emdash 1.2.0 → 1.3.0

package/dist/settings-Dd1uivmQ.mjs

@@ -0,0 +1,73 @@
+//#region src/transfer/format/settings.ts
+/**
+* Classification of `options` rows for site transfer.
+*
+* - `portable`: exported as `setting` records (explicit allowlist, never a
+*   prefix match).
+* - `targetLocal`: belongs to the target installation and is never exported
+*   or overwritten by an import.
+* - `excluded`: everything else (secrets, runtime state, plugin options).
+*/
+const PORTABLE_SETTING_NAMES = [
+	"emdash:locale",
+	"emdash:site_tagline",
+	"emdash:site_title",
+	"site:dateFormat",
+	"site:favicon",
+	"site:logo",
+	"site:postsPerPage",
+	"site:seo",
+	"site:social",
+	"site:tagline",
+	"site:timezone",
+	"site:title"
+];
+const PORTABLE_SETTINGS = new Set(PORTABLE_SETTING_NAMES);
+const TARGET_LOCAL_SETTING_NAMES = new Set([
+	"site:url",
+	"emdash:site_url",
+	"emdash:site_id"
+]);
+const TARGET_LOCAL_SETTING_PREFIXES = ["emdash:setup_", "emdash:backups"];
+/** Settings whose value is a plan decision rather than always taken from the package. */
+const DECIDED_SETTING_NAMES = {
+	title: ["site:title", "emdash:site_title"],
+	tagline: ["site:tagline", "emdash:site_tagline"]
+};
+/** Options the importer resets after writing settings. */
+const POST_IMPORT_OPTION_RESETS = {
+	bumpVersion: ["byline_fields_version"],
+	delete: ["_redirect_loop_ids"]
+};
+function isPortableSettingName(name) {
+	return PORTABLE_SETTINGS.has(name);
+}
+function classifySetting(name) {
+	if (PORTABLE_SETTINGS.has(name)) return "portable";
+	if (TARGET_LOCAL_SETTING_NAMES.has(name)) return "targetLocal";
+	if (TARGET_LOCAL_SETTING_PREFIXES.some((prefix) => name.startsWith(prefix))) return "targetLocal";
+	return "excluded";
+}
+/** Settings whose stored value is a `{ mediaId, alt? }` media reference, and where. */
+const SETTING_MEDIA_REFERENCE_PATHS = Object.freeze({
+	"site:logo": [["mediaId"]],
+	"site:favicon": [["mediaId"]],
+	"site:seo": [["defaultOgImage", "mediaId"]]
+});
+/** Media ids referenced by a portable setting's value. */
+function settingMediaIds(name, value) {
+	if (!isPortableSettingName(name)) return [];
+	const paths = SETTING_MEDIA_REFERENCE_PATHS[name];
+	if (!paths) return [];
+	const ids = [];
+	for (const path of paths) {
+		let current = value;
+		for (const segment of path) current = current !== null && typeof current === "object" && !Array.isArray(current) && Object.hasOwn(current, segment) ? Reflect.get(current, segment) : void 0;
+		if (typeof current === "string" && current.length > 0) ids.push(current);
+	}
+	return ids;
+}
+
+//#endregion
+export { settingMediaIds as a, classifySetting as i, PORTABLE_SETTING_NAMES as n, POST_IMPORT_OPTION_RESETS as r, DECIDED_SETTING_NAMES as t };
+//# sourceMappingURL=settings-Dd1uivmQ.mjs.map

package/dist/settings-Dd1uivmQ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-Dd1uivmQ.mjs","names":[],"sources":["../src/transfer/format/settings.ts"],"sourcesContent":["/**\n * Classification of `options` rows for site transfer.\n *\n * - `portable`: exported as `setting` records (explicit allowlist, never a\n *   prefix match).\n * - `targetLocal`: belongs to the target installation and is never exported\n *   or overwritten by an import.\n * - `excluded`: everything else (secrets, runtime state, plugin options).\n */\n\nexport const PORTABLE_SETTING_NAMES = [\n\t\"emdash:locale\",\n\t\"emdash:site_tagline\",\n\t\"emdash:site_title\",\n\t\"site:dateFormat\",\n\t\"site:favicon\",\n\t\"site:logo\",\n\t\"site:postsPerPage\",\n\t\"site:seo\",\n\t\"site:social\",\n\t\"site:tagline\",\n\t\"site:timezone\",\n\t\"site:title\",\n] as const;\n\nexport type PortableSettingName = (typeof PORTABLE_SETTING_NAMES)[number];\n\nconst PORTABLE_SETTINGS: ReadonlySet<string> = new Set(PORTABLE_SETTING_NAMES);\n\nconst TARGET_LOCAL_SETTING_NAMES: ReadonlySet<string> = new Set([\n\t\"site:url\",\n\t\"emdash:site_url\",\n\t\"emdash:site_id\",\n]);\n\nconst TARGET_LOCAL_SETTING_PREFIXES = [\"emdash:setup_\", \"emdash:backups\"] as const;\n\n/** Settings whose value is a plan decision rather than always taken from the package. */\nexport const DECIDED_SETTING_NAMES = {\n\ttitle: [\"site:title\", \"emdash:site_title\"],\n\ttagline: [\"site:tagline\", \"emdash:site_tagline\"],\n} as const satisfies Record<string, readonly PortableSettingName[]>;\n\n/** Options the importer resets after writing settings. */\nexport const POST_IMPORT_OPTION_RESETS = {\n\tbumpVersion: [\"byline_fields_version\"],\n\tdelete: [\"_redirect_loop_ids\"],\n} as const;\n\nexport type SettingClass = \"portable\" | \"targetLocal\" | \"excluded\";\n\nexport function isPortableSettingName(name: string): name is PortableSettingName {\n\treturn PORTABLE_SETTINGS.has(name);\n}\n\nexport function classifySetting(name: string): SettingClass {\n\tif (PORTABLE_SETTINGS.has(name)) return \"portable\";\n\tif (TARGET_LOCAL_SETTING_NAMES.has(name)) return \"targetLocal\";\n\tif (TARGET_LOCAL_SETTING_PREFIXES.some((prefix) => name.startsWith(prefix))) {\n\t\treturn \"targetLocal\";\n\t}\n\treturn \"excluded\";\n}\n\n/** Settings whose stored value is a `{ mediaId, alt? }` media reference, and where. */\nexport const SETTING_MEDIA_REFERENCE_PATHS: Readonly<\n\tPartial<Record<PortableSettingName, readonly (readonly string[])[]>>\n> = Object.freeze({\n\t\"site:logo\": [[\"mediaId\"]],\n\t\"site:favicon\": [[\"mediaId\"]],\n\t\"site:seo\": [[\"defaultOgImage\", \"mediaId\"]],\n});\n\n/** Media ids referenced by a portable setting's value. */\nexport function settingMediaIds(name: string, value: unknown): string[] {\n\tif (!isPortableSettingName(name)) return [];\n\tconst paths = SETTING_MEDIA_REFERENCE_PATHS[name];\n\tif (!paths) return [];\n\tconst ids: string[] = [];\n\tfor (const path of paths) {\n\t\tlet current: unknown = value;\n\t\tfor (const segment of path) {\n\t\t\tcurrent =\n\t\t\t\tcurrent !== null &&\n\t\t\t\ttypeof current === \"object\" &&\n\t\t\t\t!Array.isArray(current) &&\n\t\t\t\tObject.hasOwn(current, segment)\n\t\t\t\t\t? Reflect.get(current, segment)\n\t\t\t\t\t: undefined;\n\t\t}\n\t\tif (typeof current === \"string\" && current.length > 0) ids.push(current);\n\t}\n\treturn ids;\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAa,yBAAyB;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAID,MAAM,oBAAyC,IAAI,IAAI,uBAAuB;AAE9E,MAAM,6BAAkD,IAAI,IAAI;CAC/D;CACA;CACA;CACA,CAAC;AAEF,MAAM,gCAAgC,CAAC,iBAAiB,iBAAiB;;AAGzE,MAAa,wBAAwB;CACpC,OAAO,CAAC,cAAc,oBAAoB;CAC1C,SAAS,CAAC,gBAAgB,sBAAsB;CAChD;;AAGD,MAAa,4BAA4B;CACxC,aAAa,CAAC,wBAAwB;CACtC,QAAQ,CAAC,qBAAqB;CAC9B;AAID,SAAgB,sBAAsB,MAA2C;AAChF,QAAO,kBAAkB,IAAI,KAAK;;AAGnC,SAAgB,gBAAgB,MAA4B;AAC3D,KAAI,kBAAkB,IAAI,KAAK,CAAE,QAAO;AACxC,KAAI,2BAA2B,IAAI,KAAK,CAAE,QAAO;AACjD,KAAI,8BAA8B,MAAM,WAAW,KAAK,WAAW,OAAO,CAAC,CAC1E,QAAO;AAER,QAAO;;;AAIR,MAAa,gCAET,OAAO,OAAO;CACjB,aAAa,CAAC,CAAC,UAAU,CAAC;CAC1B,gBAAgB,CAAC,CAAC,UAAU,CAAC;CAC7B,YAAY,CAAC,CAAC,kBAAkB,UAAU,CAAC;CAC3C,CAAC;;AAGF,SAAgB,gBAAgB,MAAc,OAA0B;AACvE,KAAI,CAAC,sBAAsB,KAAK,CAAE,QAAO,EAAE;CAC3C,MAAM,QAAQ,8BAA8B;AAC5C,KAAI,CAAC,MAAO,QAAO,EAAE;CACrB,MAAM,MAAgB,EAAE;AACxB,MAAK,MAAM,QAAQ,OAAO;EACzB,IAAI,UAAmB;AACvB,OAAK,MAAM,WAAW,KACrB,WACC,YAAY,QACZ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,QAAQ,IACvB,OAAO,OAAO,SAAS,QAAQ,GAC5B,QAAQ,IAAI,SAAS,QAAQ,GAC7B;AAEL,MAAI,OAAO,YAAY,YAAY,QAAQ,SAAS,EAAG,KAAI,KAAK,QAAQ;;AAEzE,QAAO"}

package/dist/setup-complete-BuNxAUiN.mjs

@@ -0,0 +1,65 @@
+import { u as isPostgres } from "./dialect-helpers-7_IqPdh9.mjs";
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+import { Role } from "@emdash-cms/auth";
+
+//#region src/api/setup-complete.ts
+/**
+* Shared setup completion logic.
+*
+* Called by OAuth callbacks and the passkey verify step when the first user
+* is created during setup. Persists site title/tagline from setup state
+* and marks setup as complete.
+*/
+const FIRST_ADMIN_LOCK_KEY = 1168624764;
+/**
+* Create the first admin only while the users table is empty.
+*
+* Returns null when a user already exists, including one created by a
+* concurrent call after the caller's own zero-users check. On Postgres the
+* insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see
+* another transaction's uncommitted row under READ COMMITTED.
+*/
+async function createFirstAdmin(db, input) {
+	const admin = {
+		id: ulid(),
+		email: input.email.toLowerCase(),
+		name: input.name,
+		role: Role.ADMIN
+	};
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const insert = async (executor) => sql`
+			INSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)
+			SELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}
+			WHERE NOT EXISTS (SELECT 1 FROM users)
+			RETURNING id
+		`.execute(executor);
+	return (isPostgres(db) ? await db.transaction().execute(async (trx) => {
+		await sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);
+		return insert(trx);
+	}) : await insert(db)).rows.length > 0 ? admin : null;
+}
+/**
+* Finalize setup after the first admin user is created.
+*
+* Reads the setup_state option (written by the setup wizard's step 1),
+* persists site_title and site_tagline, then marks setup complete.
+*
+* Safe to call multiple times — checks setup_complete first and no-ops
+* if already done.
+*/
+async function finalizeSetup(db) {
+	const options = new OptionsRepository(db);
+	const setupComplete = await options.get("emdash:setup_complete");
+	if (setupComplete === true || setupComplete === "true") return;
+	const setupState = await options.get("emdash:setup_state");
+	if (setupState?.title && typeof setupState.title === "string") await options.set("emdash:site_title", setupState.title);
+	if (setupState?.tagline && typeof setupState.tagline === "string") await options.set("emdash:site_tagline", setupState.tagline);
+	await options.set("emdash:setup_complete", true);
+	await options.delete("emdash:setup_state");
+}
+
+//#endregion
+export { finalizeSetup as n, createFirstAdmin as t };
+//# sourceMappingURL=setup-complete-BuNxAUiN.mjs.map

package/dist/setup-complete-BuNxAUiN.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-complete-BuNxAUiN.mjs","names":[],"sources":["../src/api/setup-complete.ts"],"sourcesContent":["/**\n * Shared setup completion logic.\n *\n * Called by OAuth callbacks and the passkey verify step when the first user\n * is created during setup. Persists site title/tagline from setup state\n * and marks setup as complete.\n */\n\nimport { Role } from \"@emdash-cms/auth\";\nimport { sql, type Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport { isPostgres } from \"../database/dialect-helpers.js\";\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\n\nexport const FIRST_ADMIN_LOCK_KEY = 1_168_624_764;\n\nexport interface FirstAdmin {\n\tid: string;\n\temail: string;\n\tname: string | null;\n\trole: typeof Role.ADMIN;\n}\n\n/**\n * Create the first admin only while the users table is empty.\n *\n * Returns null when a user already exists, including one created by a\n * concurrent call after the caller's own zero-users check. On Postgres the\n * insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see\n * another transaction's uncommitted row under READ COMMITTED.\n */\nexport async function createFirstAdmin(\n\tdb: Kysely<Database>,\n\tinput: { email: string; name: string | null },\n): Promise<FirstAdmin | null> {\n\tconst admin: FirstAdmin = {\n\t\tid: ulid(),\n\t\temail: input.email.toLowerCase(),\n\t\tname: input.name,\n\t\trole: Role.ADMIN,\n\t};\n\tconst now = new Date().toISOString();\n\tconst insert = async (executor: Kysely<Database>) =>\n\t\tsql<{ id: string }>`\n\t\t\tINSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)\n\t\t\tSELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}\n\t\t\tWHERE NOT EXISTS (SELECT 1 FROM users)\n\t\t\tRETURNING id\n\t\t`.execute(executor);\n\n\tconst result = isPostgres(db)\n\t\t? await db.transaction().execute(async (trx) => {\n\t\t\t\tawait sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);\n\t\t\t\treturn insert(trx);\n\t\t\t})\n\t\t: await insert(db);\n\treturn result.rows.length > 0 ? admin : null;\n}\n\n/**\n * Finalize setup after the first admin user is created.\n *\n * Reads the setup_state option (written by the setup wizard's step 1),\n * persists site_title and site_tagline, then marks setup complete.\n *\n * Safe to call multiple times — checks setup_complete first and no-ops\n * if already done.\n */\nexport async function finalizeSetup(db: Kysely<Database>): Promise<void> {\n\tconst options = new OptionsRepository(db);\n\n\tconst setupComplete = await options.get(\"emdash:setup_complete\");\n\tif (setupComplete === true || setupComplete === \"true\") return;\n\n\t// Persist site title/tagline from setup state (stored in step 1)\n\tconst setupState = await options.get<Record<string, unknown>>(\"emdash:setup_state\");\n\tif (setupState?.title && typeof setupState.title === \"string\") {\n\t\tawait options.set(\"emdash:site_title\", setupState.title);\n\t}\n\tif (setupState?.tagline && typeof setupState.tagline === \"string\") {\n\t\tawait options.set(\"emdash:site_tagline\", setupState.tagline);\n\t}\n\n\tawait options.set(\"emdash:setup_complete\", true);\n\tawait options.delete(\"emdash:setup_state\");\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAa,uBAAuB;;;;;;;;;AAiBpC,eAAsB,iBACrB,IACA,OAC6B;CAC7B,MAAM,QAAoB;EACzB,IAAI,MAAM;EACV,OAAO,MAAM,MAAM,aAAa;EAChC,MAAM,MAAM;EACZ,MAAM,KAAK;EACX;CACD,MAAM,uBAAM,IAAI,MAAM,EAAC,aAAa;CACpC,MAAM,SAAS,OAAO,aACrB,GAAmB;;YAET,MAAM,GAAG,IAAI,MAAM,MAAM,IAAI,MAAM,KAAK,SAAS,MAAM,KAAK,mBAAmB,IAAI,IAAI,IAAI;;;IAGnG,QAAQ,SAAS;AAQpB,SANe,WAAW,GAAG,GAC1B,MAAM,GAAG,aAAa,CAAC,QAAQ,OAAO,QAAQ;AAC9C,QAAM,GAAG,gCAAgC,qBAAqB,GAAG,QAAQ,IAAI;AAC7E,SAAO,OAAO,IAAI;GACjB,GACD,MAAM,OAAO,GAAG,EACL,KAAK,SAAS,IAAI,QAAQ;;;;;;;;;;;AAYzC,eAAsB,cAAc,IAAqC;CACxE,MAAM,UAAU,IAAI,kBAAkB,GAAG;CAEzC,MAAM,gBAAgB,MAAM,QAAQ,IAAI,wBAAwB;AAChE,KAAI,kBAAkB,QAAQ,kBAAkB,OAAQ;CAGxD,MAAM,aAAa,MAAM,QAAQ,IAA6B,qBAAqB;AACnF,KAAI,YAAY,SAAS,OAAO,WAAW,UAAU,SACpD,OAAM,QAAQ,IAAI,qBAAqB,WAAW,MAAM;AAEzD,KAAI,YAAY,WAAW,OAAO,WAAW,YAAY,SACxD,OAAM,QAAQ,IAAI,uBAAuB,WAAW,QAAQ;AAG7D,OAAM,QAAQ,IAAI,yBAAyB,KAAK;AAChD,OAAM,QAAQ,OAAO,qBAAqB"}

package/dist/setup-nonce-BnEAX0iy.mjs

@@ -0,0 +1,25 @@
+//#region src/auth/setup-nonce.ts
+/**
+* Session binding for the first-setup admin-creation flow.
+*
+* Shared constants for the nonce cookie that ties /_emdash/api/setup/admin
+* and /_emdash/api/setup/admin/verify to the same browser. Without this
+* binding, any unauthenticated caller could POST /setup/admin during the
+* setup window and substitute their own email into the stored setup state
+* before the legitimate admin completes passkey verification.
+*
+* Implementation lives in the two route handlers; this module is just
+* the name / lifetime so both ends agree.
+*/
+/** Cookie name carrying the setup-admin session nonce. */
+const SETUP_NONCE_COOKIE = "emdash_setup_nonce";
+/**
+* Cookie max-age in seconds. One hour is plenty of time to complete
+* a passkey registration; if the user lingers longer the admin step
+* can simply be retried.
+*/
+const SETUP_NONCE_MAX_AGE_SECONDS = 3600;
+
+//#endregion
+export { SETUP_NONCE_MAX_AGE_SECONDS as n, SETUP_NONCE_COOKIE as t };
+//# sourceMappingURL=setup-nonce-BnEAX0iy.mjs.map

package/dist/setup-nonce-BnEAX0iy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-nonce-BnEAX0iy.mjs","names":[],"sources":["../src/auth/setup-nonce.ts"],"sourcesContent":["/**\n * Session binding for the first-setup admin-creation flow.\n *\n * Shared constants for the nonce cookie that ties /_emdash/api/setup/admin\n * and /_emdash/api/setup/admin/verify to the same browser. Without this\n * binding, any unauthenticated caller could POST /setup/admin during the\n * setup window and substitute their own email into the stored setup state\n * before the legitimate admin completes passkey verification.\n *\n * Implementation lives in the two route handlers; this module is just\n * the name / lifetime so both ends agree.\n */\n\n/** Cookie name carrying the setup-admin session nonce. */\nexport const SETUP_NONCE_COOKIE = \"emdash_setup_nonce\";\n\n/**\n * Cookie max-age in seconds. One hour is plenty of time to complete\n * a passkey registration; if the user lingers longer the admin step\n * can simply be retried.\n */\nexport const SETUP_NONCE_MAX_AGE_SECONDS = 60 * 60;\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,qBAAqB;;;;;;AAOlC,MAAa,8BAA8B"}

package/dist/site-domain-Bq5j5bVg.mjs

@@ -0,0 +1,131 @@
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { a as encodeBase64url } from "./base64-BQBZwXCx.mjs";
+import { l as setSiteSettings } from "./settings-CWb84sDm.mjs";
+import { r as resolveAndValidateExternalUrl } from "./ssrf-BcYjyM4M.mjs";
+
+//#region src/api/handlers/site-domain.ts
+const DOMAIN_PROOF_PATH = "/_emdash/api/site/domain-proof";
+const PROOF_OPTION = "emdash:domain_proof";
+const PROOF_TTL_MS = 6e4;
+const CHECK_TIMEOUT_MS = 1e4;
+const IPV4_RE = /^\d{1,3}(\.\d{1,3}){3}$/;
+/**
+* Parse a bare hostname or an `https://` origin into an origin. Paths,
+* ports, credentials, IP addresses, and single-label hosts are rejected.
+*/
+function parseSiteDomain(input) {
+	const trimmed = input.trim();
+	const candidate = trimmed.includes("://") ? trimmed : `https://${trimmed}`;
+	if (!URL.canParse(candidate)) return void 0;
+	const url = new URL(candidate);
+	if (url.protocol !== "https:") return void 0;
+	if (url.username || url.password || url.port || url.search || url.hash) return void 0;
+	if (url.pathname !== "/") return void 0;
+	const host = url.hostname;
+	if (!host.includes(".") || host.endsWith(".") || host.startsWith("[") || IPV4_RE.test(host)) return;
+	return url.origin;
+}
+function checkFailed(message, details) {
+	return {
+		success: false,
+		error: {
+			code: "DOMAIN_CHECK_FAILED",
+			message,
+			details
+		}
+	};
+}
+/**
+* Verify that `input` serves this site and store it as the Site URL.
+*/
+async function handleSiteDomainChange(db, input) {
+	const origin = parseSiteDomain(input);
+	if (!origin) return {
+		success: false,
+		error: {
+			code: "VALIDATION_ERROR",
+			message: "Enter a domain such as example.com, without a path or port"
+		}
+	};
+	const options = new OptionsRepository(db);
+	const token = encodeBase64url(crypto.getRandomValues(new Uint8Array(24)));
+	const proof = {
+		token,
+		expiresAt: Date.now() + PROOF_TTL_MS
+	};
+	const revision = await options.setVersioned(PROOF_OPTION, proof);
+	try {
+		const proofUrl = `${origin}${DOMAIN_PROOF_PATH}`;
+		try {
+			await resolveAndValidateExternalUrl(proofUrl);
+		} catch {
+			const host = new URL(origin).hostname;
+			return checkFailed(`${host} does not resolve to a public address`, {
+				reason: "NO_PUBLIC_ADDRESS",
+				host
+			});
+		}
+		let response;
+		try {
+			response = await fetch(proofUrl, {
+				method: "POST",
+				redirect: "manual",
+				headers: {
+					Accept: "application/json",
+					"X-EmDash-Request": "1"
+				},
+				signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+			});
+		} catch {
+			return checkFailed(`Could not reach ${origin}`, {
+				reason: "UNREACHABLE",
+				origin
+			});
+		}
+		if (response.status >= 300 && response.status < 400) {
+			const location = response.headers.get("Location");
+			const target = location && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;
+			return target ? checkFailed(`${origin} redirects to ${target.origin}. Enter that address instead.`, {
+				reason: "REDIRECT",
+				origin,
+				target: target.origin
+			}) : checkFailed(`${origin} redirects elsewhere`, {
+				reason: "REDIRECT",
+				origin
+			});
+		}
+		const body = response.ok ? await response.json().catch(() => null) : null;
+		if ((body && typeof body === "object" && "data" in body && body.data && typeof body.data === "object" ? body.data.token : void 0) !== token) return checkFailed(`${origin} does not serve this site yet`, {
+			reason: "NOT_SERVING",
+			origin
+		});
+		await setSiteSettings({ url: origin }, db);
+		return {
+			success: true,
+			data: { url: origin }
+		};
+	} finally {
+		await db.deleteFrom("options").where("name", "=", PROOF_OPTION).where("revision", "=", revision).execute();
+	}
+}
+/**
+* Return the pending domain proof token, if a check is in progress.
+*/
+async function handleDomainProof(db) {
+	const proof = await new OptionsRepository(db).get(PROOF_OPTION);
+	if (!proof || typeof proof.token !== "string" || proof.expiresAt < Date.now()) return {
+		success: false,
+		error: {
+			code: "NOT_FOUND",
+			message: "No domain check in progress"
+		}
+	};
+	return {
+		success: true,
+		data: { token: proof.token }
+	};
+}
+
+//#endregion
+export { handleSiteDomainChange as n, handleDomainProof as t };
+//# sourceMappingURL=site-domain-Bq5j5bVg.mjs.map

package/dist/site-domain-Bq5j5bVg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-domain-Bq5j5bVg.mjs","names":[],"sources":["../src/api/handlers/site-domain.ts"],"sourcesContent":["/**\n * Site domain handlers\n *\n * Changing the site's domain stores the new origin as the Site URL, which\n * links in emails and plugins, sitemaps, and absolute URLs in search and\n * social metadata use. Before it is stored, EmDash fetches a one-time token\n * from the new domain to prove the domain serves this site.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../../database/repositories/options.js\";\nimport type { Database } from \"../../database/types.js\";\nimport { resolveAndValidateExternalUrl } from \"../../security/ssrf.js\";\nimport { setSiteSettings } from \"../../settings/index.js\";\nimport { encodeBase64url } from \"../../utils/base64.js\";\nimport type { ApiResult } from \"../types.js\";\n\nexport const DOMAIN_PROOF_PATH = \"/_emdash/api/site/domain-proof\";\n\nconst PROOF_OPTION = \"emdash:domain_proof\";\nconst PROOF_TTL_MS = 60_000;\nconst CHECK_TIMEOUT_MS = 10_000;\nconst IPV4_RE = /^\\d{1,3}(\\.\\d{1,3}){3}$/;\n\ninterface DomainProof {\n\ttoken: string;\n\texpiresAt: number;\n}\n\n/**\n * Parse a bare hostname or an `https://` origin into an origin. Paths,\n * ports, credentials, IP addresses, and single-label hosts are rejected.\n */\nexport function parseSiteDomain(input: string): string | undefined {\n\tconst trimmed = input.trim();\n\tconst candidate = trimmed.includes(\"://\") ? trimmed : `https://${trimmed}`;\n\tif (!URL.canParse(candidate)) return undefined;\n\tconst url = new URL(candidate);\n\tif (url.protocol !== \"https:\") return undefined;\n\tif (url.username || url.password || url.port || url.search || url.hash) return undefined;\n\tif (url.pathname !== \"/\") return undefined;\n\tconst host = url.hostname;\n\tif (!host.includes(\".\") || host.endsWith(\".\") || host.startsWith(\"[\") || IPV4_RE.test(host)) {\n\t\treturn undefined;\n\t}\n\treturn url.origin;\n}\n\n/** Why a domain check failed, sent as `error.details` with the addresses its message names. */\ntype DomainCheckFailure =\n\t| { reason: \"NO_PUBLIC_ADDRESS\"; host: string }\n\t| { reason: \"UNREACHABLE\"; origin: string }\n\t| { reason: \"REDIRECT\"; origin: string; target?: string }\n\t| { reason: \"NOT_SERVING\"; origin: string };\n\nfunction checkFailed(message: string, details: DomainCheckFailure): ApiResult<never> {\n\treturn { success: false, error: { code: \"DOMAIN_CHECK_FAILED\", message, details } };\n}\n\n/**\n * Verify that `input` serves this site and store it as the Site URL.\n */\nexport async function handleSiteDomainChange(\n\tdb: Kysely<Database>,\n\tinput: string,\n): Promise<ApiResult<{ url: string }>> {\n\tconst origin = parseSiteDomain(input);\n\tif (!origin) {\n\t\treturn {\n\t\t\tsuccess: false,\n\t\t\terror: {\n\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\tmessage: \"Enter a domain such as example.com, without a path or port\",\n\t\t\t},\n\t\t};\n\t}\n\n\tconst options = new OptionsRepository(db);\n\tconst token = encodeBase64url(crypto.getRandomValues(new Uint8Array(24)));\n\tconst proof: DomainProof = { token, expiresAt: Date.now() + PROOF_TTL_MS };\n\tconst revision = await options.setVersioned(PROOF_OPTION, proof);\n\n\ttry {\n\t\tconst proofUrl = `${origin}${DOMAIN_PROOF_PATH}`;\n\t\ttry {\n\t\t\tawait resolveAndValidateExternalUrl(proofUrl);\n\t\t} catch {\n\t\t\tconst host = new URL(origin).hostname;\n\t\t\treturn checkFailed(`${host} does not resolve to a public address`, {\n\t\t\t\treason: \"NO_PUBLIC_ADDRESS\",\n\t\t\t\thost,\n\t\t\t});\n\t\t}\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(proofUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\theaders: { Accept: \"application/json\", \"X-EmDash-Request\": \"1\" },\n\t\t\t\tsignal: AbortSignal.timeout(CHECK_TIMEOUT_MS),\n\t\t\t});\n\t\t} catch {\n\t\t\treturn checkFailed(`Could not reach ${origin}`, { reason: \"UNREACHABLE\", origin });\n\t\t}\n\n\t\tif (response.status >= 300 && response.status < 400) {\n\t\t\tconst location = response.headers.get(\"Location\");\n\t\t\tconst target =\n\t\t\t\tlocation && URL.canParse(location, proofUrl) ? new URL(location, proofUrl) : null;\n\t\t\treturn target\n\t\t\t\t? checkFailed(`${origin} redirects to ${target.origin}. Enter that address instead.`, {\n\t\t\t\t\t\treason: \"REDIRECT\",\n\t\t\t\t\t\torigin,\n\t\t\t\t\t\ttarget: target.origin,\n\t\t\t\t\t})\n\t\t\t\t: checkFailed(`${origin} redirects elsewhere`, { reason: \"REDIRECT\", origin });\n\t\t}\n\n\t\tconst body: unknown = response.ok ? await response.json().catch(() => null) : null;\n\t\tconst received =\n\t\t\tbody &&\n\t\t\ttypeof body === \"object\" &&\n\t\t\t\"data\" in body &&\n\t\t\tbody.data &&\n\t\t\ttypeof body.data === \"object\"\n\t\t\t\t? (body.data as { token?: unknown }).token\n\t\t\t\t: undefined;\n\t\tif (received !== token) {\n\t\t\treturn checkFailed(`${origin} does not serve this site yet`, {\n\t\t\t\treason: \"NOT_SERVING\",\n\t\t\t\torigin,\n\t\t\t});\n\t\t}\n\n\t\tawait setSiteSettings({ url: origin }, db);\n\t\treturn { success: true, data: { url: origin } };\n\t} finally {\n\t\tawait db\n\t\t\t.deleteFrom(\"options\")\n\t\t\t.where(\"name\", \"=\", PROOF_OPTION)\n\t\t\t.where(\"revision\", \"=\", revision)\n\t\t\t.execute();\n\t}\n}\n\n/**\n * Return the pending domain proof token, if a check is in progress.\n */\nexport async function handleDomainProof(\n\tdb: Kysely<Database>,\n): Promise<ApiResult<{ token: string }>> {\n\tconst proof = await new OptionsRepository(db).get<DomainProof>(PROOF_OPTION);\n\tif (!proof || typeof proof.token !== \"string\" || proof.expiresAt < Date.now()) {\n\t\treturn { success: false, error: { code: \"NOT_FOUND\", message: \"No domain check in progress\" } };\n\t}\n\treturn { success: true, data: { token: proof.token } };\n}\n"],"mappings":";;;;;;AAkBA,MAAa,oBAAoB;AAEjC,MAAM,eAAe;AACrB,MAAM,eAAe;AACrB,MAAM,mBAAmB;AACzB,MAAM,UAAU;;;;;AAWhB,SAAgB,gBAAgB,OAAmC;CAClE,MAAM,UAAU,MAAM,MAAM;CAC5B,MAAM,YAAY,QAAQ,SAAS,MAAM,GAAG,UAAU,WAAW;AACjE,KAAI,CAAC,IAAI,SAAS,UAAU,CAAE,QAAO;CACrC,MAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,KAAI,IAAI,aAAa,SAAU,QAAO;AACtC,KAAI,IAAI,YAAY,IAAI,YAAY,IAAI,QAAQ,IAAI,UAAU,IAAI,KAAM,QAAO;AAC/E,KAAI,IAAI,aAAa,IAAK,QAAO;CACjC,MAAM,OAAO,IAAI;AACjB,KAAI,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,QAAQ,KAAK,KAAK,CAC1F;AAED,QAAO,IAAI;;AAUZ,SAAS,YAAY,SAAiB,SAA+C;AACpF,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAuB;GAAS;GAAS;EAAE;;;;;AAMpF,eAAsB,uBACrB,IACA,OACsC;CACtC,MAAM,SAAS,gBAAgB,MAAM;AACrC,KAAI,CAAC,OACJ,QAAO;EACN,SAAS;EACT,OAAO;GACN,MAAM;GACN,SAAS;GACT;EACD;CAGF,MAAM,UAAU,IAAI,kBAAkB,GAAG;CACzC,MAAM,QAAQ,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC,CAAC;CACzE,MAAM,QAAqB;EAAE;EAAO,WAAW,KAAK,KAAK,GAAG;EAAc;CAC1E,MAAM,WAAW,MAAM,QAAQ,aAAa,cAAc,MAAM;AAEhE,KAAI;EACH,MAAM,WAAW,GAAG,SAAS;AAC7B,MAAI;AACH,SAAM,8BAA8B,SAAS;UACtC;GACP,MAAM,OAAO,IAAI,IAAI,OAAO,CAAC;AAC7B,UAAO,YAAY,GAAG,KAAK,wCAAwC;IAClE,QAAQ;IACR;IACA,CAAC;;EAGH,IAAI;AACJ,MAAI;AACH,cAAW,MAAM,MAAM,UAAU;IAChC,QAAQ;IACR,UAAU;IACV,SAAS;KAAE,QAAQ;KAAoB,oBAAoB;KAAK;IAChE,QAAQ,YAAY,QAAQ,iBAAiB;IAC7C,CAAC;UACK;AACP,UAAO,YAAY,mBAAmB,UAAU;IAAE,QAAQ;IAAe;IAAQ,CAAC;;AAGnF,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;GACpD,MAAM,WAAW,SAAS,QAAQ,IAAI,WAAW;GACjD,MAAM,SACL,YAAY,IAAI,SAAS,UAAU,SAAS,GAAG,IAAI,IAAI,UAAU,SAAS,GAAG;AAC9E,UAAO,SACJ,YAAY,GAAG,OAAO,gBAAgB,OAAO,OAAO,gCAAgC;IACpF,QAAQ;IACR;IACA,QAAQ,OAAO;IACf,CAAC,GACD,YAAY,GAAG,OAAO,uBAAuB;IAAE,QAAQ;IAAY;IAAQ,CAAC;;EAGhF,MAAM,OAAgB,SAAS,KAAK,MAAM,SAAS,MAAM,CAAC,YAAY,KAAK,GAAG;AAS9E,OAPC,QACA,OAAO,SAAS,YAChB,UAAU,QACV,KAAK,QACL,OAAO,KAAK,SAAS,WACjB,KAAK,KAA6B,QACnC,YACa,MAChB,QAAO,YAAY,GAAG,OAAO,gCAAgC;GAC5D,QAAQ;GACR;GACA,CAAC;AAGH,QAAM,gBAAgB,EAAE,KAAK,QAAQ,EAAE,GAAG;AAC1C,SAAO;GAAE,SAAS;GAAM,MAAM,EAAE,KAAK,QAAQ;GAAE;WACtC;AACT,QAAM,GACJ,WAAW,UAAU,CACrB,MAAM,QAAQ,KAAK,aAAa,CAChC,MAAM,YAAY,KAAK,SAAS,CAChC,SAAS;;;;;;AAOb,eAAsB,kBACrB,IACwC;CACxC,MAAM,QAAQ,MAAM,IAAI,kBAAkB,GAAG,CAAC,IAAiB,aAAa;AAC5E,KAAI,CAAC,SAAS,OAAO,MAAM,UAAU,YAAY,MAAM,YAAY,KAAK,KAAK,CAC5E,QAAO;EAAE,SAAS;EAAO,OAAO;GAAE,MAAM;GAAa,SAAS;GAA+B;EAAE;AAEhG,QAAO;EAAE,SAAS;EAAM,MAAM,EAAE,OAAO,MAAM,OAAO;EAAE"}

package/dist/site-settings-DRHfX7bq.mjs

@@ -0,0 +1,50 @@
+import { a as settingMediaIds } from "./settings-Dd1uivmQ.mjs";
+
+//#region src/media/usage/site-settings.ts
+/**
+* Media references held by site settings.
+*
+* Usage reads parse these from the stored `site:*` options on every read, so
+* a change through any writer of those options shows up on the next read.
+*/
+const MEDIA_USAGE_SITE_SETTINGS = [
+	"logo",
+	"favicon",
+	"seo.defaultOgImage"
+];
+/**
+* One setting per option, which holds while each option has a single path in
+* `SETTING_MEDIA_REFERENCE_PATHS`. A second path needs a setting of its own.
+*/
+const SITE_SETTING_OPTIONS = [
+	["site:logo", "logo"],
+	["site:favicon", "favicon"],
+	["site:seo", "seo.defaultOgImage"]
+];
+const MEDIA_USAGE_SITE_SETTING_OPTIONS = SITE_SETTING_OPTIONS.map(([option]) => option);
+/**
+* Group the site settings that select each media item, in settings order.
+*
+* @param options Raw JSON option values keyed by option name.
+*/
+function groupSiteSettingMediaUsage(options) {
+	const usage = /* @__PURE__ */ new Map();
+	for (const [option, setting] of SITE_SETTING_OPTIONS) for (const mediaId of settingMediaIds(option, parseOption(options.get(option)))) {
+		const settings = usage.get(mediaId);
+		if (settings) settings.push(setting);
+		else usage.set(mediaId, [setting]);
+	}
+	return usage;
+}
+function parseOption(value) {
+	if (value == null) return void 0;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+export { MEDIA_USAGE_SITE_SETTING_OPTIONS as n, groupSiteSettingMediaUsage as r, MEDIA_USAGE_SITE_SETTINGS as t };
+//# sourceMappingURL=site-settings-DRHfX7bq.mjs.map

package/dist/site-settings-DRHfX7bq.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-settings-DRHfX7bq.mjs","names":[],"sources":["../src/media/usage/site-settings.ts"],"sourcesContent":["/**\n * Media references held by site settings.\n *\n * Usage reads parse these from the stored `site:*` options on every read, so\n * a change through any writer of those options shows up on the next read.\n */\n\nimport { settingMediaIds, type PortableSettingName } from \"../../transfer/format/settings.js\";\n\nexport const MEDIA_USAGE_SITE_SETTINGS = [\"logo\", \"favicon\", \"seo.defaultOgImage\"] as const;\n\nexport type MediaUsageSiteSetting = (typeof MEDIA_USAGE_SITE_SETTINGS)[number];\n\n/**\n * One setting per option, which holds while each option has a single path in\n * `SETTING_MEDIA_REFERENCE_PATHS`. A second path needs a setting of its own.\n */\nconst SITE_SETTING_OPTIONS = [\n\t[\"site:logo\", \"logo\"],\n\t[\"site:favicon\", \"favicon\"],\n\t[\"site:seo\", \"seo.defaultOgImage\"],\n] as const satisfies readonly (readonly [PortableSettingName, MediaUsageSiteSetting])[];\n\nexport const MEDIA_USAGE_SITE_SETTING_OPTIONS = SITE_SETTING_OPTIONS.map(([option]) => option);\n\n/**\n * Group the site settings that select each media item, in settings order.\n *\n * @param options Raw JSON option values keyed by option name.\n */\nexport function groupSiteSettingMediaUsage(\n\toptions: ReadonlyMap<string, string | null>,\n): Map<string, MediaUsageSiteSetting[]> {\n\tconst usage = new Map<string, MediaUsageSiteSetting[]>();\n\tfor (const [option, setting] of SITE_SETTING_OPTIONS) {\n\t\tfor (const mediaId of settingMediaIds(option, parseOption(options.get(option)))) {\n\t\t\tconst settings = usage.get(mediaId);\n\t\t\tif (settings) settings.push(setting);\n\t\t\telse usage.set(mediaId, [setting]);\n\t\t}\n\t}\n\treturn usage;\n}\n\nfunction parseOption(value: string | null | undefined): unknown {\n\tif (value == null) return undefined;\n\ttry {\n\t\treturn JSON.parse(value);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"],"mappings":";;;;;;;;;AASA,MAAa,4BAA4B;CAAC;CAAQ;CAAW;CAAqB;;;;;AAQlF,MAAM,uBAAuB;CAC5B,CAAC,aAAa,OAAO;CACrB,CAAC,gBAAgB,UAAU;CAC3B,CAAC,YAAY,qBAAqB;CAClC;AAED,MAAa,mCAAmC,qBAAqB,KAAK,CAAC,YAAY,OAAO;;;;;;AAO9F,SAAgB,2BACf,SACuC;CACvC,MAAM,wBAAQ,IAAI,KAAsC;AACxD,MAAK,MAAM,CAAC,QAAQ,YAAY,qBAC/B,MAAK,MAAM,WAAW,gBAAgB,QAAQ,YAAY,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE;EAChF,MAAM,WAAW,MAAM,IAAI,QAAQ;AACnC,MAAI,SAAU,UAAS,KAAK,QAAQ;MAC/B,OAAM,IAAI,SAAS,CAAC,QAAQ,CAAC;;AAGpC,QAAO;;AAGR,SAAS,YAAY,OAA2C;AAC/D,KAAI,SAAS,KAAM,QAAO;AAC1B,KAAI;AACH,SAAO,KAAK,MAAM,MAAM;SACjB;AACP"}

package/dist/site-url-MB685I5X.mjs

@@ -0,0 +1,45 @@
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { t as getConfiguredOrigin } from "./public-url-Bt98vysr.mjs";
+
+//#region src/api/site-url.ts
+const LOOPBACK_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/** Sign-in tokens travel in these links, so plain HTTP is only accepted for loopback hosts. */
+function siteUrlSettingOrigin(value) {
+	if (typeof value !== "string" || !URL.canParse(value)) return void 0;
+	const url = new URL(value);
+	if (url.protocol === "https:") return url.origin;
+	if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)) return url.origin;
+}
+/**
+* The site's public origin for outbound links, in the precedence order
+* described above. `siteUrlSetting` and `setupUrl` are the stored
+* `site:url` and `emdash:site_url` option values.
+*/
+function resolveSiteOrigin(config, siteUrlSetting, setupUrl) {
+	return getConfiguredOrigin(config) ?? siteUrlSettingOrigin(siteUrlSetting) ?? (typeof setupUrl === "string" && setupUrl ? setupUrl : void 0);
+}
+/**
+* The origin chosen for the site: the configured origin, then the **Site URL**.
+* Unlike `getSiteBaseUrl`, it never falls back to the origin recorded during
+* setup, which may be an address the site has since moved away from.
+*/
+async function getChosenSiteOrigin(db, config) {
+	return getConfiguredOrigin(config) ?? siteUrlSettingOrigin(await new OptionsRepository(db).get("site:url"));
+}
+async function getSiteBaseUrl(db, request, config) {
+	const configured = getConfiguredOrigin(config);
+	if (configured) return `${configured}/_emdash`;
+	const stored = await new OptionsRepository(db).getMany(["site:url", "emdash:site_url"]);
+	const storedUrl = resolveSiteOrigin(config, stored.get("site:url"), stored.get("emdash:site_url"));
+	if (storedUrl) return `${storedUrl}/_emdash`;
+	const url = new URL(request.url);
+	return `${url.protocol}//${url.host}/_emdash`;
+}
+
+//#endregion
+export { getSiteBaseUrl as n, resolveSiteOrigin as r, getChosenSiteOrigin as t };
+//# sourceMappingURL=site-url-MB685I5X.mjs.map

package/dist/site-url-MB685I5X.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-url-MB685I5X.mjs","names":[],"sources":["../src/api/site-url.ts"],"sourcesContent":["/**\n * Resolve the canonical site base URL for use in outbound links (emails, etc.).\n *\n * Precedence: the operator-configured origin (`config.siteUrl`, then the\n * `EMDASH_SITE_URL`/`SITE_URL` env vars), then the **Site URL** an admin set\n * in Settings > General (`site:url`, origin only), then the `emdash:site_url` option\n * written once during setup, and only before setup completes the request URL.\n * A configured or stored value always beats the request, so Host header\n * spoofing cannot redirect users to attacker-controlled domains.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { OptionsRepository } from \"../database/repositories/options.js\";\nimport type { Database } from \"../database/types.js\";\nimport { getConfiguredOrigin, type SiteUrlConfig } from \"./public-url.js\";\n\nconst LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n\n/** Sign-in tokens travel in these links, so plain HTTP is only accepted for loopback hosts. */\nfunction siteUrlSettingOrigin(value: unknown): string | undefined {\n\tif (typeof value !== \"string\" || !URL.canParse(value)) return undefined;\n\tconst url = new URL(value);\n\tif (url.protocol === \"https:\") return url.origin;\n\tif (url.protocol === \"http:\" && LOOPBACK_HOSTS.has(url.hostname)) return url.origin;\n\treturn undefined;\n}\n\n/**\n * The site's public origin for outbound links, in the precedence order\n * described above. `siteUrlSetting` and `setupUrl` are the stored\n * `site:url` and `emdash:site_url` option values.\n */\nexport function resolveSiteOrigin(\n\tconfig: SiteUrlConfig | undefined,\n\tsiteUrlSetting: unknown,\n\tsetupUrl: unknown,\n): string | undefined {\n\treturn (\n\t\tgetConfiguredOrigin(config) ??\n\t\tsiteUrlSettingOrigin(siteUrlSetting) ??\n\t\t(typeof setupUrl === \"string\" && setupUrl ? setupUrl : undefined)\n\t);\n}\n\n/**\n * The origin chosen for the site: the configured origin, then the **Site URL**.\n * Unlike `getSiteBaseUrl`, it never falls back to the origin recorded during\n * setup, which may be an address the site has since moved away from.\n */\nexport async function getChosenSiteOrigin(\n\tdb: Kysely<Database>,\n\tconfig?: SiteUrlConfig,\n): Promise<string | undefined> {\n\treturn (\n\t\tgetConfiguredOrigin(config) ??\n\t\tsiteUrlSettingOrigin(await new OptionsRepository(db).get(\"site:url\"))\n\t);\n}\n\nexport async function getSiteBaseUrl(\n\tdb: Kysely<Database>,\n\trequest: Request,\n\tconfig?: SiteUrlConfig,\n): Promise<string> {\n\tconst configured = getConfiguredOrigin(config);\n\tif (configured) {\n\t\treturn `${configured}/_emdash`;\n\t}\n\tconst options = new OptionsRepository(db);\n\tconst stored = await options.getMany([\"site:url\", \"emdash:site_url\"]);\n\tconst storedUrl = resolveSiteOrigin(\n\t\tconfig,\n\t\tstored.get(\"site:url\"),\n\t\tstored.get(\"emdash:site_url\"),\n\t);\n\tif (storedUrl) {\n\t\treturn `${storedUrl}/_emdash`;\n\t}\n\t// Fallback: derive from request (only reached before setup completes)\n\tconst url = new URL(request.url);\n\treturn `${url.protocol}//${url.host}/_emdash`;\n}\n"],"mappings":";;;;AAiBA,MAAM,iBAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;CAAQ,CAAC;;AAGnE,SAAS,qBAAqB,OAAoC;AACjE,KAAI,OAAO,UAAU,YAAY,CAAC,IAAI,SAAS,MAAM,CAAE,QAAO;CAC9D,MAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,KAAI,IAAI,aAAa,SAAU,QAAO,IAAI;AAC1C,KAAI,IAAI,aAAa,WAAW,eAAe,IAAI,IAAI,SAAS,CAAE,QAAO,IAAI;;;;;;;AAS9E,SAAgB,kBACf,QACA,gBACA,UACqB;AACrB,QACC,oBAAoB,OAAO,IAC3B,qBAAqB,eAAe,KACnC,OAAO,aAAa,YAAY,WAAW,WAAW;;;;;;;AASzD,eAAsB,oBACrB,IACA,QAC8B;AAC9B,QACC,oBAAoB,OAAO,IAC3B,qBAAqB,MAAM,IAAI,kBAAkB,GAAG,CAAC,IAAI,WAAW,CAAC;;AAIvE,eAAsB,eACrB,IACA,SACA,QACkB;CAClB,MAAM,aAAa,oBAAoB,OAAO;AAC9C,KAAI,WACH,QAAO,GAAG,WAAW;CAGtB,MAAM,SAAS,MADC,IAAI,kBAAkB,GAAG,CACZ,QAAQ,CAAC,YAAY,kBAAkB,CAAC;CACrE,MAAM,YAAY,kBACjB,QACA,OAAO,IAAI,WAAW,EACtB,OAAO,IAAI,kBAAkB,CAC7B;AACD,KAAI,UACH,QAAO,GAAG,UAAU;CAGrB,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAChC,QAAO,GAAG,IAAI,SAAS,IAAI,IAAI,KAAK"}

package/dist/sitemap-name-BTg2NJJv.mjs

@@ -0,0 +1,26 @@
+import { r as isValidSchemaSlug } from "./slug-aVnUV4SL.mjs";
+
+//#region src/seo/sitemap-name.ts
+/**
+* The `{name}` in a per-collection sitemap path, `/sitemap-{name}.xml`.
+*/
+/** `{collection}` for page 1, `{collection}-{n}` for page n from 2 up. */
+const SITEMAP_NAME_RE = /^([a-z][a-z0-9_]*)(?:-([2-9]|[1-9]\d{1,5}))?$/;
+/**
+* The collection and page a sitemap name refers to, or null when the name
+* can't belong to any collection (its collection part must be a valid
+* collection slug).
+*/
+function parseCollectionSitemapName(name) {
+	const match = SITEMAP_NAME_RE.exec(name);
+	const collection = match?.[1];
+	if (!match || !isValidSchemaSlug(collection)) return null;
+	return {
+		collection,
+		page: match[2] ? Number(match[2]) : 1
+	};
+}
+
+//#endregion
+export { parseCollectionSitemapName as t };
+//# sourceMappingURL=sitemap-name-BTg2NJJv.mjs.map

package/dist/sitemap-name-BTg2NJJv.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sitemap-name-BTg2NJJv.mjs","names":[],"sources":["../src/seo/sitemap-name.ts"],"sourcesContent":["/**\n * The `{name}` in a per-collection sitemap path, `/sitemap-{name}.xml`.\n */\n\nimport { isValidSchemaSlug } from \"../schema/slug.js\";\n\n/** `{collection}` for page 1, `{collection}-{n}` for page n from 2 up. */\nconst SITEMAP_NAME_RE = /^([a-z][a-z0-9_]*)(?:-([2-9]|[1-9]\\d{1,5}))?$/;\n\n/**\n * The collection and page a sitemap name refers to, or null when the name\n * can't belong to any collection (its collection part must be a valid\n * collection slug).\n */\nexport function parseCollectionSitemapName(\n\tname: string,\n): { collection: string; page: number } | null {\n\tconst match = SITEMAP_NAME_RE.exec(name);\n\tconst collection = match?.[1];\n\tif (!match || !isValidSchemaSlug(collection)) return null;\n\treturn { collection, page: match[2] ? Number(match[2]) : 1 };\n}\n"],"mappings":";;;;;;;AAOA,MAAM,kBAAkB;;;;;;AAOxB,SAAgB,2BACf,MAC8C;CAC9C,MAAM,QAAQ,gBAAgB,KAAK,KAAK;CACxC,MAAM,aAAa,QAAQ;AAC3B,KAAI,CAAC,SAAS,CAAC,kBAAkB,WAAW,CAAE,QAAO;AACrD,QAAO;EAAE;EAAY,MAAM,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG;EAAG"}

package/dist/slug-aVnUV4SL.mjs

@@ -0,0 +1,16 @@
+//#region src/schema/slug.ts
+/**
+* The collection and field slug rule.
+*/
+/** Lowercase letter first, then lowercase letters, digits, and underscores. */
+const SCHEMA_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
+/** Maximum length of a collection or field slug. */
+const MAX_SCHEMA_SLUG_LENGTH = 63;
+/** Whether `value` is a valid collection or field slug. */
+function isValidSchemaSlug(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= MAX_SCHEMA_SLUG_LENGTH && SCHEMA_SLUG_PATTERN.test(value);
+}
+
+//#endregion
+export { SCHEMA_SLUG_PATTERN as n, isValidSchemaSlug as r, MAX_SCHEMA_SLUG_LENGTH as t };
+//# sourceMappingURL=slug-aVnUV4SL.mjs.map

package/dist/slug-aVnUV4SL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-aVnUV4SL.mjs","names":[],"sources":["../src/schema/slug.ts"],"sourcesContent":["/**\n * The collection and field slug rule.\n */\n\n/** Lowercase letter first, then lowercase letters, digits, and underscores. */\nexport const SCHEMA_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;\n\n/** Maximum length of a collection or field slug. */\nexport const MAX_SCHEMA_SLUG_LENGTH = 63;\n\n/** Whether `value` is a valid collection or field slug. */\nexport function isValidSchemaSlug(value: unknown): value is string {\n\treturn (\n\t\ttypeof value === \"string\" &&\n\t\tvalue.length > 0 &&\n\t\tvalue.length <= MAX_SCHEMA_SLUG_LENGTH &&\n\t\tSCHEMA_SLUG_PATTERN.test(value)\n\t);\n}\n"],"mappings":";;;;;AAKA,MAAa,sBAAsB;;AAGnC,MAAa,yBAAyB;;AAGtC,SAAgB,kBAAkB,OAAiC;AAClE,QACC,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,0BAChB,oBAAoB,KAAK,MAAM"}