@aeptus/aexeo-emdash 0.8.18 → 0.8.19

package/dist/sandbox-entry.js

@@ -255,11 +255,27 @@ function trimTrailingSlash(url) {
 }
 
 // src/plugin.ts
+function buildAllowedHosts(evaluatorHost) {
+  const host = normalizeHost(evaluatorHost);
+  return host === null ? [] : [host];
+}
+function normalizeHost(evaluatorHost) {
+  const host = evaluatorHost?.trim() ?? "";
+  return host.length === 0 ? null : host;
+}
 var CONFIG_URL_KEY = "config:evaluator_url";
 var CONFIG_TOKEN_KEY = "config:eval_token";
-async function readSidecarConfig(kv) {
-  const url = await kv.get(CONFIG_URL_KEY);
-  const token = await kv.get(CONFIG_TOKEN_KEY);
+var SETTINGS_TOKEN_KEY = "eval_token";
+var PLUGIN_SETTINGS_SCHEMA = {
+  [SETTINGS_TOKEN_KEY]: {
+    type: "secret",
+    label: "EVAL_TOKEN",
+    description: "Bearer token for your aexeo-crawl-worker Worker. Encrypted at rest by the emdash host."
+  }
+};
+async function readSidecarConfig(store) {
+  const url = await store.kv.get(CONFIG_URL_KEY);
+  const token = await readStoredToken(store);
   if (typeof url !== "string" || typeof token !== "string") {
     return null;
   }
@@ -268,12 +284,48 @@ async function readSidecarConfig(kv) {
   }
   return { url, token };
 }
-async function writeSidecarConfig(kv, config) {
-  await kv.set(CONFIG_URL_KEY, config.url);
-  await kv.set(CONFIG_TOKEN_KEY, config.token);
+async function writeSidecarConfig(store, config) {
+  await store.kv.set(CONFIG_URL_KEY, config.url);
+  await writeStoredToken(store, config.token);
+}
+async function readStoredToken(store) {
+  const { settings } = store;
+  if (settings !== void 0) {
+    try {
+      const stored = await settings.get(SETTINGS_TOKEN_KEY);
+      if (typeof stored === "string" && stored.length > 0) {
+        return stored;
+      }
+    } catch (err) {
+      store.log?.warn?.(
+        `aexeo: could not read the encrypted EVAL_TOKEN from plugin settings, falling back to KV: ${describeError(err, "")}`
+      );
+    }
+  }
+  const legacy = await store.kv.get(CONFIG_TOKEN_KEY);
+  return typeof legacy === "string" && legacy.length > 0 ? legacy : null;
+}
+async function writeStoredToken(store, token) {
+  const { settings } = store;
+  if (settings !== void 0) {
+    try {
+      await settings.set(SETTINGS_TOKEN_KEY, token);
+      await store.kv.delete(CONFIG_TOKEN_KEY);
+      return;
+    } catch (err) {
+      store.log?.warn?.(
+        `aexeo: could not store the EVAL_TOKEN encrypted in plugin settings; it will be written to plugin KV in plaintext instead. Set EMDASH_ENCRYPTION_KEY on the emdash host to fix this. Detail: ${describeError(err, token)}`
+      );
+    }
+  }
+  await store.kv.set(CONFIG_TOKEN_KEY, token);
+}
+function describeError(err, secret) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return secret.length === 0 ? raw : raw.split(secret).join("[redacted]");
 }
 async function handleAfterSave(event, ctx) {
-  const runtime = await readSidecarConfig(ctx.kv);
+  const runtime = await readSidecarConfig(ctx);
   if (runtime === null) {
     ctx.log?.warn?.(
       "Aexeo afterSave skipped: configure the evaluator URL and token on the Setup page"
@@ -378,18 +430,18 @@ async function evaluateAndPersistAll(ctx, options) {
     summary.errors.push(`${result.reason}: ${result.detail}`);
     return summary;
   }
-  const findingsByRoute2 = /* @__PURE__ */ new Map();
+  const findingsByRoute = /* @__PURE__ */ new Map();
   for (const route of documentRoutes) {
-    findingsByRoute2.set(route, []);
+    findingsByRoute.set(route, []);
   }
   for (const finding of result.findings) {
     const bucket = finding.scope === "page" ? finding.path : "*";
-    const list = findingsByRoute2.get(bucket) ?? [];
+    const list = findingsByRoute.get(bucket) ?? [];
     list.push(finding);
-    findingsByRoute2.set(bucket, list);
+    findingsByRoute.set(bucket, list);
   }
   let totalAfterSuppression = 0;
-  for (const [route, findings] of findingsByRoute2) {
+  for (const [route, findings] of findingsByRoute) {
     const stored = adaptedByRoute.get(route);
     const context = {
       route,
@@ -481,10 +533,100 @@ async function readFindings(kv, route) {
   return stored.findings;
 }
 
-// src/evaluator-sandbox.ts
-async function evaluate(_documents) {
-  return [];
+// src/sidecar-url.ts
+function validateSidecarUrl(raw, allowedHosts = []) {
+  const url = raw.trim();
+  if (url.length === 0) {
+    return { ok: false, error: "Sidecar URL is required." };
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { ok: false, error: `Sidecar URL is not a valid URL: ${url}` };
+  }
+  if (parsed.protocol !== "https:") {
+    return {
+      ok: false,
+      error: `Sidecar URL must be https: \u2014 the EVAL_TOKEN is sent as a bearer header and must never travel in cleartext. Got ${parsed.protocol}`
+    };
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (isBlockedHost(host)) {
+    return {
+      ok: false,
+      error: "Sidecar URL must not point at a loopback, private, or link-local address. Use the deployed *.workers.dev URL."
+    };
+  }
+  if (allowedHosts.length > 0 && !hostMatchesAllowlist(host, allowedHosts)) {
+    return {
+      ok: false,
+      error: `Sidecar host "${host}" is not in this plugin's outbound allowlist (${allowedHosts.join(", ")}). The emdash sandbox would reject the fetch with "Host not allowed" \u2014 update evaluatorHost in astro.config and rebuild, or use that host.`
+    };
+  }
+  return { ok: true, url };
 }
+function isBlockedHost(host) {
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    return true;
+  }
+  if (host.startsWith("[")) {
+    return isBlockedIpv6(host);
+  }
+  return isBlockedIpv4(host);
+}
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (match === null) {
+    return false;
+  }
+  const first = Number(match[1]);
+  const second = Number(match[2]);
+  if (first === 0) return true;
+  if (first === 127) return true;
+  if (first === 10) return true;
+  if (first === 172 && second >= 16 && second <= 31) return true;
+  if (first === 192 && second === 168) return true;
+  if (first === 169 && second === 254) return true;
+  if (first === 100 && second >= 64 && second <= 127) return true;
+  if (first >= 224) return true;
+  return false;
+}
+function isBlockedIpv6(host) {
+  const inner = host.slice(1, -1).toLowerCase();
+  if (inner === "::" || inner === "::1") {
+    return true;
+  }
+  if (inner.startsWith("::ffff:") || inner.startsWith("::7f")) {
+    return true;
+  }
+  const firstHextet = Number.parseInt(inner.split(":")[0] ?? "", 16);
+  if (Number.isNaN(firstHextet)) {
+    return false;
+  }
+  if ((firstHextet & 65024) === 64512) {
+    return true;
+  }
+  if ((firstHextet & 65472) === 65152) {
+    return true;
+  }
+  return false;
+}
+function hostMatchesAllowlist(host, allowedHosts) {
+  return allowedHosts.some((allowed) => {
+    const entry = allowed.trim().toLowerCase();
+    if (entry.length === 0) {
+      return false;
+    }
+    if (entry.startsWith("*.")) {
+      const suffix = entry.slice(1);
+      return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === entry;
+  });
+}
+
+// src/evaluator-sandbox.ts
 async function scoreSite(_documents) {
   return {
     overall_score: 0,
@@ -496,159 +638,8 @@ async function scoreSite(_documents) {
     blockers: []
   };
 }
-function errorFindings(findings) {
-  return findings.filter((finding) => finding.severity === "error");
-}
-function findingsByRoute(findings) {
-  const grouped = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const bucket = grouped.get(finding.path);
-    if (bucket) {
-      bucket.push(finding);
-    } else {
-      grouped.set(finding.path, [finding]);
-    }
-  }
-  return grouped;
-}
 
-// src/indexnow.ts
-var INDEXNOW_ENDPOINT = "https://api.indexnow.org/indexnow";
-async function submitIndexNow(config, urls) {
-  const host = hostOf(config.siteUrl);
-  if (host === null) {
-    return failure("siteUrl is not a valid URL", []);
-  }
-  const keyLocation = config.keyLocation ?? defaultKeyLocation(config);
-  const { submitted, rejected } = partitionByHost(urls, host);
-  if (submitted.length === 0) {
-    return failure("no submittable URLs after host check", rejected);
-  }
-  const payload = {
-    host,
-    key: config.key,
-    keyLocation,
-    urlList: submitted
-  };
-  const response = await fetch(INDEXNOW_ENDPOINT, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(payload)
-  });
-  return {
-    ok: response.ok,
-    status: response.status,
-    endpoint: INDEXNOW_ENDPOINT,
-    submitted,
-    rejected
-  };
-}
-function hostOf(rawUrl) {
-  try {
-    return new URL(rawUrl).host;
-  } catch {
-    return null;
-  }
-}
-function defaultKeyLocation(config) {
-  const siteUrl = config.siteUrl.endsWith("/") ? config.siteUrl.slice(0, -1) : config.siteUrl;
-  return `${siteUrl}/${config.key}.txt`;
-}
-function partitionByHost(urls, expectedHost) {
-  const submitted = [];
-  const rejected = [];
-  for (const candidate of urls) {
-    const host = hostOf(candidate);
-    if (host === expectedHost) {
-      submitted.push(candidate);
-    } else {
-      rejected.push(candidate);
-    }
-  }
-  return { submitted, rejected };
-}
-function failure(reason, rejected) {
-  return {
-    ok: false,
-    status: 0,
-    endpoint: INDEXNOW_ENDPOINT,
-    submitted: [],
-    rejected,
-    reason
-  };
-}
-
-// src/mcp.ts
-var checkTool = {
-  name: "aexeo.check",
-  description: "Evaluate a list of EmdashDocument values against the Aexeo rule engine and return the stable Finding contract. Mirrors the CLI's `aexeo-cli check` surface so agents, the admin UI, and the CI gate all see the same rule ids.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      documents: {
-        type: "array",
-        description: "Array of EmdashDocument values to evaluate. Each entry carries route, title, optional description/canonical/lang, alternates, meta map, schema, and Portable Text body."
-      },
-      configJson: {
-        type: "string",
-        description: "Optional JSON-serialized Aexeo config. When absent the evaluator uses Config::default(), matching a cold CLI run."
-      }
-    },
-    required: ["documents"]
-  },
-  handler: async ({ documents, configJson }) => {
-    const options = configJson === void 0 ? {} : { configJson };
-    const findings = await evaluate(documents, options);
-    const errors = errorFindings(findings);
-    const grouped = findingsByRoute(findings);
-    const byRoute = {};
-    for (const [route, items] of grouped.entries()) {
-      byRoute[route] = items;
-    }
-    return {
-      findings,
-      errors,
-      byRoute,
-      totals: {
-        findings: findings.length,
-        errors: errors.length,
-        warnings: findings.length - errors.length
-      }
-    };
-  }
-};
-var indexNowSubmitTool = {
-  name: "aexeo.indexnow.submit",
-  description: "Submit a list of URLs to the IndexNow freshness endpoint. Mirrors the aexeo-cli `indexnow submit` contract: the IndexNow protocol requires every submitted URL to belong to the configured site host. URLs that do not match the host are returned in `rejected` and never sent over the wire.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      config: {
-        type: "object",
-        description: "IndexNow configuration: siteUrl, key, and optional keyLocation override.",
-        properties: {
-          siteUrl: { type: "string" },
-          key: { type: "string" },
-          keyLocation: { type: "string" }
-        },
-        required: ["siteUrl", "key"]
-      },
-      urls: {
-        type: "array",
-        items: { type: "string" },
-        description: "Absolute URLs to submit. Must share siteUrl's host."
-      }
-    },
-    required: ["config", "urls"]
-  },
-  handler: async ({ config, urls }) => submitIndexNow(config, urls)
-};
-var tools = [checkTool, indexNowSubmitTool];
-
-// src/sandbox-entry.ts
-function definePlugin(plugin) {
-  return plugin;
-}
+// src/findings-view.ts
 function normalizeInteraction(input) {
   if (!input || typeof input !== "object") {
     return { type: "page_load", page: "/findings" };
@@ -678,107 +669,31 @@ function normalizeInteraction(input) {
   }
   return { type: "page_load", page: "/findings" };
 }
-async function handleAdminRoute(input, ctx) {
-  const body = normalizeInteraction(input?.input);
-  ctx.log?.info?.(
-    `aexeo route: type=${body.type} page=${body.type === "page_load" ? body.page : ""}`
-  );
-  const dispatch = { body, kv: ctx.kv, ctx };
-  if (body.type === "page_load") {
-    return handlePageLoad(dispatch, body.page);
-  }
-  if (body.type === "block_action") {
-    return handleBlockAction(
-      dispatch,
-      body.action_id,
-      body.value
-    );
-  }
-  if (body.type === "form_submit") {
-    return handleFormSubmit(
-      dispatch,
-      body.action_id,
-      body.values
-    );
-  }
-  return handlePageLoad(dispatch, "findings");
-}
-async function handleFormSubmit(ctx, actionId, values) {
-  if (actionId === "save_setup") {
-    return handleSetupSubmit(ctx, values);
-  }
-  if (actionId === "view_document") {
-    const picked = values["route_picker"];
-    if (typeof picked === "string" && picked.length > 0) {
-      return renderDocumentPanel(ctx, picked);
-    }
-  }
-  return handlePageLoad(ctx, "findings");
-}
-async function handlePageLoad(ctx, page) {
-  const normalized = page.startsWith("/") ? page.slice(1) : page;
-  if (normalized === "findings") {
-    return renderFindingsPage(ctx);
-  }
-  if (normalized === "widget:aexeo-score") {
-    return renderScoreWidget(ctx);
-  }
-  if (normalized === "document") {
-    return renderDocumentPanel(ctx);
-  }
-  if (normalized === "setup") {
-    return renderSetupPage(ctx);
-  }
-  return notFound(page);
-}
-async function handleBlockAction(ctx, actionId, value) {
-  if (actionId === "view_document" && typeof value === "string") {
-    return renderDocumentPanel(ctx, value);
-  }
-  if (actionId === "refresh_findings") {
-    return handleRefresh(ctx);
-  }
-  if (actionId.startsWith("filter:")) {
-    return renderFindingsPage(ctx);
-  }
-  return notFound(actionId);
-}
-async function handleRefresh(ctx) {
-  const sandboxEvaluator = async (documents) => {
-    const runtime = await readSidecarConfig(ctx.kv);
-    if (runtime === null) {
-      return {
-        ok: false,
-        reason: "config_missing",
-        detail: "sidecar not configured \u2014 open the Aexeo Setup page and enter your evaluator URL and token"
-      };
-    }
-    return evaluateViaSidecar(
-      ctx.ctx.http,
-      { url: runtime.url, authToken: runtime.token },
-      documents
-    );
-  };
+async function handleRefresh(options) {
   let summary;
   try {
-    summary = await evaluateAndPersistAll(ctx.ctx, {
-      evaluator: sandboxEvaluator
+    summary = await evaluateAndPersistAll(options.ctx, {
+      collections: options.collections,
+      evaluator: options.evaluator,
+      // Always forwarded. See RefreshOptions.suppressionFilter.
+      suppressionFilter: options.suppressionFilter
     });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
+    const message = `Refresh failed: ${detail}`;
     return {
       blocks: [
         { type: "header", text: "SEO findings" },
         {
           type: "banner",
-          title: `Refresh failed: ${detail}`,
-          variant: "alert"
+          title: message,
+          variant: options.tuning.refreshFailureVariant
         }
       ],
-      toast: { message: `Refresh failed: ${detail}`, type: "error" }
+      toast: { message, type: "error" }
     };
   }
-  const refreshed = await renderFindingsPage(ctx);
+  const refreshed = await renderFindingsPage(options.ctx.kv, options.tuning);
   const toastMessage = summary.errors.length === 0 ? `Refreshed ${summary.routesUpdated} routes (${summary.totalFindings} findings across ${summary.documentsScanned} documents)` : `Refresh completed with ${summary.errors.length} errors \u2014 see banner`;
   if (summary.errors.length > 0) {
     refreshed.blocks.unshift({
@@ -795,10 +710,43 @@ async function handleRefresh(ctx) {
     }
   };
 }
-async function renderFindingsPage(ctx) {
-  const findings = await readAllFindings(ctx.kv);
+async function readAllFindings(kv) {
+  const entries = await kv.list(
+    "findings:"
+  );
+  const out = [];
+  for (const entry of entries) {
+    if (entry.value === null) {
+      continue;
+    }
+    const route = entry.key.replace(/^findings:/, "");
+    for (const finding of entry.value.findings) {
+      out.push({ ...finding, document_route: route });
+    }
+  }
+  return out;
+}
+function severityFirst(a, b) {
+  const rank = (severity) => severity === "error" ? 0 : 1;
+  const diff = rank(a.severity) - rank(b.severity);
+  if (diff !== 0) {
+    return diff;
+  }
+  return a.rule_id.localeCompare(b.rule_id);
+}
+function uniqueRoutes(rows) {
+  const routes = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    routes.add(row.document_route);
+  }
+  return [...routes].sort();
+}
+async function renderFindingsPage(kv, tuning) {
+  const findings = await readAllFindings(kv);
   const errors = findings.filter((finding) => finding.severity === "error");
-  const warnings = findings.filter((finding) => finding.severity === "warning");
+  const warnings = findings.filter(
+    (finding) => finding.severity === "warning"
+  );
   const sorted = [...findings].sort(severityFirst);
   const routes = uniqueRoutes(findings);
   const blocks = [
@@ -812,8 +760,8 @@ async function renderFindingsPage(ctx) {
       type: "actions",
       elements: [
         // Refresh evaluates every configured entry. Pressing it lists
-        // content via the live in-request bridge,
-        // calls the sidecar /evaluate, and writes findings back to KV.
+        // content via the live in-request bridge, evaluates it, and
+        // writes findings back to KV (with suppressions applied).
         {
           type: "button",
           label: "Refresh",
@@ -831,7 +779,7 @@ async function renderFindingsPage(ctx) {
     },
     sorted.length === 0 ? {
       type: "context",
-      text: "Once a document publishes, its rule findings list here."
+      text: tuning.emptyFindingsText
     } : findingsTable(sorted)
   ];
   if (routes.length > 0) {
@@ -850,37 +798,6 @@ async function renderFindingsPage(ctx) {
   }
   return { blocks };
 }
-async function readAllFindings(kv) {
-  const entries = await kv.list(
-    "findings:"
-  );
-  const out = [];
-  for (const entry of entries) {
-    if (entry.value === null) {
-      continue;
-    }
-    const route = entry.key.replace(/^findings:/, "");
-    for (const finding of entry.value.findings) {
-      out.push({ ...finding, document_route: route });
-    }
-  }
-  return out;
-}
-function uniqueRoutes(rows) {
-  const routes = /* @__PURE__ */ new Set();
-  for (const row of rows) {
-    routes.add(row.document_route);
-  }
-  return [...routes].sort();
-}
-function severityFirst(a, b) {
-  const rank = (severity) => severity === "error" ? 0 : 1;
-  const diff = rank(a.severity) - rank(b.severity);
-  if (diff !== 0) {
-    return diff;
-  }
-  return a.rule_id.localeCompare(b.rule_id);
-}
 function findingsTable(rows) {
   return {
     type: "table",
@@ -898,40 +815,31 @@ function findingsTable(rows) {
     }))
   };
 }
-async function renderScoreWidget(ctx) {
-  const documents = await readAllDocuments(ctx.kv);
+async function renderScoreWidget(kv, tuning) {
+  const documents = await readAllDocuments(kv);
   if (documents.length === 0) {
     return {
       blocks: [
         { type: "header", text: "SEO score" },
         {
           type: "context",
-          text: "No documents saved yet \u2014 score appears after the first emdash save."
+          text: tuning.emptyScoreText
         }
       ]
     };
   }
-  const score = await scoreSite(documents);
+  const score = await tuning.score(documents, kv);
   const blocks = [
     {
       type: "stats",
       items: [
+        { label: "Overall", value: `${score.overall_score}` },
+        { label: "Citation", value: `${score.citation_readiness_score}` },
         {
-          label: "Overall",
-          value: `${score.overall_score}`
-        },
-        {
-          label: "Citation",
-          value: `${score.citation_readiness_score}`
-        },
-        {
-          label: "Truth",
+          label: tuning.truthLabel(score),
           value: `${score.truth_consistency_score}`
         },
-        {
-          label: "Answers",
-          value: `${score.answer_pack_score}`
-        }
+        { label: "Answers", value: `${score.answer_pack_score}` }
       ]
     }
   ];
@@ -957,7 +865,7 @@ function topBlockersLine(score) {
   }
   return `Top blockers: ${top.join(" \u2022 ")}`;
 }
-async function renderDocumentPanel(ctx, route) {
+async function renderDocumentPanel(kv, route) {
   if (route === void 0) {
     return {
       blocks: [
@@ -969,9 +877,11 @@ async function renderDocumentPanel(ctx, route) {
       ]
     };
   }
-  const findings = await readFindings(ctx.kv, route);
+  const findings = await readFindings(kv, route);
   const errors = findings.filter((finding) => finding.severity === "error");
-  const warnings = findings.filter((finding) => finding.severity === "warning");
+  const warnings = findings.filter(
+    (finding) => finding.severity === "warning"
+  );
   const sorted = [...findings].sort(severityFirst);
   return {
     blocks: [
@@ -1004,13 +914,185 @@ function documentFindingsTable(findings) {
     }))
   };
 }
+function notFound(page) {
+  return {
+    blocks: [
+      { type: "header", text: "Not found" },
+      { type: "context", text: `unknown page: ${page}` }
+    ]
+  };
+}
+
+// src/suppressions.ts
+var NOOP_FILTER = {
+  apply: (_context, findings) => [...findings]
+};
+function compileSuppressions(rules) {
+  if (rules === void 0 || rules.length === 0) {
+    return NOOP_FILTER;
+  }
+  rules.forEach((rule, index) => {
+    const hasRoute = rule.routePattern !== void 0 && rule.routePattern.length > 0;
+    const hasRuleIds = rule.ruleIds !== void 0 && rule.ruleIds.length > 0;
+    const hasCollections = rule.collections !== void 0 && rule.collections.length > 0;
+    const hasStatuses = rule.statuses !== void 0 && rule.statuses.length > 0;
+    if (!hasRoute && !hasRuleIds && !hasCollections && !hasStatuses) {
+      throw new Error(
+        `aexeoPlugin: suppressions[${index}] is empty \u2014 set at least one of routePattern, ruleIds, collections, statuses`
+      );
+    }
+  });
+  const compiled = rules.map((rule) => ({
+    matchRoute: rule.routePattern === void 0 ? matchAlways : globToMatcher(rule.routePattern),
+    ruleIds: rule.ruleIds === void 0 || rule.ruleIds.length === 0 ? null : new Set(rule.ruleIds),
+    collections: rule.collections === void 0 || rule.collections.length === 0 ? null : new Set(rule.collections),
+    statuses: rule.statuses === void 0 || rule.statuses.length === 0 ? null : new Set(rule.statuses)
+  }));
+  return {
+    apply(context, findings) {
+      return findings.filter(
+        (finding) => !compiled.some((rule) => {
+          if (!rule.matchRoute(context.route)) return false;
+          if (rule.ruleIds !== null && !rule.ruleIds.has(finding.rule_id)) {
+            return false;
+          }
+          if (rule.collections !== null) {
+            if (context.collection === void 0 || !rule.collections.has(context.collection)) {
+              return false;
+            }
+          }
+          if (rule.statuses !== null) {
+            if (context.status === void 0 || !rule.statuses.has(context.status)) {
+              return false;
+            }
+          }
+          return true;
+        })
+      );
+    }
+  };
+}
+var matchAlways = () => true;
+function globToMatcher(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const DOUBLE_STAR_TOKEN = "
";
+  const body = escaped.replace(/\*\*/g, DOUBLE_STAR_TOKEN).replace(/\*/g, "[^/]*").replace(new RegExp(DOUBLE_STAR_TOKEN, "g"), ".*").replace(/\?/g, "[^/]");
+  const re = new RegExp(`^${body}$`);
+  return (route) => re.test(route);
+}
+
+// src/sandbox-entry.ts
+function definePlugin(plugin) {
+  return plugin;
+}
+var sandboxSuppressionFilter = compileSuppressions(
+  void 0
+);
+var adminViewTuning = {
+  emptyFindingsText: "Once a document publishes, its rule findings list here.",
+  emptyScoreText: "No documents saved yet \u2014 score appears after the first emdash save.",
+  refreshFailureVariant: "alert",
+  score: async (documents) => scoreSite(documents),
+  truthLabel: () => "Truth"
+};
+async function handleAdminRoute(input, ctx) {
+  const body = normalizeInteraction(input?.input);
+  ctx.log?.info?.(
+    `aexeo route: type=${body.type} page=${body.type === "page_load" ? body.page : ""}`
+  );
+  const dispatch = { body, kv: ctx.kv, ctx };
+  if (body.type === "page_load") {
+    return handlePageLoad(dispatch, body.page);
+  }
+  if (body.type === "block_action") {
+    return handleBlockAction(
+      dispatch,
+      body.action_id,
+      body.value
+    );
+  }
+  if (body.type === "form_submit") {
+    return handleFormSubmit(
+      dispatch,
+      body.action_id,
+      body.values
+    );
+  }
+  return handlePageLoad(dispatch, "findings");
+}
+async function handleFormSubmit(ctx, actionId, values) {
+  if (actionId === "save_setup") {
+    return handleSetupSubmit(ctx, values);
+  }
+  if (actionId === "view_document") {
+    const picked = values["route_picker"];
+    if (typeof picked === "string" && picked.length > 0) {
+      return renderDocumentPanel(ctx.kv, picked);
+    }
+  }
+  return handlePageLoad(ctx, "findings");
+}
+async function handlePageLoad(ctx, page) {
+  const normalized = page.startsWith("/") ? page.slice(1) : page;
+  if (normalized === "findings") {
+    return renderFindingsPage(ctx.kv, adminViewTuning);
+  }
+  if (normalized === "widget:aexeo-score") {
+    return renderScoreWidget(ctx.kv, adminViewTuning);
+  }
+  if (normalized === "document") {
+    return renderDocumentPanel(ctx.kv);
+  }
+  if (normalized === "setup") {
+    return renderSetupPage(ctx);
+  }
+  return notFound(page);
+}
+async function handleBlockAction(ctx, actionId, value) {
+  if (actionId === "view_document" && typeof value === "string") {
+    return renderDocumentPanel(ctx.kv, value);
+  }
+  if (actionId === "refresh_findings") {
+    return handleRefresh2(ctx);
+  }
+  if (actionId.startsWith("filter:")) {
+    return renderFindingsPage(ctx.kv, adminViewTuning);
+  }
+  return notFound(actionId);
+}
+async function handleRefresh2(ctx) {
+  const sandboxEvaluator = async (documents) => {
+    const runtime = await readSidecarConfig(ctx.ctx);
+    if (runtime === null) {
+      return {
+        ok: false,
+        reason: "config_missing",
+        detail: "sidecar not configured \u2014 open the Aexeo Setup page and enter your evaluator URL and token"
+      };
+    }
+    return evaluateViaSidecar(
+      ctx.ctx.http,
+      { url: runtime.url, authToken: runtime.token },
+      documents
+    );
+  };
+  return handleRefresh({
+    ctx: ctx.ctx,
+    // The sandboxed descriptor takes no collection knobs, so the sweep
+    // always covers the default set.
+    collections: DEFAULT_COLLECTIONS,
+    evaluator: sandboxEvaluator,
+    suppressionFilter: sandboxSuppressionFilter,
+    tuning: adminViewTuning
+  });
+}
 async function renderSetupPage(ctx, options = {}) {
-  const existing = await readSidecarConfig(ctx.kv);
+  const existing = await readSidecarConfig(ctx.ctx);
   const blocks = [
     { type: "header", text: "Aexeo setup" },
     {
       type: "context",
-      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. These are stored in plugin KV and read at runtime \u2014 no rebuild required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
+      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. The token is stored encrypted by the emdash host; both values are read at runtime, so no rebuild is required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
     }
   ];
   if (options.bannerError !== void 0) {
@@ -1058,39 +1140,23 @@ async function renderSetupPage(ctx, options = {}) {
   );
   return { blocks };
 }
+function runtimeAllowedHosts() {
+  const env = typeof process === "undefined" ? void 0 : process.env;
+  return buildAllowedHosts(env?.["AEXEO_EVALUATOR_HOST"] ?? null);
+}
 async function handleSetupSubmit(ctx, values) {
   const rawUrl = values["evaluator_url"];
   const rawToken = values["eval_token"];
   const url = typeof rawUrl === "string" ? rawUrl.trim() : "";
   const token = typeof rawToken === "string" ? rawToken.trim() : "";
-  if (url.length === 0) {
+  const validated = validateSidecarUrl(url, runtimeAllowedHosts());
+  if (!validated.ok) {
     return renderSetupPage(ctx, {
-      bannerError: "Sidecar URL is required.",
+      bannerError: validated.error,
       initialUrl: url
     });
   }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return renderSetupPage(ctx, {
-      bannerError: `Sidecar URL is not a valid URL: ${url}`,
-      initialUrl: url
-    });
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    return renderSetupPage(ctx, {
-      bannerError: `Sidecar URL must be http(s): got ${parsed.protocol}`,
-      initialUrl: url
-    });
-  }
-  if (parsed.hostname === "localhost" || parsed.hostname.endsWith(".localhost") || /^127\./.test(parsed.hostname)) {
-    return renderSetupPage(ctx, {
-      bannerError: "emdash's sandbox blocks fetches to localhost (anti-SSRF). Use the deployed *.workers.dev URL.",
-      initialUrl: url
-    });
-  }
-  const existing = await readSidecarConfig(ctx.kv);
+  const existing = await readSidecarConfig(ctx.ctx);
   let resolvedToken;
   if (token.length > 0) {
     resolvedToken = token;
@@ -1099,34 +1165,25 @@ async function handleSetupSubmit(ctx, values) {
   } else {
     return renderSetupPage(ctx, {
       bannerError: "EVAL_TOKEN is required on first setup.",
-      initialUrl: url
+      initialUrl: validated.url
     });
   }
-  const next = { url, token: resolvedToken };
-  await writeSidecarConfig(ctx.kv, next);
+  const next = {
+    url: validated.url,
+    token: resolvedToken
+  };
+  await writeSidecarConfig(ctx.ctx, next);
   return renderSetupPage(ctx, {
     bannerSuccess: "Configuration saved. Click Refresh on the findings page to evaluate."
   });
 }
-function notFound(page) {
-  return {
-    blocks: [
-      { type: "header", text: "Not found" },
-      { type: "context", text: `unknown page: ${page}` }
-    ]
-  };
-}
 var sandbox_entry_default = definePlugin({
   hooks: {
     "content:afterSave": handleAfterSave
   },
   routes: {
     admin: { handler: handleAdminRoute }
-  },
-  // emdash's MCP server picks tools up from this field. The exact
-  // host-side spec for plugin-contributed tools is still being mapped;
-  // the field is harmless if unrecognized.
-  mcpTools: tools
+  }
 });
 export {
   sandbox_entry_default as default