');
+
+    const missing = analyse(f, {urlPath: '/garden-tools', focus: 'lawn mower'});
+    assert.equal(missing.checks.find(c => c.id === 'focus').status, 'fail');
+    assert.equal(analyse(scanHtml('<html><head><meta name="robots" content="noindex"></head></html>')).checks.find(c => c.id === 'index').status, 'info');
+    assert.equal(analyse(scanHtml('<script type="application/ld+json">{bad</script>')).checks.find(c => c.id === 'schema').status, 'fail');
+});
+
+test('siteIssues: duplicate titles and descriptions, hidden pages left out', () => {
+    const r = siteIssues([
+        {urlPath: '/a', title: 'Home', description: 'Same'},
+        {urlPath: '/b', title: 'home', description: 'Same'},
+        {urlPath: '/c', title: 'Home', noindex: true},
+        {urlPath: '/d', title: 'Other', description: ''}
+    ]);
+    assert.deepEqual(r.duplicateTitles.map(d => d.paths), [['/a', '/b']]);
+    assert.deepEqual(r.duplicateDescriptions.map(d => d.paths), [['/a', '/b']]);
+});
+
+test('snippet: cut where search results cut, crumbs from the address', () => {
+    const s = snippet({title: 'x'.repeat(40) + ' ' + 'y'.repeat(30), description: 'short', url: 'https://ex.com/a/b'});
+    assert.equal(s.titleCut, true);
+    assert.ok(s.title.endsWith('…'));
+    assert.equal(s.crumbs, 'ex.com › a › b');
+    assert.equal(s.descriptionCut, false);
+});
+
+test('settings: checked, merged, and a missing organisation name refused', () => {
+    const {errors, settings} = checkSettings({audit: {titleMax: 20}, sitemap: {exclude: 'thanks\n/private/'}, organisation: {enabled: true}});
+    assert.ok(errors['audit.titleMax']);
+    assert.ok(errors['sitemap.exclude']);
+    assert.ok(errors['organisation.name']);
+    assert.equal(settings.audit.titleMax, DEFAULT_SETTINGS.audit.titleMax);
+    const ok = checkSettings({sitemap: {exclude: '/private/\n/thanks', sources: {blog: false}}, robots: {extra: 'Disallow: /x/\n# note'}, organisation: {sameAs: 'https://x.com/a'}});
+    assert.deepEqual(ok.errors, {});
+    assert.deepEqual(ok.settings.sitemap.exclude, ['/private/', '/thanks']);
+    assert.equal(ok.settings.sitemap.sources.blog, false);
+    assert.ok(checkSettings({robots: {extra: 'nonsense line'}}).errors['robots.extra']);
+    assert.deepEqual(mergeDefaults({audit: {everyHours: 6}}).audit.titleMax, DEFAULT_SETTINGS.audit.titleMax);
+    assert.equal(excluded('/private/x', ['/private/']), true);
+    assert.equal(excluded('/private', ['/private/']), true);
+    assert.equal(excluded('/privateer', ['/private/']), false);
+    assert.equal(excluded('/thanks', ['/thanks']), true);
+    assert.equal(excluded('/thanks/more', ['/thanks']), false);
+});
+
+test('structured data: the organisation on the home page, BlogPosting on posts, overrides applied', () => {
+    const settings = mergeDefaults({organisation: {enabled: true, type: 'LocalBusiness', name: 'Acme', logo: '/logo.png', address: {locality: 'Leeds'}}});
+    assert.equal(organisationLd({enabled: false}), null);
+    const ld = organisationLd(settings.organisation, {origin: 'https://ex.com'});
+    assert.equal(ld.logo, 'https://ex.com/logo.png');
+    assert.equal(ld.address.addressLocality, 'Leeds');
+
+    const base = {title: 'T', description: 'D', image: '', ogType: 'website', noindex: false, canonical: 'https://ex.com/', og: {}, twitter: {}, jsonLd: [{'@type': 'WebPage'}], extra: []};
+    const home = applySeo(base, {page: {urlPath: '/'}, kind: 'page', origin: 'https://ex.com', settings});
+    assert.deepEqual(home.jsonLd.map(x => x['@type']), ['WebPage', 'LocalBusiness']);
+    assert.deepEqual(base.jsonLd.length, 1, 'core\'s model is not changed in place');
+
+    const post = applySeo({...base, canonical: 'https://ex.com/blog/p'}, {page: {urlPath: '/blog/p', item: {type: 'blog:post'}}, kind: 'plugin', origin: 'https://ex.com', settings,
+        override: {title: 'Better', description: 'Better D', image: '/p.jpg', noindex: true}});
+    assert.equal(post.title, 'Better');
+    assert.equal(post.image, 'https://ex.com/p.jpg');
+    assert.equal(post.noindex, true);
+    assert.equal(post.ogType, 'article');
+    const bp = post.jsonLd.find(x => x['@type'] === 'BlogPosting');
+    assert.equal(bp.headline, 'Better');
+    assert.equal(bp.publisher.name, 'Acme');
+    assert.equal(post.jsonLd[0].description, 'Better D');
+});
+
+test('robots: extra rules join the * group; their own groups go before Sitemap; block all', () => {
+    const core = ['User-agent: *', 'Allow: /', 'Disallow: /admin/', 'Disallow: /api/', '', 'Sitemap: https://ex.com/sitemap.xml'];
+    assert.deepEqual(robotsLines(core, {extra: 'Disallow: /tmp/'}), ['User-agent: *', 'Allow: /', 'Disallow: /admin/', 'Disallow: /api/', 'Disallow: /tmp/', '', 'Sitemap: https://ex.com/sitemap.xml']);
+    const g = robotsLines(core, {extra: 'User-agent: GPTBot\nDisallow: /'});
+    assert.deepEqual(g.slice(5), ['User-agent: GPTBot', 'Disallow: /', '', 'Sitemap: https://ex.com/sitemap.xml']);
+    assert.deepEqual(robotsLines(core, {blockAll: true}).slice(1), ['User-agent: *', 'Disallow: /']);
+    assert.equal(robotsLines(core, {}), core);
+});

package/server/routes/public.js

@@ -101,13 +101,14 @@ export async function publicRoutes(fastify) {
 
     // SEO: sitemap.xml - cached per origin (so a single CMS responding on
     // multiple domains gets the right absolute URLs); invalidated by page
-    // CRUD via the 'sitemap' tag.
+    // CRUD via the 'sitemap' tag, and by plugins (hooks.sitemapChanged). The
+    // ten-minute ceiling covers a plugin whose content changes without telling.
     fastify.get('/sitemap.xml', async (request, reply) => {
         const baseUrl = getBaseUrl(request);
         const xml = await cache.wrap(
             `sitemap:xml:${baseUrl}`,
-            () => generateSitemap(baseUrl),
-            {tags: ['sitemap']}
+            () => generateSitemap(baseUrl, {log: fastify.log}),
+            {tags: ['sitemap'], ttlSeconds: 600}
         );
         return reply.type('application/xml').send(xml);
     });

package/server/services/content.js

@@ -198,6 +198,15 @@ export async function updatePage(urlPath, frontmatter, body, {author} = {}) {
     // asking for the page's tags to be emptied.
     if ('tags' in meta) meta.tags = cleanTags(meta.tags);
 
+    // `seo` is merged, not replaced: the page editor sends only title and
+    // description, and a save from it must not wipe what the SEO Tool set
+    // (image, noindex, focus keyword...). A key sent as null is removed.
+    if (frontmatter?.seo && typeof frontmatter.seo === 'object' && !Array.isArray(frontmatter.seo)) {
+        const merged = {...(existingMeta.seo && typeof existingMeta.seo === 'object' ? existingMeta.seo : {}), ...frontmatter.seo};
+        for (const [k, v] of Object.entries(merged)) if (v === null) delete merged[k];
+        meta.seo = merged;
+    }
+
     if (existingMeta.createdAt) meta.createdAt = existingMeta.createdAt;
 
     // '' is the editor's "inherit by rootUrl" choice - drop the key so the
@@ -237,6 +246,8 @@ export async function renamePage(oldUrlPath, newUrlPath) {
     } catch {
         // Version directory move failure is non-fatal
     }
+    // The old URL may be linked from anywhere - the SEO plugin offers a redirect.
+    hooks.emit('content:pageRenamed', {from: oldUrlPath, to: newUrlPath});
 }
 
 /**

package/server/services/hooks.js

@@ -152,7 +152,8 @@ const _transforms = new Map(); // hookName -> [{ fn, priority }]
 /**
  * Register a transform function at a named hook point.
  * Available hook names: 'markdown:beforeParse', 'markdown:afterParse',
- *                       'render:beforeRender', 'render:afterRender'
+ *                       'render:beforeRender', 'render:afterRender',
+ *                       'seo:meta', 'sitemap:entries', 'robots:lines' (0.89 - section 8)
  *
  * @param {string} hookName
  * @param {Function} fn - (value, context) => value
@@ -305,3 +306,46 @@ export function unregisterRelatedItems(kind, id) {
 export function getRelatedProviders(kind) {
   return [...(_relatedProviders.get(kind)?.values() ?? [])];
 }
+
+// ---------------------------------------------------------------------------
+// 8. Sitemap sources (0.89) - URLs a plugin serves, in /sitemap.xml
+// ---------------------------------------------------------------------------
+//
+// Core lists its own pages. Anything a plugin serves (blog posts, job listings)
+// is invisible to it, so the plugin registers a source. `list({baseUrl})`
+// resolves to `[{urlPath, title?, lastmod?, changefreq?, priority?, image?}]`,
+// public items only - the sitemap is for anonymous visitors. A source that
+// throws is skipped (and logged) rather than taking the sitemap down.
+//
+// Transforms beside it (registerTransform):
+//   'sitemap:entries' (entries, {baseUrl})   - the merged list, before XML
+//   'robots:lines'    (lines,   {baseUrl})   - robots.txt, one entry per line
+//   'seo:meta'        (meta,    {page, site, baseUrl, kind}) - see renderer.js
+
+const _sitemapSources = new Map(); // id -> {id, label, owner, list}
+
+/**
+ * @param {{id: string, label?: string, list: Function, owner?: string}} source
+ * @returns {boolean} false when the source is malformed (it is then ignored)
+ */
+export function registerSitemapSource(source = {}) {
+  const {id, list} = source;
+  if (typeof id !== 'string' || !/^[a-z0-9][a-z0-9:-]*$/.test(id) || typeof list !== 'function') return false;
+  _sitemapSources.set(id, {
+    id,
+    label: typeof source.label === 'string' && source.label.trim() ? source.label.trim() : id,
+    owner: typeof source.owner === 'string' ? source.owner : 'core',
+    list
+  });
+  return true;
+}
+
+/** @param {string} id */
+export function unregisterSitemapSource(id) {
+  _sitemapSources.delete(id);
+}
+
+/** Every registered sitemap source, in registration order. */
+export function getSitemapSources() {
+  return [..._sitemapSources.values()];
+}

package/server/services/plugins.js

@@ -20,6 +20,7 @@ import {
     hooks,
     registerCalendarSource,
     registerRelatedItems,
+    registerSitemapSource,
     registerMenuLocation,
     registerSanitizeRules,
     registerShortcode,
@@ -38,6 +39,7 @@ import {authenticateFor} from './pluginScope.js';
 import {getEffectiveRoles} from './userRoles.js';
 import * as defaultUsersService from './users.js';
 import {registerLoginCheck, registerPasswordCheck} from './authChecks.js';
+import {invalidateTags as cacheInvalidateTags} from './cache/index.js';
 import {CORE_TOOLS, getToolStates, unmetRequirements} from './tools.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
@@ -508,6 +510,10 @@ export async function registerPlugins(fastify) {
                   registerCalendarSource: (source) => registerCalendarSource({...source, owner: manifest.name}),
                   getCalendarSources,
                   registerRelatedItems: (kind, provider) => registerRelatedItems(kind, {...provider, owner: manifest.name}),
+                  // Sitemap sources (0.89) - the URLs a plugin serves, in /sitemap.xml. A plugin
+                  // calls sitemapChanged() when they change; otherwise they show within ten minutes.
+                  registerSitemapSource: (source) => registerSitemapSource({...source, owner: manifest.name}),
+                  sitemapChanged: () => cacheInvalidateTags(['sitemap']).catch(() => {}),
                   on: hooks.on.bind(hooks), ...pluginRoleHooks(manifest.name),
                   // Notifications (0.80) - notify, resolveNotification, registerNotificationSource,
                   // stamped with the plugin's name (its source ids are `<plugin>:<id>`).