@aeptus/aexeo-emdash 0.8.18 → 0.9.0

package/CHANGELOG.md

@@ -6,14 +6,167 @@ and the project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-## [0.8.18] - 2026-09-27
+## [0.9.0] - 2026-11-10
 
-Updates the EmDash integration to the current plugin and content APIs.
+### Added
+
+- Portable content presets with per-collection selection, typed body capabilities and explicit incomplete results.
+- Ordered mappings for multiple content fields and custom blocks, including nested repeats and heading levels, in configured and sandboxed modes.
+- Conservative CMS link inventory export, source locations and aggregate content coverage telemetry.
+- The configured dashboard reports evaluator failures without breaking the editor and tolerates older findings without secondary layers.
+
+### Compatibility
+
+- Supports EmDash `^1.2.0`. Deploy the matching sidecar when using sandboxed mode.
+- The intelligence widget reports facts and blockers instead of the removed composite score.
+- Existing site and CLI checks remain separate from optional content presets.
+
+### Changed
+
+- **The dashboard widget no longer shows a composite score.** The "Overall"
+  stat and the "Site score is N — below the 60 quality threshold" banner are
+  gone; blockers remain the call to action. `SiteIntelligenceScore` loses
+  `overall_score`, `answer_pack_score` and `elapsed_us` and gains
+  `answer_pack`, and `citation_readiness_score` and `truth_consistency_score`
+  may now be `null`, shown as "unknown", when nothing was measured.
+- **Entity presence resolves the newest Common Crawl index at runtime** from
+  `collinfo.json` instead of a pinned crawl, so a site first crawled after a
+  plugin release is no longer reported `not_found`. Failing to resolve the
+  index reports `unreachable`.
+- Support EmDash `^1.2.0` and run the plugin-host integration coverage against
+  EmDash `1.2.0`.
+
+### Added
+
+- **The sandboxed plugin warns when its sidecar is on another version.** The
+  Worker reports its version in the `x-aexeo-version` response header, and the
+  plugin logs a warning when it differs, since a Worker left behind on an upgrade
+  keeps evaluating with older rules.
+
+### Security
+
+- **EVAL_TOKEN never falls back to plaintext.** When the host cannot encrypt
+  the token (usually `EMDASH_ENCRYPTION_KEY` is unset), the Setup page now shows
+  an error and changes nothing, where it used to store the token in plaintext KV
+  with only a log line. **Behaviour change:** on such a host, saving the Setup
+  form fails until the key is set, even for a URL-only change. A token already
+  in KV keeps working, and the Setup page says it is unencrypted.
+- **A rotated token is no longer ignored.** Reads preferred settings, so a token
+  that fell back to KV during a rotation lost to the older one in settings. A KV
+  token is always the newer of the two, and is now read first.
+- **The Setup form rejects trailing-dot hosts** such as `https://localhost./`,
+  which passed the loopback check.
+
+### Changed
+
+- **`aexeo-crawl-worker` upgrade notes.** The Worker refuses every request when
+  `EVAL_TOKEN` is shorter than 32 characters, so rotate a shorter token before
+  redeploying. It answers `413` above 8 MiB, the limit of emdash's sandbox
+  bridge. Malformed bodies and initialization failures now return JSON errors, and
+  token comparison is constant-time. It is built with Wrangler 4 and a newer
+  compatibility date.
+- **Editors can read findings.** The configured plugin's `admin` and `data`
+  routes declare `plugins:read`; emdash otherwise requires `plugins:manage`.
+  Refresh, facts and presence stay admin-only, and the `admin` route refuses
+  `refresh_findings` for non-admins. The sandboxed entry stays admin-only because
+  its `admin` route also saves the Setup form.
+- **The configured plugin declares its network use**: `network:request` and the
+  presence sources' hosts, which it was using while declaring only `content:read`.
+
+### Fixed
+
+- **Concurrent writes no longer lose newer data.** A save older than the stored
+  revision is ignored, a slow evaluation does not overwrite the findings of a
+  later save or delete, and a Refresh does not overwrite a save that landed during
+  the sweep or remove a document created during it.
+- **Deleted content leaves the findings immediately**, through a
+  `content:afterDelete` hook, including when it is only trashed. Restoring an
+  entry brings it back at its next save or Refresh.
+- **Legacy `document:` entries are removed** by a Refresh that does not see their
+  route. They record no collection, so they were previously never removed.
+- **The sandboxed score widget reports the score as unavailable** instead of a
+  score of 0, which read as a measured result.
+- **Entity presence no longer reports false results.** Common Crawl searches the
+  whole domain, where an exact-URL match reported a site absent when the crawl
+  skipped only its home page. Wikipedia and Wikidata records must name the entity
+  or a declared alias, ignoring legal forms; a substring used to count, so
+  "Pineapple" matched "Apple".
+- **Saving a document no longer reports false site-graph findings or erases
+  real ones.** A save evaluates one document as a one-page site, so every
+  internal link was reported as broken (`LNK001`) and the page as an orphan
+  (`LNK002`), and those results replaced the route's stored findings until the
+  next Refresh. Rules that depend on other documents (`LNK001`-`LNK004`,
+  `SEO009`, `SEO012`, `SEO016`, `SEO017`, `CNT005`) are now computed by Refresh
+  only: a save keeps the route's stored findings for them, so a link fixed or
+  added in that save is reflected at the next Refresh.
+
+## [0.8.19] - 2026-09-29
+
+Updates the EmDash integration to the current plugin and content APIs, and
+closes three security findings. Everything since 0.8.18 ships in this one
+version, since 0.8.19 had never been published.
 
 **Compatibility target:** EmDash `>=0.41.0 <0.42.0`.
 
+### Security
+
+- **EVAL_TOKEN is stored through the host's encrypted plugin settings.**
+  The sidecar bearer token was written as plaintext into the plugin's KV
+  namespace. EmDash provides `PluginContext.settings` with host-side
+  encryption for fields declared `type: "secret"` in a plugin's
+  `settingsSchema`, which is exactly this case; the descriptor now declares
+  that schema and the token is written there. Installs that predate the
+  change have their plaintext KV copy deleted on the next write, so the
+  credential is not sitting in the database twice. Hosts without
+  `EMDASH_ENCRYPTION_KEY` configured fall back to the previous KV path with
+  a warning that names the missing environment variable and never the
+  token, so the Setup page keeps working instead of failing closed.
+- **Sidecar URL validation is allowlist-backed and HTTPS-only.**
+  `handleSetupSubmit` accepted `http:`, which sent the bearer token in
+  cleartext, and rejected only `localhost` and `127.*` — leaving
+  `0.0.0.0`, `[::1]`, RFC1918, CGNAT, and the `169.254.169.254` cloud
+  metadata address reachable. It now requires HTTPS, rejects the private,
+  loopback, link-local, multicast, and IPv4-mapped-IPv6 ranges, and
+  compares the submitted host against the `allowedHosts` list the plugin
+  already computes at build time, so the form cannot store a URL the
+  plugin's own allowlist would reject later.
+- **Unauthenticated crawl-artifact routes removed from
+  `packages/aexeo-crawl-worker`.** `GET /findings/latest` returned the full
+  body of the customer's `aexeo-cli crawl` artifact and
+  `GET /findings/list` returned R2 key names, timestamps, and sizes.
+  Neither was behind the bearer-token check that guarded `/evaluate`, and
+  neither had any caller in this repository. CORS is not access control, so
+  anyone who learned the worker hostname could read the whole crawl
+  artifact. Both routes, the R2 binding, and the `examples/github-actions.yml`
+  R2 upload workflow that existed only to feed them are gone.
+
+### Removed
+
+- **`src/mcp.ts` and `src/indexnow.ts`.** Both were unreachable. The host
+  reads `PluginDefinition.mcp` as a `Record` of tool definitions keyed by
+  name; the code attached an `mcpTools` array with a different container and
+  a different per-entry shape, and `configured.ts` never attached it at
+  all. No MCP tool this package offered could ever have been invoked.
+
 ### Fixed
 
+- **Suppressions ignored by the Block Kit Refresh button.** In configured
+  mode the /findings "Refresh" button called the sweep without the
+  compiled `suppressionFilter`, so it re-persisted findings the editor
+  had explicitly silenced. The React `/refresh` route always applied
+  them, so the two surfaces disagreed and the documented guarantee
+  ("suppressed findings never reach the dashboard, /findings, or the
+  per-document panel") did not hold on the Block Kit path.
+  Root cause: `configured.ts` and `sandbox-entry.ts` each carried their
+  own near-verbatim copy of the interaction normalizer, the findings
+  page, the score widget, the document panel, and the refresh handler.
+  The copies had already drifted — this missing argument was one of the
+  drifts. Fix: the whole block now lives once in `src/findings-view.ts`,
+  and `RefreshOptions.suppressionFilter` is a **required** property, so a
+  caller cannot silently omit it again.
+- **`/evaluate` no longer 500s when `EVAL_TOKEN` is unset.** The check read
+  `env.EVAL_TOKEN.length` without a guard, so a worker deployed without the
+  secret threw a `TypeError` on every request instead of rejecting it.
 - **Sandbox access declaration:** replace obsolete capability strings with
   `content:read` and conditional `network:request`, scoped to the configured
   evaluator host. Remove unused schema, artifact, KV, and IndexNow host grants.
@@ -32,10 +185,49 @@ Updates the EmDash integration to the current plugin and content APIs.
 
 ### Changed
 
+- Extract the shared Block Kit view layer (`normalizeInteraction`,
+  `BlockInteraction`, `BlockResponse`, the findings page, the score
+  widget, the document panel, and the refresh sweep) out of
+  `configured.ts` and `sandbox-entry.ts` into `src/findings-view.ts`.
+  Behaviour is unchanged apart from the suppression fix above; the two
+  entrypoints keep their own dispatch and their own copy of the three
+  strings that legitimately differ (empty-state copy, score-widget
+  empty copy, hard-refresh banner variant), passed in through
+  `AdminViewTuning`. `BlockInteraction` and `BlockResponse` are
+  re-exported from `sandbox-entry.ts`, so the `./sandbox` entry's
+  public type surface is unchanged.
 - Bump the EmDash peer and development ranges to `0.41.x`; update the README
   and install guide to name the supported range and sandbox save behavior.
-- Add Vitest coverage using EmDash's official plugin runtime test host for
-  sandbox hooks, blocks extraction, resolved URLs, and translation alternates.
+- Add regression tests for `normalizeInteraction` — the ten edge cases
+  the 0.8.17 changelog claimed to have verified but never did — plus
+  entrypoint parity tests that drive both admin routes with the same
+  malformed bodies, and a test that the configured Block Kit refresh and
+  the React `/refresh` route agree on suppressed findings. Vitest coverage
+  now runs against EmDash's official plugin runtime test host for sandbox
+  hooks, blocks extraction, resolved URLs, and translation alternates.
+- Add `tsconfig.test.json` and a `typecheck:tests` script so `tests/`
+  and `vitest.config.ts` are typechecked. `tsconfig.json`'s `include`
+  covered `src/**` only, which meant the suite guarding the 0.8.17
+  production hotfix and the emdash test-host fixture plugin were both
+  unchecked. `npm run typecheck` now runs `typecheck:src` and
+  `typecheck:tests`.
+- `packages/aexeo-crawl-worker` no longer commits its build artifacts. The
+  checked-in `aexeo_emdash_bridge_bg.wasm` and its glue were several
+  releases behind the bridge the plugin actually calls — missing
+  `generateFactsPrompt`, `validateFactsManifest`, the manifest argument on
+  `scoreIntelligence`, and the `__wbg_*` bindings — and nothing in the
+  repository could regenerate them. The hand-written `.d.ts` files had been
+  updated to match the stale binary, which is why it went unnoticed. The
+  binary is now produced by `npm run build:wasm`, chained into `dev` and
+  `deploy`, and only the two declaration files remain tracked. The package
+  also gains a README, which it did not have.
+
+## [0.8.18] - 2026-09-28
+
+### Added
+
+- Include deterministic editorial-policy rules EDT001–EDT003 in the bundled Rust/WASM evaluator. Configured answer summaries, target questions, and evidence-marked claims can now be checked through the serialized Aexeo config.
+
 
 ## [0.8.17] - 2026-05-29
 

package/INSTALL.md

@@ -5,6 +5,84 @@ site. Findings show up as a Block Kit admin page; a sidebar widget
 shows the site's current intelligence score; saves auto-evaluate the
 changed document.
 
+## Restricting content presets to specific collections
+
+Content presets apply to all evaluated collections by default. Set
+`contentPreset.collections` to select only the collections that use the preset;
+existing site checks continue to run on all configured collections. Use
+`byCollection` to choose an alternate preset for a selected collection.
+For example:
+
+```js
+aexeoPlugin({
+  contentPreset: {
+    name: "article",
+    collections: ["blog_posts", "glossary_terms"],
+    byCollection: { glossary_terms: "glossary" },
+  },
+})
+```
+
+## Content coverage
+
+Portable Text bodies provide text, headings, paragraphs and links to content
+presets. A plain text body provides text only. EmDash custom blocks are
+project-specific; their flattened text is available to the legacy site audit,
+but content-preset gates that require body capabilities are reported as
+`not_checked` until a faithful mapping is provided. The configured plugin
+returns `content_preset_incomplete` for such a report, preserving its existing
+fail-closed behavior. This avoids treating unobserved headings, paragraphs or
+links as absent. An explicitly empty body
+is distinct from an unavailable body. When an entry has several candidate
+content fields, the default first-field projection remains unverified because
+it cannot establish which fields appear in the rendered page.
+
+For custom blocks in configured mode, declare the ordered rendered content
+fields for each block type in the plugin configuration:
+
+```js
+aexeoPlugin({
+  contentFieldsByCollection: { pages: ["introduction", "sections"] },
+  blockMappings: {
+    hero: [
+      { kind: "heading", field: "headline" },
+      { kind: "paragraph", field: "description", optional: true },
+      { kind: "link", field: "linkLabel", hrefField: "linkUrl", optional: true },
+      { kind: "richText", field: "body" },
+    ],
+    faq: [
+      { kind: "heading", field: "heading" },
+      { kind: "repeat", field: "faqs", fields: [
+        { kind: "heading", field: "question", level: 3 },
+        { kind: "paragraph", field: "answer" },
+      ] },
+    ],
+  },
+})
+```
+
+`contentFieldsByCollection` declares the body fields rendered by each selected
+collection, in order. It is an explicit assertion of completeness, so include
+all rendered fields; entries without any selected field remain unavailable.
+In sandboxed mode, enter this object in `Content fields by collection (JSON)`.
+
+A block mapping is the site's assertion that those fields cover the rendered content,
+in order. `richText` accepts Portable Text arrays and preserves their headings
+and links; `heading` defaults to h2 and accepts levels 1 through 6. `repeat`
+maps each item in an array;
+`optional: true` permits an absent field without inventing content. Every
+encountered block type must be
+mapped and every mapped field must have the expected type. If not, capabilities
+remain unverified. These options apply to configured-mode saves and both
+refresh routes. In sandboxed mode, enter the same JSON object in the plugin
+settings field `Custom block mappings (JSON)`; it applies to save and Refresh.
+Invalid or unavailable settings leave custom blocks unverified.
+
+Adapters supplying an `EmdashDocument` can set `body_capabilities` to a subset
+of `text`, `headings`, `paragraphs` and `links`. Omit it only when all four
+are faithfully represented. These capability declarations describe input
+coverage; they do not validate the content itself.
+
 ## Two install paths
 
 The package exports two factories:
@@ -31,8 +109,8 @@ when it's actually needed.
   (`@astrojs/cloudflare` + `@emdash-cms/cloudflare`'s `sandbox()`
   runner is fine — sandboxed plugins use Worker Loader, configured
   plugins don't, but both adapters import cleanly).
-- EmDash `>=0.41.0 <0.42.0` as a peer dependency. The integration
-  coverage targets `0.41.0` with EmDash's official plugin test host.
+- EmDash `^1.2.0` as a peer dependency. The integration coverage targets
+  `1.2.0` with EmDash's official plugin test host.
 
 ### Install
 
@@ -266,16 +344,25 @@ in this repo. Per-site deploy:
 
 ```bash
 cd aexeo-crawl-worker
-# Edit wrangler.toml: name, R2 bucket name, SITE_URL
+npm ci
+# Edit wrangler.toml: name, SITE_URL
 npx wrangler login
-npx wrangler r2 bucket create <bucket-name>
-npx wrangler deploy
+npm run deploy   # builds the WASM bridge, then deploys
 echo "$(openssl rand -hex 32)" | npx wrangler secret put EVAL_TOKEN
 ```
 
+The Worker's WASM is generated, not committed — `npm run deploy` runs
+`npm run build:wasm` first, which needs the Rust toolchain and
+`wasm-bindgen`. See the template's README.
+
 Then in the admin UI, visit
 `/admin/plugins/aexeo-emdash/setup` and paste the deployed URL +
-the same token.
+the same token. The URL must be `https`, must not point at a
+loopback, private, or link-local address, and must be the host in
+`evaluatorHost` above — the emdash sandbox rejects any other outbound
+host, so the form checks it before storing. The token is written
+through the host's encrypted plugin settings (`admin.settingsSchema`
+declares it `secret`), not to plugin KV.
 
 ## Alternative install sources
 
@@ -362,8 +449,10 @@ Node adapter.
   evaluated document under `document:<route>`.
 - **Auto-evaluate on save**: emdash's `content:afterSave` hook fires
   for each save, re-evaluates that one document, and updates its
-  KV findings entry. The dashboard widget reflects the new score on
-  the next page load.
+  KV findings entry. Findings that depend on other documents, such as
+  broken internal links, keep their last Refresh result until the next
+  Refresh. The dashboard widget reflects the new score on the next page
+  load.
 
 ## Architecture in one paragraph
 
@@ -377,3 +466,32 @@ itself is the same `aexeo-emdash-bridge` Rust crate that powers the
 Aexeo CLI; it's compiled to WebAssembly via wasm-pack and imported
 by the host's bundler (Vite + `vite-plugin-wasm`). No separate
 service, no sidecar, no auth token.
+
+### Exporting a conservative link inventory
+
+For host code with access to EmDash's content API, the package exports
+`exportLinkInventory(content, options)`. Select the collections belonging to
+one publication explicitly and supply the observed site identity:
+
+```ts
+import { exportLinkInventory } from "@aeptus/aexeo-emdash";
+
+const result = await exportLinkInventory(ctx.content, {
+  collections: ["blog_posts", "pages"],
+  identity: { origin: "https://example.org", release: "release-id", surface: "public", snapshot: "snapshot-id" },
+});
+// result.inventory matches the link-graph input's inventory shape.
+// Inspect result.issues and result.omitted before using it.
+```
+
+The export resolves public URLs through EmDash and paginates each selected
+collection. Entries without public URLs are reported as omitted, and entries
+with URLs default to `unknown` disposition. A host may supply `classify` when
+it has authoritative indexability and alias information. Repeated or missing
+cursors, failures, and page limits are reported. The inventory is always marked
+incomplete because pagination alone cannot establish a transactional snapshot or
+include routes outside the chosen collections. No HTTP endpoint is installed by
+this API. It cannot by itself establish that a crawl and CMS view describe the
+same publication, release and point in time.
+
+An optional `onTelemetry` callback receives only elapsed milliseconds and aggregate counts. It is disabled by default and does not receive URLs or content.

package/README.md

@@ -3,7 +3,7 @@
 Aexeo SEO/GEO content evaluator as an emdash plugin.
 
 Adds a Findings admin page, per-document panel, and dashboard
-intelligence-score widget to an emdash site. Saves auto-evaluate the
+intelligence facts widget to an emdash site. Saves auto-evaluate the
 changed document; the Refresh button re-evaluates the whole site.
 
 ## Install
@@ -43,18 +43,25 @@ troubleshooting list, see [INSTALL.md](./INSTALL.md).
 - **Findings page** at `/_emdash/admin/plugins/aexeo-emdash/findings`:
   rule violations across the site, filterable by severity.
 - **Document panel** at `/document`: findings scoped to one document.
-- **Dashboard widget**: top-line intelligence score (citation, truth,
-  answer-pack, external-trust dimensions). Banner appears below 60.
+- **Dashboard widget**: citation readiness, truth consistency and answer
+  structure side by side, with the top blockers. There is no composite score
+  or quality threshold, and a dimension with nothing to measure reads
+  `unknown`.
+- **Entity presence**: Wikipedia is searched on `en.wikipedia.org` only, so
+  `not_found` says nothing about other language editions.
 - **Refresh button**: re-evaluate every document in the configured
   collections (`posts`, `pages` by default).
 - **Auto-evaluate on save**: EmDash's `content:afterSave` hook evaluates
   the saved document and updates its findings. Sandboxed installs need a
   configured evaluator sidecar; configured installs run evaluation in-process.
+  Findings that depend on other documents (broken and weak internal links,
+  inbound links, hreflang targets, shared canonicals, duplicate metadata and
+  text) stay as the last Refresh stored them until the next Refresh.
 
 ## Compatibility
 
-- EmDash `>= 0.41.0 < 0.42.0` (peer dependency; current supported range)
-- Runtime integration coverage targets EmDash `0.41.0` via the official
+- EmDash `^1.2.0` (peer dependency; current supported range)
+- Runtime integration coverage targets EmDash `1.2.0` via the official
   `@emdash-cms/plugin-test` host.
 - Cloudflare Workers via `@astrojs/cloudflare`. The plugin uses
   Cloudflare-specific APIs and silently no-ops on the Node adapter.

package/dist/adapter.d.ts

@@ -1,10 +1,34 @@
 import type { EmdashDocument } from "./types.js";
+/** Ordered fields that the host declares constitute a custom block's content. */
+export type CustomBlockField = {
+    kind: "paragraph" | "richText";
+    field: string;
+    optional?: boolean;
+} | {
+    kind: "heading";
+    field: string;
+    level?: 1 | 2 | 3 | 4 | 5 | 6;
+    optional?: boolean;
+} | {
+    kind: "link";
+    field: string;
+    hrefField: string;
+    optional?: boolean;
+} | {
+    kind: "repeat";
+    field: string;
+    fields: readonly CustomBlockField[];
+    optional?: boolean;
+};
+export type CustomBlockMappings = Record<string, readonly CustomBlockField[]>;
 export interface EmdashContentItem {
     id: string;
     type: string;
     slug: string | null;
     status: string;
     locale: string | null;
+    /** Host write timestamp. Orders concurrent saves and Refresh sweeps. */
+    updatedAt?: string;
     translationGroup?: string | null;
     data: Record<string, unknown>;
     seo?: {
@@ -21,6 +45,8 @@ export interface EmdashContentMeta {
     title: string;
     /** Exact URL returned by EmDash, or null when this entry has no public route. */
     publicUrl: string | null;
+    /** The host's `updatedAt` for the row this entry was adapted from. */
+    updatedAt?: string;
 }
 export interface ContentUrlApi {
     getPublicUrl(collection: string, id: string): Promise<string | null>;
@@ -44,16 +70,18 @@ export interface AdaptedContent {
  * accounts for collection URL patterns, locale prefixes, and slash policy;
  * slug-derived paths are not equivalent to the site's actual public URLs.
  */
-export declare function adaptContentItemWithContext(content: EmdashContentItem, contentApi: ContentUrlApi, defaultLocale?: string): Promise<AdaptedContent>;
+export declare function adaptContentItemWithContext(content: EmdashContentItem, contentApi: ContentUrlApi, defaultLocale?: string, blockMappings?: CustomBlockMappings, contentFields?: readonly string[]): Promise<AdaptedContent>;
 /**
  * Synchronous adapter for callers that do not have a host content API.
  * It deliberately uses a stable identity route; callers should use
  * adaptContentItemWithContext whenever EmDash can resolve the public URL.
  */
-export declare function contentItemToEmdashDocument(content: EmdashContentItem): EmdashDocument;
+export declare function contentItemToEmdashDocument(content: EmdashContentItem, blockMappings?: CustomBlockMappings): EmdashDocument;
 export declare function adaptContentItem(content: EmdashContentItem, options?: {
     route?: string;
     publicUrl?: string | null;
     defaultLocale?: string;
+    blockMappings?: CustomBlockMappings | undefined;
+    contentFields?: readonly string[];
 }): AdaptedContent;
 //# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrE,eAAe,CACb,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QACT,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,KAAK,CAAC;YAClB,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,aAAa,EACzB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC,CA2CzB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,GACzB,cAAc,CAEhB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACnB,GACL,cAAc,CAgChB"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAEpE,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAC/F,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC,CAAC;AAE9E,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrE,eAAe,CACb,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QACT,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,KAAK,CAAC;YAClB,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,aAAa,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,mBAAmB,EACnC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,cAAc,CAAC,CA6CzB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAC1B,aAAa,CAAC,EAAE,mBAAmB,GAClC,cAAc,CAEhB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAChD,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACL,cAAc,CAsChB"}

package/dist/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.tsx"],"names":[],"mappings":"AAkBA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,eAAO,MAAM,KAAK;;;;;;;;CAcjB,CAAC"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.tsx"],"names":[],"mappings":"AAkBA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,eAAO,MAAM,KAAK;IAEhB,iBAAiB;IACjB,aAAa;IACb,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAIhB,WAAW;IAGX,QAAQ;CACT,CAAC"}

package/dist/admin.js

@@ -163,7 +163,7 @@ function PillarView({
         /* @__PURE__ */ jsx(SeverityBadge, { severity: finding.severity }),
         /* @__PURE__ */ jsx("code", { className: "font-mono text-xs", children: finding.rule_id }),
         /* @__PURE__ */ jsx("span", { className: "flex-1", children: finding.message }),
-        finding.layers?.secondaries.length ? /* @__PURE__ */ jsx(SecondariesChips, { layers: finding.layers.secondaries }) : null
+        finding.layers?.secondaries?.length ? /* @__PURE__ */ jsx(SecondariesChips, { layers: finding.layers.secondaries }) : null
       ] }, i)) })
     ] }),
     findings.length === 0 ? sitewide.length === 0 ? /* @__PURE__ */ jsx("p", { className: "text-sm text-kumo-subtle", children: "All clean on this layer." }) : null : /* @__PURE__ */ jsx("div", { className: "overflow-x-auto rounded border border-kumo-line", children: /* @__PURE__ */ jsxs("table", { className: "w-full text-left text-sm", children: [
@@ -181,7 +181,7 @@ function PillarView({
           /* @__PURE__ */ jsx("td", { className: "px-3 py-2 align-top", children: /* @__PURE__ */ jsx("code", { className: "rounded bg-kumo-tint px-1.5 py-0.5 font-mono text-xs", children: finding.rule_id }) }),
           /* @__PURE__ */ jsx("td", { className: "px-3 py-2 align-top", children: /* @__PURE__ */ jsx(SeverityBadge, { severity: finding.severity }) }),
           /* @__PURE__ */ jsx("td", { className: "px-3 py-2 align-top", children: finding.message }),
-          /* @__PURE__ */ jsx("td", { className: "px-3 py-2 align-top", children: finding.layers?.secondaries.length ? /* @__PURE__ */ jsx(SecondariesChips, { layers: finding.layers.secondaries }) : /* @__PURE__ */ jsx("span", { className: "text-xs text-kumo-subtle", children: "\u2014" }) })
+          /* @__PURE__ */ jsx("td", { className: "px-3 py-2 align-top", children: finding.layers?.secondaries?.length ? /* @__PURE__ */ jsx(SecondariesChips, { layers: finding.layers.secondaries }) : /* @__PURE__ */ jsx("span", { className: "text-xs text-kumo-subtle", children: "\u2014" }) })
         ] }, i);
       }) })
     ] }) })

package/dist/configured.d.ts

@@ -1,5 +1,11 @@
 import type { Suppression } from "./suppressions.js";
+import type { ContentPresetOptions } from "./content-evaluator.js";
+import type { CustomBlockMappings } from "./adapter.js";
 export interface ConfiguredPluginOptions {
+    blockMappings?: CustomBlockMappings;
+    contentFieldsByCollection?: Record<string, readonly string[]>;
+    /** Optional portable preset evaluated in addition to the existing site checks. */
+    contentPreset?: ContentPresetOptions;
     /**
      * Full override of the swept collections. See `aexeoPlugin` in
      * src/index.ts for the full precedence story.

package/dist/configured.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configured.d.ts","sourceRoot":"","sources":["../src/configured.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA0HrD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CA0H3E;AAID,eAAe,YAAY,CAAC"}
+{"version":3,"file":"configured.d.ts","sourceRoot":"","sources":["../src/configured.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAC;AAKxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAqB,MAAM,cAAc,CAAC;AAuH3E,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,yBAAyB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC9D,kFAAkF;IAClF,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEhC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACvC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAmJ3E;eAIc,YAAY"}