emdash 1.1.0 → 1.3.0

package/src/astro/routes/api/settings/domain-notify.ts

@@ -0,0 +1,76 @@
+/**
+ * POST /_emdash/api/settings/domain/notify
+ *
+ * Emails every active user except the sender that the site now lives at
+ * its chosen address (the configured `siteUrl`, otherwise the Site URL),
+ * with a link to the sign-in page there. The email carries no sign-in token.
+ * Sites that sign in through an external provider are refused.
+ */
+
+import { getDomainMoveEmailStrings } from "@emdash-cms/admin/locales/emails";
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { resolveEmailLocale } from "#api/email-locale.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleDomainMoveNotice } from "#api/handlers/domain-move-notice.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { getAuthMode } from "#auth/mode.js";
+import { checkRateLimit } from "#auth/rate-limit.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!user) return apiError("NOT_AUTHENTICATED", "Not authenticated", 401);
+	const denied = requirePerm(user, "users:manage");
+	if (denied) return denied;
+	if (locals.tokenScopes !== undefined) {
+		return apiError("FORBIDDEN", "Emailing users requires a signed-in session", 403);
+	}
+	if (getAuthMode(emdash.config).type !== "passkey") {
+		return apiError("NOT_SUPPORTED", "Users sign in through an external provider", 400);
+	}
+
+	if (!emdash.email?.isAvailable()) {
+		return apiError(
+			"EMAIL_NOT_CONFIGURED",
+			"No email provider is configured. Install and activate an email provider plugin.",
+			503,
+		);
+	}
+
+	try {
+		const origin = await getChosenSiteOrigin(emdash.db, emdash.config);
+		if (!origin) {
+			return apiError("NO_SITE_URL", "Set a Site URL before emailing users about it", 409);
+		}
+
+		const rateLimit = await checkRateLimit(emdash.db, "site", "settings/domain/notify", 3, 3600);
+		if (!rateLimit.allowed) {
+			return apiError("RATE_LIMITED", "Users were emailed recently. Try again later.", 429);
+		}
+
+		const options = new OptionsRepository(emdash.db);
+		const siteOptions = await options.getMany<string>(["emdash:site_title", "emdash:locale"]);
+		const siteName = siteOptions.get("emdash:site_title") || "EmDash";
+		const locale = resolveEmailLocale(siteOptions.get("emdash:locale"), request);
+		const email = emdash.email;
+
+		const result = await handleDomainMoveNotice(emdash.db, {
+			origin,
+			strings: await getDomainMoveEmailStrings(locale, siteName, new URL(origin).host),
+			locale,
+			senderId: user.id,
+			send: (message) => email.send(message, "system"),
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to email users", "DOMAIN_MOVE_NOTICE_ERROR");
+	}
+};

package/src/astro/routes/api/settings/domain.ts

@@ -0,0 +1,64 @@
+/**
+ * Site domain endpoint
+ *
+ * GET  /_emdash/api/settings/domain - The site URL set by the deployment
+ *      configuration, if any, which takes precedence over the Site URL for
+ *      links in emails and plugins, and `siteOrigin`, the origin sign-in
+ *      handover links to (null until a Site URL or `siteUrl` is set).
+ * POST /_emdash/api/settings/domain - Verify a new domain and store it as the
+ *      Site URL.
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
+import { handleSiteDomainChange } from "#api/handlers/site-domain.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { getConfiguredOrigin } from "#api/public-url.js";
+import { getChosenSiteOrigin } from "#api/site-url.js";
+import { siteSettingsTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
+
+export const prerender = false;
+
+const siteDomainBody = z.object({ domain: z.string().min(1).max(253) });
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:read");
+	if (denied) return denied;
+
+	try {
+		const siteOrigin = (await getChosenSiteOrigin(emdash.db, emdash.config)) ?? null;
+		return apiSuccess({ configuredUrl: getConfiguredOrigin(emdash.config) ?? null, siteOrigin });
+	} catch (error) {
+		return handleError(error, "Failed to read the site domain", "SITE_DOMAIN_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals, cache }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, siteDomainBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleSiteDomainChange(emdash.db, body.domain);
+		if (result.success) await invalidateRouteCache(cache, [siteSettingsTag()]);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to change the site domain", "SITE_DOMAIN_ERROR");
+	}
+};

package/src/astro/routes/api/settings.ts

@@ -13,6 +13,7 @@ import { handleSettingsGet, handleSettingsUpdate } from "#api/handlers/settings.
 import { isParseError, parseBody } from "#api/parse.js";
 import { settingsUpdateBody } from "#api/schemas.js";
 import { siteSettingsTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -62,7 +63,7 @@ export const POST: APIRoute = async ({ request, locals, cache }) => {
 
 		const result = await handleSettingsUpdate(emdash.db, emdash.storage, body);
 		if (!result.success) return unwrapResult(result);
-		if (cache?.enabled) await cache.invalidate({ tags: [siteSettingsTag()] });
+		await invalidateRouteCache(cache, [siteSettingsTag()]);
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update settings", "SETTINGS_UPDATE_ERROR");

package/src/astro/routes/api/setup/admin-verify.ts

@@ -23,12 +23,15 @@ import { getPasskeyConfig } from "#auth/passkey-config.js";
 import { SETUP_NONCE_COOKIE } from "#auth/setup-nonce.js";
 import { OptionsRepository } from "#db/repositories/options.js";
 
-export const POST: APIRoute = async ({ cookies, request, locals }) => {
+import { sessionUnavailableError } from "../../../session-user.js";
+
+export const POST: APIRoute = async ({ cookies, request, locals, session }) => {
 	const { emdash } = locals;
 
 	if (!emdash?.db) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	if (!session) return sessionUnavailableError();
 
 	try {
 		// Check if setup is already complete
@@ -118,6 +121,9 @@ export const POST: APIRoute = async ({ cookies, request, locals }) => {
 		// Mark setup as complete
 		await options.set("emdash:setup_complete", true);
 
+		// Authenticate the newly created admin so the dashboard opens immediately.
+		session.set("user", { id: user.id });
+
 		// Clean up setup state and the session nonce cookie
 		await options.delete("emdash:setup_state");
 		cookies.delete(SETUP_NONCE_COOKIE, { path: "/_emdash/" });

package/src/astro/routes/api/setup/index.ts

@@ -17,6 +17,7 @@ import { OptionsRepository } from "#db/repositories/options.js";
 import { applySeedWithinBudget, type SeedApplyBudget } from "#seed/apply.js";
 import { loadSeed } from "#seed/load.js";
 import { validateSeed } from "#seed/validate.js";
+import { setSiteSettings } from "#settings/index.js";
 
 /**
  * What one setup request may spend on the seed before the rest continues in
@@ -113,6 +114,12 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 		}
 		const { result, complete: seedComplete, progress: seedProgress } = seeded;
 
+		if (seedComplete) {
+			// The seed only fills settings that are still unset, and the runtime
+			// has usually auto-seeded the template's title and tagline already.
+			await setSiteSettings({ title: body.title, tagline: body.tagline }, emdash.db);
+		}
+
 		// Store setup state
 		// In external auth mode, mark setup complete immediately (first user to login becomes admin)
 		// Otherwise, setup_complete is set after admin user is created (passkey or auth provider)

package/src/astro/routes/api/site/domain-proof.ts

@@ -0,0 +1,28 @@
+/**
+ * Domain proof endpoint
+ *
+ * POST /_emdash/api/site/domain-proof - Returns the token of a domain check in
+ * progress, so the site can confirm that a new domain serves it. POST keeps
+ * the read on the primary database, where the token was just written, rather
+ * than a read replica.
+ */
+
+import type { APIRoute } from "astro";
+
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleDomainProof } from "#api/handlers/site-domain.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ locals }) => {
+	const { emdash } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		return unwrapResult(await handleDomainProof(emdash.db));
+	} catch (error) {
+		return handleError(error, "Failed to read domain proof", "DOMAIN_PROOF_ERROR");
+	}
+};

package/src/astro/routes/api/taxonomies/[name]/reorder.ts

@@ -16,6 +16,7 @@ import { handleTermReorder } from "#api/handlers/taxonomies.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { reorderTermsBody } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -36,7 +37,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 
 		const result = await handleTermReorder(emdash.db, name, body);
 		if (!result.success) return unwrapResult(result);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(name)]);
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to reorder terms", "TERM_REORDER_ERROR");

package/src/astro/routes/api/taxonomies/[name]/terms/[slug]/translations.ts

@@ -19,6 +19,7 @@ import {
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { localeFilterQuery } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -84,7 +85,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 			translationOf: source.data.term.id,
 		});
 		if (!result.success) return unwrapResult(result, 201);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(name)]);
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create term translation", "TERM_TRANSLATION_CREATE_ERROR");

package/src/astro/routes/api/taxonomies/[name]/terms/[slug].ts

@@ -14,6 +14,7 @@ import { handleTermDelete, handleTermGet, handleTermUpdate } from "#api/handlers
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { localeFilterQuery, updateTermBody } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -65,7 +66,7 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 
 		const result = await handleTermUpdate(emdash.db, name, slug, body, { locale: query.locale });
 		if (!result.success) return unwrapResult(result);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(name)]);
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update term", "TERM_UPDATE_ERROR");
@@ -92,7 +93,7 @@ export const DELETE: APIRoute = async ({ params, request, locals, cache }) => {
 	try {
 		const result = await handleTermDelete(emdash.db, name, slug, { locale: query.locale });
 		if (!result.success) return unwrapResult(result);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(name)]);
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to delete term", "TERM_DELETE_ERROR");

package/src/astro/routes/api/taxonomies/[name]/terms/index.ts

@@ -13,6 +13,7 @@ import { handleTermCreate, handleTermList } from "#api/handlers/taxonomies.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { createTermBody, termListQuery } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -65,7 +66,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 
 		const result = await handleTermCreate(emdash.db, name, body);
 		if (!result.success) return unwrapResult(result, 201);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(name)]);
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create term", "TERM_CREATE_ERROR");

package/src/astro/routes/api/taxonomies/[name].ts

@@ -21,6 +21,7 @@ import {
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { localeFilterQuery, updateTaxonomyDefBody } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -75,7 +76,7 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 			locale: query.locale,
 		});
 		if (!result.success) return unwrapResult(result);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(name)]);
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update taxonomy", "TAXONOMY_UPDATE_ERROR");
@@ -99,7 +100,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 	try {
 		const result = await handleTaxonomyDelete(emdash.db, name);
 		if (!result.success) return unwrapResult(result);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(name)]);
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to delete taxonomy", "TAXONOMY_DELETE_ERROR");

package/src/astro/routes/api/taxonomies/index.ts

@@ -13,6 +13,7 @@ import { handleTaxonomyCreate, handleTaxonomyList } from "#api/handlers/taxonomi
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { createTaxonomyDefBody, localeFilterQuery } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -57,7 +58,7 @@ export const POST: APIRoute = async ({ request, locals, cache }) => {
 
 		const result = await handleTaxonomyCreate(emdash.db, body);
 		if (!result.success) return unwrapResult(result, 201);
-		if (cache?.enabled) await cache.invalidate({ tags: [taxonomyTag(result.data.taxonomy.name)] });
+		await invalidateRouteCache(cache, [taxonomyTag(result.data.taxonomy.name)]);
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create taxonomy", "TAXONOMY_CREATE_ERROR");

package/src/astro/routes/api/widget-areas/[name]/reorder.ts

@@ -11,6 +11,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { reorderWidgetsBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -62,7 +63,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 			),
 		);
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess({ success: true });
 	} catch (error) {
 		return handleError(error, "Failed to reorder widgets", "WIDGET_REORDER_ERROR");

package/src/astro/routes/api/widget-areas/[name]/widgets/[id].ts

@@ -12,6 +12,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { updateWidgetBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
@@ -80,7 +81,7 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 			.where("id", "=", id)
 			.executeTakeFirstOrThrow();
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess(rowToWidget(widget));
 	} catch (error) {
 		return handleError(error, "Failed to update widget", "WIDGET_UPDATE_ERROR");
@@ -125,7 +126,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 
 		await db.deleteFrom("_emdash_widgets").where("id", "=", id).execute();
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess({ deleted: true });
 	} catch (error) {
 		return handleError(error, "Failed to delete widget", "WIDGET_DELETE_ERROR");

package/src/astro/routes/api/widget-areas/[name]/widgets.ts

@@ -12,6 +12,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { createWidgetBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
@@ -77,7 +78,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 			.where("id", "=", id)
 			.executeTakeFirstOrThrow();
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess(rowToWidget(widget), 201);
 	} catch (error) {
 		return handleError(error, "Failed to create widget", "WIDGET_CREATE_ERROR");

package/src/astro/routes/api/widget-areas/[name].ts

@@ -10,6 +10,7 @@ import type { APIRoute } from "astro";
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
@@ -84,7 +85,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 		// Delete area (widgets cascade)
 		await db.deleteFrom("_emdash_widget_areas").where("id", "=", area.id).execute();
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(name)]);
 		return apiSuccess({ deleted: true });
 	} catch (error) {
 		return handleError(error, "Failed to delete widget area", "WIDGET_AREA_DELETE_ERROR");

package/src/astro/routes/api/widget-areas/index.ts

@@ -13,6 +13,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { createWidgetAreaBody } from "#api/schemas.js";
 import { widgetAreaTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { rowToWidget } from "#widgets/index.js";
 import type { WidgetRow } from "#widgets/types.js";
 
@@ -96,7 +97,7 @@ export const POST: APIRoute = async ({ request, locals, cache }) => {
 			.where("id", "=", id)
 			.executeTakeFirstOrThrow();
 
-		if (cache?.enabled) await cache.invalidate({ tags: [widgetAreaTag(area.name)] });
+		await invalidateRouteCache(cache, [widgetAreaTag(area.name)]);
 		return apiSuccess(area, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create widget area", "WIDGET_AREA_CREATE_ERROR");

package/src/astro/routes/robots.txt.ts

@@ -5,7 +5,8 @@
  *
  * If a custom robots.txt is configured in SEO settings, that is returned.
  * Otherwise generates a default that allows all crawlers and references
- * the sitemap.
+ * the sitemap. When `seo.disallowAiTraining` is set, either version gets
+ * rules asking AI training crawlers to stay away.
  */
 
 import type { APIRoute } from "astro";
@@ -17,6 +18,31 @@ export const prerender = false;
 
 const TRAILING_SLASH_RE = /\/$/;
 
+/** AI training crawlers and opt-out tokens, as listed in Cloudflare's managed robots.txt. */
+const AI_TRAINING_CRAWLERS = [
+	"Amazonbot",
+	"Applebot-Extended",
+	"Bytespider",
+	"CCBot",
+	"ClaudeBot",
+	"Google-Extended",
+	"GPTBot",
+	"meta-externalagent",
+];
+
+/**
+ * `Content-Signal` is not a rule, so the empty `Disallow:` is what closes the
+ * `*` group; without a rule, crawlers merge it with the next group and apply
+ * `Disallow: /` to everyone.
+ */
+const AI_TRAINING_RULES = [
+	"# Disallow AI training",
+	"User-agent: *",
+	"Content-Signal: search=yes, ai-train=no",
+	"Disallow:",
+	...AI_TRAINING_CRAWLERS.flatMap((agent) => ["", `User-agent: ${agent}`, "Disallow: /"]),
+].join("\n");
+
 export const GET: APIRoute = async ({ locals, url }) => {
 	const { emdash } = locals;
 
@@ -35,11 +61,15 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			"",
 		);
 		const sitemapUrl = `${siteUrl}/sitemap.xml`;
+		const disallowAiTraining = settings.seo?.disallowAiTraining === true;
 
 		// Use custom robots.txt if configured
 		if (settings.seo?.robotsTxt) {
-			// Append sitemap directive if not already present
 			let content = settings.seo.robotsTxt;
+			if (disallowAiTraining) {
+				content = `${content.trimEnd()}\n\n${AI_TRAINING_RULES}\n`;
+			}
+			// Append sitemap directive if not already present
 			if (!content.toLowerCase().includes("sitemap:")) {
 				content = `${content.trimEnd()}\n\nSitemap: ${sitemapUrl}\n`;
 			}
@@ -61,6 +91,7 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			"# Disallow admin and API routes",
 			"Disallow: /_emdash/",
 			"",
+			...(disallowAiTraining ? [AI_TRAINING_RULES, ""] : []),
 			`Sitemap: ${sitemapUrl}`,
 			"",
 		].join("\n");

package/src/astro/routes/sitemap-[collection].xml.ts

@@ -1,7 +1,8 @@
 /**
  * Per-collection sitemap endpoint
  *
- * GET /sitemap-{collection}.xml - Sitemap for a single content collection.
+ * GET /sitemap-{collection}.xml - First page of a single collection's sitemap.
+ * GET /sitemap-{collection}-{n}.xml - Page n (2 and up) of that sitemap.
  *
  * Uses the collection's url_pattern to build URLs. Falls back to
  * /{collection}/{slug} when no pattern is configured.
@@ -26,6 +27,7 @@ import { getSiteSettingsWithDb } from "#settings/index.js";
 import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
 import { resolveLocalizedContentRoutePath } from "../../i18n/resolve.js";
 import { buildSeoImageUrl } from "../../seo/media-url.js";
+import { parseCollectionSitemapName } from "../../seo/sitemap-name.js";
 
 export const prerender = false;
 
@@ -38,9 +40,19 @@ const APOS_RE = /'/g;
 
 export const GET: APIRoute = async ({ params, locals, url }) => {
 	const { emdash } = locals;
-	const collectionSlug = params.collection;
 
-	if (!emdash?.db || !collectionSlug) {
+	// The middleware skips runtime setup for names no collection can have, so
+	// this check must run before the configuration check below.
+	const parsed = params.collection ? parseCollectionSitemapName(params.collection) : null;
+	if (!parsed) {
+		return new Response("<!-- Sitemap not found -->", {
+			status: 404,
+			headers: { "Content-Type": "application/xml" },
+		});
+	}
+	const { collection: collectionSlug, page } = parsed;
+
+	if (!emdash?.db) {
 		return new Response("<!-- EmDash not configured -->", {
 			status: 500,
 			headers: { "Content-Type": "application/xml" },
@@ -54,7 +66,7 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			"",
 		);
 
-		const result = await handleSitemapData(emdash.db, collectionSlug);
+		const result = await handleSitemapData(emdash.db, collectionSlug, { page });
 
 		if (!result.success || !result.data) {
 			return new Response("<!-- Failed to generate sitemap -->", {
@@ -89,6 +101,17 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				ungrouped.push(entry);
 			}
 		}
+		// Translations listed on other pages still count as alternates here.
+		const alternatesByGroup = new Map<string, Entry[]>();
+		const all = [...col.entries, ...col.translations].toSorted((a, b) =>
+			a.id < b.id ? -1 : a.id > b.id ? 1 : 0,
+		);
+		for (const entry of all) {
+			if (!i18nEnabled || !entry.translationGroup) continue;
+			const list = alternatesByGroup.get(entry.translationGroup);
+			if (list) list.push(entry);
+			else alternatesByGroup.set(entry.translationGroup, [entry]);
+		}
 
 		// Resolve every URL up-front so we can reference sibling URLs
 		// while emitting hreflang alternates without re-resolving.
@@ -159,8 +182,7 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 				}
 
 				// x-default: prefer the default-locale sibling, otherwise
-				// the first sibling with a routable URL. Stable order:
-				// rows arrive sorted by updated_at DESC from the handler.
+				// the first sibling with a routable URL (siblings are sorted by ID).
 				const defaultSibling =
 					i18nConfig && alternateEntries.find((s) => s.locale === i18nConfig.defaultLocale);
 				let xDefaultLoc: string | null = null;
@@ -186,9 +208,10 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 			lines.push("  </url>");
 		};
 
-		for (const siblings of groups.values()) {
+		for (const [group, siblings] of groups) {
+			const alternates = alternatesByGroup.get(group) ?? siblings;
 			for (const entry of siblings) {
-				await writeUrl(entry, siblings);
+				await writeUrl(entry, alternates);
 			}
 		}
 		for (const entry of ungrouped) {