emdash 0.8.0 → 0.10.0

package/src/astro/routes/api/snapshot.ts

@@ -7,6 +7,7 @@
  * - Excludes auth/user/session/token tables
  */
 
+import type { User } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
@@ -17,11 +18,31 @@ import {
 	verifyPreviewSignature,
 } from "#api/handlers/snapshot.js";
 import { getPublicOrigin } from "#api/public-url.js";
+import { resolveSecretsCached } from "#config/secrets.js";
 
 export const prerender = false;
 
-export const GET: APIRoute = async ({ request, locals, url }) => {
-	const { emdash, user } = locals;
+export const GET: APIRoute = async ({ request, locals, url, session }) => {
+	const { emdash } = locals;
+	// This route is in PUBLIC_API_EXACT (for preview-signature callers with no session),
+	// so auth middleware skips user resolution. Manually resolve the session user here
+	// to support session-authenticated admin users alongside preview-signature auth.
+	let user: User | undefined = (locals as { user?: User }).user;
+	if (!user && session && emdash?.db) {
+		try {
+			const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
+			const sessionUser = await session.get("user");
+			if (sessionUser?.id) {
+				const adapter = createKyselyAdapter(emdash.db);
+				const resolved = await adapter.getUserById(sessionUser.id);
+				if (resolved && !resolved.disabled) {
+					user = resolved;
+				}
+			}
+		} catch {
+			// Session resolution failed, continue to preview-signature check
+		}
+	}
 
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
@@ -32,24 +53,29 @@ export const GET: APIRoute = async ({ request, locals, url }) => {
 	let authorized = false;
 
 	if (previewSig) {
-		const secret = import.meta.env.EMDASH_PREVIEW_SECRET || import.meta.env.PREVIEW_SECRET || "";
-		if (!secret) {
-			console.warn(
-				"[snapshot] X-Preview-Signature header present but no PREVIEW_SECRET configured",
-			);
+		// Resolves env override or DB-stored value. Always non-empty after
+		// resolution, so the signature path is never silently disabled.
+		// Note: a signing process without access to this database (e.g. a
+		// remote preview Worker) must set the same `EMDASH_PREVIEW_SECRET`
+		// env var on both sides.
+		const { previewSecret: secret, previewSecretSource } = await resolveSecretsCached(emdash.db);
+		const parsed = parsePreviewSignatureHeader(previewSig);
+		if (!parsed) {
+			console.warn("[snapshot] Failed to parse X-Preview-Signature header");
 		} else {
-			const parsed = parsePreviewSignatureHeader(previewSig);
-			if (!parsed) {
-				console.warn("[snapshot] Failed to parse X-Preview-Signature header");
-			} else {
-				authorized = await verifyPreviewSignature(parsed.source, parsed.exp, parsed.sig, secret);
-				if (!authorized) {
-					console.warn("[snapshot] Preview signature verification failed", {
-						source: parsed.source,
-						exp: parsed.exp,
-						expired: parsed.exp < Date.now() / 1000,
-					});
+			authorized = await verifyPreviewSignature(parsed.source, parsed.exp, parsed.sig, secret);
+			if (!authorized) {
+				const fields: Record<string, unknown> = {
+					source: parsed.source,
+					exp: parsed.exp,
+					expired: parsed.exp < Date.now() / 1000,
+					secretSource: previewSecretSource,
+				};
+				if (previewSecretSource === "db") {
+					fields.hint =
+						"Set EMDASH_PREVIEW_SECRET in both this process and the signing process to share secrets across deployments";
 				}
+				console.warn("[snapshot] Preview signature verification failed", fields);
 			}
 		}
 	}

package/src/astro/routes/api/taxonomies/[name]/terms/[slug]/translations.ts

@@ -0,0 +1,89 @@
+/**
+ * Term translation endpoints
+ *
+ * GET  /_emdash/api/taxonomies/:name/terms/:slug/translations[?locale=xx]
+ * POST /_emdash/api/taxonomies/:name/terms/:slug/translations
+ *    body: { locale, label?, slug? }
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import {
+	handleTermCreate,
+	handleTermGet,
+	handleTermTranslations,
+} from "#api/handlers/taxonomies.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { localeFilterQuery } from "#api/schemas.js";
+
+export const prerender = false;
+
+const createTermTranslationBody = z
+	.object({
+		locale: z.string().min(1),
+		label: z.string().min(1).optional(),
+		slug: z.string().min(1).optional(),
+	})
+	.meta({ id: "CreateTermTranslationBody" });
+
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name, slug } = params;
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const anchor = await handleTermGet(emdash.db, name, slug, { locale: query.locale });
+		if (!anchor.success) return unwrapResult(anchor);
+		const result = await handleTermTranslations(emdash.db, anchor.data.term.id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to list term translations", "TERM_TRANSLATIONS_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name, slug } = params;
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const body = await parseBody(request, createTermTranslationBody);
+		if (isParseError(body)) return body;
+
+		const source = await handleTermGet(emdash.db, name, slug, { locale: query.locale });
+		if (!source.success) return unwrapResult(source);
+
+		const result = await handleTermCreate(emdash.db, name, {
+			slug: body.slug ?? source.data.term.slug,
+			label: body.label ?? source.data.term.label,
+			parentId: source.data.term.parentId,
+			description: source.data.term.description,
+			locale: body.locale,
+			translationOf: source.data.term.id,
+		});
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create term translation", "TERM_TRANSLATION_CREATE_ERROR");
+	}
+};

package/src/astro/routes/api/taxonomies/[name]/terms/[slug].ts

@@ -1,9 +1,9 @@
 /**
  * Single term endpoint
  *
- * GET /_emdash/api/taxonomies/:name/terms/:slug - Get a single term
- * PUT /_emdash/api/taxonomies/:name/terms/:slug - Update a term
- * DELETE /_emdash/api/taxonomies/:name/terms/:slug - Delete a term
+ * GET    /_emdash/api/taxonomies/:name/terms/:slug[?locale=xx]
+ * PUT    /_emdash/api/taxonomies/:name/terms/:slug[?locale=xx]
+ * DELETE /_emdash/api/taxonomies/:name/terms/:slug[?locale=xx]
  */
 
 import type { APIRoute } from "astro";
@@ -11,21 +11,18 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleTermDelete, handleTermGet, handleTermUpdate } from "#api/handlers/taxonomies.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { updateTermBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { localeFilterQuery, updateTermBody } from "#api/schemas.js";
 
 export const prerender = false;
 
 /**
  * Get a single term
  */
-export const GET: APIRoute = async ({ params, locals }) => {
+export const GET: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -33,8 +30,11 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "taxonomies:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTermGet(emdash.db, name, slug);
+		const result = await handleTermGet(emdash.db, name, slug, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to get term", "TERM_GET_ERROR");
@@ -47,10 +47,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 export const PUT: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -58,11 +55,14 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	const denied = requirePerm(user, "taxonomies:manage");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
 		const body = await parseBody(request, updateTermBody);
 		if (isParseError(body)) return body;
 
-		const result = await handleTermUpdate(emdash.db, name, slug, body);
+		const result = await handleTermUpdate(emdash.db, name, slug, body, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update term", "TERM_UPDATE_ERROR");
@@ -72,13 +72,10 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 /**
  * Delete a term
  */
-export const DELETE: APIRoute = async ({ params, locals }) => {
+export const DELETE: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
+	if (!name || !slug) return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -86,8 +83,11 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "taxonomies:manage");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTermDelete(emdash.db, name, slug);
+		const result = await handleTermDelete(emdash.db, name, slug, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to delete term", "TERM_DELETE_ERROR");

package/src/astro/routes/api/taxonomies/[name]/terms/index.ts

@@ -1,8 +1,8 @@
 /**
  * Taxonomy terms list and create endpoint
  *
- * GET /_emdash/api/taxonomies/:name/terms - List all terms (tree for hierarchical)
- * POST /_emdash/api/taxonomies/:name/terms - Create a new term
+ * GET  /_emdash/api/taxonomies/:name/terms[?locale=xx] - List terms (tree for hierarchical)
+ * POST /_emdash/api/taxonomies/:name/terms              - Create a new term (body may include locale & translationOf)
  */
 
 import type { APIRoute } from "astro";
@@ -10,21 +10,18 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleTermCreate, handleTermList } from "#api/handlers/taxonomies.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createTermBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { createTermBody, localeFilterQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
 /**
  * List all terms for a taxonomy
  */
-export const GET: APIRoute = async ({ params, locals }) => {
+export const GET: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name } = params;
-
-	if (!name) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
-	}
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
@@ -32,8 +29,11 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "taxonomies:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTermList(emdash.db, name);
+		const result = await handleTermList(emdash.db, name, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to list terms", "TERM_LIST_ERROR");
@@ -46,10 +46,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const { name } = params;
-
-	if (!name) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
-	}
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;

package/src/astro/routes/api/taxonomies/index.ts

@@ -1,8 +1,8 @@
 /**
  * Taxonomy definitions endpoint
  *
- * GET  /_emdash/api/taxonomies - List all taxonomy definitions
- * POST /_emdash/api/taxonomies - Create a custom taxonomy definition
+ * GET  /_emdash/api/taxonomies[?locale=xx] - List taxonomy definitions
+ * POST /_emdash/api/taxonomies              - Create a custom taxonomy definition
  */
 
 import type { APIRoute } from "astro";
@@ -10,15 +10,15 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleTaxonomyCreate, handleTaxonomyList } from "#api/handlers/taxonomies.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createTaxonomyDefBody } from "#api/schemas.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { createTaxonomyDefBody, localeFilterQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
 /**
  * List taxonomy definitions
  */
-export const GET: APIRoute = async ({ locals }) => {
+export const GET: APIRoute = async ({ request, locals }) => {
 	const { emdash, user } = locals;
 
 	const dbErr = requireDb(emdash?.db);
@@ -27,8 +27,11 @@ export const GET: APIRoute = async ({ locals }) => {
 	const denied = requirePerm(user, "taxonomies:read");
 	if (denied) return denied;
 
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
 	try {
-		const result = await handleTaxonomyList(emdash.db);
+		const result = await handleTaxonomyList(emdash.db, { locale: query.locale });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to list taxonomies", "TAXONOMY_LIST_ERROR");
@@ -52,7 +55,6 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		if (isParseError(body)) return body;
 
 		const result = await handleTaxonomyCreate(emdash.db, body);
-		if (result.success) emdash.invalidateManifest();
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create taxonomy", "TAXONOMY_CREATE_ERROR");

package/src/astro/routes/api/themes/preview.ts

@@ -4,7 +4,13 @@
  * POST /_emdash/api/themes/preview
  *
  * Generates a signed preview URL for the "Try with my data" feature.
- * The PREVIEW_SECRET must be set in the environment (shared with preview Workers).
+ *
+ * Uses the resolved preview secret: env override (`EMDASH_PREVIEW_SECRET`)
+ * wins, otherwise an auto-generated stable per-site value persisted in the
+ * options table is used. Processes that share the same database converge on
+ * the same auto-generated value; only set `EMDASH_PREVIEW_SECRET` in both
+ * processes when the verifying side runs without access to the EmDash DB
+ * (e.g. a remote preview Worker).
  */
 
 import type { APIRoute } from "astro";
@@ -12,6 +18,7 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess } from "#api/error.js";
 import { getPublicOrigin } from "#api/public-url.js";
+import { resolveSecretsCached } from "#config/secrets.js";
 
 export const prerender = false;
 
@@ -25,10 +32,9 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 	const denied = requirePerm(user, "plugins:read");
 	if (denied) return denied;
 
-	const secret = import.meta.env.EMDASH_PREVIEW_SECRET || import.meta.env.PREVIEW_SECRET || "";
-	if (!secret) {
-		return apiError("NOT_CONFIGURED", "PREVIEW_SECRET is not configured", 500);
-	}
+	// Always non-empty after resolution; env override wins, otherwise a
+	// stable DB-stored value is used.
+	const { previewSecret: secret } = await resolveSecretsCached(emdash.db);
 
 	let body: { previewUrl: string };
 	try {

package/src/astro/types.ts

@@ -228,6 +228,15 @@ export interface EmDashHandlers {
 			slug?: string;
 			status?: string;
 			authorId?: string | null;
+			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
+			seo?: {
+				title?: string | null;
+				description?: string | null;
+				image?: string | null;
+				canonical?: string | null;
+				noIndex?: boolean;
+			};
+			publishedAt?: string | null;
 			_rev?: string;
 		},
 	) => Promise<HandlerResponse>;
@@ -255,7 +264,11 @@ export interface EmDashHandlers {
 	) => Promise<HandlerResponse>;
 
 	// Publishing & Scheduling handlers
-	handleContentPublish: (collection: string, id: string) => Promise<HandlerResponse>;
+	handleContentPublish: (
+		collection: string,
+		id: string,
+		options?: { publishedAt?: string },
+	) => Promise<HandlerResponse>;
 
 	handleContentUnpublish: (collection: string, id: string) => Promise<HandlerResponse>;
 
@@ -362,8 +375,15 @@ export interface EmDashHandlers {
 	// Configuration (for checking database type, auth mode, etc.)
 	config: import("./integration/runtime.js").EmDashConfig;
 
-	// Manifest invalidation (call after schema changes)
-	invalidateManifest: () => void;
+	// Build the admin manifest from the live database. Only used by admin
+	// routes; logged-out requests don't need it. Per-request, deduplicated
+	// by `requestCached`.
+	getManifest: () => Promise<EmDashManifest>;
+
+	// Clear the cached URL patterns used by `resolveEmDashPath`. Call after
+	// any schema mutation that creates/updates/deletes a collection's
+	// `urlPattern` so public routing picks up the change immediately.
+	invalidateUrlPatternCache: () => void;
 
 	// Sandbox runner (for marketplace plugin install/update)
 	getSandboxRunner: () => import("../plugins/sandbox/types.js").SandboxRunner | null;

package/src/auth/allowed-origins.ts

@@ -0,0 +1,168 @@
+/**
+ * Resolution and validation of multi-origin passkey verification.
+ *
+ * `allowedOrigins` lets one EmDash deployment accept passkey assertions from
+ * several hostnames sharing the same `rpId` (e.g. apex + preview/staging
+ * subdomains under one registrable parent). Origins come from two sources:
+ *
+ *   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)
+ *   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)
+ *
+ * Sources are merged (union of permissions, deduplicated). Each entry is
+ * validated against `siteUrl` to fail loud on dead config the browser would
+ * never honor.
+ */
+
+import { getEnvAllowedOrigins } from "../api/public-url.js";
+import type { EmDashConfig } from "../astro/integration/runtime.js";
+
+export type AllowedOriginSource = "config.allowedOrigins" | "EMDASH_ALLOWED_ORIGINS";
+
+export interface TaggedOrigin {
+	/** Raw entry as declared by the operator. */
+	origin: string;
+	/** Where the entry came from (used for source-attributed errors). */
+	source: AllowedOriginSource;
+}
+
+/**
+ * Collect raw allowedOrigins from config and env, source-tagged.
+ *
+ * Returns raw values — the caller is expected to pass the result through
+ * `validateAllowedOrigins()` before use in passkey verification.
+ */
+export function getConfiguredAllowedOrigins(config?: EmDashConfig): TaggedOrigin[] {
+	const tagged: TaggedOrigin[] = [];
+	if (config?.allowedOrigins) {
+		for (const origin of config.allowedOrigins) {
+			if (origin) tagged.push({ origin, source: "config.allowedOrigins" });
+		}
+	}
+	for (const origin of getEnvAllowedOrigins()) {
+		tagged.push({ origin, source: "EMDASH_ALLOWED_ORIGINS" });
+	}
+	return tagged;
+}
+
+/**
+ * Validate per-entry shape rules (no `siteUrl` needed):
+ *   - parses as `URL`
+ *   - protocol is `http:` or `https:`
+ *   - hostname has no trailing dot (`example.com.` rejected)
+ *   - hostname has no empty labels (`foo..example.com` rejected)
+ *
+ * Returns the deduplicated, normalized origin form (`URL.origin`) of every
+ * input, in input order. Throws on the first violation with a source-tagged
+ * error message.
+ */
+export function validateOriginShape(tagged: TaggedOrigin[]): string[] {
+	const normalized: string[] = [];
+	const seen = new Set<string>();
+	for (const { origin, source } of tagged) {
+		let parsed: URL;
+		try {
+			parsed = new URL(origin);
+		} catch (e) {
+			throw configError(source, `invalid URL: "${origin}"`, e);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+			throw configError(
+				source,
+				`origin must be http or https: "${origin}" (got ${parsed.protocol})`,
+			);
+		}
+		if (parsed.hostname.endsWith(".")) {
+			throw configError(
+				source,
+				`hostname has a trailing dot: "${origin}". Remove the trailing dot — assertion origins from the browser do not include it.`,
+			);
+		}
+		if (parsed.hostname.split(".").includes("")) {
+			throw configError(source, `hostname has empty labels: "${origin}"`);
+		}
+		if (!seen.has(parsed.origin)) {
+			seen.add(parsed.origin);
+			normalized.push(parsed.origin);
+		}
+	}
+	return normalized;
+}
+
+/**
+ * Validate the effective merged allowedOrigins set against `siteUrl`.
+ *
+ * Performs `validateOriginShape()` plus the siteUrl-dependent rules:
+ *   - Rule A: non-empty origins ⇒ `siteUrl` is set
+ *   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)
+ *   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)
+ *   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain
+ *
+ * Throws on first violation. Returns the deduplicated normalized origins.
+ *
+ * Use this at the runtime chokepoint (where config + env are merged into the
+ * effective set). At Astro integration init, prefer `validateOriginShape()`
+ * for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be
+ * supplied at runtime via `EMDASH_SITE_URL`.
+ */
+export function validateAllowedOrigins(
+	siteUrl: string | undefined,
+	tagged: TaggedOrigin[],
+): string[] {
+	const normalized = validateOriginShape(tagged);
+	if (normalized.length === 0) return normalized;
+
+	if (!siteUrl) {
+		throw new Error(
+			`EmDash config error: allowedOrigins is set (${normalized.length} ${
+				normalized.length === 1 ? "entry" : "entries"
+			}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`,
+		);
+	}
+
+	let siteHost: string;
+	try {
+		siteHost = new URL(siteUrl).hostname;
+	} catch (e) {
+		throw new Error(`EmDash config error: siteUrl is not a valid URL: "${siteUrl}"`, {
+			cause: e,
+		});
+	}
+
+	if (siteHost.endsWith(".")) {
+		throw new Error(
+			`EmDash config error: siteUrl "${siteUrl}" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`,
+		);
+	}
+	if (isIPLiteralHostname(siteHost)) {
+		throw new Error(
+			`EmDash config error: siteUrl "${siteUrl}" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`,
+		);
+	}
+
+	for (const { origin, source } of tagged) {
+		const h = new URL(origin).hostname;
+		if (h !== siteHost && !h.endsWith("." + siteHost)) {
+			throw configError(
+				source,
+				`"${origin}" is not a subdomain of siteUrl "${siteUrl}". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`,
+			);
+		}
+	}
+
+	return normalized;
+}
+
+function configError(source: AllowedOriginSource, detail: string, cause?: unknown): Error {
+	const err = new Error(`EmDash config error in ${source}: ${detail}`);
+	if (cause !== undefined) (err as Error & { cause?: unknown }).cause = cause;
+	return err;
+}
+
+const IPV4_DOTTED_DECIMAL_RE = /^\d+(\.\d+){3}$/;
+
+function isIPLiteralHostname(h: string): boolean {
+	// IPv6 hostnames are bracketed by URL.hostname, e.g. "[::1]"
+	if (h.startsWith("[")) return true;
+	// IPv4 dotted-decimal
+	return IPV4_DOTTED_DECIMAL_RE.test(h);
+}