@aeptus/aexeo-emdash 0.8.17 → 0.8.19

package/CHANGELOG.md

@@ -4,8 +4,137 @@ All notable changes to `@aeptus/aexeo-emdash` are listed here.
 The format follows [Keep a Changelog](https://keepachangelog.com/),
 and the project follows [Semantic Versioning](https://semver.org/).
 
+## [0.8.19] - 2026-09-29
+
+Updates the EmDash integration to the current plugin and content APIs, and
+closes three security findings. Everything since 0.8.18 ships in this one
+version, since 0.8.19 had never been published.
+
+**Compatibility target:** EmDash `>=0.41.0 <0.42.0`.
+
+### Security
+
+- **EVAL_TOKEN is stored through the host's encrypted plugin settings.**
+  The sidecar bearer token was written as plaintext into the plugin's KV
+  namespace. EmDash provides `PluginContext.settings` with host-side
+  encryption for fields declared `type: "secret"` in a plugin's
+  `settingsSchema`, which is exactly this case; the descriptor now declares
+  that schema and the token is written there. Installs that predate the
+  change have their plaintext KV copy deleted on the next write, so the
+  credential is not sitting in the database twice. Hosts without
+  `EMDASH_ENCRYPTION_KEY` configured fall back to the previous KV path with
+  a warning that names the missing environment variable and never the
+  token, so the Setup page keeps working instead of failing closed.
+- **Sidecar URL validation is allowlist-backed and HTTPS-only.**
+  `handleSetupSubmit` accepted `http:`, which sent the bearer token in
+  cleartext, and rejected only `localhost` and `127.*` — leaving
+  `0.0.0.0`, `[::1]`, RFC1918, CGNAT, and the `169.254.169.254` cloud
+  metadata address reachable. It now requires HTTPS, rejects the private,
+  loopback, link-local, multicast, and IPv4-mapped-IPv6 ranges, and
+  compares the submitted host against the `allowedHosts` list the plugin
+  already computes at build time, so the form cannot store a URL the
+  plugin's own allowlist would reject later.
+- **Unauthenticated crawl-artifact routes removed from
+  `packages/aexeo-crawl-worker`.** `GET /findings/latest` returned the full
+  body of the customer's `aexeo-cli crawl` artifact and
+  `GET /findings/list` returned R2 key names, timestamps, and sizes.
+  Neither was behind the bearer-token check that guarded `/evaluate`, and
+  neither had any caller in this repository. CORS is not access control, so
+  anyone who learned the worker hostname could read the whole crawl
+  artifact. Both routes, the R2 binding, and the `examples/github-actions.yml`
+  R2 upload workflow that existed only to feed them are gone.
+
+### Removed
+
+- **`src/mcp.ts` and `src/indexnow.ts`.** Both were unreachable. The host
+  reads `PluginDefinition.mcp` as a `Record` of tool definitions keyed by
+  name; the code attached an `mcpTools` array with a different container and
+  a different per-entry shape, and `configured.ts` never attached it at
+  all. No MCP tool this package offered could ever have been invoked.
+
+### Fixed
+
+- **Suppressions ignored by the Block Kit Refresh button.** In configured
+  mode the /findings "Refresh" button called the sweep without the
+  compiled `suppressionFilter`, so it re-persisted findings the editor
+  had explicitly silenced. The React `/refresh` route always applied
+  them, so the two surfaces disagreed and the documented guarantee
+  ("suppressed findings never reach the dashboard, /findings, or the
+  per-document panel") did not hold on the Block Kit path.
+  Root cause: `configured.ts` and `sandbox-entry.ts` each carried their
+  own near-verbatim copy of the interaction normalizer, the findings
+  page, the score widget, the document panel, and the refresh handler.
+  The copies had already drifted — this missing argument was one of the
+  drifts. Fix: the whole block now lives once in `src/findings-view.ts`,
+  and `RefreshOptions.suppressionFilter` is a **required** property, so a
+  caller cannot silently omit it again.
+- **`/evaluate` no longer 500s when `EVAL_TOKEN` is unset.** The check read
+  `env.EVAL_TOKEN.length` without a guard, so a worker deployed without the
+  secret threw a `TypeError` on every request instead of rejecting it.
+- **Sandbox access declaration:** replace obsolete capability strings with
+  `content:read` and conditional `network:request`, scoped to the configured
+  evaluator host. Remove unused schema, artifact, KV, and IndexNow host grants.
+- **Typed `blocks` content:** distinguish EmDash block compositions from
+  Portable Text and adapt their editorial strings into the evaluator's text
+  format instead of discarding them.
+- **Routes and translations:** use EmDash's `getPublicUrl()` and
+  `getTranslations()` APIs for collection patterns, locale paths, trailing
+  slash policy, and hreflang alternates. Keep draft and unroutable entries
+  under stable collection/ID keys, and link only to URLs the host resolves.
+- **Sandbox save evaluation:** `content:afterSave` now persists and evaluates
+  the saved item through the configured sidecar, matching configured mode.
+- **Route migrations:** remove obsolete document and finding entries when a
+  document's resolved route changes or a successful refresh no longer finds
+  an entry in the selected collections.
+
+### Changed
+
+- Extract the shared Block Kit view layer (`normalizeInteraction`,
+  `BlockInteraction`, `BlockResponse`, the findings page, the score
+  widget, the document panel, and the refresh sweep) out of
+  `configured.ts` and `sandbox-entry.ts` into `src/findings-view.ts`.
+  Behaviour is unchanged apart from the suppression fix above; the two
+  entrypoints keep their own dispatch and their own copy of the three
+  strings that legitimately differ (empty-state copy, score-widget
+  empty copy, hard-refresh banner variant), passed in through
+  `AdminViewTuning`. `BlockInteraction` and `BlockResponse` are
+  re-exported from `sandbox-entry.ts`, so the `./sandbox` entry's
+  public type surface is unchanged.
+- Bump the EmDash peer and development ranges to `0.41.x`; update the README
+  and install guide to name the supported range and sandbox save behavior.
+- Add regression tests for `normalizeInteraction` — the ten edge cases
+  the 0.8.17 changelog claimed to have verified but never did — plus
+  entrypoint parity tests that drive both admin routes with the same
+  malformed bodies, and a test that the configured Block Kit refresh and
+  the React `/refresh` route agree on suppressed findings. Vitest coverage
+  now runs against EmDash's official plugin runtime test host for sandbox
+  hooks, blocks extraction, resolved URLs, and translation alternates.
+- Add `tsconfig.test.json` and a `typecheck:tests` script so `tests/`
+  and `vitest.config.ts` are typechecked. `tsconfig.json`'s `include`
+  covered `src/**` only, which meant the suite guarding the 0.8.17
+  production hotfix and the emdash test-host fixture plugin were both
+  unchecked. `npm run typecheck` now runs `typecheck:src` and
+  `typecheck:tests`.
+- `packages/aexeo-crawl-worker` no longer commits its build artifacts. The
+  checked-in `aexeo_emdash_bridge_bg.wasm` and its glue were several
+  releases behind the bridge the plugin actually calls — missing
+  `generateFactsPrompt`, `validateFactsManifest`, the manifest argument on
+  `scoreIntelligence`, and the `__wbg_*` bindings — and nothing in the
+  repository could regenerate them. The hand-written `.d.ts` files had been
+  updated to match the stale binary, which is why it went unnoticed. The
+  binary is now produced by `npm run build:wasm`, chained into `dev` and
+  `deploy`, and only the two declaration files remain tracked. The package
+  also gains a README, which it did not have.
+
 ## [Unreleased]
 
+## [0.8.18] - 2026-09-28
+
+### Added
+
+- Include deterministic editorial-policy rules EDT001–EDT003 in the bundled Rust/WASM evaluator. Configured answer summaries, target questions, and evidence-marked claims can now be checked through the serialized Aexeo config.
+
+
 ## [0.8.17] - 2026-05-29
 
 Hotfix release. Closes the production admin-route regression

package/INSTALL.md

@@ -31,7 +31,8 @@ when it's actually needed.
   (`@astrojs/cloudflare` + `@emdash-cms/cloudflare`'s `sandbox()`
   runner is fine — sandboxed plugins use Worker Loader, configured
   plugins don't, but both adapters import cleanly).
-- emdash 0.7.0 or later as a peer dependency.
+- EmDash `>=0.41.0 <0.42.0` as a peer dependency. The integration
+  coverage targets `0.41.0` with EmDash's official plugin test host.
 
 ### Install
 
@@ -106,9 +107,8 @@ no sidecar to deploy.
    — toast says "Refreshed N routes (M findings across K documents)"
    and the table populates.
 
-4. Save a document: the `content:afterSave` hook auto-evaluates that
-   one document; refresh the findings page and that route's findings
-   are updated. (The dashboard widget also picks up the new score.)
+4. Save a document: `content:afterSave` evaluates that document. Reload
+   the findings page to see the updated row and dashboard score.
 
 ### Production deploy
 
@@ -171,8 +171,8 @@ Pre-flight before bumping:
 
 1. Look up the plugin version's tested emdash range in our
    [CHANGELOG](./CHANGELOG.md). The latest plugin version's
-   `Compatibility` line says e.g. "tested against emdash 0.7.0
-   through 0.8.0." If the emdash version you want is **inside that
+   `Compatibility` line names the supported EmDash range and test-host
+   target. If the EmDash version you want is **inside that
    range**, the bump is safe. If it's **above the range**, treat it
    as untested.
 2. If untested, scan the emdash release notes for breaking changes
@@ -181,7 +181,7 @@ Pre-flight before bumping:
    - Hook signatures (`content:afterSave`, etc.)
    - Block Kit element schemas (banner variants, button styles,
      table column formats)
-   - Capability validation strings (`read:content`, `network:fetch`)
+   - Capability names (`content:read`, `network:request`)
    - The `definePlugin` API
    - The `createPlugin` / configured-plugin descriptor contract
    If any of those changed, expect to bump the plugin too.
@@ -240,9 +240,8 @@ Trade-offs vs. configured mode:
   prevents the plugin from ever reading host state directly.
 - **Con**: separate sidecar Worker to deploy and maintain; an
   EVAL_TOKEN to rotate; a Setup admin page to configure. The
-  `content:afterSave` hook is also non-functional in emdash 0.7.x's
-  sandbox (post-response bridge invalidation — known upstream issue);
-  evaluation is manual-Refresh-only.
+  `content:afterSave` hook evaluates through the sidecar after you save
+  its URL and token on the Setup page. Refresh still runs a full-site sweep.
 
 ```js
 // astro.config.mjs (sandboxed mode)
@@ -267,16 +266,25 @@ in this repo. Per-site deploy:
 
 ```bash
 cd aexeo-crawl-worker
-# Edit wrangler.toml: name, R2 bucket name, SITE_URL
+npm ci
+# Edit wrangler.toml: name, SITE_URL
 npx wrangler login
-npx wrangler r2 bucket create <bucket-name>
-npx wrangler deploy
+npm run deploy   # builds the WASM bridge, then deploys
 echo "$(openssl rand -hex 32)" | npx wrangler secret put EVAL_TOKEN
 ```
 
+The Worker's WASM is generated, not committed — `npm run deploy` runs
+`npm run build:wasm` first, which needs the Rust toolchain and
+`wasm-bindgen`. See the template's README.
+
 Then in the admin UI, visit
 `/admin/plugins/aexeo-emdash/setup` and paste the deployed URL +
-the same token.
+the same token. The URL must be `https`, must not point at a
+loopback, private, or link-local address, and must be the host in
+`evaluatorHost` above — the emdash sandbox rejects any other outbound
+host, so the form checks it before storing. The token is written
+through the host's encrypted plugin settings (`admin.settingsSchema`
+declares it `secret`), not to plugin KV.
 
 ## Alternative install sources
 

package/README.md

@@ -47,12 +47,15 @@ troubleshooting list, see [INSTALL.md](./INSTALL.md).
   answer-pack, external-trust dimensions). Banner appears below 60.
 - **Refresh button**: re-evaluate every document in the configured
   collections (`posts`, `pages` by default).
-- **Auto-evaluate on save**: emdash's `content:afterSave` hook fires,
-  re-evaluates the saved document, updates the findings table.
+- **Auto-evaluate on save**: EmDash's `content:afterSave` hook evaluates
+  the saved document and updates its findings. Sandboxed installs need a
+  configured evaluator sidecar; configured installs run evaluation in-process.
 
 ## Compatibility
 
-- emdash `>= 0.7.0` (peer dep)
+- EmDash `>= 0.41.0 < 0.42.0` (peer dependency; current supported range)
+- Runtime integration coverage targets EmDash `0.41.0` via the official
+  `@emdash-cms/plugin-test` host.
 - Cloudflare Workers via `@astrojs/cloudflare`. The plugin uses
   Cloudflare-specific APIs and silently no-ops on the Node adapter.
 - WASM eval ships with the package; the consumer's Vite/Wrangler

package/dist/adapter.d.ts

@@ -5,6 +5,7 @@ export interface EmdashContentItem {
     slug: string | null;
     status: string;
     locale: string | null;
+    translationGroup?: string | null;
     data: Record<string, unknown>;
     seo?: {
         title?: string | null;
@@ -18,11 +19,41 @@ export interface EmdashContentMeta {
     slug: string | null;
     status: string;
     title: string;
+    /** Exact URL returned by EmDash, or null when this entry has no public route. */
+    publicUrl: string | null;
+}
+export interface ContentUrlApi {
+    getPublicUrl(collection: string, id: string): Promise<string | null>;
+    getTranslations(collection: string, id: string): Promise<{
+        translationGroup: string;
+        translations: Array<{
+            id: string;
+            locale: string | null;
+            slug: string | null;
+            status: string;
+            updatedAt: string;
+        }>;
+    }>;
 }
 export interface AdaptedContent {
     document: EmdashDocument;
     meta: EmdashContentMeta;
 }
+/**
+ * Adapt a stored content row using EmDash's route resolver. The host API
+ * accounts for collection URL patterns, locale prefixes, and slash policy;
+ * slug-derived paths are not equivalent to the site's actual public URLs.
+ */
+export declare function adaptContentItemWithContext(content: EmdashContentItem, contentApi: ContentUrlApi, defaultLocale?: string): Promise<AdaptedContent>;
+/**
+ * Synchronous adapter for callers that do not have a host content API.
+ * It deliberately uses a stable identity route; callers should use
+ * adaptContentItemWithContext whenever EmDash can resolve the public URL.
+ */
 export declare function contentItemToEmdashDocument(content: EmdashContentItem): EmdashDocument;
-export declare function adaptContentItem(content: EmdashContentItem): AdaptedContent;
+export declare function adaptContentItem(content: EmdashContentItem, options?: {
+    route?: string;
+    publicUrl?: string | null;
+    defaultLocale?: string;
+}): AdaptedContent;
 //# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAmBpE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH;AAOD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IAIf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,GACzB,cAAc,CAEhB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,cAAc,CAkC3E"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrE,eAAe,CACb,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QACT,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,KAAK,CAAC;YAClB,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,aAAa,EACzB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC,CA2CzB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,GACzB,cAAc,CAEhB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACnB,GACL,cAAc,CAgChB"}

package/dist/configured.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configured.d.ts","sourceRoot":"","sources":["../src/configured.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA0HrD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CA4H3E;AAID,eAAe,YAAY,CAAC"}
+{"version":3,"file":"configured.d.ts","sourceRoot":"","sources":["../src/configured.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AA0HxE,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CA2H3E;AAID,eAAe,YAAY,CAAC"}