@aeptus/aexeo-emdash 0.8.17 → 0.8.19

package/dist/sandbox-entry.js

@@ -1,13 +1,40 @@
 // src/adapter.ts
-function adaptContentItem(content) {
-  const route = deriveRoute(content);
+async function adaptContentItemWithContext(content, contentApi, defaultLocale) {
+  const publicUrl = content.status === "published" ? await contentApi.getPublicUrl(content.type, content.id) : null;
+  const route = publicUrl === null ? deriveRoute(content) : routeFromPublicUrl(publicUrl);
+  const adapted = adaptContentItem(content, {
+    route,
+    publicUrl,
+    ...defaultLocale === void 0 ? {} : { defaultLocale }
+  });
+  const translationSet = await contentApi.getTranslations(
+    content.type,
+    content.id
+  );
+  const alternates = await Promise.all(
+    translationSet.translations.filter(
+      (translation) => translation.status === "published" && typeof translation.locale === "string" && translation.locale.length > 0
+    ).map(async (translation) => {
+      const href = translation.id === content.id ? publicUrl : await contentApi.getPublicUrl(content.type, translation.id);
+      if (href === null) return null;
+      return { lang: translation.locale, href };
+    })
+  );
+  const uniqueAlternates = /* @__PURE__ */ new Map();
+  for (const alternate of alternates) {
+    if (alternate !== null) uniqueAlternates.set(alternate.lang, alternate);
+  }
+  if (uniqueAlternates.size > 0) {
+    adapted.document.alternates = [...uniqueAlternates.values()];
+  }
+  return adapted;
+}
+function adaptContentItem(content, options = {}) {
+  const route = options.route ?? deriveRoute(content);
   const title = stringOrEmpty(
     content.seo?.title ?? content.data["title"] ?? content.slug ?? content.id
   );
-  const document = {
-    route,
-    title
-  };
+  const document = { route, title };
   const description = content.seo?.description ?? content.data["description"];
   if (typeof description === "string" && description.length > 0) {
     document.description = description;
@@ -16,13 +43,12 @@ function adaptContentItem(content) {
   if (typeof canonical === "string" && canonical.length > 0) {
     document.canonical = canonical;
   }
-  if (content.locale !== null) {
-    document.lang = content.locale;
+  const locale = content.locale || options.defaultLocale;
+  if (typeof locale === "string" && locale.length > 0) {
+    document.lang = locale;
   }
   const body = extractPortableText(content.data);
-  if (body !== null) {
-    document.body = body;
-  }
+  if (body !== null) document.body = body;
   return {
     document,
     meta: {
@@ -30,48 +56,226 @@ function adaptContentItem(content) {
       collection: content.type,
       slug: content.slug,
       status: content.status,
-      title
+      title,
+      publicUrl: options.publicUrl ?? null
     }
   };
 }
 function deriveRoute(content) {
-  if (typeof content.slug === "string" && content.slug.length > 0) {
-    return content.slug.startsWith("/") ? content.slug : `/${content.slug}`;
+  return `/${encodeURIComponent(content.type)}/${encodeURIComponent(content.id)}`;
+}
+function routeFromPublicUrl(publicUrl) {
+  try {
+    return new URL(publicUrl).pathname || "/";
+  } catch (cause) {
+    throw new Error(`EmDash returned an invalid public URL: ${publicUrl}`, {
+      cause
+    });
   }
-  return `/${content.type}/${content.id}`;
 }
 function stringOrEmpty(value) {
   return typeof value === "string" ? value : "";
 }
 function extractPortableText(data) {
-  const candidates = ["body", "content"];
-  for (const slug of candidates) {
+  for (const slug of ["body", "content"]) {
     const value = data[slug];
-    if (isPortableTextArray(value)) {
-      return value;
+    if (isPortableTextArray(value)) return value;
+    if (isEmdashBlocksArray(value, slug)) return blocksToPortableText(value);
+    if (typeof value === "string" && value.trim().length > 0) {
+      return [portableTextBlock(value.trim(), `${slug}-text`)];
     }
   }
-  for (const value of Object.values(data)) {
-    if (isPortableTextArray(value)) {
-      return value;
-    }
+  const blocks = data["blocks"];
+  if (isPortableTextArray(blocks)) return blocks;
+  if (isEmdashBlocksArray(blocks, "blocks")) return blocksToPortableText(blocks);
+  for (const [field, value] of Object.entries(data)) {
+    if (field === "body" || field === "content" || field === "blocks") continue;
+    if (isPortableTextArray(value)) return value;
+    if (isEmdashBlocksArray(value, field)) return blocksToPortableText(value);
   }
   return null;
 }
 function isPortableTextArray(value) {
-  if (!Array.isArray(value) || value.length === 0) {
-    return false;
+  return Array.isArray(value) && value.length > 0 && value.every(
+    (item) => isRecord(item) && item["_type"] === "block" && Array.isArray(item["children"]) && item["children"].every(
+      (child) => isRecord(child) && typeof child["text"] === "string"
+    )
+  );
+}
+function isEmdashBlocksArray(value, field) {
+  if (!Array.isArray(value) || value.length === 0) return false;
+  return value.every(
+    (item) => isRecord(item) && typeof item["_type"] === "string" && typeof item["_key"] === "string" && (typeof item["_version"] === "number" || field === "blocks")
+  );
+}
+function blocksToPortableText(blocks) {
+  const paragraphs = [];
+  for (const block of blocks) {
+    const segments = [];
+    collectText(block, "", segments);
+    const text = segments.map((segment) => segment.trim()).filter(Boolean).join(" ");
+    if (text.length > 0) {
+      paragraphs.push(portableTextBlock(text, stringOrEmpty(block["_key"])));
+    }
+  }
+  return paragraphs;
+}
+function collectText(value, key, out) {
+  if (typeof value === "string") {
+    if (!isStructuralField(key) && value.trim().length > 0) out.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectText(item, key, out);
+    return;
+  }
+  if (!isRecord(value)) return;
+  for (const [childKey, childValue] of Object.entries(value)) {
+    if (isStructuralField(childKey)) continue;
+    collectText(childValue, childKey, out);
   }
-  const first = value[0];
-  return typeof first === "object" && first !== null && "_type" in first && typeof first._type === "string";
+}
+var STRUCTURAL_FIELDS = /* @__PURE__ */ new Set([
+  "_key",
+  "_ref",
+  "_type",
+  "_version",
+  "asset",
+  "align",
+  "alignment",
+  "autoplay",
+  "color",
+  "controls",
+  "focalpoint",
+  "height",
+  "href",
+  "id",
+  "layout",
+  "level",
+  "loop",
+  "markdefs",
+  "marks",
+  "mime_type",
+  "mimetype",
+  "position",
+  "rel",
+  "size",
+  "src",
+  "style",
+  "target",
+  "theme",
+  "tone",
+  "url",
+  "variant",
+  "width"
+]);
+function isStructuralField(key) {
+  const normalized = key.toLowerCase();
+  return normalized.startsWith("_") || STRUCTURAL_FIELDS.has(normalized);
+}
+function portableTextBlock(text, key) {
+  return {
+    _type: "block",
+    ...key.length === 0 ? {} : { _key: key },
+    children: [
+      {
+        _type: "span",
+        ...key.length === 0 ? {} : { _key: `${key}-text` },
+        text,
+        marks: []
+      }
+    ]
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/sidecar.ts
+async function evaluateViaSidecar(http, config, documents) {
+  const body = {
+    documents
+  };
+  if (config.configJson !== void 0) {
+    body.configJson = config.configJson;
+  }
+  let response;
+  try {
+    response = await http.fetch(`${trimTrailingSlash(config.url)}/evaluate`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${config.authToken}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: "network_error", detail };
+  }
+  if (response.status === 401 || response.status === 403) {
+    return {
+      ok: false,
+      reason: "auth_error",
+      detail: `sidecar rejected token (HTTP ${response.status})`
+    };
+  }
+  if (!response.ok) {
+    let detail = `sidecar HTTP ${response.status}`;
+    try {
+      detail = `${detail}: ${await response.text()}`;
+    } catch {
+    }
+    return { ok: false, reason: "server_error", detail };
+  }
+  let raw;
+  try {
+    raw = await response.text();
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: "invalid_response", detail };
+  }
+  try {
+    const findings = JSON.parse(raw);
+    if (!Array.isArray(findings)) {
+      return {
+        ok: false,
+        reason: "invalid_response",
+        detail: "sidecar returned non-array body"
+      };
+    }
+    return { ok: true, findings };
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: "invalid_response", detail };
+  }
+}
+function trimTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
 }
 
 // src/plugin.ts
+function buildAllowedHosts(evaluatorHost) {
+  const host = normalizeHost(evaluatorHost);
+  return host === null ? [] : [host];
+}
+function normalizeHost(evaluatorHost) {
+  const host = evaluatorHost?.trim() ?? "";
+  return host.length === 0 ? null : host;
+}
 var CONFIG_URL_KEY = "config:evaluator_url";
 var CONFIG_TOKEN_KEY = "config:eval_token";
-async function readSidecarConfig(kv) {
-  const url = await kv.get(CONFIG_URL_KEY);
-  const token = await kv.get(CONFIG_TOKEN_KEY);
+var SETTINGS_TOKEN_KEY = "eval_token";
+var PLUGIN_SETTINGS_SCHEMA = {
+  [SETTINGS_TOKEN_KEY]: {
+    type: "secret",
+    label: "EVAL_TOKEN",
+    description: "Bearer token for your aexeo-crawl-worker Worker. Encrypted at rest by the emdash host."
+  }
+};
+async function readSidecarConfig(store) {
+  const url = await store.kv.get(CONFIG_URL_KEY);
+  const token = await readStoredToken(store);
   if (typeof url !== "string" || typeof token !== "string") {
     return null;
   }
@@ -80,11 +284,96 @@ async function readSidecarConfig(kv) {
   }
   return { url, token };
 }
-async function writeSidecarConfig(kv, config) {
-  await kv.set(CONFIG_URL_KEY, config.url);
-  await kv.set(CONFIG_TOKEN_KEY, config.token);
+async function writeSidecarConfig(store, config) {
+  await store.kv.set(CONFIG_URL_KEY, config.url);
+  await writeStoredToken(store, config.token);
+}
+async function readStoredToken(store) {
+  const { settings } = store;
+  if (settings !== void 0) {
+    try {
+      const stored = await settings.get(SETTINGS_TOKEN_KEY);
+      if (typeof stored === "string" && stored.length > 0) {
+        return stored;
+      }
+    } catch (err) {
+      store.log?.warn?.(
+        `aexeo: could not read the encrypted EVAL_TOKEN from plugin settings, falling back to KV: ${describeError(err, "")}`
+      );
+    }
+  }
+  const legacy = await store.kv.get(CONFIG_TOKEN_KEY);
+  return typeof legacy === "string" && legacy.length > 0 ? legacy : null;
+}
+async function writeStoredToken(store, token) {
+  const { settings } = store;
+  if (settings !== void 0) {
+    try {
+      await settings.set(SETTINGS_TOKEN_KEY, token);
+      await store.kv.delete(CONFIG_TOKEN_KEY);
+      return;
+    } catch (err) {
+      store.log?.warn?.(
+        `aexeo: could not store the EVAL_TOKEN encrypted in plugin settings; it will be written to plugin KV in plaintext instead. Set EMDASH_ENCRYPTION_KEY on the emdash host to fix this. Detail: ${describeError(err, token)}`
+      );
+    }
+  }
+  await store.kv.set(CONFIG_TOKEN_KEY, token);
 }
-async function handleAfterSave(_event, _ctx) {
+function describeError(err, secret) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return secret.length === 0 ? raw : raw.split(secret).join("[redacted]");
+}
+async function handleAfterSave(event, ctx) {
+  const runtime = await readSidecarConfig(ctx);
+  if (runtime === null) {
+    ctx.log?.warn?.(
+      "Aexeo afterSave skipped: configure the evaluator URL and token on the Setup page"
+    );
+    return;
+  }
+  await handleAfterSaveConfigured(
+    event,
+    ctx,
+    (documents) => evaluateViaSidecar(
+      ctx.http,
+      { url: runtime.url, authToken: runtime.token },
+      documents
+    )
+  );
+}
+async function handleAfterSaveConfigured(event, ctx, evaluator, suppressionFilter) {
+  const adapted = await adaptContentItemWithContext(
+    event.content,
+    ctx.content,
+    ctx.site?.locale
+  );
+  const document = adapted.document;
+  const { kv, log } = ctx;
+  const stored = { document, meta: adapted.meta };
+  await persistDocument(ctx, stored);
+  const result = await evaluator([document]);
+  if (!result.ok) {
+    log?.error?.(`afterSave evaluator failure (${result.reason})`, {
+      detail: result.detail
+    });
+    return;
+  }
+  const pageFindings = result.findings.filter(
+    (finding) => finding.scope === "page"
+  );
+  const filtered = suppressionFilter === void 0 ? pageFindings : suppressionFilter.apply(
+    {
+      route: document.route,
+      collection: adapted.meta.collection,
+      status: adapted.meta.status
+    },
+    pageFindings
+  );
+  await kv.set(findingsKey(document.route), {
+    route: document.route,
+    findings: filtered
+  });
 }
 var DEFAULT_COLLECTIONS = ["posts", "pages"];
 async function evaluateAndPersistAll(ctx, options) {
@@ -109,7 +398,11 @@ async function evaluateAndPersistAll(ctx, options) {
           ...cursor === void 0 ? {} : { cursor }
         });
         for (const item of page.items) {
-          const adapted = adaptContentItem(item);
+          const adapted = await adaptContentItemWithContext(
+            item,
+            ctx.content,
+            ctx.site?.locale
+          );
           documents.push(adapted.document);
           documentRoutes.add(adapted.document.route);
           adaptedByRoute.set(adapted.document.route, {
@@ -137,18 +430,18 @@ async function evaluateAndPersistAll(ctx, options) {
     summary.errors.push(`${result.reason}: ${result.detail}`);
     return summary;
   }
-  const findingsByRoute2 = /* @__PURE__ */ new Map();
+  const findingsByRoute = /* @__PURE__ */ new Map();
   for (const route of documentRoutes) {
-    findingsByRoute2.set(route, []);
+    findingsByRoute.set(route, []);
   }
   for (const finding of result.findings) {
     const bucket = finding.scope === "page" ? finding.path : "*";
-    const list = findingsByRoute2.get(bucket) ?? [];
+    const list = findingsByRoute.get(bucket) ?? [];
     list.push(finding);
-    findingsByRoute2.set(bucket, list);
+    findingsByRoute.set(bucket, list);
   }
   let totalAfterSuppression = 0;
-  for (const [route, findings] of findingsByRoute2) {
+  for (const [route, findings] of findingsByRoute) {
     const stored = adaptedByRoute.get(route);
     const context = {
       route,
@@ -161,8 +454,57 @@ async function evaluateAndPersistAll(ctx, options) {
     totalAfterSuppression += filtered.length;
   }
   summary.totalFindings = totalAfterSuppression;
+  if (summary.errors.length === 0) {
+    await removeStaleDocuments(ctx, collections, documentRoutes);
+  }
   return summary;
 }
+async function persistDocument(ctx, stored) {
+  const route = stored.document.route;
+  const entries = await ctx.kv.list("document:");
+  for (const entry of entries) {
+    const previous = toStoredDocument(entry.value);
+    if (previous === null || previous.document.route === route || previous.meta.id !== stored.meta.id || previous.meta.collection !== stored.meta.collection) {
+      continue;
+    }
+    await ctx.kv.delete(entry.key);
+    await ctx.kv.delete(findingsKey(previous.document.route));
+  }
+  await ctx.kv.set(documentKey(route), stored);
+}
+async function removeStaleDocuments(ctx, collections, currentRoutes) {
+  const scannedCollections = new Set(collections);
+  const entries = await ctx.kv.list("document:");
+  for (const entry of entries) {
+    const stored = toStoredDocument(entry.value);
+    if (stored === null || !scannedCollections.has(stored.meta.collection) || currentRoutes.has(stored.document.route)) {
+      continue;
+    }
+    await ctx.kv.delete(entry.key);
+    await ctx.kv.delete(findingsKey(stored.document.route));
+  }
+}
+function toStoredDocument(value) {
+  if (value === null || typeof value !== "object") return null;
+  if ("document" in value && "meta" in value && value.document !== null && typeof value.document === "object" && "route" in value.document && typeof value.document.route === "string" && value.meta !== null && typeof value.meta === "object") {
+    return value;
+  }
+  if ("route" in value && typeof value.route === "string") {
+    const document = value;
+    return {
+      document,
+      meta: {
+        id: document.route,
+        collection: "",
+        slug: null,
+        status: "",
+        title: document.title ?? "",
+        publicUrl: null
+      }
+    };
+  }
+  return null;
+}
 function findingsKey(route) {
   const normalized = route === "" || route === "/" ? "/" : route;
   return `findings:${normalized}`;
@@ -178,25 +520,8 @@ async function readAllStoredDocuments(kv) {
   const entries = await kv.list("document:");
   const out = [];
   for (const entry of entries) {
-    const value = entry.value;
-    if (value === null || typeof value !== "object") continue;
-    if ("document" in value && "meta" in value) {
-      out.push(value);
-      continue;
-    }
-    if ("route" in value) {
-      const document = value;
-      out.push({
-        document,
-        meta: {
-          id: document.route,
-          collection: "",
-          slug: null,
-          status: "",
-          title: document.title ?? ""
-        }
-      });
-    }
+    const stored = toStoredDocument(entry.value);
+    if (stored !== null) out.push(stored);
   }
   return out;
 }
@@ -208,367 +533,167 @@ async function readFindings(kv, route) {
   return stored.findings;
 }
 
-// src/sidecar.ts
-async function evaluateViaSidecar(http, config, documents) {
-  const body = {
-    documents
-  };
-  if (config.configJson !== void 0) {
-    body.configJson = config.configJson;
+// src/sidecar-url.ts
+function validateSidecarUrl(raw, allowedHosts = []) {
+  const url = raw.trim();
+  if (url.length === 0) {
+    return { ok: false, error: "Sidecar URL is required." };
   }
-  let response;
+  let parsed;
   try {
-    response = await http.fetch(`${trimTrailingSlash(config.url)}/evaluate`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${config.authToken}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify(body)
-    });
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    return { ok: false, reason: "network_error", detail };
+    parsed = new URL(url);
+  } catch {
+    return { ok: false, error: `Sidecar URL is not a valid URL: ${url}` };
   }
-  if (response.status === 401 || response.status === 403) {
+  if (parsed.protocol !== "https:") {
     return {
       ok: false,
-      reason: "auth_error",
-      detail: `sidecar rejected token (HTTP ${response.status})`
+      error: `Sidecar URL must be https: \u2014 the EVAL_TOKEN is sent as a bearer header and must never travel in cleartext. Got ${parsed.protocol}`
     };
   }
-  if (!response.ok) {
-    let detail = `sidecar HTTP ${response.status}`;
-    try {
-      detail = `${detail}: ${await response.text()}`;
-    } catch {
-    }
-    return { ok: false, reason: "server_error", detail };
-  }
-  let raw;
-  try {
-    raw = await response.text();
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    return { ok: false, reason: "invalid_response", detail };
-  }
-  try {
-    const findings = JSON.parse(raw);
-    if (!Array.isArray(findings)) {
-      return {
-        ok: false,
-        reason: "invalid_response",
-        detail: "sidecar returned non-array body"
-      };
-    }
-    return { ok: true, findings };
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    return { ok: false, reason: "invalid_response", detail };
+  const host = parsed.hostname.toLowerCase();
+  if (isBlockedHost(host)) {
+    return {
+      ok: false,
+      error: "Sidecar URL must not point at a loopback, private, or link-local address. Use the deployed *.workers.dev URL."
+    };
   }
-}
-function trimTrailingSlash(url) {
-  return url.endsWith("/") ? url.slice(0, -1) : url;
-}
-
-// src/evaluator-sandbox.ts
-async function evaluate(_documents) {
-  return [];
-}
-async function scoreSite(_documents) {
-  return {
-    overall_score: 0,
-    citation_readiness_score: 0,
-    truth_consistency_score: 0,
-    answer_pack_score: 0,
-    external_trust_alignment_score: null,
-    route_scores: [],
-    blockers: []
-  };
-}
-function errorFindings(findings) {
-  return findings.filter((finding) => finding.severity === "error");
-}
-function findingsByRoute(findings) {
-  const grouped = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const bucket = grouped.get(finding.path);
-    if (bucket) {
-      bucket.push(finding);
-    } else {
-      grouped.set(finding.path, [finding]);
-    }
+  if (allowedHosts.length > 0 && !hostMatchesAllowlist(host, allowedHosts)) {
+    return {
+      ok: false,
+      error: `Sidecar host "${host}" is not in this plugin's outbound allowlist (${allowedHosts.join(", ")}). The emdash sandbox would reject the fetch with "Host not allowed" \u2014 update evaluatorHost in astro.config and rebuild, or use that host.`
+    };
   }
-  return grouped;
-}
-
-// src/indexnow.ts
-var INDEXNOW_ENDPOINT = "https://api.indexnow.org/indexnow";
-async function submitIndexNow(config, urls) {
-  const host = hostOf(config.siteUrl);
-  if (host === null) {
-    return failure("siteUrl is not a valid URL", []);
-  }
-  const keyLocation = config.keyLocation ?? defaultKeyLocation(config);
-  const { submitted, rejected } = partitionByHost(urls, host);
-  if (submitted.length === 0) {
-    return failure("no submittable URLs after host check", rejected);
-  }
-  const payload = {
-    host,
-    key: config.key,
-    keyLocation,
-    urlList: submitted
-  };
-  const response = await fetch(INDEXNOW_ENDPOINT, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(payload)
-  });
-  return {
-    ok: response.ok,
-    status: response.status,
-    endpoint: INDEXNOW_ENDPOINT,
-    submitted,
-    rejected
-  };
+  return { ok: true, url };
 }
-function hostOf(rawUrl) {
-  try {
-    return new URL(rawUrl).host;
-  } catch {
-    return null;
+function isBlockedHost(host) {
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    return true;
   }
-}
-function defaultKeyLocation(config) {
-  const siteUrl = config.siteUrl.endsWith("/") ? config.siteUrl.slice(0, -1) : config.siteUrl;
-  return `${siteUrl}/${config.key}.txt`;
-}
-function partitionByHost(urls, expectedHost) {
-  const submitted = [];
-  const rejected = [];
-  for (const candidate of urls) {
-    const host = hostOf(candidate);
-    if (host === expectedHost) {
-      submitted.push(candidate);
-    } else {
-      rejected.push(candidate);
-    }
+  if (host.startsWith("[")) {
+    return isBlockedIpv6(host);
   }
-  return { submitted, rejected };
+  return isBlockedIpv4(host);
 }
-function failure(reason, rejected) {
-  return {
-    ok: false,
-    status: 0,
-    endpoint: INDEXNOW_ENDPOINT,
-    submitted: [],
-    rejected,
-    reason
-  };
-}
-
-// src/mcp.ts
-var checkTool = {
-  name: "aexeo.check",
-  description: "Evaluate a list of EmdashDocument values against the Aexeo rule engine and return the stable Finding contract. Mirrors the CLI's `aexeo-cli check` surface so agents, the admin UI, and the CI gate all see the same rule ids.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      documents: {
-        type: "array",
-        description: "Array of EmdashDocument values to evaluate. Each entry carries route, title, optional description/canonical/lang, alternates, meta map, schema, and Portable Text body."
-      },
-      configJson: {
-        type: "string",
-        description: "Optional JSON-serialized Aexeo config. When absent the evaluator uses Config::default(), matching a cold CLI run."
-      }
-    },
-    required: ["documents"]
-  },
-  handler: async ({ documents, configJson }) => {
-    const options = configJson === void 0 ? {} : { configJson };
-    const findings = await evaluate(documents, options);
-    const errors = errorFindings(findings);
-    const grouped = findingsByRoute(findings);
-    const byRoute = {};
-    for (const [route, items] of grouped.entries()) {
-      byRoute[route] = items;
-    }
-    return {
-      findings,
-      errors,
-      byRoute,
-      totals: {
-        findings: findings.length,
-        errors: errors.length,
-        warnings: findings.length - errors.length
-      }
-    };
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (match === null) {
+    return false;
   }
-};
-var indexNowSubmitTool = {
-  name: "aexeo.indexnow.submit",
-  description: "Submit a list of URLs to the IndexNow freshness endpoint. Mirrors the aexeo-cli `indexnow submit` contract: the IndexNow protocol requires every submitted URL to belong to the configured site host. URLs that do not match the host are returned in `rejected` and never sent over the wire.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      config: {
-        type: "object",
-        description: "IndexNow configuration: siteUrl, key, and optional keyLocation override.",
-        properties: {
-          siteUrl: { type: "string" },
-          key: { type: "string" },
-          keyLocation: { type: "string" }
-        },
-        required: ["siteUrl", "key"]
-      },
-      urls: {
-        type: "array",
-        items: { type: "string" },
-        description: "Absolute URLs to submit. Must share siteUrl's host."
-      }
-    },
-    required: ["config", "urls"]
-  },
-  handler: async ({ config, urls }) => submitIndexNow(config, urls)
-};
-var tools = [checkTool, indexNowSubmitTool];
-
-// src/sandbox-entry.ts
-function definePlugin(plugin) {
-  return plugin;
+  const first = Number(match[1]);
+  const second = Number(match[2]);
+  if (first === 0) return true;
+  if (first === 127) return true;
+  if (first === 10) return true;
+  if (first === 172 && second >= 16 && second <= 31) return true;
+  if (first === 192 && second === 168) return true;
+  if (first === 169 && second === 254) return true;
+  if (first === 100 && second >= 64 && second <= 127) return true;
+  if (first >= 224) return true;
+  return false;
 }
-function normalizeInteraction(input) {
-  if (!input || typeof input !== "object") {
-    return { type: "page_load", page: "/findings" };
-  }
-  const raw = input;
-  if (raw.type === "page_load") {
-    return {
-      type: "page_load",
-      page: typeof raw.page === "string" && raw.page.length > 0 ? raw.page : "/findings"
-    };
+function isBlockedIpv6(host) {
+  const inner = host.slice(1, -1).toLowerCase();
+  if (inner === "::" || inner === "::1") {
+    return true;
   }
-  if (raw.type === "block_action") {
-    return {
-      type: "block_action",
-      action_id: typeof raw.action_id === "string" ? raw.action_id : "",
-      ...typeof raw.block_id === "string" ? { block_id: raw.block_id } : {},
-      value: raw.value
-    };
+  if (inner.startsWith("::ffff:") || inner.startsWith("::7f")) {
+    return true;
   }
-  if (raw.type === "form_submit") {
-    return {
-      type: "form_submit",
-      action_id: typeof raw.action_id === "string" ? raw.action_id : "",
-      ...typeof raw.block_id === "string" ? { block_id: raw.block_id } : {},
-      values: raw.values && typeof raw.values === "object" ? raw.values : {}
-    };
-  }
-  return { type: "page_load", page: "/findings" };
-}
-async function handleAdminRoute(input, ctx) {
-  const body = normalizeInteraction(input?.input);
-  ctx.log?.info?.(
-    `aexeo route: type=${body.type} page=${body.type === "page_load" ? body.page : ""}`
-  );
-  const dispatch = { body, kv: ctx.kv, ctx };
-  if (body.type === "page_load") {
-    return handlePageLoad(dispatch, body.page);
+  const firstHextet = Number.parseInt(inner.split(":")[0] ?? "", 16);
+  if (Number.isNaN(firstHextet)) {
+    return false;
   }
-  if (body.type === "block_action") {
-    return handleBlockAction(
-      dispatch,
-      body.action_id,
-      body.value
-    );
+  if ((firstHextet & 65024) === 64512) {
+    return true;
   }
-  if (body.type === "form_submit") {
-    return handleFormSubmit(
-      dispatch,
-      body.action_id,
-      body.values
-    );
+  if ((firstHextet & 65472) === 65152) {
+    return true;
   }
-  return handlePageLoad(dispatch, "findings");
+  return false;
 }
-async function handleFormSubmit(ctx, actionId, values) {
-  if (actionId === "save_setup") {
-    return handleSetupSubmit(ctx, values);
-  }
-  if (actionId === "view_document") {
-    const picked = values["route_picker"];
-    if (typeof picked === "string" && picked.length > 0) {
-      return renderDocumentPanel(ctx, picked);
+function hostMatchesAllowlist(host, allowedHosts) {
+  return allowedHosts.some((allowed) => {
+    const entry = allowed.trim().toLowerCase();
+    if (entry.length === 0) {
+      return false;
     }
-  }
-  return handlePageLoad(ctx, "findings");
+    if (entry.startsWith("*.")) {
+      const suffix = entry.slice(1);
+      return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === entry;
+  });
+}
+
+// src/evaluator-sandbox.ts
+async function scoreSite(_documents) {
+  return {
+    overall_score: 0,
+    citation_readiness_score: 0,
+    truth_consistency_score: 0,
+    answer_pack_score: 0,
+    external_trust_alignment_score: null,
+    route_scores: [],
+    blockers: []
+  };
 }
-async function handlePageLoad(ctx, page) {
-  const normalized = page.startsWith("/") ? page.slice(1) : page;
-  if (normalized === "findings") {
-    return renderFindingsPage(ctx);
-  }
-  if (normalized === "widget:aexeo-score") {
-    return renderScoreWidget(ctx);
-  }
-  if (normalized === "document") {
-    return renderDocumentPanel(ctx);
-  }
-  if (normalized === "setup") {
-    return renderSetupPage(ctx);
+
+// src/findings-view.ts
+function normalizeInteraction(input) {
+  if (!input || typeof input !== "object") {
+    return { type: "page_load", page: "/findings" };
   }
-  return notFound(page);
-}
-async function handleBlockAction(ctx, actionId, value) {
-  if (actionId === "view_document" && typeof value === "string") {
-    return renderDocumentPanel(ctx, value);
+  const raw = input;
+  if (raw.type === "page_load") {
+    return {
+      type: "page_load",
+      page: typeof raw.page === "string" && raw.page.length > 0 ? raw.page : "/findings"
+    };
   }
-  if (actionId === "refresh_findings") {
-    return handleRefresh(ctx);
+  if (raw.type === "block_action") {
+    return {
+      type: "block_action",
+      action_id: typeof raw.action_id === "string" ? raw.action_id : "",
+      ...typeof raw.block_id === "string" ? { block_id: raw.block_id } : {},
+      value: raw.value
+    };
   }
-  if (actionId.startsWith("filter:")) {
-    return renderFindingsPage(ctx);
+  if (raw.type === "form_submit") {
+    return {
+      type: "form_submit",
+      action_id: typeof raw.action_id === "string" ? raw.action_id : "",
+      ...typeof raw.block_id === "string" ? { block_id: raw.block_id } : {},
+      values: raw.values && typeof raw.values === "object" ? raw.values : {}
+    };
   }
-  return notFound(actionId);
+  return { type: "page_load", page: "/findings" };
 }
-async function handleRefresh(ctx) {
-  const sandboxEvaluator = async (documents) => {
-    const runtime = await readSidecarConfig(ctx.kv);
-    if (runtime === null) {
-      return {
-        ok: false,
-        reason: "config_missing",
-        detail: "sidecar not configured \u2014 open the Aexeo Setup page and enter your evaluator URL and token"
-      };
-    }
-    return evaluateViaSidecar(
-      ctx.ctx.http,
-      { url: runtime.url, authToken: runtime.token },
-      documents
-    );
-  };
+async function handleRefresh(options) {
   let summary;
   try {
-    summary = await evaluateAndPersistAll(ctx.ctx, {
-      evaluator: sandboxEvaluator
+    summary = await evaluateAndPersistAll(options.ctx, {
+      collections: options.collections,
+      evaluator: options.evaluator,
+      // Always forwarded. See RefreshOptions.suppressionFilter.
+      suppressionFilter: options.suppressionFilter
     });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
+    const message = `Refresh failed: ${detail}`;
     return {
       blocks: [
         { type: "header", text: "SEO findings" },
         {
           type: "banner",
-          title: `Refresh failed: ${detail}`,
-          variant: "alert"
+          title: message,
+          variant: options.tuning.refreshFailureVariant
         }
       ],
-      toast: { message: `Refresh failed: ${detail}`, type: "error" }
+      toast: { message, type: "error" }
     };
   }
-  const refreshed = await renderFindingsPage(ctx);
+  const refreshed = await renderFindingsPage(options.ctx.kv, options.tuning);
   const toastMessage = summary.errors.length === 0 ? `Refreshed ${summary.routesUpdated} routes (${summary.totalFindings} findings across ${summary.documentsScanned} documents)` : `Refresh completed with ${summary.errors.length} errors \u2014 see banner`;
   if (summary.errors.length > 0) {
     refreshed.blocks.unshift({
@@ -585,10 +710,43 @@ async function handleRefresh(ctx) {
     }
   };
 }
-async function renderFindingsPage(ctx) {
-  const findings = await readAllFindings(ctx.kv);
+async function readAllFindings(kv) {
+  const entries = await kv.list(
+    "findings:"
+  );
+  const out = [];
+  for (const entry of entries) {
+    if (entry.value === null) {
+      continue;
+    }
+    const route = entry.key.replace(/^findings:/, "");
+    for (const finding of entry.value.findings) {
+      out.push({ ...finding, document_route: route });
+    }
+  }
+  return out;
+}
+function severityFirst(a, b) {
+  const rank = (severity) => severity === "error" ? 0 : 1;
+  const diff = rank(a.severity) - rank(b.severity);
+  if (diff !== 0) {
+    return diff;
+  }
+  return a.rule_id.localeCompare(b.rule_id);
+}
+function uniqueRoutes(rows) {
+  const routes = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    routes.add(row.document_route);
+  }
+  return [...routes].sort();
+}
+async function renderFindingsPage(kv, tuning) {
+  const findings = await readAllFindings(kv);
   const errors = findings.filter((finding) => finding.severity === "error");
-  const warnings = findings.filter((finding) => finding.severity === "warning");
+  const warnings = findings.filter(
+    (finding) => finding.severity === "warning"
+  );
   const sorted = [...findings].sort(severityFirst);
   const routes = uniqueRoutes(findings);
   const blocks = [
@@ -601,11 +759,9 @@ async function renderFindingsPage(ctx) {
     {
       type: "actions",
       elements: [
-        // Refresh is the primary action: emdash 0.7.0's afterSave hook
-        // can't reliably do I/O (post-response bridge invalidation), so
-        // re-evaluation is admin-triggered rather than save-triggered.
-        // Pressing this lists all content via the live in-request bridge,
-        // calls the sidecar /evaluate, and writes findings back to KV.
+        // Refresh evaluates every configured entry. Pressing it lists
+        // content via the live in-request bridge, evaluates it, and
+        // writes findings back to KV (with suppressions applied).
         {
           type: "button",
           label: "Refresh",
@@ -623,7 +779,7 @@ async function renderFindingsPage(ctx) {
     },
     sorted.length === 0 ? {
       type: "context",
-      text: "Once a document publishes, its rule findings list here."
+      text: tuning.emptyFindingsText
     } : findingsTable(sorted)
   ];
   if (routes.length > 0) {
@@ -642,37 +798,6 @@ async function renderFindingsPage(ctx) {
   }
   return { blocks };
 }
-async function readAllFindings(kv) {
-  const entries = await kv.list(
-    "findings:"
-  );
-  const out = [];
-  for (const entry of entries) {
-    if (entry.value === null) {
-      continue;
-    }
-    const route = entry.key.replace(/^findings:/, "");
-    for (const finding of entry.value.findings) {
-      out.push({ ...finding, document_route: route });
-    }
-  }
-  return out;
-}
-function uniqueRoutes(rows) {
-  const routes = /* @__PURE__ */ new Set();
-  for (const row of rows) {
-    routes.add(row.document_route);
-  }
-  return [...routes].sort();
-}
-function severityFirst(a, b) {
-  const rank = (severity) => severity === "error" ? 0 : 1;
-  const diff = rank(a.severity) - rank(b.severity);
-  if (diff !== 0) {
-    return diff;
-  }
-  return a.rule_id.localeCompare(b.rule_id);
-}
 function findingsTable(rows) {
   return {
     type: "table",
@@ -690,40 +815,31 @@ function findingsTable(rows) {
     }))
   };
 }
-async function renderScoreWidget(ctx) {
-  const documents = await readAllDocuments(ctx.kv);
+async function renderScoreWidget(kv, tuning) {
+  const documents = await readAllDocuments(kv);
   if (documents.length === 0) {
     return {
       blocks: [
         { type: "header", text: "SEO score" },
         {
           type: "context",
-          text: "No documents saved yet \u2014 score appears after the first emdash save."
+          text: tuning.emptyScoreText
         }
       ]
     };
   }
-  const score = await scoreSite(documents);
+  const score = await tuning.score(documents, kv);
   const blocks = [
     {
       type: "stats",
       items: [
+        { label: "Overall", value: `${score.overall_score}` },
+        { label: "Citation", value: `${score.citation_readiness_score}` },
         {
-          label: "Overall",
-          value: `${score.overall_score}`
-        },
-        {
-          label: "Citation",
-          value: `${score.citation_readiness_score}`
-        },
-        {
-          label: "Truth",
+          label: tuning.truthLabel(score),
           value: `${score.truth_consistency_score}`
         },
-        {
-          label: "Answers",
-          value: `${score.answer_pack_score}`
-        }
+        { label: "Answers", value: `${score.answer_pack_score}` }
       ]
     }
   ];
@@ -749,7 +865,7 @@ function topBlockersLine(score) {
   }
   return `Top blockers: ${top.join(" \u2022 ")}`;
 }
-async function renderDocumentPanel(ctx, route) {
+async function renderDocumentPanel(kv, route) {
   if (route === void 0) {
     return {
       blocks: [
@@ -761,9 +877,11 @@ async function renderDocumentPanel(ctx, route) {
       ]
     };
   }
-  const findings = await readFindings(ctx.kv, route);
+  const findings = await readFindings(kv, route);
   const errors = findings.filter((finding) => finding.severity === "error");
-  const warnings = findings.filter((finding) => finding.severity === "warning");
+  const warnings = findings.filter(
+    (finding) => finding.severity === "warning"
+  );
   const sorted = [...findings].sort(severityFirst);
   return {
     blocks: [
@@ -796,13 +914,185 @@ function documentFindingsTable(findings) {
     }))
   };
 }
+function notFound(page) {
+  return {
+    blocks: [
+      { type: "header", text: "Not found" },
+      { type: "context", text: `unknown page: ${page}` }
+    ]
+  };
+}
+
+// src/suppressions.ts
+var NOOP_FILTER = {
+  apply: (_context, findings) => [...findings]
+};
+function compileSuppressions(rules) {
+  if (rules === void 0 || rules.length === 0) {
+    return NOOP_FILTER;
+  }
+  rules.forEach((rule, index) => {
+    const hasRoute = rule.routePattern !== void 0 && rule.routePattern.length > 0;
+    const hasRuleIds = rule.ruleIds !== void 0 && rule.ruleIds.length > 0;
+    const hasCollections = rule.collections !== void 0 && rule.collections.length > 0;
+    const hasStatuses = rule.statuses !== void 0 && rule.statuses.length > 0;
+    if (!hasRoute && !hasRuleIds && !hasCollections && !hasStatuses) {
+      throw new Error(
+        `aexeoPlugin: suppressions[${index}] is empty \u2014 set at least one of routePattern, ruleIds, collections, statuses`
+      );
+    }
+  });
+  const compiled = rules.map((rule) => ({
+    matchRoute: rule.routePattern === void 0 ? matchAlways : globToMatcher(rule.routePattern),
+    ruleIds: rule.ruleIds === void 0 || rule.ruleIds.length === 0 ? null : new Set(rule.ruleIds),
+    collections: rule.collections === void 0 || rule.collections.length === 0 ? null : new Set(rule.collections),
+    statuses: rule.statuses === void 0 || rule.statuses.length === 0 ? null : new Set(rule.statuses)
+  }));
+  return {
+    apply(context, findings) {
+      return findings.filter(
+        (finding) => !compiled.some((rule) => {
+          if (!rule.matchRoute(context.route)) return false;
+          if (rule.ruleIds !== null && !rule.ruleIds.has(finding.rule_id)) {
+            return false;
+          }
+          if (rule.collections !== null) {
+            if (context.collection === void 0 || !rule.collections.has(context.collection)) {
+              return false;
+            }
+          }
+          if (rule.statuses !== null) {
+            if (context.status === void 0 || !rule.statuses.has(context.status)) {
+              return false;
+            }
+          }
+          return true;
+        })
+      );
+    }
+  };
+}
+var matchAlways = () => true;
+function globToMatcher(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const DOUBLE_STAR_TOKEN = "
";
+  const body = escaped.replace(/\*\*/g, DOUBLE_STAR_TOKEN).replace(/\*/g, "[^/]*").replace(new RegExp(DOUBLE_STAR_TOKEN, "g"), ".*").replace(/\?/g, "[^/]");
+  const re = new RegExp(`^${body}$`);
+  return (route) => re.test(route);
+}
+
+// src/sandbox-entry.ts
+function definePlugin(plugin) {
+  return plugin;
+}
+var sandboxSuppressionFilter = compileSuppressions(
+  void 0
+);
+var adminViewTuning = {
+  emptyFindingsText: "Once a document publishes, its rule findings list here.",
+  emptyScoreText: "No documents saved yet \u2014 score appears after the first emdash save.",
+  refreshFailureVariant: "alert",
+  score: async (documents) => scoreSite(documents),
+  truthLabel: () => "Truth"
+};
+async function handleAdminRoute(input, ctx) {
+  const body = normalizeInteraction(input?.input);
+  ctx.log?.info?.(
+    `aexeo route: type=${body.type} page=${body.type === "page_load" ? body.page : ""}`
+  );
+  const dispatch = { body, kv: ctx.kv, ctx };
+  if (body.type === "page_load") {
+    return handlePageLoad(dispatch, body.page);
+  }
+  if (body.type === "block_action") {
+    return handleBlockAction(
+      dispatch,
+      body.action_id,
+      body.value
+    );
+  }
+  if (body.type === "form_submit") {
+    return handleFormSubmit(
+      dispatch,
+      body.action_id,
+      body.values
+    );
+  }
+  return handlePageLoad(dispatch, "findings");
+}
+async function handleFormSubmit(ctx, actionId, values) {
+  if (actionId === "save_setup") {
+    return handleSetupSubmit(ctx, values);
+  }
+  if (actionId === "view_document") {
+    const picked = values["route_picker"];
+    if (typeof picked === "string" && picked.length > 0) {
+      return renderDocumentPanel(ctx.kv, picked);
+    }
+  }
+  return handlePageLoad(ctx, "findings");
+}
+async function handlePageLoad(ctx, page) {
+  const normalized = page.startsWith("/") ? page.slice(1) : page;
+  if (normalized === "findings") {
+    return renderFindingsPage(ctx.kv, adminViewTuning);
+  }
+  if (normalized === "widget:aexeo-score") {
+    return renderScoreWidget(ctx.kv, adminViewTuning);
+  }
+  if (normalized === "document") {
+    return renderDocumentPanel(ctx.kv);
+  }
+  if (normalized === "setup") {
+    return renderSetupPage(ctx);
+  }
+  return notFound(page);
+}
+async function handleBlockAction(ctx, actionId, value) {
+  if (actionId === "view_document" && typeof value === "string") {
+    return renderDocumentPanel(ctx.kv, value);
+  }
+  if (actionId === "refresh_findings") {
+    return handleRefresh2(ctx);
+  }
+  if (actionId.startsWith("filter:")) {
+    return renderFindingsPage(ctx.kv, adminViewTuning);
+  }
+  return notFound(actionId);
+}
+async function handleRefresh2(ctx) {
+  const sandboxEvaluator = async (documents) => {
+    const runtime = await readSidecarConfig(ctx.ctx);
+    if (runtime === null) {
+      return {
+        ok: false,
+        reason: "config_missing",
+        detail: "sidecar not configured \u2014 open the Aexeo Setup page and enter your evaluator URL and token"
+      };
+    }
+    return evaluateViaSidecar(
+      ctx.ctx.http,
+      { url: runtime.url, authToken: runtime.token },
+      documents
+    );
+  };
+  return handleRefresh({
+    ctx: ctx.ctx,
+    // The sandboxed descriptor takes no collection knobs, so the sweep
+    // always covers the default set.
+    collections: DEFAULT_COLLECTIONS,
+    evaluator: sandboxEvaluator,
+    suppressionFilter: sandboxSuppressionFilter,
+    tuning: adminViewTuning
+  });
+}
 async function renderSetupPage(ctx, options = {}) {
-  const existing = await readSidecarConfig(ctx.kv);
+  const existing = await readSidecarConfig(ctx.ctx);
   const blocks = [
     { type: "header", text: "Aexeo setup" },
     {
       type: "context",
-      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. These are stored in plugin KV and read at runtime \u2014 no rebuild required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
+      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. The token is stored encrypted by the emdash host; both values are read at runtime, so no rebuild is required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
     }
   ];
   if (options.bannerError !== void 0) {
@@ -850,39 +1140,23 @@ async function renderSetupPage(ctx, options = {}) {
   );
   return { blocks };
 }
+function runtimeAllowedHosts() {
+  const env = typeof process === "undefined" ? void 0 : process.env;
+  return buildAllowedHosts(env?.["AEXEO_EVALUATOR_HOST"] ?? null);
+}
 async function handleSetupSubmit(ctx, values) {
   const rawUrl = values["evaluator_url"];
   const rawToken = values["eval_token"];
   const url = typeof rawUrl === "string" ? rawUrl.trim() : "";
   const token = typeof rawToken === "string" ? rawToken.trim() : "";
-  if (url.length === 0) {
-    return renderSetupPage(ctx, {
-      bannerError: "Sidecar URL is required.",
-      initialUrl: url
-    });
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return renderSetupPage(ctx, {
-      bannerError: `Sidecar URL is not a valid URL: ${url}`,
-      initialUrl: url
-    });
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+  const validated = validateSidecarUrl(url, runtimeAllowedHosts());
+  if (!validated.ok) {
     return renderSetupPage(ctx, {
-      bannerError: `Sidecar URL must be http(s): got ${parsed.protocol}`,
+      bannerError: validated.error,
       initialUrl: url
     });
   }
-  if (parsed.hostname === "localhost" || parsed.hostname.endsWith(".localhost") || /^127\./.test(parsed.hostname)) {
-    return renderSetupPage(ctx, {
-      bannerError: "emdash's sandbox blocks fetches to localhost (anti-SSRF). Use the deployed *.workers.dev URL.",
-      initialUrl: url
-    });
-  }
-  const existing = await readSidecarConfig(ctx.kv);
+  const existing = await readSidecarConfig(ctx.ctx);
   let resolvedToken;
   if (token.length > 0) {
     resolvedToken = token;
@@ -891,34 +1165,25 @@ async function handleSetupSubmit(ctx, values) {
   } else {
     return renderSetupPage(ctx, {
       bannerError: "EVAL_TOKEN is required on first setup.",
-      initialUrl: url
+      initialUrl: validated.url
     });
   }
-  const next = { url, token: resolvedToken };
-  await writeSidecarConfig(ctx.kv, next);
+  const next = {
+    url: validated.url,
+    token: resolvedToken
+  };
+  await writeSidecarConfig(ctx.ctx, next);
   return renderSetupPage(ctx, {
     bannerSuccess: "Configuration saved. Click Refresh on the findings page to evaluate."
   });
 }
-function notFound(page) {
-  return {
-    blocks: [
-      { type: "header", text: "Not found" },
-      { type: "context", text: `unknown page: ${page}` }
-    ]
-  };
-}
 var sandbox_entry_default = definePlugin({
   hooks: {
     "content:afterSave": handleAfterSave
   },
   routes: {
     admin: { handler: handleAdminRoute }
-  },
-  // emdash's MCP server picks tools up from this field. The exact
-  // host-side spec for plugin-contributed tools is still being mapped;
-  // the field is harmless if unrecognized.
-  mcpTools: tools
+  }
 });
 export {
   sandbox_entry_default as default