emdash 1.0.1 → 1.2.0

package/src/api/handlers/domain-move-notice.ts

@@ -0,0 +1,94 @@
+/**
+ * Tell users that the site moved to a new address.
+ */
+
+import { getLocaleDir } from "@emdash-cms/admin/locales/config";
+import type { DomainMoveEmailStrings } from "@emdash-cms/admin/locales/emails";
+import { escapeHtml, type EmailMessage } from "@emdash-cms/auth";
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+import type { ApiResult } from "../types.js";
+
+export interface DomainMoveNoticeOptions {
+	/** Origin users should sign in at, e.g. `https://example.com`. */
+	origin: string;
+	strings: DomainMoveEmailStrings;
+	locale: string;
+	/** The user sending the notice; they are not emailed. */
+	senderId: string;
+	send: (message: EmailMessage) => Promise<void>;
+}
+
+export function buildDomainMoveEmail(
+	to: string,
+	loginUrl: string,
+	strings: DomainMoveEmailStrings,
+	locale: string,
+): EmailMessage {
+	const url = escapeHtml(loginUrl);
+	return {
+		to,
+		subject: strings.subject,
+		text: `${strings.intro}\n\n${strings.instruction}\n\n${loginUrl}\n\n${strings.passkeyNote}`,
+		html: `
+<!DOCTYPE html>
+<html lang="${escapeHtml(locale)}" dir="${getLocaleDir(locale)}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.5; color: #333; max-width: 600px; margin: 0 auto; padding: 20px;">
+  <h1 style="font-size: 24px; margin-bottom: 20px;">${escapeHtml(strings.subject)}</h1>
+  <p>${escapeHtml(strings.intro)}</p>
+  <p>${escapeHtml(strings.instruction)}</p>
+  <p style="margin: 30px 0;">
+    <a href="${url}" style="background-color: #0066cc; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; display: inline-block;">${escapeHtml(strings.buttonLabel)}</a>
+  </p>
+  <p style="color: #666; font-size: 14px;">${escapeHtml(strings.passkeyNote)}</p>
+</body>
+</html>`,
+	};
+}
+
+/**
+ * Email every active user except the sender a link to the sign-in page at
+ * `origin`. The email carries no sign-in token. Sends one email per user,
+ * so a failed send for one address doesn't stop the others.
+ */
+export async function handleDomainMoveNotice(
+	db: Kysely<Database>,
+	options: DomainMoveNoticeOptions,
+): Promise<ApiResult<{ sent: number; failed: number }>> {
+	try {
+		const users = await db
+			.selectFrom("users")
+			.select("email")
+			.where("disabled", "=", 0)
+			.where("id", "!=", options.senderId)
+			.execute();
+
+		const loginUrl = new URL("/_emdash/admin/login", options.origin).toString();
+		let sent = 0;
+		let failed = 0;
+		for (const user of users) {
+			try {
+				// oxlint-disable-next-line no-await-in-loop -- one send at a time keeps email providers within their rate limits
+				await options.send(
+					buildDomainMoveEmail(user.email, loginUrl, options.strings, options.locale),
+				);
+				sent++;
+			} catch (error) {
+				failed++;
+				console.error("[domain-move-notice] send failed:", error);
+			}
+		}
+		return { success: true, data: { sent, failed } };
+	} catch (error) {
+		console.error("[domain-move-notice] failed:", error);
+		return {
+			success: false,
+			error: { code: "DOMAIN_MOVE_NOTICE_ERROR", message: "Failed to email users" },
+		};
+	}
+}

package/src/api/handlers/index.ts

@@ -147,9 +147,11 @@ export {
 // SEO handlers
 export {
 	handleSitemapData,
+	handleSitemapIndexData,
 	type SitemapCollectionData,
 	type SitemapContentEntry,
 	type SitemapDataResponse,
+	type SitemapIndexEntry,
 } from "./seo.js";
 
 // Plugin handlers

package/src/api/handlers/manifest.ts

@@ -377,6 +377,11 @@ function dbFieldDescriptor(
 		entry.validation = validation;
 	}
 
+	// A bound reference is set through `references`; create refuses a value for it in `data`.
+	if (field.defaultValue !== undefined && !isStoragelessField(field)) {
+		entry.defaultValue = field.defaultValue;
+	}
+
 	return entry;
 }
 

package/src/api/handlers/media-allowlist.ts

@@ -22,6 +22,7 @@ export const GLOBAL_UPLOAD_ALLOWLIST: readonly string[] = [
 	"image/gif",
 	"image/webp",
 	"image/avif",
+	"image/jxl",
 	"video/",
 	"audio/",
 	"application/pdf",

package/src/api/handlers/media-upload.ts

@@ -14,7 +14,7 @@ import { ulid } from "ulidx";
 import { MediaRepository, type MediaItem } from "../../database/repositories/media.js";
 import type { Database } from "../../database/types.js";
 import { enrichImageMetadata } from "../../media/enrich.js";
-import { matchesMimeAllowlist, normalizeMime } from "../../media/mime.js";
+import { matchesMimeAllowlist, normalizeMime, resolveUploadMimeType } from "../../media/mime.js";
 import type { Storage } from "../../storage/types.js";
 import { decodeBase64Bytes } from "../../utils/base64.js";
 import { computeContentHash } from "../../utils/hash.js";
@@ -107,18 +107,21 @@ export async function handleMediaUpload(
 	if ("success" in acquired) return acquired;
 	const { bytes } = acquired;
 
-	// Validate the raw MIME string before normalize/allowlist: normalizeMime
-	// only strips parameters and matchesMimeAllowlist only checks startsWith,
-	// so without this a crafted value like "image/png\r\nX-Evil: 1" would
-	// reach the storage backend's ContentType header and be echoed by the
-	// media file serving route.
-	if (!CONTENT_TYPE_RE.test(acquired.mimeType)) {
-		return fail("VALIDATION_ERROR", "Invalid content type");
-	}
 	let filename = input.filename;
-	let mimeType = normalizeMime(acquired.mimeType);
+	// Resolve from the supplied content type where possible, but fall back to
+	// the filename extension so callers that can't identify a format such as
+	// JPEG XL (e.g. empty or generic `application/octet-stream`) still work.
+	let mimeType = resolveUploadMimeType(filename, acquired.mimeType);
 	let size = bytes.byteLength;
 
+	// Re-validate the resolved type here: the resolved value is either the
+	// client-supplied type (parameters already stripped) or a value from the
+	// internal extension map, so a crafted Content-Type with header injection
+	// cannot reach the storage backend or the file-serving response.
+	if (!CONTENT_TYPE_RE.test(mimeType)) {
+		return fail("VALIDATION_ERROR", "Invalid content type");
+	}
+
 	if (!matchesMimeAllowlist(mimeType, GLOBAL_UPLOAD_ALLOWLIST)) {
 		return fail("INVALID_TYPE", "File type not allowed");
 	}

package/src/api/handlers/media-usage.ts

@@ -410,7 +410,8 @@ function normalizeMediaUsageReferenceType(
 	if (
 		referenceType === "image_field" ||
 		referenceType === "file_field" ||
-		referenceType === "portable_text_image"
+		referenceType === "portable_text_image" ||
+		referenceType === "portable_text_video"
 	) {
 		return referenceType;
 	}

package/src/api/handlers/media.ts

@@ -146,6 +146,7 @@ export async function handleMediaCreate(
 		width?: number;
 		height?: number;
 		alt?: string;
+		caption?: string;
 		storageKey: string;
 		contentHash?: string;
 		blurhash?: string;

package/src/api/handlers/plugins.ts

@@ -187,32 +187,7 @@ export async function handlePluginList(
 			if (state.source !== "marketplace" && state.source !== "registry") continue;
 			if (configuredIds.has(state.pluginId)) continue;
 
-			items.push({
-				id: state.pluginId,
-				name: state.displayName || state.pluginId,
-				version: state.marketplaceVersion ?? state.version,
-				enabled: state.status === "active",
-				status: state.status,
-				source: state.source,
-				marketplaceVersion: state.marketplaceVersion ?? undefined,
-				registryPublisherDid: state.registryPublisherDid ?? undefined,
-				registrySlug: state.registrySlug ?? undefined,
-				capabilities: [],
-				hasAdminPages: false,
-				hasDashboardWidgets: false,
-				hasHooks: false,
-				hasSettings: Object.keys(runtimeSettingsSchemaLookup?.(state.pluginId) ?? {}).length > 0,
-				installedAt: state.installedAt?.toISOString(),
-				activatedAt: state.activatedAt?.toISOString() ?? undefined,
-				deactivatedAt: state.deactivatedAt?.toISOString() ?? undefined,
-				description: state.description ?? undefined,
-				iconUrl:
-					state.source === "marketplace" && marketplaceUrl
-						? marketplaceIconUrl(marketplaceUrl, state.pluginId)
-						: undefined,
-				mcpToolsEnabled: state.mcpToolsEnabled,
-				mcpTools: [],
-			});
+			items.push(buildStateOnlyPluginInfo(state, marketplaceUrl, runtimeSettingsSchemaLookup));
 		}
 
 		return {
@@ -239,6 +214,7 @@ export async function handlePluginGet(
 	sandboxedPluginEntries: SandboxedPluginEntry[],
 	pluginId: string,
 	marketplaceUrl?: string,
+	runtimeSettingsSchemaLookup?: (pluginId: string) => Record<string, unknown> | null,
 ): Promise<ApiResult<PluginResponse>> {
 	try {
 		const stateRepo = new PluginStateRepository(db);
@@ -261,6 +237,16 @@ export async function handlePluginGet(
 			};
 		}
 
+		const state = await stateRepo.get(pluginId);
+		if (state && (state.source === "marketplace" || state.source === "registry")) {
+			return {
+				success: true,
+				data: {
+					item: buildStateOnlyPluginInfo(state, marketplaceUrl, runtimeSettingsSchemaLookup),
+				},
+			};
+		}
+
 		return {
 			success: false,
 			error: {
@@ -284,11 +270,13 @@ export async function handlePluginGet(
  * `_plugin_state` row (marketplace or registry install), with no
  * matching `configuredPlugins` entry. Runtime-installed plugins don't
  * have ResolvedPlugin metadata until they're loaded into the sandbox,
- * so the enable/disable response surfaces the state-row view as a
- * stable shape the admin UI already understands.
+ * so the list, single-plugin, and enable/disable responses surface the
+ * state-row view as a stable shape the admin UI already understands.
  */
 function buildStateOnlyPluginInfo(
 	state: NonNullable<Awaited<ReturnType<PluginStateRepository["get"]>>>,
+	marketplaceUrl?: string,
+	runtimeSettingsSchemaLookup?: (pluginId: string) => Record<string, unknown> | null,
 ): PluginInfo {
 	return {
 		id: state.pluginId,
@@ -304,11 +292,15 @@ function buildStateOnlyPluginInfo(
 		hasAdminPages: false,
 		hasDashboardWidgets: false,
 		hasHooks: false,
-		hasSettings: false,
+		hasSettings: Object.keys(runtimeSettingsSchemaLookup?.(state.pluginId) ?? {}).length > 0,
 		installedAt: state.installedAt?.toISOString(),
 		activatedAt: state.activatedAt?.toISOString() ?? undefined,
 		deactivatedAt: state.deactivatedAt?.toISOString() ?? undefined,
 		description: state.description ?? undefined,
+		iconUrl:
+			state.source === "marketplace" && marketplaceUrl
+				? marketplaceIconUrl(marketplaceUrl, state.pluginId)
+				: undefined,
 		mcpToolsEnabled: state.mcpToolsEnabled,
 		mcpTools: [],
 	};

package/src/api/handlers/redirects.ts

@@ -16,7 +16,7 @@ import {
 import { InvalidCursorError } from "../../database/repositories/types.js";
 import type { FindManyResult } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
-import { invalidateRedirectCache } from "../../redirects/cache.js";
+import { publishRedirectChanges } from "../../redirects/artifacts.js";
 import { wouldCreateLoop, detectLoops, type RedirectEdge } from "../../redirects/loops.js";
 import { validatePattern, validateDestinationParams, isPattern } from "../../redirects/patterns.js";
 import { isTerminalStatus } from "../../redirects/status.js";
@@ -174,7 +174,7 @@ export async function handleRedirectCreate(
 			);
 			return { success: true, data: redirect };
 		});
-		if (result.success) invalidateRedirectCache();
+		if (result.success) await publishRedirectChanges(db);
 		return result;
 	} catch {
 		return {
@@ -313,12 +313,12 @@ export async function handleRedirectUpdate(
 				}
 			}
 
-			// Check for redirect loops if source or destination changed
+			// Check for redirect loops if the rule's edge changes or it becomes active
 			const willBeEnabled = input.enabled ?? existing.enabled;
 			if (
 				!terminal &&
 				willBeEnabled &&
-				(input.source !== undefined || input.destination !== undefined)
+				(input.source !== undefined || input.destination !== undefined || !existing.enabled)
 			) {
 				const edges = toEdges(await repo.findAllEnabled());
 				const loopPath = wouldCreateLoop(newSource, newDest, edges, id);
@@ -351,7 +351,7 @@ export async function handleRedirectUpdate(
 			await updateLoopCache(repo.db);
 			return { success: true, data: updated };
 		});
-		if (result.success) invalidateRedirectCache();
+		if (result.success) await publishRedirectChanges(db);
 		return result;
 	} catch {
 		return {
@@ -402,7 +402,7 @@ export async function handleRedirectDelete(
 			await updateLoopCache(repo.db);
 			return { success: true, data: { deleted: true } };
 		});
-		if (result.success) invalidateRedirectCache();
+		if (result.success) await publishRedirectChanges(db);
 		return result;
 	} catch {
 		return {

package/src/api/handlers/seo.ts

@@ -50,18 +50,33 @@ export interface SitemapCollectionData {
 	collection: string;
 	/** URL pattern with {slug} placeholder, or null for default /{collection}/{slug} */
 	urlPattern: string | null;
-	/** Most recent updated_at across all entries (for sitemap index lastmod) */
-	lastmod: string;
-	/** Individual content entries */
+	/** Entries on the requested page */
 	entries: SitemapContentEntry[];
+	/**
+	 * Indexable translations of `entries` that sit on other pages. They are
+	 * not listed themselves but are needed for `hreflang` alternates.
+	 */
+	translations: SitemapContentEntry[];
 }
 
 export interface SitemapDataResponse {
 	collections: SitemapCollectionData[];
 }
 
-/** Maximum entries per sitemap (per spec) */
-const SITEMAP_MAX_ENTRIES = 50_000;
+/** One child sitemap in the sitemap index */
+export interface SitemapIndexEntry {
+	collection: string;
+	/** 1-based page number */
+	page: number;
+	/** Most recent updated_at across the page's entries */
+	lastmod: string;
+}
+
+/**
+ * Entries per child sitemap. Collections with more indexable entries continue
+ * at `/sitemap-{collection}-2.xml`, `-3.xml`, and so on.
+ */
+export const SITEMAP_PAGE_SIZE = 2000;
 
 /** Matches a trailing timezone designator (`Z` or `±HH`, `±HHMM`, `±HH:MM`). */
 const TZ_SUFFIX_RE = /([zZ]|[+-]\d{2}(:?\d{2})?)$/;
@@ -91,12 +106,112 @@ function toW3CDate(value: string): string {
 	return Number.isNaN(parsed) ? value : new Date(parsed).toISOString();
 }
 
+interface SitemapCollectionRow {
+	slug: string;
+	url_pattern: string | null;
+}
+
+/** Routable, SEO-enabled collections with a valid slug (optionally one collection). */
+async function getSitemapCollections(
+	db: Kysely<Database>,
+	collectionSlug?: string,
+): Promise<SitemapCollectionRow[]> {
+	let query = db
+		.selectFrom("_emdash_collections")
+		.select(["slug", "url_pattern"])
+		.where("has_seo", "=", 1)
+		.where("routable", "=", 1);
+
+	if (collectionSlug) {
+		query = query.where("slug", "=", collectionSlug);
+	}
+
+	const collections = await query.execute();
+	return collections.filter((col) => {
+		// Should always pass (slugs are validated on creation), but guards the
+		// table-name identifier against corrupted DB data.
+		try {
+			validateIdentifier(col.slug, "collection slug");
+			return true;
+		} catch {
+			console.warn(`[SITEMAP] Skipping collection with invalid slug: ${col.slug}`);
+			return false;
+		}
+	});
+}
+
 /**
- * Collect all published, indexable content across SEO-enabled collections
- * for sitemap generation, grouped by collection.
- *
- * Only includes content from routable collections with `has_seo = 1`.
- * Excludes content with `seo_no_index = 1` in the `_emdash_seo` table.
+ * Published, non-deleted rows with a slug that are not marked noindex.
+ * Content without an SEO row is indexable by default.
+ */
+function indexableRows(collection: string) {
+	return sql`
+		FROM ${sql.ref(`ec_${collection}`)} c
+		LEFT JOIN _emdash_seo s
+			ON s.collection = ${collection}
+			AND s.content_id = c.id
+		WHERE c.status = 'published'
+		AND c.deleted_at IS NULL
+		AND c.slug IS NOT NULL
+		AND TRIM(c.slug) <> ''
+		AND (s.seo_no_index IS NULL OR s.seo_no_index = 0)
+	`;
+}
+
+/**
+ * List the child sitemaps for the sitemap index: one per page of each
+ * SEO-enabled collection that has indexable content, with the page's latest
+ * update as `lastmod`.
+ */
+export async function handleSitemapIndexData(
+	db: Kysely<Database>,
+	pageSize = SITEMAP_PAGE_SIZE,
+): Promise<ApiResult<{ sitemaps: SitemapIndexEntry[] }>> {
+	try {
+		const collections = await getSitemapCollections(db);
+		const sitemaps: SitemapIndexEntry[] = [];
+
+		for (const col of collections) {
+			// A missing or broken table skips that collection instead of failing
+			// the whole index.
+			try {
+				const rows = await sql<{ page: number | string; lastmod: string }>`
+					SELECT p.page AS page, MAX(p.updated_at) AS lastmod
+					FROM (
+						SELECT c.updated_at,
+							(ROW_NUMBER() OVER (ORDER BY c.id) - 1) / CAST(${pageSize} AS INTEGER) AS page
+						${indexableRows(col.slug)}
+					) p
+					GROUP BY p.page
+					ORDER BY p.page
+				`.execute(db);
+
+				for (const row of rows.rows) {
+					sitemaps.push({
+						collection: col.slug,
+						page: Number(row.page) + 1,
+						lastmod: toW3CDate(row.lastmod),
+					});
+				}
+			} catch (err) {
+				console.warn(`[SITEMAP] Failed to query collection "${col.slug}":`, err);
+			}
+		}
+
+		return { success: true, data: { sitemaps } };
+	} catch (error) {
+		console.error("[SITEMAP_ERROR]", error);
+		return {
+			success: false,
+			error: { code: "SITEMAP_ERROR", message: "Failed to generate sitemap index" },
+		};
+	}
+}
+
+/**
+ * Collect one page of published, indexable content per SEO-enabled
+ * collection for sitemap generation, ordered by ID so editing an entry does
+ * not move it to another page.
  *
  * Returns raw data grouped per collection. The caller (route) is
  * responsible for building absolute URLs — this handler does NOT
@@ -106,42 +221,19 @@ export async function handleSitemapData(
 	db: Kysely<Database>,
 	/** When set, only return data for this collection. */
 	collectionSlug?: string,
+	options: { page?: number; pageSize?: number } = {},
 ): Promise<ApiResult<SitemapDataResponse>> {
+	const page = options.page ?? 1;
+	const pageSize = options.pageSize ?? SITEMAP_PAGE_SIZE;
 	try {
-		// Find SEO-enabled collections (optionally filtered)
-		let query = db
-			.selectFrom("_emdash_collections")
-			.select(["slug", "url_pattern"])
-			.where("has_seo", "=", 1)
-			.where("routable", "=", 1);
-
-		if (collectionSlug) {
-			query = query.where("slug", "=", collectionSlug);
-		}
-
-		const collections = await query.execute();
-
+		const collections = await getSitemapCollections(db, collectionSlug);
 		const result: SitemapCollectionData[] = [];
 
 		for (const col of collections) {
-			// Validate the slug before using it as a table name identifier.
-			// Should always pass (slugs are validated on creation), but
-			// guards against corrupted DB data.
-			try {
-				validateIdentifier(col.slug, "collection slug");
-			} catch {
-				console.warn(`[SITEMAP] Skipping collection with invalid slug: ${col.slug}`);
-				continue;
-			}
-
-			const tableName = `ec_${col.slug}`;
-
-			// Query published, non-deleted content.
-			// LEFT JOIN _emdash_seo to check noindex flag.
-			// Content without an SEO row is assumed indexable (default).
-			// Wrapped in try/catch so a missing/broken table doesn't fail the
-			// entire sitemap — we skip that collection and continue.
+			// A missing or broken table skips that collection instead of failing
+			// the whole sitemap.
 			try {
+				const from = indexableRows(col.slug);
 				const rows = await sql<{
 					slug: string | null;
 					id: string;
@@ -150,26 +242,29 @@ export async function handleSitemapData(
 					locale: string;
 					translation_group: string | null;
 					seo_image: string | null;
+					on_page: number | string;
 				}>`
-					SELECT c.slug, c.id, c.updated_at, c.published_at, c.locale, c.translation_group, s.seo_image
-					FROM ${sql.ref(tableName)} c
-					LEFT JOIN _emdash_seo s
-						ON s.collection = ${col.slug}
-						AND s.content_id = c.id
-					WHERE c.status = 'published'
-					AND c.deleted_at IS NULL
-					AND c.slug IS NOT NULL
-					AND TRIM(c.slug) <> ''
-					AND (s.seo_no_index IS NULL OR s.seo_no_index = 0)
-					ORDER BY c.updated_at DESC
-					LIMIT ${SITEMAP_MAX_ENTRIES}
+					WITH page AS (
+						SELECT c.id, c.translation_group
+						${from}
+						ORDER BY c.id
+						LIMIT ${pageSize} OFFSET ${(page - 1) * pageSize}
+					)
+					SELECT c.slug, c.id, c.updated_at, c.published_at, c.locale, c.translation_group,
+						s.seo_image,
+						CASE WHEN c.id IN (SELECT id FROM page) THEN 1 ELSE 0 END AS on_page
+					${from}
+					AND (
+						c.id IN (SELECT id FROM page)
+						OR c.translation_group IN (SELECT translation_group FROM page)
+					)
+					ORDER BY c.id
 				`.execute(db);
 
-				if (rows.rows.length === 0) continue;
-
 				const entries: SitemapContentEntry[] = [];
+				const translations: SitemapContentEntry[] = [];
 				for (const row of rows.rows) {
-					entries.push({
+					const entry: SitemapContentEntry = {
 						id: row.id,
 						slug: row.slug,
 						updatedAt: toW3CDate(row.updated_at),
@@ -177,18 +272,19 @@ export async function handleSitemapData(
 						locale: row.locale,
 						translationGroup: row.translation_group,
 						image: row.seo_image ?? null,
-					});
+					};
+					(Number(row.on_page) === 1 ? entries : translations).push(entry);
 				}
 
+				if (entries.length === 0) continue;
+
 				result.push({
 					collection: col.slug,
 					urlPattern: col.url_pattern,
-					// Rows are ordered by updated_at DESC, so first row is the latest
-					lastmod: toW3CDate(rows.rows[0].updated_at),
 					entries,
+					translations,
 				});
 			} catch (err) {
-				// Table missing or query error — skip this collection
 				console.warn(`[SITEMAP] Failed to query collection "${col.slug}":`, err);
 				continue;
 			}

package/src/api/handlers/settings.ts

@@ -5,7 +5,11 @@
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
-import { getSiteSettingsWithDb, setSiteSettings } from "../../settings/index.js";
+import {
+	getSiteSettingWithDb,
+	getSiteSettingsWithDb,
+	setSiteSettings,
+} from "../../settings/index.js";
 import type { SiteSettings, SiteSettingsUpdate } from "../../settings/types.js";
 import type { Storage } from "../../storage/types.js";
 import type { ApiResult } from "../types.js";
@@ -37,6 +41,22 @@ export async function handleSettingsUpdate(
 	input: SiteSettingsUpdate,
 ): Promise<ApiResult<Partial<SiteSettings>>> {
 	try {
+		const { timezone } = input;
+		if (
+			typeof timezone === "string" &&
+			!isValidTimeZone(timezone) &&
+			// A previously stored value is sent back unchanged by the admin's settings
+			// form; rejecting it would block saving every other setting.
+			timezone !== (await getSiteSettingWithDb("timezone", db))
+		) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: `timezone: "${timezone}" is not an IANA timezone (for example "Europe/Lisbon" or "UTC")`,
+				},
+			};
+		}
 		await setSiteSettings(input, db);
 		const updatedSettings = await getSiteSettingsWithDb(db, storage);
 		return { success: true, data: updatedSettings };
@@ -47,3 +67,13 @@ export async function handleSettingsUpdate(
 		};
 	}
 }
+
+function isValidTimeZone(timezone: string): boolean {
+	try {
+		return Boolean(
+			new Intl.DateTimeFormat("en", { timeZone: timezone }).resolvedOptions().timeZone,
+		);
+	} catch {
+		return false;
+	}
+}