emdash 1.1.0 → 1.2.0

package/src/api/handlers/seo.ts

@@ -50,18 +50,33 @@ export interface SitemapCollectionData {
 	collection: string;
 	/** URL pattern with {slug} placeholder, or null for default /{collection}/{slug} */
 	urlPattern: string | null;
-	/** Most recent updated_at across all entries (for sitemap index lastmod) */
-	lastmod: string;
-	/** Individual content entries */
+	/** Entries on the requested page */
 	entries: SitemapContentEntry[];
+	/**
+	 * Indexable translations of `entries` that sit on other pages. They are
+	 * not listed themselves but are needed for `hreflang` alternates.
+	 */
+	translations: SitemapContentEntry[];
 }
 
 export interface SitemapDataResponse {
 	collections: SitemapCollectionData[];
 }
 
-/** Maximum entries per sitemap (per spec) */
-const SITEMAP_MAX_ENTRIES = 50_000;
+/** One child sitemap in the sitemap index */
+export interface SitemapIndexEntry {
+	collection: string;
+	/** 1-based page number */
+	page: number;
+	/** Most recent updated_at across the page's entries */
+	lastmod: string;
+}
+
+/**
+ * Entries per child sitemap. Collections with more indexable entries continue
+ * at `/sitemap-{collection}-2.xml`, `-3.xml`, and so on.
+ */
+export const SITEMAP_PAGE_SIZE = 2000;
 
 /** Matches a trailing timezone designator (`Z` or `±HH`, `±HHMM`, `±HH:MM`). */
 const TZ_SUFFIX_RE = /([zZ]|[+-]\d{2}(:?\d{2})?)$/;
@@ -91,12 +106,112 @@ function toW3CDate(value: string): string {
 	return Number.isNaN(parsed) ? value : new Date(parsed).toISOString();
 }
 
+interface SitemapCollectionRow {
+	slug: string;
+	url_pattern: string | null;
+}
+
+/** Routable, SEO-enabled collections with a valid slug (optionally one collection). */
+async function getSitemapCollections(
+	db: Kysely<Database>,
+	collectionSlug?: string,
+): Promise<SitemapCollectionRow[]> {
+	let query = db
+		.selectFrom("_emdash_collections")
+		.select(["slug", "url_pattern"])
+		.where("has_seo", "=", 1)
+		.where("routable", "=", 1);
+
+	if (collectionSlug) {
+		query = query.where("slug", "=", collectionSlug);
+	}
+
+	const collections = await query.execute();
+	return collections.filter((col) => {
+		// Should always pass (slugs are validated on creation), but guards the
+		// table-name identifier against corrupted DB data.
+		try {
+			validateIdentifier(col.slug, "collection slug");
+			return true;
+		} catch {
+			console.warn(`[SITEMAP] Skipping collection with invalid slug: ${col.slug}`);
+			return false;
+		}
+	});
+}
+
 /**
- * Collect all published, indexable content across SEO-enabled collections
- * for sitemap generation, grouped by collection.
- *
- * Only includes content from routable collections with `has_seo = 1`.
- * Excludes content with `seo_no_index = 1` in the `_emdash_seo` table.
+ * Published, non-deleted rows with a slug that are not marked noindex.
+ * Content without an SEO row is indexable by default.
+ */
+function indexableRows(collection: string) {
+	return sql`
+		FROM ${sql.ref(`ec_${collection}`)} c
+		LEFT JOIN _emdash_seo s
+			ON s.collection = ${collection}
+			AND s.content_id = c.id
+		WHERE c.status = 'published'
+		AND c.deleted_at IS NULL
+		AND c.slug IS NOT NULL
+		AND TRIM(c.slug) <> ''
+		AND (s.seo_no_index IS NULL OR s.seo_no_index = 0)
+	`;
+}
+
+/**
+ * List the child sitemaps for the sitemap index: one per page of each
+ * SEO-enabled collection that has indexable content, with the page's latest
+ * update as `lastmod`.
+ */
+export async function handleSitemapIndexData(
+	db: Kysely<Database>,
+	pageSize = SITEMAP_PAGE_SIZE,
+): Promise<ApiResult<{ sitemaps: SitemapIndexEntry[] }>> {
+	try {
+		const collections = await getSitemapCollections(db);
+		const sitemaps: SitemapIndexEntry[] = [];
+
+		for (const col of collections) {
+			// A missing or broken table skips that collection instead of failing
+			// the whole index.
+			try {
+				const rows = await sql<{ page: number | string; lastmod: string }>`
+					SELECT p.page AS page, MAX(p.updated_at) AS lastmod
+					FROM (
+						SELECT c.updated_at,
+							(ROW_NUMBER() OVER (ORDER BY c.id) - 1) / CAST(${pageSize} AS INTEGER) AS page
+						${indexableRows(col.slug)}
+					) p
+					GROUP BY p.page
+					ORDER BY p.page
+				`.execute(db);
+
+				for (const row of rows.rows) {
+					sitemaps.push({
+						collection: col.slug,
+						page: Number(row.page) + 1,
+						lastmod: toW3CDate(row.lastmod),
+					});
+				}
+			} catch (err) {
+				console.warn(`[SITEMAP] Failed to query collection "${col.slug}":`, err);
+			}
+		}
+
+		return { success: true, data: { sitemaps } };
+	} catch (error) {
+		console.error("[SITEMAP_ERROR]", error);
+		return {
+			success: false,
+			error: { code: "SITEMAP_ERROR", message: "Failed to generate sitemap index" },
+		};
+	}
+}
+
+/**
+ * Collect one page of published, indexable content per SEO-enabled
+ * collection for sitemap generation, ordered by ID so editing an entry does
+ * not move it to another page.
  *
  * Returns raw data grouped per collection. The caller (route) is
  * responsible for building absolute URLs — this handler does NOT
@@ -106,42 +221,19 @@ export async function handleSitemapData(
 	db: Kysely<Database>,
 	/** When set, only return data for this collection. */
 	collectionSlug?: string,
+	options: { page?: number; pageSize?: number } = {},
 ): Promise<ApiResult<SitemapDataResponse>> {
+	const page = options.page ?? 1;
+	const pageSize = options.pageSize ?? SITEMAP_PAGE_SIZE;
 	try {
-		// Find SEO-enabled collections (optionally filtered)
-		let query = db
-			.selectFrom("_emdash_collections")
-			.select(["slug", "url_pattern"])
-			.where("has_seo", "=", 1)
-			.where("routable", "=", 1);
-
-		if (collectionSlug) {
-			query = query.where("slug", "=", collectionSlug);
-		}
-
-		const collections = await query.execute();
-
+		const collections = await getSitemapCollections(db, collectionSlug);
 		const result: SitemapCollectionData[] = [];
 
 		for (const col of collections) {
-			// Validate the slug before using it as a table name identifier.
-			// Should always pass (slugs are validated on creation), but
-			// guards against corrupted DB data.
-			try {
-				validateIdentifier(col.slug, "collection slug");
-			} catch {
-				console.warn(`[SITEMAP] Skipping collection with invalid slug: ${col.slug}`);
-				continue;
-			}
-
-			const tableName = `ec_${col.slug}`;
-
-			// Query published, non-deleted content.
-			// LEFT JOIN _emdash_seo to check noindex flag.
-			// Content without an SEO row is assumed indexable (default).
-			// Wrapped in try/catch so a missing/broken table doesn't fail the
-			// entire sitemap — we skip that collection and continue.
+			// A missing or broken table skips that collection instead of failing
+			// the whole sitemap.
 			try {
+				const from = indexableRows(col.slug);
 				const rows = await sql<{
 					slug: string | null;
 					id: string;
@@ -150,26 +242,29 @@ export async function handleSitemapData(
 					locale: string;
 					translation_group: string | null;
 					seo_image: string | null;
+					on_page: number | string;
 				}>`
-					SELECT c.slug, c.id, c.updated_at, c.published_at, c.locale, c.translation_group, s.seo_image
-					FROM ${sql.ref(tableName)} c
-					LEFT JOIN _emdash_seo s
-						ON s.collection = ${col.slug}
-						AND s.content_id = c.id
-					WHERE c.status = 'published'
-					AND c.deleted_at IS NULL
-					AND c.slug IS NOT NULL
-					AND TRIM(c.slug) <> ''
-					AND (s.seo_no_index IS NULL OR s.seo_no_index = 0)
-					ORDER BY c.updated_at DESC
-					LIMIT ${SITEMAP_MAX_ENTRIES}
+					WITH page AS (
+						SELECT c.id, c.translation_group
+						${from}
+						ORDER BY c.id
+						LIMIT ${pageSize} OFFSET ${(page - 1) * pageSize}
+					)
+					SELECT c.slug, c.id, c.updated_at, c.published_at, c.locale, c.translation_group,
+						s.seo_image,
+						CASE WHEN c.id IN (SELECT id FROM page) THEN 1 ELSE 0 END AS on_page
+					${from}
+					AND (
+						c.id IN (SELECT id FROM page)
+						OR c.translation_group IN (SELECT translation_group FROM page)
+					)
+					ORDER BY c.id
 				`.execute(db);
 
-				if (rows.rows.length === 0) continue;
-
 				const entries: SitemapContentEntry[] = [];
+				const translations: SitemapContentEntry[] = [];
 				for (const row of rows.rows) {
-					entries.push({
+					const entry: SitemapContentEntry = {
 						id: row.id,
 						slug: row.slug,
 						updatedAt: toW3CDate(row.updated_at),
@@ -177,18 +272,19 @@ export async function handleSitemapData(
 						locale: row.locale,
 						translationGroup: row.translation_group,
 						image: row.seo_image ?? null,
-					});
+					};
+					(Number(row.on_page) === 1 ? entries : translations).push(entry);
 				}
 
+				if (entries.length === 0) continue;
+
 				result.push({
 					collection: col.slug,
 					urlPattern: col.url_pattern,
-					// Rows are ordered by updated_at DESC, so first row is the latest
-					lastmod: toW3CDate(rows.rows[0].updated_at),
 					entries,
+					translations,
 				});
 			} catch (err) {
-				// Table missing or query error — skip this collection
 				console.warn(`[SITEMAP] Failed to query collection "${col.slug}":`, err);
 				continue;
 			}

package/src/api/handlers/settings.ts

@@ -5,7 +5,11 @@
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
-import { getSiteSettingsWithDb, setSiteSettings } from "../../settings/index.js";
+import {
+	getSiteSettingWithDb,
+	getSiteSettingsWithDb,
+	setSiteSettings,
+} from "../../settings/index.js";
 import type { SiteSettings, SiteSettingsUpdate } from "../../settings/types.js";
 import type { Storage } from "../../storage/types.js";
 import type { ApiResult } from "../types.js";
@@ -37,6 +41,22 @@ export async function handleSettingsUpdate(
 	input: SiteSettingsUpdate,
 ): Promise<ApiResult<Partial<SiteSettings>>> {
 	try {
+		const { timezone } = input;
+		if (
+			typeof timezone === "string" &&
+			!isValidTimeZone(timezone) &&
+			// A previously stored value is sent back unchanged by the admin's settings
+			// form; rejecting it would block saving every other setting.
+			timezone !== (await getSiteSettingWithDb("timezone", db))
+		) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: `timezone: "${timezone}" is not an IANA timezone (for example "Europe/Lisbon" or "UTC")`,
+				},
+			};
+		}
 		await setSiteSettings(input, db);
 		const updatedSettings = await getSiteSettingsWithDb(db, storage);
 		return { success: true, data: updatedSettings };
@@ -47,3 +67,13 @@ export async function handleSettingsUpdate(
 		};
 	}
 }
+
+function isValidTimeZone(timezone: string): boolean {
+	try {
+		return Boolean(
+			new Intl.DateTimeFormat("en", { timeZone: timezone }).resolvedOptions().timeZone,
+		);
+	} catch {
+		return false;
+	}
+}

package/src/api/handlers/site-domain.ts

@@ -0,0 +1,143 @@
+/**
+ * Site domain handlers
+ *
+ * Changing the site's domain stores the new origin as the Site URL, which
+ * links in emails and plugins, sitemaps, and absolute URLs in search and
+ * social metadata use. Before it is stored, EmDash fetches a one-time token
+ * from the new domain to prove the domain serves this site.
+ */
+
+import type { Kysely } from "kysely";
+
+import { OptionsRepository } from "../../database/repositories/options.js";
+import type { Database } from "../../database/types.js";
+import { resolveAndValidateExternalUrl } from "../../security/ssrf.js";
+import { setSiteSettings } from "../../settings/index.js";
+import { encodeBase64url } from "../../utils/base64.js";
+import type { ApiResult } from "../types.js";
+
+export const DOMAIN_PROOF_PATH = "/_emdash/api/site/domain-proof";
+
+const PROOF_OPTION = "emdash:domain_proof";
+const PROOF_TTL_MS = 60_000;
+const CHECK_TIMEOUT_MS = 10_000;
+const IPV4_RE = /^\d{1,3}(\.\d{1,3}){3}$/;
+
+interface DomainProof {
+	token: string;
+	expiresAt: number;
+}
+
+/**
+ * Parse a bare hostname or an `https://` origin into an origin. Paths,
+ * ports, credentials, IP addresses, and single-label hosts are rejected.
+ */
+export function parseSiteDomain(input: string): string | undefined {
+	const trimmed = input.trim();
+	const candidate = trimmed.includes("://") ? trimmed : `https://${trimmed}`;
+	if (!URL.canParse(candidate)) return undefined;
+	const url = new URL(candidate);
+	if (url.protocol !== "https:") return undefined;
+	if (url.username || url.password || url.port || url.search || url.hash) return undefined;
+	if (url.pathname !== "/") return undefined;
+	const host = url.hostname;
+	if (!host.includes(".") || host.endsWith(".") || host.startsWith("[") || IPV4_RE.test(host)) {
+		return undefined;
+	}
+	return url.origin;
+}
+
+function checkFailed(message: string): ApiResult<never> {
+	return { success: false, error: { code: "DOMAIN_CHECK_FAILED", message } };
+}
+
+/**
+ * Verify that `input` serves this site and store it as the Site URL.
+ */
+export async function handleSiteDomainChange(
+	db: Kysely<Database>,
+	input: string,
+): Promise<ApiResult<{ url: string }>> {
+	const origin = parseSiteDomain(input);
+	if (!origin) {
+		return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: "Enter a domain such as example.com, without a path or port",
+			},
+		};
+	}
+
+	const options = new OptionsRepository(db);
+	const token = encodeBase64url(crypto.getRandomValues(new Uint8Array(24)));
+	const proof: DomainProof = { token, expiresAt: Date.now() + PROOF_TTL_MS };
+	const revision = await options.setVersioned(PROOF_OPTION, proof);
+
+	try {
+		const proofUrl = `${origin}${DOMAIN_PROOF_PATH}`;
+		try {
+			await resolveAndValidateExternalUrl(proofUrl);
+		} catch {
+			return checkFailed(`${new URL(origin).hostname} does not resolve to a public address`);
+		}
+
+		let response: Response;
+		try {
+			response = await fetch(proofUrl, {
+				method: "POST",
+				redirect: "manual",
+				headers: { Accept: "application/json", "X-EmDash-Request": "1" },
+				signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+			});
+		} catch {
+			return checkFailed(`Could not reach ${origin}`);
+		}
+
+		if (response.status >= 300 && response.status < 400) {
+			const location = response.headers.get("Location");
+			const target =
+				location && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;
+			return checkFailed(
+				target
+					? `${origin} redirects to ${target.origin}. Enter that address instead.`
+					: `${origin} redirects elsewhere`,
+			);
+		}
+
+		const body: unknown = response.ok ? await response.json().catch(() => null) : null;
+		const received =
+			body &&
+			typeof body === "object" &&
+			"data" in body &&
+			body.data &&
+			typeof body.data === "object"
+				? (body.data as { token?: unknown }).token
+				: undefined;
+		if (received !== token) {
+			return checkFailed(`${origin} does not serve this site yet`);
+		}
+
+		await setSiteSettings({ url: origin }, db);
+		return { success: true, data: { url: origin } };
+	} finally {
+		await db
+			.deleteFrom("options")
+			.where("name", "=", PROOF_OPTION)
+			.where("revision", "=", revision)
+			.execute();
+	}
+}
+
+/**
+ * Return the pending domain proof token, if a check is in progress.
+ */
+export async function handleDomainProof(
+	db: Kysely<Database>,
+): Promise<ApiResult<{ token: string }>> {
+	const proof = await new OptionsRepository(db).get<DomainProof>(PROOF_OPTION);
+	if (!proof || typeof proof.token !== "string" || proof.expiresAt < Date.now()) {
+		return { success: false, error: { code: "NOT_FOUND", message: "No domain check in progress" } };
+	}
+	return { success: true, data: { token: proof.token } };
+}

package/src/api/openapi/document.ts

@@ -295,7 +295,7 @@ const contentPaths = {
 					},
 				},
 				...authErrors,
-				...standardErrors(500),
+				...standardErrors(400, 500),
 			},
 		},
 		post: {
@@ -873,7 +873,7 @@ const contentPaths = {
 					},
 				},
 				...authErrors,
-				...standardErrors(500),
+				...standardErrors(400, 500),
 			},
 		},
 	},

package/src/api/public-url.ts

@@ -37,7 +37,7 @@ export function _resetEnvCache(): void {
 	_envAllowedOrigins = null;
 }
 
-function getEnvSiteUrl(): string | undefined {
+export function getEnvSiteUrl(): string | undefined {
 	if (_envSiteUrl !== null) return _envSiteUrl || undefined;
 	try {
 		// process.env is available on Node.js; undefined on Workers

package/src/api/schemas/content.ts

@@ -148,8 +148,17 @@ const CONTENT_STATUSES = [
 	"future",
 ] as const;
 
+const pageParam = z.coerce
+	.number()
+	.int()
+	.min(1)
+	.max(Number.MAX_SAFE_INTEGER)
+	.optional()
+	.meta({ description: "1-based page number, for numbered pages instead of a cursor" });
+
 export const contentListQuery = cursorPaginationQuery
 	.extend({
+		page: pageParam,
 		/** Filter by status; `all` (like omitting it) lists every status. */
 		status: z
 			.enum([...CONTENT_STATUSES, "all"])
@@ -182,6 +191,10 @@ export const contentListQuery = cursorPaginationQuery
 		/** JSON-encoded indexed custom-field filters, combined with AND semantics. */
 		fieldFilters: contentFieldFiltersQuery.optional(),
 	})
+	.refine(({ cursor, page }) => cursor === undefined || page === undefined, {
+		message: "cursor and page cannot be used together",
+		path: ["page"],
+	})
 	.transform(({ bylines, ...rest }) => ({
 		...rest,
 		bylinesNone: bylines === "none",
@@ -358,10 +371,15 @@ export const contentTermsResponseSchema = z
 
 export const contentTrashQuery = cursorPaginationQuery
 	.extend({
+		page: pageParam,
 		locale: localeCode.optional().meta({
 			description: "Restrict the trash listing to entries in this locale",
 		}),
 	})
+	.refine(({ cursor, page }) => cursor === undefined || page === undefined, {
+		message: "cursor and page cannot be used together",
+		path: ["page"],
+	})
 	.meta({ id: "ContentTrashQuery" });
 
 // ---------------------------------------------------------------------------
@@ -479,6 +497,8 @@ export const trashedContentListResponseSchema = z
 	.object({
 		items: z.array(trashedContentItemSchema),
 		nextCursor: z.string().optional(),
+		/** Every trashed entry matching the filters. Returned with numbered pages. */
+		total: z.number().int().nonnegative().optional(),
 	})
 	.meta({ id: "TrashedContentListResponse" });
 

package/src/api/schemas/media-usage.ts

@@ -43,7 +43,13 @@ export const mediaUsageOccurrenceDetailSchema = z
 		fieldSlug: z.string(),
 		fieldPath: z.string(),
 		occurrenceIndex: z.number().int().min(0),
-		referenceType: z.enum(["image_field", "file_field", "portable_text_image", "unknown"]),
+		referenceType: z.enum([
+			"image_field",
+			"file_field",
+			"portable_text_image",
+			"portable_text_video",
+			"unknown",
+		]),
 	})
 	.meta({ id: "MediaUsageOccurrenceDetail" });
 

package/src/api/schemas/media.ts

@@ -147,6 +147,16 @@ export const mediaUploadEnsureUniqueFilenameForm = z
 	.default("false")
 	.transform((value) => value === "true");
 
+const optionalMediaTextForm = z
+	.string()
+	.optional()
+	.transform((value) => (value === "" ? undefined : value));
+
+export const mediaUploadMetadataForm = z.object({
+	alt: optionalMediaTextForm,
+	caption: optionalMediaTextForm,
+});
+
 export const mediaReplaceMetadataForm = z.object({
 	width: z.coerce.number().int().positive().max(Number.MAX_SAFE_INTEGER),
 	height: z.coerce.number().int().positive().max(Number.MAX_SAFE_INTEGER),
@@ -157,6 +167,8 @@ const binaryFileSchema = z.string().meta({ format: "binary" });
 export const mediaDirectUploadBody = z
 	.object({
 		file: binaryFileSchema,
+		alt: z.string().optional(),
+		caption: z.string().optional(),
 		width: z.string().optional(),
 		height: z.string().optional(),
 		thumbnail: binaryFileSchema.optional(),

package/src/api/site-url.ts

@@ -1,10 +1,10 @@
 /**
  * Resolve the canonical site base URL for use in outbound links (emails, etc.).
  *
- * Precedence mirrors `getPublicOrigin`: the operator-configured origin
- * (`config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars) wins,
- * then the stored `emdash:site_url` option (written once during setup on the
- * real domain), and only before setup completes does the request URL fill in.
+ * Precedence: the operator-configured origin (`config.siteUrl`, then the
+ * `EMDASH_SITE_URL`/`SITE_URL` env vars), then the **Site URL** an admin set
+ * in Settings > General (`site:url`, origin only), then the `emdash:site_url` option
+ * written once during setup, and only before setup completes the request URL.
  * A configured or stored value always beats the request, so Host header
  * spoofing cannot redirect users to attacker-controlled domains.
  */
@@ -15,6 +15,49 @@ import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 import { getConfiguredOrigin, type SiteUrlConfig } from "./public-url.js";
 
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+/** Sign-in tokens travel in these links, so plain HTTP is only accepted for loopback hosts. */
+function siteUrlSettingOrigin(value: unknown): string | undefined {
+	if (typeof value !== "string" || !URL.canParse(value)) return undefined;
+	const url = new URL(value);
+	if (url.protocol === "https:") return url.origin;
+	if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)) return url.origin;
+	return undefined;
+}
+
+/**
+ * The site's public origin for outbound links, in the precedence order
+ * described above. `siteUrlSetting` and `setupUrl` are the stored
+ * `site:url` and `emdash:site_url` option values.
+ */
+export function resolveSiteOrigin(
+	config: SiteUrlConfig | undefined,
+	siteUrlSetting: unknown,
+	setupUrl: unknown,
+): string | undefined {
+	return (
+		getConfiguredOrigin(config) ??
+		siteUrlSettingOrigin(siteUrlSetting) ??
+		(typeof setupUrl === "string" && setupUrl ? setupUrl : undefined)
+	);
+}
+
+/**
+ * The origin chosen for the site: the configured origin, then the **Site URL**.
+ * Unlike `getSiteBaseUrl`, it never falls back to the origin recorded during
+ * setup, which may be an address the site has since moved away from.
+ */
+export async function getChosenSiteOrigin(
+	db: Kysely<Database>,
+	config?: SiteUrlConfig,
+): Promise<string | undefined> {
+	return (
+		getConfiguredOrigin(config) ??
+		siteUrlSettingOrigin(await new OptionsRepository(db).get("site:url"))
+	);
+}
+
 export async function getSiteBaseUrl(
 	db: Kysely<Database>,
 	request: Request,
@@ -25,7 +68,12 @@ export async function getSiteBaseUrl(
 		return `${configured}/_emdash`;
 	}
 	const options = new OptionsRepository(db);
-	const storedUrl = await options.get<string>("emdash:site_url");
+	const stored = await options.getMany(["site:url", "emdash:site_url"]);
+	const storedUrl = resolveSiteOrigin(
+		config,
+		stored.get("site:url"),
+		stored.get("emdash:site_url"),
+	);
 	if (storedUrl) {
 		return `${storedUrl}/_emdash`;
 	}

package/src/api/types.ts

@@ -74,6 +74,8 @@ export interface ManifestFieldDescriptor extends FieldDescriptor {
 	unsupportedType?: { type: string; path: string };
 	blockTypes?: BlockType[];
 	blockTypeFingerprint?: string;
+	/** Value a new entry starts with in the admin editor. */
+	defaultValue?: unknown;
 }
 
 export interface FieldDescriptor {