emdash 0.36.0 → 0.38.0

package/src/security/ssrf.ts

@@ -1,69 +1,94 @@
 /**
- * SSRF protection for import URLs.
+ * SSRF protection for outbound HTTP requests.
  *
- * Validates that URLs don't target internal/private network addresses.
- * Applied before any fetch() call in the import pipeline.
+ * Validates that URLs do not target non-public network addresses.
  */
 
-const IPV4_MAPPED_IPV6_DOTTED_PATTERN = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i;
-const IPV4_MAPPED_IPV6_HEX_PATTERN = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV4_TRANSLATED_HEX_PATTERN = /^::ffff:0:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-const IPV6_EXPANDED_MAPPED_PATTERN =
-	/^0{0,4}:0{0,4}:0{0,4}:0{0,4}:0{0,4}:ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-
-/**
- * IPv4-compatible (deprecated) addresses: ::XXXX:XXXX
- *
- * The WHATWG URL parser normalizes [::127.0.0.1] to [::7f00:1] (no ffff prefix).
- * These are deprecated but still parsed, and bypass the ffff-based checks.
- */
-const IPV4_COMPATIBLE_HEX_PATTERN = /^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-
-/**
- * NAT64 prefix (RFC 6052): 64:ff9b::XXXX:XXXX
- *
- * Used by NAT64 gateways to embed IPv4 addresses in IPv6.
- * [64:ff9b::127.0.0.1] normalizes to [64:ff9b::7f00:1].
- */
-const NAT64_HEX_PATTERN = /^64:ff9b::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;
-
 const IPV6_BRACKET_PATTERN = /^\[|\]$/g;
-
-/** Match fc00::/7 ULA — first byte 0xfc or 0xfd followed by any byte. */
-const IPV6_ULA_FC_PATTERN = /^fc[0-9a-f]{2}:/;
-const IPV6_ULA_FD_PATTERN = /^fd[0-9a-f]{2}:/;
+const IPV4_PART_PATTERN = /^(?:0|[1-9]\d{0,2})$/;
+const IPV6_PART_PATTERN = /^[0-9a-f]{1,4}$/i;
 
 /** Strip trailing dots from an FQDN-form hostname ("localhost." -> "localhost"). */
 const TRAILING_DOT_PATTERN = /\.+$/;
 
 /**
- * Private and reserved IP ranges that should never be fetched.
- *
- * Includes:
- * - Loopback (127.0.0.0/8)
- * - Private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- * - Link-local (169.254.0.0/16)
- * - Cloud metadata (169.254.169.254 — AWS/GCP/Azure)
- * - IPv6 loopback and link-local
+ * IPv4 ranges that are not globally reachable unicast destinations.
  */
 const BLOCKED_PATTERNS: Array<{ start: number; end: number }> = [
-	// 127.0.0.0/8 — loopback
-	{ start: ip4ToNum(127, 0, 0, 0), end: ip4ToNum(127, 255, 255, 255) },
-	// 10.0.0.0/8 — private
+	// Current network
+	{ start: ip4ToNum(0, 0, 0, 0), end: ip4ToNum(0, 255, 255, 255) },
+	// Private use
 	{ start: ip4ToNum(10, 0, 0, 0), end: ip4ToNum(10, 255, 255, 255) },
-	// 172.16.0.0/12 — private
+	// Shared address space
+	{ start: ip4ToNum(100, 64, 0, 0), end: ip4ToNum(100, 127, 255, 255) },
+	// Loopback
+	{ start: ip4ToNum(127, 0, 0, 0), end: ip4ToNum(127, 255, 255, 255) },
+	// Link-local, including common cloud metadata endpoints
+	{ start: ip4ToNum(169, 254, 0, 0), end: ip4ToNum(169, 254, 255, 255) },
+	// Private use
 	{ start: ip4ToNum(172, 16, 0, 0), end: ip4ToNum(172, 31, 255, 255) },
-	// 192.168.0.0/16 — private
+	// IETF protocol assignments. Globally reachable exceptions are handled below.
+	{ start: ip4ToNum(192, 0, 0, 0), end: ip4ToNum(192, 0, 0, 255) },
+	// Documentation
+	{ start: ip4ToNum(192, 0, 2, 0), end: ip4ToNum(192, 0, 2, 255) },
+	// Deprecated 6to4 relay anycast
+	{ start: ip4ToNum(192, 88, 99, 0), end: ip4ToNum(192, 88, 99, 255) },
+	// Private use
 	{ start: ip4ToNum(192, 168, 0, 0), end: ip4ToNum(192, 168, 255, 255) },
-	// 169.254.0.0/16 — link-local (includes cloud metadata endpoint)
-	{ start: ip4ToNum(169, 254, 0, 0), end: ip4ToNum(169, 254, 255, 255) },
-	// 0.0.0.0/8 — current network
-	{ start: ip4ToNum(0, 0, 0, 0), end: ip4ToNum(0, 255, 255, 255) },
+	// Benchmarking
+	{ start: ip4ToNum(198, 18, 0, 0), end: ip4ToNum(198, 19, 255, 255) },
+	// Documentation
+	{ start: ip4ToNum(198, 51, 100, 0), end: ip4ToNum(198, 51, 100, 255) },
+	{ start: ip4ToNum(203, 0, 113, 0), end: ip4ToNum(203, 0, 113, 255) },
+	// Multicast, reserved, and limited broadcast
+	{ start: ip4ToNum(224, 0, 0, 0), end: ip4ToNum(255, 255, 255, 255) },
+];
+
+const ALLOWED_IPV4_EXCEPTIONS = new Set([ip4ToNum(192, 0, 0, 9), ip4ToNum(192, 0, 0, 10)]);
+
+interface Ipv6Range {
+	address: number[];
+	prefixLength: number;
+}
+
+function ipv6Range(address: string, prefixLength: number): Ipv6Range {
+	const parsed = parseIpv6(address);
+	if (parsed === null) throw new Error(`Invalid IPv6 range: ${address}/${prefixLength}`);
+	return { address: parsed, prefixLength };
+}
+
+const IPV6_GLOBAL_UNICAST_RANGE = ipv6Range("2000::", 3);
+const IPV4_COMPATIBLE_IPV6_RANGE = ipv6Range("::", 96);
+const IPV4_EMBEDDED_IPV6_RANGES: Ipv6Range[] = [
+	IPV4_COMPATIBLE_IPV6_RANGE,
+	ipv6Range("::ffff:0:0", 96),
+	ipv6Range("::ffff:0:0:0", 96),
+	ipv6Range("64:ff9b::", 96),
+];
+
+/** Globally reachable allocations inside the otherwise reserved 2001::/23 block. */
+const ALLOWED_IPV6_SPECIAL_RANGES: Ipv6Range[] = [
+	ipv6Range("2001:1::1", 128),
+	ipv6Range("2001:1::2", 128),
+	ipv6Range("2001:1::3", 128),
+	ipv6Range("2001:3::", 32),
+	ipv6Range("2001:4:112::", 48),
+	ipv6Range("2001:20::", 28),
+	ipv6Range("2001:30::", 28),
+];
+
+/** Non-global allocations inside the ordinary IPv6 global-unicast range. */
+const BLOCKED_IPV6_GLOBAL_UNICAST_RANGES: Ipv6Range[] = [
+	ipv6Range("2001::", 23),
+	ipv6Range("2001:db8::", 32),
+	ipv6Range("2002::", 16),
+	ipv6Range("3ffe::", 16),
+	ipv6Range("3fff::", 20),
 ];
 
 // Bracket-stripped form is used for lookups (validateExternalUrl strips
 // brackets from parsed.hostname before checking), so "::1" appears here
-// without brackets. The "::1" case is already covered by isPrivateIp, but
+// without brackets. The "::1" case is already covered by isNonPublicIp, but
 // keeping it here makes the intent explicit and gives a clearer error
 // message for the common `http://[::1]/` form.
 const BLOCKED_HOSTNAMES = new Set([
@@ -101,80 +126,78 @@ function parseIpv4(ip: string): number | null {
 	const parts = ip.split(".");
 	if (parts.length !== 4) return null;
 
-	const nums = parts.map(Number);
-	if (nums.some((n) => isNaN(n) || n < 0 || n > 255)) return null;
+	const nums = parts.map((part) => (IPV4_PART_PATTERN.test(part) ? Number(part) : Number.NaN));
+	if (nums.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return null;
 
 	return ip4ToNum(nums[0], nums[1], nums[2], nums[3]);
 }
 
-/**
- * Convert IPv4-mapped/translated IPv6 addresses from hex form back to IPv4.
- *
- * The WHATWG URL parser normalizes dotted-decimal to hex:
- *   [::ffff:127.0.0.1] -> [::ffff:7f00:1]
- *   [::ffff:169.254.169.254] -> [::ffff:a9fe:a9fe]
- *
- * Without this conversion, the hex forms bypass isPrivateIp() regex checks.
- */
-export function normalizeIPv6MappedToIPv4(ip: string): string | null {
-	// Match hex-form IPv4-mapped IPv6: ::ffff:XXXX:XXXX
-	let match = ip.match(IPV4_MAPPED_IPV6_HEX_PATTERN);
-	if (!match) {
-		// Match IPv4-translated (RFC 6052): ::ffff:0:XXXX:XXXX
-		match = ip.match(IPV4_TRANSLATED_HEX_PATTERN);
-	}
-	if (!match) {
-		// Match fully expanded form: 0000:0000:0000:0000:0000:ffff:XXXX:XXXX
-		match = ip.match(IPV6_EXPANDED_MAPPED_PATTERN);
-	}
-	if (!match) {
-		// Match IPv4-compatible (deprecated) form: ::XXXX:XXXX (no ffff prefix)
-		match = ip.match(IPV4_COMPATIBLE_HEX_PATTERN);
-	}
-	if (!match) {
-		// Match NAT64 prefix (RFC 6052): 64:ff9b::XXXX:XXXX
-		match = ip.match(NAT64_HEX_PATTERN);
+function parseIpv6(ip: string): number[] | null {
+	let address = ip;
+	if (address.includes(".")) {
+		const separator = address.lastIndexOf(":");
+		if (separator === -1) return null;
+		const ipv4 = parseIpv4(address.slice(separator + 1));
+		if (ipv4 === null) return null;
+		address = `${address.slice(0, separator + 1)}${(ipv4 >>> 16).toString(16)}:${(ipv4 & 0xffff).toString(16)}`;
 	}
-	if (match) {
-		const high = parseInt(match[1] ?? "", 16);
-		const low = parseInt(match[2] ?? "", 16);
-		return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
-	}
-	return null;
+	if (address.includes(":::") || address.split("::").length > 2) return null;
+
+	const [before = "", after = ""] = address.split("::");
+	const head = before === "" ? [] : before.split(":");
+	const tail = after === "" ? [] : after.split(":");
+	const parts = [...head, ...tail];
+	if (parts.some((part) => !IPV6_PART_PATTERN.test(part)) || parts.length > 8) return null;
+	if (address.includes("::") ? parts.length >= 8 : parts.length !== 8) return null;
+
+	const zeroCount = address.includes("::") ? 8 - parts.length : 0;
+	return [...head, ...Array.from<string>({ length: zeroCount }).fill("0"), ...tail].map((part) =>
+		Number.parseInt(part, 16),
+	);
 }
 
-function isPrivateIp(ip: string): boolean {
-	// Normalize IPv6 strings to lowercase. `new URL().hostname` already
-	// lowercases, but resolver output (from DoH or an injected resolver) may
-	// not. Without this, "FE80::1" bypasses the link-local check.
-	const normalized = ip.toLowerCase();
-
-	// Handle IPv6 loopback
-	if (normalized === "::1" || normalized === "::ffff:127.0.0.1") return true;
-
-	// Handle IPv4-mapped IPv6 in hex form (WHATWG URL parser normalizes to this)
-	// e.g. ::ffff:7f00:1 -> 127.0.0.1, ::ffff:a9fe:a9fe -> 169.254.169.254
-	const hexIpv4 = normalizeIPv6MappedToIPv4(normalized);
-	if (hexIpv4) return isPrivateIp(hexIpv4);
-
-	// Handle IPv4-mapped IPv6 in dotted-decimal form
-	const v4Match = normalized.match(IPV4_MAPPED_IPV6_DOTTED_PATTERN);
-	const ipv4 = v4Match ? v4Match[1] : normalized;
-
-	const num = parseIpv4(ipv4);
-	if (num === null) {
-		// If we can't parse it, block IPv6 addresses that look internal.
-		// fc00::/7 is Unique Local (first byte 0xfc or 0xfd), fe80::/10 is
-		// link-local. Only match when followed by hex digit + colon to avoid
-		// collisions with hypothetical non-address strings.
-		return (
-			normalized.startsWith("fe80:") ||
-			IPV6_ULA_FC_PATTERN.test(normalized) ||
-			IPV6_ULA_FD_PATTERN.test(normalized)
-		);
+function isIpv6InRange(address: number[], range: Ipv6Range): boolean {
+	const completeParts = Math.floor(range.prefixLength / 16);
+	for (let i = 0; i < completeParts; i++) {
+		if (address[i] !== range.address[i]) return false;
 	}
 
-	return BLOCKED_PATTERNS.some((range) => num >= range.start && num <= range.end);
+	const remainingBits = range.prefixLength % 16;
+	if (remainingBits === 0) return true;
+	const mask = (0xffff << (16 - remainingBits)) & 0xffff;
+	return (address[completeParts] & mask) === (range.address[completeParts] & mask);
+}
+
+function extractEmbeddedIpv4(address: number[]): number | null {
+	if (!IPV4_EMBEDDED_IPV6_RANGES.some((range) => isIpv6InRange(address, range))) return null;
+	const ipv4 = ((address[6] << 16) | address[7]) >>> 0;
+	// The unspecified and loopback addresses retain their native IPv6 meaning.
+	if (ipv4 <= 1 && isIpv6InRange(address, IPV4_COMPATIBLE_IPV6_RANGE)) return null;
+	return ipv4;
+}
+
+/** Convert a hex-form IPv6 address with an embedded IPv4 destination to dotted decimal. */
+export function normalizeIPv6MappedToIPv4(ip: string): string | null {
+	if (ip.includes(".")) return null;
+	const address = parseIpv6(ip);
+	if (address === null) return null;
+	const ipv4 = extractEmbeddedIpv4(address);
+	if (ipv4 === null) return null;
+	return `${ipv4 >>> 24}.${(ipv4 >>> 16) & 0xff}.${(ipv4 >>> 8) & 0xff}.${ipv4 & 0xff}`;
+}
+
+function isNonPublicIp(ip: string): boolean {
+	const parsedIpv4 = parseIpv4(ip);
+	const ipv6 = parsedIpv4 === null ? parseIpv6(ip) : null;
+	const ipv4 = ipv6 === null ? parsedIpv4 : extractEmbeddedIpv4(ipv6);
+	if (ipv4 !== null) {
+		if (ALLOWED_IPV4_EXCEPTIONS.has(ipv4)) return false;
+		return BLOCKED_PATTERNS.some((range) => ipv4 >= range.start && ipv4 <= range.end);
+	}
+	if (ipv6 === null) return true;
+	if (ALLOWED_IPV6_SPECIAL_RANGES.some((range) => isIpv6InRange(ipv6, range))) return false;
+	if (!isIpv6InRange(ipv6, IPV6_GLOBAL_UNICAST_RANGE)) return true;
+	return BLOCKED_IPV6_GLOBAL_UNICAST_RANGES.some((range) => isIpv6InRange(ipv6, range));
 }
 
 /**
@@ -190,17 +213,15 @@ export class SsrfError extends Error {
 }
 
 /**
- * Validate that a URL is safe to fetch (not targeting internal networks).
+ * Validate a URL's scheme, hostname, and literal address.
  *
  * Checks:
  * 1. URL is well-formed with http/https scheme
  * 2. Hostname is not a known internal name (localhost, metadata endpoints)
- * 3. If hostname is an IP literal, it's not in a private range
+ * 3. If hostname is an IP literal, it is a public address
  *
- * Note: DNS rebinding attacks are not fully mitigated (hostname could resolve
- * to a private IP). Full protection requires resolving DNS and checking the IP
- * before connecting, which needs a custom fetch implementation. This covers
- * the most common SSRF vectors.
+ * Hostnames also need DNS validation before dispatch. Resolving and checking
+ * addresses does not bind an ordinary fetch() connection to those addresses.
  *
  * @throws SsrfError if the URL targets an internal address
  */
@@ -241,11 +262,11 @@ export function validateExternalUrl(url: string): URL {
 		}
 	}
 
-	// Check if hostname is an IP address in a private range. Use the
+	// Check if hostname is a non-public IP address. Use the
 	// normalized form so "127.0.0.1.." and friends don't bypass parseIpv4
 	// (which rejects extra trailing dots).
-	if (isPrivateIp(normalizedHost)) {
-		throw new SsrfError("URLs targeting private IP addresses are not allowed");
+	if (isIpLiteral(normalizedHost) && isNonPublicIp(normalizedHost)) {
+		throw new SsrfError("URLs targeting non-public IP addresses are not allowed");
 	}
 
 	return parsed;
@@ -283,6 +304,7 @@ const DOH_TIMEOUT_MS = 3000;
 const DEFAULT_DOH_URL = "https://cloudflare-dns.com/dns-query";
 
 interface DohAnswer {
+	type: number;
 	data: string;
 }
 
@@ -307,8 +329,14 @@ function parseDohResponse(raw: unknown): DohResponse {
 	const answers: DohAnswer[] = [];
 	if (hasProperty(raw, "Answer") && Array.isArray(raw.Answer)) {
 		for (const entry of raw.Answer) {
-			if (hasProperty(entry, "data") && typeof entry.data === "string") {
-				answers.push({ data: entry.data });
+			if (
+				hasProperty(entry, "type") &&
+				typeof entry.type === "number" &&
+				Number.isInteger(entry.type) &&
+				hasProperty(entry, "data") &&
+				typeof entry.data === "string"
+			) {
+				answers.push({ type: entry.type, data: entry.data });
 			}
 		}
 	}
@@ -324,6 +352,7 @@ function parseDohResponse(raw: unknown): DohResponse {
  */
 export const cloudflareDohResolver: DnsResolver = async (hostname) => {
 	async function query(type: "A" | "AAAA"): Promise<string[]> {
+		const expectedAnswerType = type === "A" ? 1 : 28;
 		const params = new URLSearchParams({ name: hostname, type });
 		const controller = new AbortController();
 		const timeout = setTimeout(() => controller.abort(), DOH_TIMEOUT_MS);
@@ -347,8 +376,10 @@ export const cloudflareDohResolver: DnsResolver = async (hostname) => {
 			}
 			// DoH Answer arrays often include CNAME records alongside A/AAAA
 			// records. Their `data` is a hostname, not an IP. Filter to just
-			// IP literals so isPrivateIp sees real addresses.
-			return body.Answer.map((a) => a.data).filter(isIpLiteral);
+			// IP literals of the requested record type.
+			return body.Answer.filter((answer) => answer.type === expectedAnswerType)
+				.map((answer) => answer.data)
+				.filter(isIpLiteral);
 		} finally {
 			clearTimeout(timeout);
 		}
@@ -359,14 +390,12 @@ export const cloudflareDohResolver: DnsResolver = async (hostname) => {
 };
 
 /**
- * Validate a URL and resolve its hostname to check the actual IPs against
- * the private-range blocklist. This catches DNS rebinding attacks using
- * attacker-controlled domains that publicly resolve to private addresses,
- * and wildcard DNS services like nip.io used by exploit tooling.
+ * Validate a URL and reject hostnames that resolve to non-public addresses,
+ * including wildcard DNS services like nip.io used by exploit tooling.
  *
  * Runs `validateExternalUrl` first for cheap pre-flight checks (scheme,
  * literal IP, known-bad hostnames). Then resolves the hostname and rejects
- * if ANY returned address is private.
+ * if ANY returned address is non-public.
  *
  * Fails closed: if resolution fails or returns no records, throws SsrfError.
  *
@@ -381,9 +410,9 @@ export const cloudflareDohResolver: DnsResolver = async (hostname) => {
  * - Host-file overrides or split-horizon corporate DNS on self-hosted Node.
  * - Attacker-controlled rebinding services the caller has allowlisted.
  *
- * The only complete defense is a network-layer egress firewall. On
- * Cloudflare Workers, the platform fetch pipeline provides most of that.
- * On self-hosted Node, operators must restrict egress themselves.
+ * Connections must use the addresses from resolveAndValidateExternalUrlTarget
+ * to avoid a second lookup. Callers using ordinary fetch() need network-level
+ * egress controls to prevent these attacks.
  */
 export async function resolveAndValidateExternalUrl(
 	url: string,
@@ -411,7 +440,7 @@ export async function resolveAndValidateExternalUrlTarget(
 	const hostname = parsed.hostname.replace(IPV6_BRACKET_PATTERN, "");
 
 	// If the hostname is already an IP literal, validateExternalUrl has
-	// already checked it against the private-range list. Skip DNS.
+	// already checked it against the non-public ranges. Skip DNS.
 	if (isIpLiteral(hostname)) {
 		return { url: parsed, addresses: [hostname] };
 	}
@@ -435,20 +464,17 @@ export async function resolveAndValidateExternalUrlTarget(
 		if (!isIpLiteral(ip)) {
 			throw new SsrfError("Hostname resolver returned a non-IP address");
 		}
-		if (isPrivateIp(ip)) {
-			throw new SsrfError("Hostname resolves to a private IP address");
+		if (isNonPublicIp(ip)) {
+			throw new SsrfError("Hostname resolves to a non-public IP address");
 		}
 	}
 
 	return { url: parsed, addresses };
 }
 
-/** True when a string looks like an IPv4 or IPv6 literal. */
+/** True when a string is a valid IPv4 or IPv6 literal. */
 function isIpLiteral(host: string): boolean {
-	if (parseIpv4(host) !== null) return true;
-	// Very loose IPv6 heuristic — matches anything with a colon, which is
-	// never valid in DNS hostnames, so this is safe.
-	return host.includes(":");
+	return parseIpv4(host) !== null || parseIpv6(host) !== null;
 }
 
 /**
@@ -467,13 +493,16 @@ const CREDENTIAL_HEADERS = ["authorization", "cookie", "proxy-authorization"];
 export async function ssrfSafeFetch(
 	url: string,
 	init?: RequestInit,
-	options?: { resolver?: DnsResolver },
+	options?: { resolver?: DnsResolver; httpsOnly?: boolean },
 ): Promise<Response> {
 	let currentUrl = url;
 	let currentInit = init;
 
 	for (let i = 0; i <= MAX_REDIRECTS; i++) {
-		await resolveAndValidateExternalUrl(currentUrl, options);
+		const validated = await resolveAndValidateExternalUrl(currentUrl, options);
+		if (options?.httpsOnly === true && validated.protocol !== "https:") {
+			throw new SsrfError("Only HTTPS URLs are allowed");
+		}
 
 		const response = await globalThis.fetch(currentUrl, {
 			...currentInit,

package/src/seed/apply.ts

@@ -199,7 +199,9 @@ export async function applySeed(
 						routable: collection.routable,
 						hidden: collection.hidden,
 						sortOrder: collection.sortOrder,
+						group: collection.group,
 						commentsEnabled: collection.commentsEnabled,
+						editLocking: collection.editLocking,
 					});
 					result.collections.updated++;
 
@@ -277,7 +279,9 @@ export async function applySeed(
 					routable: collection.routable,
 					hidden: collection.hidden,
 					sortOrder: collection.sortOrder,
+					group: collection.group,
 					commentsEnabled: collection.commentsEnabled,
+					editLocking: collection.editLocking,
 				},
 				fields,
 			);

package/src/seed/types.ts

@@ -78,8 +78,9 @@ export interface SeedCollection {
 	/** Require a slug before an entry can be published. Defaults to true. */
 	routable?: boolean;
 	/**
-	 * Omit this collection from the admin sidebar. It stays reachable through
-	 * the API, MCP, plugin hooks, and direct `/content/:collection` URLs.
+	 * Omit this collection from the admin sidebar and the dashboard quick
+	 * actions. It stays reachable through the API, MCP, plugin hooks, and
+	 * direct `/content/:collection` URLs.
 	 */
 	hidden?: boolean;
 	/**
@@ -87,8 +88,12 @@ export interface SeedCollection {
 	 * a `sortOrder` keep the alphabetical order and follow the ordered ones.
 	 */
 	sortOrder?: number;
+	/** Admin sidebar folder shared with other collections of the same group. */
+	group?: string;
 	/** Enable comments on this collection */
 	commentsEnabled?: boolean;
+	/** Take an edit lock when an entry is opened (defaults to true) */
+	editLocking?: boolean;
 	/** Field slug powering the admin list Title column (defaults to title display) */
 	titleField?: string;
 	/** Field slug (a datetime field) powering the admin list Date column (defaults to last-updated) */

package/src/seed/validate.ts

@@ -5,7 +5,12 @@
  */
 
 import { getI18nConfig, resolveConfiguredLocale } from "../i18n/config.js";
-import { FIELD_TYPES, isIndexableFieldType, MAX_COLLECTION_LIST_COLUMNS } from "../schema/types.js";
+import {
+	FIELD_TYPES,
+	isIndexableFieldType,
+	MAX_COLLECTION_GROUP_LENGTH,
+	MAX_COLLECTION_LIST_COLUMNS,
+} from "../schema/types.js";
 import type { SeedFile, SeedMenuItem, ValidationResult } from "./types.js";
 
 const COLLECTION_FIELD_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
@@ -107,9 +112,21 @@ export function validateSeed(data: unknown): ValidationResult {
 				if (!collection.label) {
 					errors.push(`${prefix}: label is required`);
 				}
+				if (collection.editLocking !== undefined && typeof collection.editLocking !== "boolean") {
+					errors.push(`${prefix}.editLocking: must be a boolean`);
+				}
 				if (collection.routable !== undefined && typeof collection.routable !== "boolean") {
 					errors.push(`${prefix}.routable: must be a boolean`);
 				}
+				if (collection.group !== undefined) {
+					if (typeof collection.group !== "string") {
+						errors.push(`${prefix}.group: must be a string`);
+					} else if (collection.group.trim().length > MAX_COLLECTION_GROUP_LENGTH) {
+						errors.push(
+							`${prefix}.group: must be at most ${MAX_COLLECTION_GROUP_LENGTH} characters`,
+						);
+					}
+				}
 
 				const declaredFieldSlugs = new Set(
 					Array.isArray(collection.fields)

package/src/seo/hreflang.ts

@@ -167,6 +167,7 @@ export async function getHreflangAlternatesWithDb(
 			collection,
 			slug: variant.slug || variant.id,
 			id: variant.id,
+			date: variant.publishedAt,
 		});
 		const localized = await localizePath(path, locale);
 		if (localized === null) continue;

package/src/seo/index.ts

@@ -30,13 +30,12 @@
  */
 
 import type { ContentSeo } from "../database/repositories/types.js";
-import { buildSeoImageUrl } from "./media-url.js";
+import { buildSeoImageUrl, resolveSeoCanonicalUrl } from "./media-url.js";
 
 export { getHreflangAlternates, getHreflangAlternatesWithDb } from "./hreflang.js";
 export type { HreflangAlternate, HreflangOptions } from "./hreflang.js";
 
 const TRAILING_SLASH_RE = /\/$/;
-const ABSOLUTE_URL_RE = /^https?:\/\//i;
 
 /**
  * Content input for SEO functions.
@@ -138,16 +137,12 @@ export function getSeoMeta<T>(content: SeoContentInput<T>, options: SeoMetaOptio
 	// OG image: SEO image > default
 	const ogImage = seo.image ? buildSeoImageUrl(seo.image, siteUrl) : (defaultOgImage ?? null);
 
-	// Canonical: explicit > path-based > null
+	// Canonical: explicit > path-based > null. The explicit value goes
+	// through the same resolver as the <EmDashHead> overlay, so a panel
+	// canonical renders identically on both paths.
 	let canonical: string | null = null;
 	if (seo.canonical) {
-		// Ensure relative canonical paths get a leading slash so we don't
-		// produce "https://example.composts/x" when joined with siteUrl
-		if (siteUrl && !seo.canonical.startsWith("/") && !ABSOLUTE_URL_RE.test(seo.canonical)) {
-			canonical = `${siteUrl.replace(TRAILING_SLASH_RE, "")}/${seo.canonical}`;
-		} else {
-			canonical = seo.canonical;
-		}
+		canonical = resolveSeoCanonicalUrl(seo.canonical, siteUrl);
 	} else if (siteUrl && path) {
 		const safePath = path.startsWith("/") ? path : `/${path}`;
 		canonical = `${siteUrl.replace(TRAILING_SLASH_RE, "")}${safePath}`;

package/src/seo/media-url.ts

@@ -20,6 +20,12 @@ export function buildSeoImageUrl(imageRef: string, siteUrl?: string): string {
 		return imageRef;
 	}
 
+	// `//host/path` is protocol-relative — already qualified, not a path
+	// to prefix with the site URL.
+	if (imageRef.startsWith("//")) {
+		return imageRef;
+	}
+
 	// Root-relative path (already includes the media API prefix). Without
 	// this branch we'd re-prefix and produce a doubled path that 404s.
 	if (imageRef.startsWith("/")) {
@@ -30,3 +36,23 @@ export function buildSeoImageUrl(imageRef: string, siteUrl?: string): string {
 	const mediaPath = `/_emdash/api/media/file/${imageRef}`;
 	return siteUrl ? `${siteUrl.replace(TRAILING_SLASH_RE, "")}${mediaPath}` : mediaPath;
 }
+
+/**
+ * Resolve a stored SEO canonical value to a URL.
+ *
+ * The SEO panel accepts absolute URLs, root-relative paths, and bare
+ * relative paths. Relative paths are joined with `siteUrl` (adding a
+ * leading slash when missing, so we never produce
+ * `https://example.composts/x`). Without a `siteUrl` the value is
+ * returned as-is. Absolute output matters here: the resolved value feeds
+ * `<link rel="canonical">` and `og:url`, both of which search engines and
+ * scrapers expect fully qualified.
+ */
+export function resolveSeoCanonicalUrl(canonical: string, siteUrl?: string): string {
+	// `//host/path` is protocol-relative — already qualified, not a path.
+	if (!siteUrl || ABSOLUTE_URL_RE.test(canonical) || canonical.startsWith("//")) {
+		return canonical;
+	}
+	const path = canonical.startsWith("/") ? canonical : `/${canonical}`;
+	return `${siteUrl.replace(TRAILING_SLASH_RE, "")}${path}`;
+}

package/src/settings/index.ts

@@ -8,11 +8,13 @@
 import type { Kysely } from "kysely";
 
 import { after } from "../after.js";
+import { siteSettingsTag } from "../cache/chrome-tags.js";
 import { MediaRepository } from "../database/repositories/media.js";
 import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 import { getDb } from "../loader.js";
 import { cachedQuery, invalidateObjectCache } from "../object-cache/index.js";
+import type { CacheHint } from "../query.js";
 import { peekRequestCache, requestCached } from "../request-cache.js";
 
 /** Object-cache namespace for site settings. */
@@ -236,6 +238,20 @@ export function getSiteSettings(): Promise<Partial<SiteSettings>> {
 	);
 }
 
+/**
+ * Get all site settings with a Workers edge-cache hint.
+ *
+ * Use the returned `cacheHint` with `Astro.cache.set()` so pages that render
+ * settings can be purged automatically when site settings change.
+ */
+export async function getSiteSettingsWithCacheHint(): Promise<{
+	data: Partial<SiteSettings>;
+	cacheHint: CacheHint;
+}> {
+	const data = await getSiteSettings();
+	return { data, cacheHint: { tags: [siteSettingsTag()] } };
+}
+
 /**
  * Get all site settings (with explicit db)
  *

package/src/storage/local.ts

@@ -70,6 +70,7 @@ export class LocalStorage implements Storage {
 		key: string;
 		body: Buffer | Uint8Array | ReadableStream<Uint8Array>;
 		contentType: string;
+		cacheControl?: string;
 	}): Promise<UploadResult> {
 		try {
 			const filePath = this.getFilePath(options.key);