domma-cms 1.6.34 → 1.6.36

package/plugins/_lib/outreach/expiry.js

@@ -0,0 +1,46 @@
+/**
+ * Shared expiry state: a thing that closes by a DATE or by a USAGE TALLY,
+ * whichever is reached first. The vocabulary is deliberately the same as
+ * Cart Pro's discount codes (shopping-cart-pro/lib/codes.js):
+ *
+ *   {active, startsAt, endsAt, limit, uses}
+ *
+ * Dates are 'YYYY-MM-DD', inclusive, '' for open; `limit` is null for
+ * unlimited; `uses` is the server's counter. The two modules must never
+ * disagree about what "expired" means - change one, change both.
+ *
+ * One deliberate difference: an entry that never carried `active` (a
+ * campaign offer, say) is treated as active; Cart Pro's cleanCode always
+ * writes the field, so its rows never hit that branch.
+ *
+ * @module _lib/outreach/expiry
+ */
+
+/** 'YYYY-MM-DD' for a time, in the server's zone. */
+export const dayOf = (t) => {
+    const d = new Date(t);
+    return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+};
+
+/**
+ * Live, scheduled, ended, used up or paused - for state chips and refusals.
+ *
+ * @param {{active?: boolean, startsAt?: string, endsAt?: string, limit?: number|null, uses?: number}} c
+ * @param {number} [now]
+ * @returns {'paused'|'scheduled'|'ended'|'used'|'live'}
+ */
+export function codeState(c, now = Date.now()) {
+    const today = dayOf(now);
+    const active = c.active === undefined ? true : Boolean(c.active);
+    if (!active) return 'paused';
+    if (c.startsAt && today < c.startsAt) return 'scheduled';
+    if (c.endsAt && today > c.endsAt) return 'ended';
+    if (c.limit !== null && c.limit !== undefined && (Number(c.uses) || 0) >= c.limit) return 'used';
+    return 'live';
+}
+
+/** Why a thing is not live now, or null when it is. */
+export function closedReason(c, now = Date.now()) {
+    const state = codeState(c, now);
+    return state === 'live' ? null : state;
+}

package/plugins/_lib/outreach/index.js

@@ -0,0 +1,15 @@
+/**
+ * The outreach library: the audience, token, ledger, sending, suppression
+ * and expiry plumbing shared by every Tool that emails people and follows
+ * up (Surveys, Campaigns, Onboard). See each module's header; collection
+ * schemas the consuming plugins copy are in ./collections.
+ *
+ * @module _lib/outreach
+ */
+export {generateToken, hashToken, formatCode, normaliseCode} from './tokens.js';
+export {createAudience} from './audience.js';
+export {createLedger} from './ledger.js';
+export {createSuppression, normaliseEmail} from './suppression.js';
+export {escapeHtml, escapeAttr, outreachBaseUrl, renderInvite, sendBatch} from './sending.js';
+export {dayOf, codeState, closedReason} from './expiry.js';
+export {UNSUBSCRIBE_PATH, mintSecret, signEmail, unsubscribeUrl, verifyUnsubscribe} from './unsubscribe.js';

package/plugins/_lib/outreach/ledger.js

@@ -0,0 +1,127 @@
+/**
+ * The outreach send ledger: one row per (thing, contact) with a hashed
+ * per-recipient token and a status - the record that makes sends resumable
+ * (the row is written before the email goes) and reminders targetable.
+ *
+ * Generic over what is being sent: `refField` names the column tying a row
+ * to its campaign/survey/journey. Surveys passes
+ * `{slug: 'surveys-invites', refField: 'surveyId', source: 'surveys'}` so its stored data is
+ * unchanged. Lifted from Surveys 1.4 (lib/ledger.js).
+ *
+ * Statuses: pending -> sent -> completed, or bounced (any send failure,
+ * including a suppressed address - deliberately excluded from reminders).
+ *
+ * @module _lib/outreach/ledger
+ */
+import {generateToken, hashToken, normaliseCode} from './tokens.js';
+
+/**
+ * @param {{createEntry,listEntries,getEntry,updateEntry}} col collections service
+ * @param {{slug?: string, refField?: string}} [opts]
+ */
+export function createLedger(col, {slug = 'outreach-invites', refField = 'ref', source = 'outreach'} = {}) {
+    async function allInvites() {
+        const {entries} = await col.listEntries(slug, {limit: 100000});
+        return entries;
+    }
+
+    async function invitesFor(refId) {
+        return (await allInvites()).filter(e => e.data[refField] === refId);
+    }
+
+    /** Issue pending invites for contacts that don't already have one. Returns [{id, contactId, token}]. */
+    async function issueInvites(refId, contactIds) {
+        const existing = await invitesFor(refId);
+        const seen = new Set(existing.map(e => e.data.contactId));
+        const out = [];
+        for (const contactId of contactIds) {
+            if (seen.has(contactId)) continue;
+            const token = generateToken();
+            const entry = await col.createEntry(slug, {
+                [refField]: refId, contactId,
+                tokenHash: hashToken(normaliseCode(token)),
+                status: 'pending', sentAt: null, completedAt: null, responseId: null
+            }, {source});
+            out.push({id: entry.id, contactId, token});
+            seen.add(contactId);
+        }
+        return out;
+    }
+
+    /**
+     * Ensure every listed contact has a FRESH token to email. New contacts get
+     * a created invite; existing non-completed invites are re-issued with a
+     * new token (so re-sends and reminders carry a working personalised link);
+     * contacts who already completed are skipped. The previous token for a
+     * re-issued invite stops working - latest link wins.
+     *
+     * Returns [{id, contactId, token}] for the invites to email.
+     */
+    async function issueOrReissue(refId, contactIds) {
+        const existing = await invitesFor(refId);
+        const byContact = new Map(existing.map(e => [e.data.contactId, e]));
+        const out = [];
+        for (const contactId of contactIds) {
+            const ex = byContact.get(contactId);
+            if (ex && ex.data.status === 'completed') continue;
+            const token = generateToken();
+            const tokenHash = hashToken(normaliseCode(token));
+            if (ex) {
+                await col.updateEntry(slug, ex.id, {...ex.data, tokenHash});
+                out.push({id: ex.id, contactId, token});
+            } else {
+                const entry = await col.createEntry(slug, {
+                    [refField]: refId, contactId, tokenHash,
+                    status: 'pending', sentAt: null, completedAt: null, responseId: null
+                }, {source});
+                out.push({id: entry.id, contactId, token});
+            }
+        }
+        return out;
+    }
+
+    /** Find an invite by submitted code (any format). Null if unknown. */
+    async function findByCode(refId, code) {
+        const hash = hashToken(normaliseCode(code));
+        const invites = await invitesFor(refId);
+        return invites.find(e => e.data.tokenHash === hash) ?? null;
+    }
+
+    /** Mark sent / bounced. */
+    async function markSent(inviteId, ok, nowIso) {
+        const entry = await col.getEntry(slug, inviteId);
+        if (!entry) return null;
+        return col.updateEntry(slug, inviteId, {
+            ...entry.data,
+            status: ok ? 'sent' : 'bounced',
+            sentAt: ok ? nowIso : entry.data.sentAt
+        });
+    }
+
+    /** Mark completed with the stored response id. */
+    async function markCompleted(inviteId, responseId, nowIso) {
+        const entry = await col.getEntry(slug, inviteId);
+        if (!entry) return null;
+        return col.updateEntry(slug, inviteId, {
+            ...entry.data, status: 'completed', completedAt: nowIso, responseId: responseId ?? null
+        });
+    }
+
+    /** Invites that are neither completed nor bounced. */
+    async function outstanding(refId) {
+        const invites = await invitesFor(refId);
+        return invites.filter(e => e.data.status !== 'completed' && e.data.status !== 'bounced');
+    }
+
+    /** Sent invites, not yet completed, whose sentAt is older than afterDays before now. */
+    async function dueForReminder(refId, afterDays, now) {
+        const cutoff = now.getTime() - Number(afterDays) * 86400000;
+        const invites = await invitesFor(refId);
+        return invites.filter(e =>
+            e.data.status === 'sent' &&
+            e.data.sentAt && new Date(e.data.sentAt).getTime() <= cutoff
+        );
+    }
+
+    return {allInvites, invitesFor, issueInvites, issueOrReissue, findByCode, markSent, markCompleted, outstanding, dueForReminder, slug, refField};
+}

package/plugins/_lib/outreach/sending.js

@@ -0,0 +1,121 @@
+/**
+ * Outreach email rendering and batch sending. Lifted from Surveys 1.4
+ * (lib/sending.js), generalised: the per-recipient link and the button label
+ * are the caller's, and a suppression check can sit in front of every send.
+ *
+ * @module _lib/outreach/sending
+ */
+import {normaliseEmail} from './suppression.js';
+
+export function escapeHtml(s) {
+    return String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+
+/** Escape a value for use inside a double-quoted HTML attribute (e.g. href). */
+export function escapeAttr(s) {
+    return String(s ?? '').replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
+}
+
+/** 'https://example.com' from a configured address, or '' when it is not one. */
+function origin(value) {
+    const v = String(value ?? '').trim().replace(/\/+$/, '');
+    return /^https?:\/\/[^\s/?#]+$/i.test(v) ? v : '';
+}
+
+/**
+ * Where the links in outreach emails point: the Site URL setting
+ * (site.baseUrl, the address core builds password-reset, canonical and
+ * sitemap links on), else the old `site.url`, else the address this request
+ * came in on.
+ *
+ * @param {object} site - getConfig('site')
+ * @param {{protocol?: string, host?: string, headers?: object}} [req]
+ * @returns {string} origin, no trailing slash
+ */
+export function outreachBaseUrl(site, req) {
+    const configured = origin(site?.baseUrl) || origin(site?.url);
+    if (configured) return configured;
+    const host = req?.host || req?.headers?.host || '';
+    return host ? `${req?.protocol || 'http'}://${host}` : '';
+}
+
+/**
+ * Render one message's subject + plain-text + HTML from a template and a link.
+ *
+ * The HTML version turns each {{link}} into a clickable button; all non-link
+ * copy is escaped so user-authored bodies can't inject markup. The plain-text
+ * version keeps the raw URL. An optional `footerHtml` (already-safe markup -
+ * an unsubscribe line) is appended inside the wrapper.
+ *
+ * @param {{subject?: string, body?: string}} template
+ * @param {{name?: string}} contact
+ * @param {string} link
+ * @param {{buttonLabel?: string, defaultSubject?: string, defaultBody?: string, footerHtml?: string, footerText?: string}} [opts]
+ */
+export function renderInvite(template, contact, link, opts = {}) {
+    const {
+        buttonLabel = 'Open the link',
+        defaultSubject = 'A message for you',
+        defaultBody = "Hi {{name}},\n\n{{link}}",
+        footerHtml = '',
+        footerText = ''
+    } = opts;
+    const name = contact.name || 'there';
+    const subjectTpl = (template.subject && template.subject.trim()) || defaultSubject;
+    const bodyTpl = (template.body && template.body.trim()) || defaultBody;
+
+    const subject = subjectTpl.replaceAll('{{name}}', name).replaceAll('{{link}}', link);
+    const text = bodyTpl.replaceAll('{{name}}', name).replaceAll('{{link}}', link)
+        + (footerText ? `\n\n${footerText}` : '');
+
+    const button = `<p style="margin:24px 0;"><a href="${escapeAttr(link)}" `
+        + `style="display:inline-block;background:#2563eb;color:#ffffff;text-decoration:none;`
+        + `padding:12px 24px;border-radius:6px;font-weight:600;font-size:15px;">${escapeHtml(buttonLabel)}</a></p>`;
+
+    const bodyHtml = bodyTpl
+        .split('{{link}}')
+        .map((seg) => escapeHtml(seg.replaceAll('{{name}}', name)).replace(/\n/g, '<br>'))
+        .join(button);
+
+    const html = `<div style="font-family:-apple-system,Segoe UI,Roboto,Arial,sans-serif;`
+        + `max-width:560px;margin:0 auto;padding:24px;color:#1f2937;line-height:1.6;font-size:15px;">`
+        + bodyHtml
+        + `<hr style="border:none;border-top:1px solid #e5e7eb;margin:24px 0;">`
+        + `<p style="font-size:12px;color:#6b7280;">If the button doesn't work, paste this link into your browser:<br>`
+        + `<a href="${escapeAttr(link)}" style="color:#2563eb;">${escapeHtml(link)}</a></p>`
+        + (footerHtml || '')
+        + `</div>`;
+
+    return {subject, text, html};
+}
+
+/**
+ * Send to each recipient; never fails wholesale. A recipient on the
+ * suppression set is not sent to at all and comes back
+ * `{inviteId, ok: false, suppressed: true}` - the caller's ledger treats
+ * that like a bounce, which keeps them out of reminders.
+ *
+ * @param {Array<{invite: {id: string}, contact: {name?: string, email: string}, token: string}>} recipients
+ * @param {{subject?: string, body?: string}} template
+ * @param {object} deps {sendEmail, transport, from, fromName, linkFor(recipient), suppressed?: Set<string>, render?: opts for renderInvite}
+ * @returns {Promise<Array<{inviteId: string, ok: boolean, suppressed?: true}>>}
+ */
+export async function sendBatch(recipients, template, deps) {
+    const {sendEmail, transport, from, fromName, linkFor, suppressed = null, render = {}} = deps;
+    const results = [];
+    for (const r of recipients) {
+        if (suppressed && suppressed.has(normaliseEmail(r.contact.email))) {
+            results.push({inviteId: r.invite.id, ok: false, suppressed: true});
+            continue;
+        }
+        const link = linkFor(r);
+        const msg = renderInvite(template, r.contact, link, render);
+        try {
+            await sendEmail(transport, {from, fromName, to: r.contact.email, subject: msg.subject, html: msg.html, text: msg.text});
+            results.push({inviteId: r.invite.id, ok: true});
+        } catch {
+            results.push({inviteId: r.invite.id, ok: false});
+        }
+    }
+    return results;
+}

package/plugins/_lib/outreach/suppression.js

@@ -0,0 +1,62 @@
+/**
+ * The shared suppression list: addresses that must not be emailed by any
+ * outreach Tool. One opt-out silences them all - marketing email without a
+ * working unsubscribe is not shippable (PECR), and a surveys opt-out should
+ * silence campaigns too. Rows live in the shared `outreach-unsubscribes`
+ * collection ({email, at, source}; schema in ./collections).
+ *
+ * Addresses are compared lower-cased and trimmed. Suppressed recipients are
+ * not sent to and are marked `bounced` in the ledger, which keeps them out
+ * of reminders for good.
+ *
+ * @module _lib/outreach/suppression
+ */
+
+/** Canonical form for comparison and storage. */
+export const normaliseEmail = (email) => String(email ?? '').trim().toLowerCase();
+
+/**
+ * @param {{createEntry,listEntries,deleteEntry?}} col collections service
+ * @param {{slug?: string}} [opts]
+ */
+export function createSuppression(col, {slug = 'outreach-unsubscribes'} = {}) {
+    async function rows() {
+        const {entries} = await col.listEntries(slug, {limit: 100000}).catch(() => ({entries: []}));
+        return entries;
+    }
+
+    /** Every suppressed address as a Set - take one per send batch. */
+    async function suppressedSet() {
+        return new Set((await rows()).map(e => normaliseEmail(e.data.email)).filter(Boolean));
+    }
+
+    async function isSuppressed(email) {
+        const want = normaliseEmail(email);
+        if (!want) return false;
+        return (await suppressedSet()).has(want);
+    }
+
+    /** Add an address (idempotent). `source` says which Tool took the opt-out. */
+    async function add(email, source = 'outreach') {
+        const want = normaliseEmail(email);
+        if (!want) return null;
+        const existing = (await rows()).find(e => normaliseEmail(e.data.email) === want);
+        if (existing) return existing;
+        return col.createEntry(slug, {email: want, at: new Date().toISOString(), source}, {source});
+    }
+
+    /** Take an address off the list (they asked to hear from us again). */
+    async function remove(email) {
+        if (typeof col.deleteEntry !== 'function') return false;
+        const want = normaliseEmail(email);
+        const hits = (await rows()).filter(e => normaliseEmail(e.data.email) === want);
+        for (const e of hits) await col.deleteEntry(slug, e.id).catch(() => {});
+        return hits.length > 0;
+    }
+
+    async function list() {
+        return (await rows()).map(e => ({id: e.id, email: e.data.email, at: e.data.at ?? null, source: e.data.source ?? ''}));
+    }
+
+    return {isSuppressed, suppressedSet, add, remove, list, slug};
+}

package/plugins/_lib/outreach/tokens.js

@@ -0,0 +1,35 @@
+/**
+ * Outreach tokens: short unambiguous codes for per-recipient links. Only the
+ * SHA-256 hash is ever stored - the plaintext travels in the emailed URL and
+ * nowhere else. Lifted from Surveys 1.4 (lib/tokens.js) unchanged.
+ *
+ * @module _lib/outreach/tokens
+ */
+import crypto from 'crypto';
+
+const ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789'; // no O,0,I,1,L
+const LENGTH = 8;
+
+/** Generate an 8-char unambiguous uppercase token. */
+export function generateToken() {
+    const bytes = crypto.randomBytes(LENGTH);
+    let out = '';
+    for (let i = 0; i < LENGTH; i++) out += ALPHABET[bytes[i] % ALPHABET.length];
+    return out;
+}
+
+/** SHA-256 hex of a normalised code. The plaintext is never stored. */
+export function hashToken(code) {
+    return crypto.createHash('sha256').update(String(code)).digest('hex');
+}
+
+/** Display form: ABCD-EFGH. */
+export function formatCode(token) {
+    const t = String(token).toUpperCase();
+    return t.length === 8 ? `${t.slice(0, 4)}-${t.slice(4)}` : t;
+}
+
+/** Canonical form for hashing/lookup: strip non-alphanumerics, uppercase. */
+export function normaliseCode(input) {
+    return String(input ?? '').toUpperCase().replace(/[^A-Z0-9]/g, '');
+}

package/plugins/_lib/outreach/unsubscribe.js

@@ -0,0 +1,46 @@
+/**
+ * Unsubscribe links that keep working forever: an HMAC of the address under a
+ * per-site secret, not a ledger token (a re-send re-issues ledger tokens, and
+ * the unsubscribe link in an OLD email must still work - PECR). The secret is
+ * the engine's (server/services/outreachUnsubscribe.js) and so is the
+ * `/campaign-unsubscribe` route (server/routes/outreach-public.js), so a link
+ * keeps working after the Tool that sent it lapses or is removed.
+ *
+ * Campaigns Pro carries a byte-identical copy for engines older than this
+ * file - change the signature here and the links already sent stop verifying.
+ *
+ * @module _lib/outreach/unsubscribe
+ */
+import crypto from 'crypto';
+import {normaliseEmail} from './suppression.js';
+
+/** Where every unsubscribe link points; links already sent carry this path. */
+export const UNSUBSCRIBE_PATH = '/campaign-unsubscribe';
+
+export function mintSecret() {
+    return crypto.randomBytes(24).toString('hex');
+}
+
+export function signEmail(secret, email) {
+    return crypto.createHmac('sha256', String(secret)).update(normaliseEmail(email)).digest('hex');
+}
+
+/** The address an emailed unsubscribe link points at. */
+export function unsubscribeUrl(baseUrl, secret, email) {
+    const e = Buffer.from(normaliseEmail(email), 'utf8').toString('base64url');
+    return `${baseUrl}${UNSUBSCRIBE_PATH}?e=${e}&k=${signEmail(secret, email)}`;
+}
+
+/** The verified address from ?e=&k=, or null. Constant-time on the signature. */
+export function verifyUnsubscribe(secret, e, k) {
+    let email = '';
+    try { email = Buffer.from(String(e ?? ''), 'base64url').toString('utf8'); } catch { return null; }
+    email = normaliseEmail(email);
+    if (!email || !k) return null;
+    const want = signEmail(secret, email);
+    const got = String(k);
+    if (got.length !== want.length) return null;
+    try {
+        return crypto.timingSafeEqual(Buffer.from(got, 'hex'), Buffer.from(want, 'hex')) ? email : null;
+    } catch { return null; }
+}

package/plugins/_lib/public/call/call.js

@@ -569,6 +569,8 @@ function mount(el) {
         switch (e.type) {
             case 'knocking': stage.value = 'waiting'; break;
             case 'admitted':
+                // The ICE servers arrive with admission (not the join reply) - before any peer is connected.
+                if (Array.isArray(e.iceServers)) iceServers = e.iceServers;
                 stage.value = 'in';
                 recording.value = e.recording === true;
                 (e.chat || []).forEach(item => addItem(item, {live: false}));
@@ -868,7 +870,7 @@ function mount(el) {
                 if (r.status === 425 && body.opensAt) { error.value = `This call opens at ${new Date(body.opensAt).toLocaleTimeString([], {hour: '2-digit', minute: '2-digit'})}. Come back then.`; return; }
                 if (!r.ok) { error.value = body.error || 'Could not join the call.'; return; }
                 me = {id: body.id, secret: body.secret, who: body.who || body.id};
-                iceServers = body.iceServers || [];
+                iceServers = body.iceServers || [];   // an older engine's join reply; the admitted event replaces it
                 host.value = body.host === true;
                 if (body.name) name.value = body.name;
                 max.value = body.max || 6;

package/plugins/blog/CLAUDE.md

@@ -20,7 +20,7 @@ Public-facing blog for the CMS. Supports posts with categories, tags, and option
 - `blocks/*.html|css` - the shipped layouts, copied into content/blocks/ once
 - `public/blog.js`, `public/blog.css` - the browser half (listing, right-click menu, post extras)
 - `public/samples/*.svg` - sample covers
-- `tests/layouts.test.js`, `tests/public.test.js`, `tests/nav-link.test.js`
+- `tests/access.test.js`, `tests/comment-notices.test.js`, `tests/layouts.test.js`, `tests/nav-link.test.js`, `tests/notices.test.js`, `tests/public.test.js`
 - `admin/views/blog.js` - post list (KPIs + status/category/search filters)
 - `admin/views/post-editor.js` - create / edit a post
 - `admin/views/categories.js`, `admin/views/comments.js`, `admin/views/settings.js`
@@ -319,3 +319,13 @@ Declared in plugin.json `permissions` (granted once to `admin`), checked on EVER
 - `usePermissionLookup()` points the checks at a lookup: the plugin passes core's `getPermissionsFor` (or
   `options.getPermissionsFor` in tests).
 
+## 1.9.6 (2026-10-13 Tool sweep)
+
+- **One slug, one post.** `POST /posts` and `PUT /posts/:id` answer 409 when another post (draft or not; a Pro-era post
+  in another blog does not count) holds the slug - `slugHolder()` in lib/page.js. The public post lookup is
+  `publicPost()`: the LIVE post with that slug, not whichever is newest. Before, an author's draft saved with a live
+  post's slug sat first in the newest-first list and the live address answered 404.
+- **POST /comments** has its own `config.rateLimit` (5/min/IP), caps every field (`commentFields()`, exported and
+  tested), needs a plausible email, and refuses a post that does not exist or is not visible (404) - each of those
+  used to raise a staff notification.
+- `ASSET_V` / the preview `assetV` are 1.9.6 (they were 1.6.x while the plugin was 1.9.5 - keep them with the version).

package/plugins/blog/docs/guide.md

@@ -39,7 +39,7 @@ Writers without the Publish permission see only their own posts.
 | Field | What it does |
 |---|---|
 | Title | Required. |
-| Slug | The last part of the post's address, for example `my-first-post`. With **Auto** ticked it follows the title. Changing it on a published post breaks links to the old address. |
+| Slug | The last part of the post's address, for example `my-first-post`. With **Auto** ticked it follows the title. Changing it on a published post breaks links to the old address. Two posts cannot share a slug: saving one with a slug another post already has (a draft included) is refused with a message. |
 | Excerpt | A sentence or two shown in listings. Also used as the search-engine description when **SEO Description** is empty. |
 | Content | Markdown. Every shortcode the site supports works here too. |
 | SEO Title / SEO Description | What search engines and link previews show. Leave empty to use the title and excerpt. |

package/plugins/blog/lib/page.js

@@ -26,6 +26,38 @@ export function isVisible(post) {
         (post.status === 'scheduled' && post.publishedAt && new Date(post.publishedAt) <= new Date());
 }
 
+/** Whether a post is this blog's (a Pro-era post in another blog is not), whatever its status. */
+function inThisBlog(post) {
+    return !post.blogId || post.blogId === 'main';
+}
+
+/**
+ * The post readers get for an address: a LIVE one. The list is newest first,
+ * so `find(slug)` alone picked an author's fresh draft over the published
+ * post with the same slug and answered 404 for the live one.
+ *
+ * @param {object[]} posts
+ * @param {string} slug
+ * @returns {object|null}
+ */
+export function publicPost(posts, slug) {
+    return posts.find((p) => p.slug === slug && isVisible(p)) ?? null;
+}
+
+/**
+ * The post, other than `exceptId`, that already holds a slug - a save that
+ * would make two posts answer one address. Drafts count: the one that is live
+ * today is not always the one that is live tomorrow.
+ *
+ * @param {object[]} posts
+ * @param {string} slug
+ * @param {string|null} [exceptId] - the post being saved
+ * @returns {object|null}
+ */
+export function slugHolder(posts, slug, exceptId = null) {
+    return posts.find((p) => p.slug === slug && p.id !== exceptId && inThisBlog(p)) ?? null;
+}
+
 /** Settings as they are NOW - display choices apply without a restart. */
 export function liveSettings(registered) {
     return {...defaultConfig, ...DISPLAY_DEFAULTS, ...registered, ...(getPluginStates()?.blog?.settings ?? {})};