@aeptus/aexeo-emdash 0.8.18 → 0.9.0

package/dist/sandbox-entry.js

@@ -1,11 +1,13 @@
 // src/adapter.ts
-async function adaptContentItemWithContext(content, contentApi, defaultLocale) {
+async function adaptContentItemWithContext(content, contentApi, defaultLocale, blockMappings, contentFields) {
   const publicUrl = content.status === "published" ? await contentApi.getPublicUrl(content.type, content.id) : null;
   const route = publicUrl === null ? deriveRoute(content) : routeFromPublicUrl(publicUrl);
   const adapted = adaptContentItem(content, {
     route,
     publicUrl,
-    ...defaultLocale === void 0 ? {} : { defaultLocale }
+    ...defaultLocale === void 0 ? {} : { defaultLocale },
+    ...blockMappings === void 0 ? {} : { blockMappings },
+    ...contentFields === void 0 ? {} : { contentFields }
   });
   const translationSet = await contentApi.getTranslations(
     content.type,
@@ -47,8 +49,11 @@ function adaptContentItem(content, options = {}) {
   if (typeof locale === "string" && locale.length > 0) {
     document.lang = locale;
   }
-  const body = extractPortableText(content.data);
-  if (body !== null) document.body = body;
+  const body = options.contentFields === void 0 ? extractPortableText(content.data, options.blockMappings) : extractSelectedContent(content.data, options.contentFields, options.blockMappings);
+  if (body !== null) {
+    document.body = body.blocks;
+    if (body.capabilities !== void 0) document.body_capabilities = body.capabilities;
+  }
   return {
     document,
     meta: {
@@ -57,7 +62,8 @@ function adaptContentItem(content, options = {}) {
       slug: content.slug,
       status: content.status,
       title,
-      publicUrl: options.publicUrl ?? null
+      publicUrl: options.publicUrl ?? null,
+      ...content.updatedAt === void 0 ? {} : { updatedAt: content.updatedAt }
     }
   };
 }
@@ -76,24 +82,53 @@ function routeFromPublicUrl(publicUrl) {
 function stringOrEmpty(value) {
   return typeof value === "string" ? value : "";
 }
-function extractPortableText(data) {
+function extractSelectedContent(data, fields, mappings) {
+  if (fields.length === 0 || new Set(fields).size !== fields.length || fields.some((field) => typeof field !== "string" || field.length === 0)) return null;
+  const all = ["text", "headings", "paragraphs", "links"];
+  let capabilities = all;
+  const blocks = [];
+  let observed = false;
+  for (const field of fields) {
+    const value = data[field];
+    if (value === void 0 || value === null) continue;
+    observed = true;
+    const part = extractFirstPortableText({ content: value }, mappings);
+    if (part === null) return { blocks, capabilities: [] };
+    blocks.push(...part.blocks);
+    capabilities = capabilities.filter((capability) => part.capabilities === void 0 || part.capabilities.includes(capability));
+  }
+  if (!observed) return null;
+  return capabilities.length === all.length ? { blocks } : { blocks, capabilities: [...capabilities] };
+}
+function extractPortableText(data, mappings) {
+  const result = extractFirstPortableText(data, mappings);
+  if (result === null) return null;
+  const candidates = Object.entries(data).filter(
+    ([field, value]) => isPortableTextArray(value) || isEmdashBlocksArray(value, field) || (field === "body" || field === "content") && typeof value === "string" && value.trim().length > 0
+  );
+  return candidates.length > 1 ? { blocks: result.blocks, capabilities: [] } : result;
+}
+function extractFirstPortableText(data, mappings) {
+  let foundEmptyBody = false;
   for (const slug of ["body", "content"]) {
     const value = data[slug];
-    if (isPortableTextArray(value)) return value;
-    if (isEmdashBlocksArray(value, slug)) return blocksToPortableText(value);
+    if (Array.isArray(value) && value.length === 0 || typeof value === "string" && value.trim().length === 0) foundEmptyBody = true;
+    if (isPortableTextArray(value)) return { blocks: value };
+    if (isEmdashBlocksArray(value, slug)) return mapCustomBlocks(value, mappings);
     if (typeof value === "string" && value.trim().length > 0) {
-      return [portableTextBlock(value.trim(), `${slug}-text`)];
+      return { blocks: [portableTextBlock(value.trim(), `${slug}-text`)], capabilities: ["text"] };
     }
   }
   const blocks = data["blocks"];
-  if (isPortableTextArray(blocks)) return blocks;
-  if (isEmdashBlocksArray(blocks, "blocks")) return blocksToPortableText(blocks);
+  if (Array.isArray(blocks) && blocks.length === 0) foundEmptyBody = true;
+  if (isPortableTextArray(blocks)) return { blocks };
+  if (isEmdashBlocksArray(blocks, "blocks")) return mapCustomBlocks(blocks, mappings);
   for (const [field, value] of Object.entries(data)) {
     if (field === "body" || field === "content" || field === "blocks") continue;
-    if (isPortableTextArray(value)) return value;
-    if (isEmdashBlocksArray(value, field)) return blocksToPortableText(value);
+    if (isPortableTextArray(value)) return { blocks: value };
+    if (isEmdashBlocksArray(value, field)) return mapCustomBlocks(value, mappings);
   }
-  return null;
+  return foundEmptyBody ? { blocks: [] } : null;
 }
 function isPortableTextArray(value) {
   return Array.isArray(value) && value.length > 0 && value.every(
@@ -108,6 +143,52 @@ function isEmdashBlocksArray(value, field) {
     (item) => isRecord(item) && typeof item["_type"] === "string" && typeof item["_key"] === "string" && (typeof item["_version"] === "number" || field === "blocks")
   );
 }
+function mapCustomBlocks(blocks, mappings) {
+  const unavailable = () => ({ blocks: blocksToPortableText(blocks), capabilities: [] });
+  const result = [];
+  const mapFields = (record, fields, depth) => {
+    if (depth > 8 || fields.length === 0) return false;
+    for (const entry of fields) {
+      if (!entry || typeof entry.field !== "string" || !entry.field || !["heading", "paragraph", "richText", "link", "repeat"].includes(entry.kind)) return false;
+      if (entry.kind === "heading" && entry.level !== void 0 && ![1, 2, 3, 4, 5, 6].includes(entry.level)) return false;
+      if (entry.kind === "link" && (typeof entry.hrefField !== "string" || !entry.hrefField)) return false;
+      if (entry.kind === "repeat" && (!Array.isArray(entry.fields) || entry.fields.length === 0)) return false;
+      const value = record[entry.field];
+      if ((value === void 0 || value === null || value === "") && entry.optional) {
+        if (entry.kind === "link" && record[entry.hrefField] != null && record[entry.hrefField] !== "") return false;
+        continue;
+      }
+      if (entry.kind === "richText") {
+        if (!Array.isArray(value) || value.length > 0 && !isPortableTextArray(value)) return false;
+        result.push(...value);
+      } else if (entry.kind === "heading" || entry.kind === "paragraph") {
+        if (typeof value !== "string") return false;
+        result.push({ ...portableTextBlock(value, ""), style: entry.kind === "heading" ? `h${entry.level ?? 2}` : "normal" });
+      } else if (entry.kind === "link") {
+        const href = record[entry.hrefField];
+        if (typeof value !== "string" || typeof href !== "string" || !href) return false;
+        result.push({
+          _type: "block",
+          children: [{ _type: "span", text: value, marks: ["link"] }],
+          markDefs: [{ _key: "link", _type: "link", href }]
+        });
+      } else if (entry.kind === "repeat") {
+        if (!Array.isArray(value) || !Array.isArray(entry.fields)) return false;
+        for (const item of value) {
+          if (!isRecord(item) || !mapFields(item, entry.fields, depth + 1)) return false;
+        }
+      } else {
+        return false;
+      }
+    }
+    return true;
+  };
+  for (const block of blocks) {
+    const fields = mappings?.[String(block["_type"])];
+    if (!Array.isArray(fields) || !mapFields(block, fields, 0)) return unavailable();
+  }
+  return { blocks: result };
+}
 function blocksToPortableText(blocks) {
   const paragraphs = [];
   for (const block of blocks) {
@@ -191,11 +272,15 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/version.ts
+var PACKAGE_VERSION = "0.9.0";
+
 // src/sidecar.ts
-async function evaluateViaSidecar(http, config, documents) {
+async function evaluateViaSidecar(http, config, documents, collections) {
   const body = {
     documents
   };
+  if (collections !== void 0) body.collections = collections;
   if (config.configJson !== void 0) {
     body.configJson = config.configJson;
   }
@@ -228,6 +313,12 @@ async function evaluateViaSidecar(http, config, documents) {
     }
     return { ok: false, reason: "server_error", detail };
   }
+  const workerVersion = response.headers?.get("x-aexeo-version") ?? "unknown";
+  if (workerVersion !== PACKAGE_VERSION) {
+    config.log?.warn(
+      `Aexeo sidecar is version ${workerVersion} but the plugin is ${PACKAGE_VERSION}; redeploy the Worker so both run the same rules`
+    );
+  }
   let raw;
   try {
     raw = await response.text();
@@ -255,11 +346,41 @@ function trimTrailingSlash(url) {
 }
 
 // src/plugin.ts
+function buildAllowedHosts(evaluatorHost) {
+  const host = normalizeHost(evaluatorHost);
+  return host === null ? [] : [host];
+}
+function normalizeHost(evaluatorHost) {
+  const host = evaluatorHost?.trim() ?? "";
+  return host.length === 0 ? null : host;
+}
 var CONFIG_URL_KEY = "config:evaluator_url";
 var CONFIG_TOKEN_KEY = "config:eval_token";
-async function readSidecarConfig(kv) {
-  const url = await kv.get(CONFIG_URL_KEY);
-  const token = await kv.get(CONFIG_TOKEN_KEY);
+var SETTINGS_TOKEN_KEY = "eval_token";
+var SETTINGS_BLOCK_MAPPINGS_KEY = "block_mappings";
+var SETTINGS_CONTENT_FIELDS_KEY = "content_fields_by_collection";
+var PLUGIN_SETTINGS_SCHEMA = {
+  [SETTINGS_CONTENT_FIELDS_KEY]: {
+    type: "string",
+    label: "Content fields by collection (JSON)",
+    description: "Ordered rendered body fields per collection.",
+    multiline: true
+  },
+  [SETTINGS_BLOCK_MAPPINGS_KEY]: {
+    type: "string",
+    label: "Custom block mappings (JSON)",
+    description: "Ordered mappings for the rendered fields of each custom block type.",
+    multiline: true
+  },
+  [SETTINGS_TOKEN_KEY]: {
+    type: "secret",
+    label: "EVAL_TOKEN",
+    description: "Bearer token for your aexeo-crawl-worker Worker. Encrypted at rest by the emdash host."
+  }
+};
+async function readSidecarConfig(store) {
+  const url = await store.kv.get(CONFIG_URL_KEY);
+  const token = await readStoredToken(store);
   if (typeof url !== "string" || typeof token !== "string") {
     return null;
   }
@@ -268,48 +389,185 @@ async function readSidecarConfig(kv) {
   }
   return { url, token };
 }
-async function writeSidecarConfig(kv, config) {
-  await kv.set(CONFIG_URL_KEY, config.url);
-  await kv.set(CONFIG_TOKEN_KEY, config.token);
+async function writeSidecarConfig(store, config) {
+  await writeStoredToken(store, config.token);
+  await store.kv.set(CONFIG_URL_KEY, config.url);
+}
+async function isTokenStoredInPlaintext(store) {
+  return await readLegacyToken(store) !== null;
+}
+async function readLegacyToken(store) {
+  const legacy = await store.kv.get(CONFIG_TOKEN_KEY);
+  return typeof legacy === "string" && legacy.length > 0 ? legacy : null;
+}
+async function readStoredToken(store) {
+  const legacy = await readLegacyToken(store);
+  if (legacy !== null) {
+    return legacy;
+  }
+  const { settings } = store;
+  if (settings !== void 0) {
+    try {
+      const stored = await settings.get(SETTINGS_TOKEN_KEY);
+      if (typeof stored === "string" && stored.length > 0) {
+        return stored;
+      }
+    } catch (err) {
+      store.log?.warn?.(
+        `aexeo: could not read the encrypted EVAL_TOKEN from plugin settings: ${describeError(err, "")}`
+      );
+    }
+  }
+  return null;
+}
+var TokenStorageError = class extends Error {
+};
+async function writeStoredToken(store, token) {
+  const { settings } = store;
+  if (settings === void 0) {
+    throw new TokenStorageError(
+      "This emdash host does not provide encrypted plugin settings, so EVAL_TOKEN was not saved. Upgrade emdash."
+    );
+  }
+  try {
+    await settings.set(SETTINGS_TOKEN_KEY, token);
+    await store.kv.delete(CONFIG_TOKEN_KEY);
+  } catch (err) {
+    throw new TokenStorageError(
+      `EVAL_TOKEN was not saved because the host could not store it encrypted. Set EMDASH_ENCRYPTION_KEY on the emdash host and try again. Detail: ${describeError(err, token)}`
+    );
+  }
+}
+function describeError(err, secret) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return secret.length === 0 ? raw : raw.split(secret).join("[redacted]");
+}
+function recordContentCoverage(ctx, documents) {
+  const counts = { documents: documents.length, complete: 0, partial: 0, unavailable: 0 };
+  for (const document of documents) {
+    if (document.body === void 0 || document.body_capabilities?.length === 0) counts.unavailable++;
+    else if (document.body_capabilities === void 0 || ["text", "headings", "paragraphs", "links"].every(
+      (capability) => document.body_capabilities?.includes(capability)
+    )) counts.complete++;
+    else counts.partial++;
+  }
+  try {
+    ctx.log?.info?.("aexeo.content_coverage", counts);
+  } catch {
+  }
+}
+async function handleAfterDelete(event, ctx) {
+  for (const entry of await ctx.kv.list("document:")) {
+    const stored = toStoredDocument(entry.value);
+    if (stored !== null && stored.meta.id === event.id && stored.meta.collection === event.collection) {
+      await ctx.kv.delete(entry.key);
+      await ctx.kv.delete(findingsKey(stored.document.route));
+    }
+  }
+}
+async function readSandboxBlockMappings(ctx) {
+  if (!ctx.settings) return void 0;
+  try {
+    const raw = await ctx.settings.get(SETTINGS_BLOCK_MAPPINGS_KEY);
+    if (raw === null || raw === "") return void 0;
+    if (typeof raw !== "string" || raw.length > 65536) throw new Error("invalid mapping size or type");
+    const value = JSON.parse(raw);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("mapping must be an object");
+    return value;
+  } catch {
+    ctx.log?.warn?.("Aexeo custom block mappings unavailable; custom content remains unverified");
+    return void 0;
+  }
+}
+async function readSandboxContentFields(ctx) {
+  if (!ctx.settings) return void 0;
+  try {
+    const raw = await ctx.settings.get(SETTINGS_CONTENT_FIELDS_KEY);
+    if (raw === null || raw === "") return void 0;
+    if (typeof raw !== "string" || raw.length > 65536) throw new Error("invalid selection size or type");
+    const value = JSON.parse(raw);
+    if (value === null || typeof value !== "object" || Array.isArray(value) || !Object.values(value).every((fields) => Array.isArray(fields) && fields.length > 0 && fields.every((field) => typeof field === "string" && field.length > 0))) throw new Error("invalid selection");
+    return value;
+  } catch {
+    ctx.log?.warn?.("Aexeo content field selection unavailable; multiple fields remain unverified");
+    return void 0;
+  }
 }
 async function handleAfterSave(event, ctx) {
-  const runtime = await readSidecarConfig(ctx.kv);
+  const runtime = await readSidecarConfig(ctx);
   if (runtime === null) {
     ctx.log?.warn?.(
       "Aexeo afterSave skipped: configure the evaluator URL and token on the Setup page"
     );
     return;
   }
+  const [blockMappings, fields] = await Promise.all([readSandboxBlockMappings(ctx), readSandboxContentFields(ctx)]);
   await handleAfterSaveConfigured(
     event,
     ctx,
-    (documents) => evaluateViaSidecar(
+    (documents, context) => evaluateViaSidecar(
       ctx.http,
-      { url: runtime.url, authToken: runtime.token },
-      documents
-    )
+      { url: runtime.url, authToken: runtime.token, log: ctx.log },
+      documents,
+      context?.collections
+    ),
+    void 0,
+    blockMappings,
+    fields?.[event.content.type]
   );
 }
-async function handleAfterSaveConfigured(event, ctx, evaluator, suppressionFilter) {
+var SITE_GRAPH_RULE_IDS = /* @__PURE__ */ new Set([
+  "LNK001",
+  // internal link target missing from the site
+  "LNK002",
+  // no inbound links
+  "LNK003",
+  // weak anchor, checked only when the target route exists
+  "LNK004",
+  // too few inbound links
+  "SEO009",
+  // hreflang alternate target missing from the site
+  "SEO012",
+  // hreflang alternate does not link back
+  "SEO016",
+  // canonical points at another crawlable route
+  "SEO017",
+  // title and description shared with another route
+  "CNT005"
+  // visible text duplicated on another route
+]);
+async function handleAfterSaveConfigured(event, ctx, evaluator, suppressionFilter, blockMappings, contentFields) {
   const adapted = await adaptContentItemWithContext(
     event.content,
     ctx.content,
-    ctx.site?.locale
+    ctx.site?.locale,
+    blockMappings,
+    contentFields
   );
   const document = adapted.document;
+  recordContentCoverage(ctx, [document]);
   const { kv, log } = ctx;
   const stored = { document, meta: adapted.meta };
-  await persistDocument(ctx, stored);
-  const result = await evaluator([document]);
+  if (!await persistDocument(ctx, stored)) {
+    log?.info?.(`Aexeo afterSave skipped: ${document.route} has a newer save`);
+    return;
+  }
+  const result = await evaluator([document], { collections: [adapted.meta.collection] });
   if (!result.ok) {
     log?.error?.(`afterSave evaluator failure (${result.reason})`, {
       detail: result.detail
     });
     return;
   }
-  const pageFindings = result.findings.filter(
-    (finding) => finding.scope === "page"
+  const storedGraphFindings = (await readFindings(kv, document.route)).filter(
+    (finding) => SITE_GRAPH_RULE_IDS.has(finding.rule_id)
   );
+  const pageFindings = [
+    ...result.findings.filter(
+      (finding) => finding.scope === "page" && !SITE_GRAPH_RULE_IDS.has(finding.rule_id)
+    ),
+    ...storedGraphFindings
+  ];
   const filtered = suppressionFilter === void 0 ? pageFindings : suppressionFilter.apply(
     {
       route: document.route,
@@ -318,6 +576,10 @@ async function handleAfterSaveConfigured(event, ctx, evaluator, suppressionFilte
     },
     pageFindings
   );
+  if (await isSuperseded(kv, document.route, adapted.meta.updatedAt)) {
+    log?.info?.(`Aexeo afterSave discarded: ${document.route} changed while evaluating`);
+    return;
+  }
   await kv.set(findingsKey(document.route), {
     route: document.route,
     findings: filtered
@@ -334,7 +596,9 @@ async function evaluateAndPersistAll(ctx, options) {
     totalFindings: 0,
     errors: []
   };
+  const storedAtStart = await readAllStoredDocuments(kv);
   const documents = [];
+  const documentCollections = [];
   const adaptedByRoute = /* @__PURE__ */ new Map();
   const documentRoutes = /* @__PURE__ */ new Set();
   for (const collection of collections) {
@@ -349,9 +613,12 @@ async function evaluateAndPersistAll(ctx, options) {
           const adapted = await adaptContentItemWithContext(
             item,
             ctx.content,
-            ctx.site?.locale
+            ctx.site?.locale,
+            options.blockMappings,
+            options.contentFieldsByCollection?.[collection]
           );
           documents.push(adapted.document);
+          documentCollections.push(adapted.meta.collection);
           documentRoutes.add(adapted.document.route);
           adaptedByRoute.set(adapted.document.route, {
             document: adapted.document,
@@ -367,10 +634,14 @@ async function evaluateAndPersistAll(ctx, options) {
     } while (cursor !== void 0);
   }
   summary.documentsScanned = documents.length;
+  recordContentCoverage(ctx, documents);
   for (const stored of adaptedByRoute.values()) {
-    await kv.set(documentKey(stored.document.route), stored);
+    const current = await readStoredDocument(kv, stored.document.route);
+    if (!isOlderRevision(stored.meta.updatedAt, current?.meta.updatedAt)) {
+      await kv.set(documentKey(stored.document.route), stored);
+    }
   }
-  const result = await options.evaluator(documents);
+  const result = await options.evaluator(documents, { collections: documentCollections });
   if (!result.ok) {
     log?.error?.(`aexeo evaluator failure (${result.reason})`, {
       detail: result.detail
@@ -378,19 +649,22 @@ async function evaluateAndPersistAll(ctx, options) {
     summary.errors.push(`${result.reason}: ${result.detail}`);
     return summary;
   }
-  const findingsByRoute2 = /* @__PURE__ */ new Map();
+  const findingsByRoute = /* @__PURE__ */ new Map();
   for (const route of documentRoutes) {
-    findingsByRoute2.set(route, []);
+    findingsByRoute.set(route, []);
   }
   for (const finding of result.findings) {
     const bucket = finding.scope === "page" ? finding.path : "*";
-    const list = findingsByRoute2.get(bucket) ?? [];
+    const list = findingsByRoute.get(bucket) ?? [];
     list.push(finding);
-    findingsByRoute2.set(bucket, list);
+    findingsByRoute.set(bucket, list);
   }
   let totalAfterSuppression = 0;
-  for (const [route, findings] of findingsByRoute2) {
+  for (const [route, findings] of findingsByRoute) {
     const stored = adaptedByRoute.get(route);
+    if (stored !== void 0 && await isSuperseded(kv, route, stored.meta.updatedAt)) {
+      continue;
+    }
     const context = {
       route,
       ...stored?.meta.collection === void 0 ? {} : { collection: stored.meta.collection },
@@ -403,29 +677,52 @@ async function evaluateAndPersistAll(ctx, options) {
   }
   summary.totalFindings = totalAfterSuppression;
   if (summary.errors.length === 0) {
-    await removeStaleDocuments(ctx, collections, documentRoutes);
+    await removeStaleDocuments(ctx, collections, documentRoutes, storedAtStart);
   }
   return summary;
 }
+function isOlderRevision(revision, other) {
+  if (revision === void 0 || other === void 0) return false;
+  return Date.parse(revision) < Date.parse(other);
+}
+async function readStoredDocument(kv, route) {
+  return toStoredDocument(await kv.get(documentKey(route)));
+}
+async function isSuperseded(kv, route, revision) {
+  const current = await readStoredDocument(kv, route);
+  return current === null || isOlderRevision(revision, current.meta.updatedAt);
+}
 async function persistDocument(ctx, stored) {
   const route = stored.document.route;
-  const entries = await ctx.kv.list("document:");
-  for (const entry of entries) {
+  const sameEntry = (await ctx.kv.list("document:")).flatMap((entry) => {
     const previous = toStoredDocument(entry.value);
-    if (previous === null || previous.document.route === route || previous.meta.id !== stored.meta.id || previous.meta.collection !== stored.meta.collection) {
-      continue;
-    }
-    await ctx.kv.delete(entry.key);
+    return previous !== null && previous.meta.id === stored.meta.id && previous.meta.collection === stored.meta.collection ? [{ key: entry.key, previous }] : [];
+  });
+  if (sameEntry.some(
+    ({ previous }) => isOlderRevision(stored.meta.updatedAt, previous.meta.updatedAt)
+  )) {
+    return false;
+  }
+  for (const { key, previous } of sameEntry) {
+    if (previous.document.route === route) continue;
+    await ctx.kv.delete(key);
     await ctx.kv.delete(findingsKey(previous.document.route));
   }
   await ctx.kv.set(documentKey(route), stored);
+  return true;
 }
-async function removeStaleDocuments(ctx, collections, currentRoutes) {
+async function removeStaleDocuments(ctx, collections, currentRoutes, storedAtStart) {
   const scannedCollections = new Set(collections);
+  const revisionAtStart = new Map(
+    storedAtStart.map((stored) => [
+      stored.document.route,
+      stored.meta.updatedAt
+    ])
+  );
   const entries = await ctx.kv.list("document:");
   for (const entry of entries) {
     const stored = toStoredDocument(entry.value);
-    if (stored === null || !scannedCollections.has(stored.meta.collection) || currentRoutes.has(stored.document.route)) {
+    if (stored === null || stored.meta.collection !== "" && !scannedCollections.has(stored.meta.collection) || currentRoutes.has(stored.document.route) || !revisionAtStart.has(stored.document.route) || revisionAtStart.get(stored.document.route) !== stored.meta.updatedAt) {
       continue;
     }
     await ctx.kv.delete(entry.key);
@@ -481,174 +778,111 @@ async function readFindings(kv, route) {
   return stored.findings;
 }
 
-// src/evaluator-sandbox.ts
-async function evaluate(_documents) {
-  return [];
-}
-async function scoreSite(_documents) {
-  return {
-    overall_score: 0,
-    citation_readiness_score: 0,
-    truth_consistency_score: 0,
-    answer_pack_score: 0,
-    external_trust_alignment_score: null,
-    route_scores: [],
-    blockers: []
-  };
-}
-function errorFindings(findings) {
-  return findings.filter((finding) => finding.severity === "error");
-}
-function findingsByRoute(findings) {
-  const grouped = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const bucket = grouped.get(finding.path);
-    if (bucket) {
-      bucket.push(finding);
-    } else {
-      grouped.set(finding.path, [finding]);
-    }
+// src/sidecar-url.ts
+function validateSidecarUrl(raw, allowedHosts = []) {
+  const url = raw.trim();
+  if (url.length === 0) {
+    return { ok: false, error: "Sidecar URL is required." };
   }
-  return grouped;
-}
-
-// src/indexnow.ts
-var INDEXNOW_ENDPOINT = "https://api.indexnow.org/indexnow";
-async function submitIndexNow(config, urls) {
-  const host = hostOf(config.siteUrl);
-  if (host === null) {
-    return failure("siteUrl is not a valid URL", []);
-  }
-  const keyLocation = config.keyLocation ?? defaultKeyLocation(config);
-  const { submitted, rejected } = partitionByHost(urls, host);
-  if (submitted.length === 0) {
-    return failure("no submittable URLs after host check", rejected);
-  }
-  const payload = {
-    host,
-    key: config.key,
-    keyLocation,
-    urlList: submitted
-  };
-  const response = await fetch(INDEXNOW_ENDPOINT, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(payload)
-  });
-  return {
-    ok: response.ok,
-    status: response.status,
-    endpoint: INDEXNOW_ENDPOINT,
-    submitted,
-    rejected
-  };
-}
-function hostOf(rawUrl) {
+  let parsed;
   try {
-    return new URL(rawUrl).host;
+    parsed = new URL(url);
   } catch {
-    return null;
+    return { ok: false, error: `Sidecar URL is not a valid URL: ${url}` };
   }
+  if (parsed.protocol !== "https:") {
+    return {
+      ok: false,
+      error: `Sidecar URL must be https: \u2014 the EVAL_TOKEN is sent as a bearer header and must never travel in cleartext. Got ${parsed.protocol}`
+    };
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (host.endsWith(".")) {
+    return {
+      ok: false,
+      error: `Sidecar URL host must not end with a dot: ${host}`
+    };
+  }
+  if (isBlockedHost(host)) {
+    return {
+      ok: false,
+      error: "Sidecar URL must not point at a loopback, private, or link-local address. Use the deployed *.workers.dev URL."
+    };
+  }
+  if (allowedHosts.length > 0 && !hostMatchesAllowlist(host, allowedHosts)) {
+    return {
+      ok: false,
+      error: `Sidecar host "${host}" is not in this plugin's outbound allowlist (${allowedHosts.join(", ")}). The emdash sandbox would reject the fetch with "Host not allowed" \u2014 update evaluatorHost in astro.config and rebuild, or use that host.`
+    };
+  }
+  return { ok: true, url };
 }
-function defaultKeyLocation(config) {
-  const siteUrl = config.siteUrl.endsWith("/") ? config.siteUrl.slice(0, -1) : config.siteUrl;
-  return `${siteUrl}/${config.key}.txt`;
-}
-function partitionByHost(urls, expectedHost) {
-  const submitted = [];
-  const rejected = [];
-  for (const candidate of urls) {
-    const host = hostOf(candidate);
-    if (host === expectedHost) {
-      submitted.push(candidate);
-    } else {
-      rejected.push(candidate);
-    }
+function isBlockedHost(host) {
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    return true;
+  }
+  if (host.startsWith("[")) {
+    return isBlockedIpv6(host);
   }
-  return { submitted, rejected };
+  return isBlockedIpv4(host);
 }
-function failure(reason, rejected) {
-  return {
-    ok: false,
-    status: 0,
-    endpoint: INDEXNOW_ENDPOINT,
-    submitted: [],
-    rejected,
-    reason
-  };
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (match === null) {
+    return false;
+  }
+  const first = Number(match[1]);
+  const second = Number(match[2]);
+  if (first === 0) return true;
+  if (first === 127) return true;
+  if (first === 10) return true;
+  if (first === 172 && second >= 16 && second <= 31) return true;
+  if (first === 192 && second === 168) return true;
+  if (first === 169 && second === 254) return true;
+  if (first === 100 && second >= 64 && second <= 127) return true;
+  if (first >= 224) return true;
+  return false;
 }
-
-// src/mcp.ts
-var checkTool = {
-  name: "aexeo.check",
-  description: "Evaluate a list of EmdashDocument values against the Aexeo rule engine and return the stable Finding contract. Mirrors the CLI's `aexeo-cli check` surface so agents, the admin UI, and the CI gate all see the same rule ids.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      documents: {
-        type: "array",
-        description: "Array of EmdashDocument values to evaluate. Each entry carries route, title, optional description/canonical/lang, alternates, meta map, schema, and Portable Text body."
-      },
-      configJson: {
-        type: "string",
-        description: "Optional JSON-serialized Aexeo config. When absent the evaluator uses Config::default(), matching a cold CLI run."
-      }
-    },
-    required: ["documents"]
-  },
-  handler: async ({ documents, configJson }) => {
-    const options = configJson === void 0 ? {} : { configJson };
-    const findings = await evaluate(documents, options);
-    const errors = errorFindings(findings);
-    const grouped = findingsByRoute(findings);
-    const byRoute = {};
-    for (const [route, items] of grouped.entries()) {
-      byRoute[route] = items;
-    }
-    return {
-      findings,
-      errors,
-      byRoute,
-      totals: {
-        findings: findings.length,
-        errors: errors.length,
-        warnings: findings.length - errors.length
-      }
-    };
+function isBlockedIpv6(host) {
+  const inner = host.slice(1, -1).toLowerCase();
+  if (inner === "::" || inner === "::1") {
+    return true;
   }
-};
-var indexNowSubmitTool = {
-  name: "aexeo.indexnow.submit",
-  description: "Submit a list of URLs to the IndexNow freshness endpoint. Mirrors the aexeo-cli `indexnow submit` contract: the IndexNow protocol requires every submitted URL to belong to the configured site host. URLs that do not match the host are returned in `rejected` and never sent over the wire.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      config: {
-        type: "object",
-        description: "IndexNow configuration: siteUrl, key, and optional keyLocation override.",
-        properties: {
-          siteUrl: { type: "string" },
-          key: { type: "string" },
-          keyLocation: { type: "string" }
-        },
-        required: ["siteUrl", "key"]
-      },
-      urls: {
-        type: "array",
-        items: { type: "string" },
-        description: "Absolute URLs to submit. Must share siteUrl's host."
-      }
-    },
-    required: ["config", "urls"]
-  },
-  handler: async ({ config, urls }) => submitIndexNow(config, urls)
-};
-var tools = [checkTool, indexNowSubmitTool];
+  if (inner.startsWith("::ffff:") || inner.startsWith("::7f")) {
+    return true;
+  }
+  const firstHextet = Number.parseInt(inner.split(":")[0] ?? "", 16);
+  if (Number.isNaN(firstHextet)) {
+    return false;
+  }
+  if ((firstHextet & 65024) === 64512) {
+    return true;
+  }
+  if ((firstHextet & 65472) === 65152) {
+    return true;
+  }
+  return false;
+}
+function hostMatchesAllowlist(host, allowedHosts) {
+  return allowedHosts.some((allowed) => {
+    const entry = allowed.trim().toLowerCase();
+    if (entry.length === 0) {
+      return false;
+    }
+    if (entry.startsWith("*.")) {
+      const suffix = entry.slice(1);
+      return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === entry;
+  });
+}
 
-// src/sandbox-entry.ts
-function definePlugin(plugin) {
-  return plugin;
+// src/evaluator-sandbox.ts
+async function scoreSite(_documents) {
+  return null;
 }
+
+// src/findings-view.ts
 function normalizeInteraction(input) {
   if (!input || typeof input !== "object") {
     return { type: "page_load", page: "/findings" };
@@ -678,107 +912,33 @@ function normalizeInteraction(input) {
   }
   return { type: "page_load", page: "/findings" };
 }
-async function handleAdminRoute(input, ctx) {
-  const body = normalizeInteraction(input?.input);
-  ctx.log?.info?.(
-    `aexeo route: type=${body.type} page=${body.type === "page_load" ? body.page : ""}`
-  );
-  const dispatch = { body, kv: ctx.kv, ctx };
-  if (body.type === "page_load") {
-    return handlePageLoad(dispatch, body.page);
-  }
-  if (body.type === "block_action") {
-    return handleBlockAction(
-      dispatch,
-      body.action_id,
-      body.value
-    );
-  }
-  if (body.type === "form_submit") {
-    return handleFormSubmit(
-      dispatch,
-      body.action_id,
-      body.values
-    );
-  }
-  return handlePageLoad(dispatch, "findings");
-}
-async function handleFormSubmit(ctx, actionId, values) {
-  if (actionId === "save_setup") {
-    return handleSetupSubmit(ctx, values);
-  }
-  if (actionId === "view_document") {
-    const picked = values["route_picker"];
-    if (typeof picked === "string" && picked.length > 0) {
-      return renderDocumentPanel(ctx, picked);
-    }
-  }
-  return handlePageLoad(ctx, "findings");
-}
-async function handlePageLoad(ctx, page) {
-  const normalized = page.startsWith("/") ? page.slice(1) : page;
-  if (normalized === "findings") {
-    return renderFindingsPage(ctx);
-  }
-  if (normalized === "widget:aexeo-score") {
-    return renderScoreWidget(ctx);
-  }
-  if (normalized === "document") {
-    return renderDocumentPanel(ctx);
-  }
-  if (normalized === "setup") {
-    return renderSetupPage(ctx);
-  }
-  return notFound(page);
-}
-async function handleBlockAction(ctx, actionId, value) {
-  if (actionId === "view_document" && typeof value === "string") {
-    return renderDocumentPanel(ctx, value);
-  }
-  if (actionId === "refresh_findings") {
-    return handleRefresh(ctx);
-  }
-  if (actionId.startsWith("filter:")) {
-    return renderFindingsPage(ctx);
-  }
-  return notFound(actionId);
-}
-async function handleRefresh(ctx) {
-  const sandboxEvaluator = async (documents) => {
-    const runtime = await readSidecarConfig(ctx.kv);
-    if (runtime === null) {
-      return {
-        ok: false,
-        reason: "config_missing",
-        detail: "sidecar not configured \u2014 open the Aexeo Setup page and enter your evaluator URL and token"
-      };
-    }
-    return evaluateViaSidecar(
-      ctx.ctx.http,
-      { url: runtime.url, authToken: runtime.token },
-      documents
-    );
-  };
+async function handleRefresh(options) {
   let summary;
   try {
-    summary = await evaluateAndPersistAll(ctx.ctx, {
-      evaluator: sandboxEvaluator
+    summary = await evaluateAndPersistAll(options.ctx, {
+      collections: options.collections,
+      evaluator: options.evaluator,
+      blockMappings: options.blockMappings,
+      contentFieldsByCollection: options.contentFieldsByCollection,
+      // Always forwarded. See RefreshOptions.suppressionFilter.
+      suppressionFilter: options.suppressionFilter
     });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
+    const message = `Refresh failed: ${detail}`;
     return {
       blocks: [
         { type: "header", text: "SEO findings" },
         {
           type: "banner",
-          title: `Refresh failed: ${detail}`,
-          variant: "alert"
+          title: message,
+          variant: options.tuning.refreshFailureVariant
         }
       ],
-      toast: { message: `Refresh failed: ${detail}`, type: "error" }
+      toast: { message, type: "error" }
     };
   }
-  const refreshed = await renderFindingsPage(ctx);
+  const refreshed = await renderFindingsPage(options.ctx.kv, options.tuning);
   const toastMessage = summary.errors.length === 0 ? `Refreshed ${summary.routesUpdated} routes (${summary.totalFindings} findings across ${summary.documentsScanned} documents)` : `Refresh completed with ${summary.errors.length} errors \u2014 see banner`;
   if (summary.errors.length > 0) {
     refreshed.blocks.unshift({
@@ -795,10 +955,43 @@ async function handleRefresh(ctx) {
     }
   };
 }
-async function renderFindingsPage(ctx) {
-  const findings = await readAllFindings(ctx.kv);
+async function readAllFindings(kv) {
+  const entries = await kv.list(
+    "findings:"
+  );
+  const out = [];
+  for (const entry of entries) {
+    if (entry.value === null) {
+      continue;
+    }
+    const route = entry.key.replace(/^findings:/, "");
+    for (const finding of entry.value.findings) {
+      out.push({ ...finding, document_route: route });
+    }
+  }
+  return out;
+}
+function severityFirst(a, b) {
+  const rank = (severity) => severity === "error" ? 0 : 1;
+  const diff = rank(a.severity) - rank(b.severity);
+  if (diff !== 0) {
+    return diff;
+  }
+  return a.rule_id.localeCompare(b.rule_id);
+}
+function uniqueRoutes(rows) {
+  const routes = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    routes.add(row.document_route);
+  }
+  return [...routes].sort();
+}
+async function renderFindingsPage(kv, tuning) {
+  const findings = await readAllFindings(kv);
   const errors = findings.filter((finding) => finding.severity === "error");
-  const warnings = findings.filter((finding) => finding.severity === "warning");
+  const warnings = findings.filter(
+    (finding) => finding.severity === "warning"
+  );
   const sorted = [...findings].sort(severityFirst);
   const routes = uniqueRoutes(findings);
   const blocks = [
@@ -812,8 +1005,8 @@ async function renderFindingsPage(ctx) {
       type: "actions",
       elements: [
         // Refresh evaluates every configured entry. Pressing it lists
-        // content via the live in-request bridge,
-        // calls the sidecar /evaluate, and writes findings back to KV.
+        // content via the live in-request bridge, evaluates it, and
+        // writes findings back to KV (with suppressions applied).
         {
           type: "button",
           label: "Refresh",
@@ -831,7 +1024,7 @@ async function renderFindingsPage(ctx) {
     },
     sorted.length === 0 ? {
       type: "context",
-      text: "Once a document publishes, its rule findings list here."
+      text: tuning.emptyFindingsText
     } : findingsTable(sorted)
   ];
   if (routes.length > 0) {
@@ -850,37 +1043,6 @@ async function renderFindingsPage(ctx) {
   }
   return { blocks };
 }
-async function readAllFindings(kv) {
-  const entries = await kv.list(
-    "findings:"
-  );
-  const out = [];
-  for (const entry of entries) {
-    if (entry.value === null) {
-      continue;
-    }
-    const route = entry.key.replace(/^findings:/, "");
-    for (const finding of entry.value.findings) {
-      out.push({ ...finding, document_route: route });
-    }
-  }
-  return out;
-}
-function uniqueRoutes(rows) {
-  const routes = /* @__PURE__ */ new Set();
-  for (const row of rows) {
-    routes.add(row.document_route);
-  }
-  return [...routes].sort();
-}
-function severityFirst(a, b) {
-  const rank = (severity) => severity === "error" ? 0 : 1;
-  const diff = rank(a.severity) - rank(b.severity);
-  if (diff !== 0) {
-    return diff;
-  }
-  return a.rule_id.localeCompare(b.rule_id);
-}
 function findingsTable(rows) {
   return {
     type: "table",
@@ -898,50 +1060,61 @@ function findingsTable(rows) {
     }))
   };
 }
-async function renderScoreWidget(ctx) {
-  const documents = await readAllDocuments(ctx.kv);
+async function renderScoreWidget(kv, tuning, log) {
+  const documents = await readAllDocuments(kv);
   if (documents.length === 0) {
     return {
       blocks: [
         { type: "header", text: "SEO score" },
         {
           type: "context",
-          text: "No documents saved yet \u2014 score appears after the first emdash save."
+          text: tuning.emptyScoreText
+        }
+      ]
+    };
+  }
+  let score;
+  try {
+    score = await tuning.score(documents, kv);
+  } catch (error) {
+    log?.error("Aexeo score widget failed to initialize", { error });
+    return {
+      blocks: [
+        { type: "banner", title: "SEO score is temporarily unavailable", variant: "alert" },
+        { type: "context", text: "The authoring interface remains available. Retry after the evaluator runtime has been checked." }
+      ]
+    };
+  }
+  if (score === null) {
+    return {
+      blocks: [
+        { type: "header", text: "SEO score" },
+        {
+          type: "context",
+          text: "The site score is unavailable in sandboxed mode. Findings are not affected."
         }
       ]
     };
   }
-  const score = await scoreSite(documents);
   const blocks = [
     {
       type: "stats",
       items: [
-        {
-          label: "Overall",
-          value: `${score.overall_score}`
-        },
         {
           label: "Citation",
-          value: `${score.citation_readiness_score}`
+          value: score.citation_readiness_score?.toString() ?? "unknown"
         },
         {
-          label: "Truth",
-          value: `${score.truth_consistency_score}`
+          label: tuning.truthLabel(score),
+          value: score.truth_consistency_score?.toString() ?? "unknown"
         },
         {
           label: "Answers",
-          value: `${score.answer_pack_score}`
+          value: `${score.answer_pack.routes_with_answer_blocks}/${score.answer_pack.routes_analyzed} routes`
         }
       ]
     }
   ];
-  if (score.overall_score < 60) {
-    blocks.unshift({
-      type: "banner",
-      title: `Site score is ${score.overall_score} \u2014 below the 60 quality threshold`,
-      variant: "alert"
-    });
-  }
   if (score.blockers.length > 0) {
     blocks.push({
       type: "context",
@@ -957,7 +1130,7 @@ function topBlockersLine(score) {
   }
   return `Top blockers: ${top.join(" \u2022 ")}`;
 }
-async function renderDocumentPanel(ctx, route) {
+async function renderDocumentPanel(kv, route) {
   if (route === void 0) {
     return {
       blocks: [
@@ -969,9 +1142,11 @@ async function renderDocumentPanel(ctx, route) {
       ]
     };
   }
-  const findings = await readFindings(ctx.kv, route);
+  const findings = await readFindings(kv, route);
   const errors = findings.filter((finding) => finding.severity === "error");
-  const warnings = findings.filter((finding) => finding.severity === "warning");
+  const warnings = findings.filter(
+    (finding) => finding.severity === "warning"
+  );
   const sorted = [...findings].sort(severityFirst);
   return {
     blocks: [
@@ -1004,15 +1179,198 @@ function documentFindingsTable(findings) {
     }))
   };
 }
+function notFound(page) {
+  return {
+    blocks: [
+      { type: "header", text: "Not found" },
+      { type: "context", text: `unknown page: ${page}` }
+    ]
+  };
+}
+
+// src/suppressions.ts
+var NOOP_FILTER = {
+  apply: (_context, findings) => [...findings]
+};
+function compileSuppressions(rules) {
+  if (rules === void 0 || rules.length === 0) {
+    return NOOP_FILTER;
+  }
+  rules.forEach((rule, index) => {
+    const hasRoute = rule.routePattern !== void 0 && rule.routePattern.length > 0;
+    const hasRuleIds = rule.ruleIds !== void 0 && rule.ruleIds.length > 0;
+    const hasCollections = rule.collections !== void 0 && rule.collections.length > 0;
+    const hasStatuses = rule.statuses !== void 0 && rule.statuses.length > 0;
+    if (!hasRoute && !hasRuleIds && !hasCollections && !hasStatuses) {
+      throw new Error(
+        `aexeoPlugin: suppressions[${index}] is empty \u2014 set at least one of routePattern, ruleIds, collections, statuses`
+      );
+    }
+  });
+  const compiled = rules.map((rule) => ({
+    matchRoute: rule.routePattern === void 0 ? matchAlways : globToMatcher(rule.routePattern),
+    ruleIds: rule.ruleIds === void 0 || rule.ruleIds.length === 0 ? null : new Set(rule.ruleIds),
+    collections: rule.collections === void 0 || rule.collections.length === 0 ? null : new Set(rule.collections),
+    statuses: rule.statuses === void 0 || rule.statuses.length === 0 ? null : new Set(rule.statuses)
+  }));
+  return {
+    apply(context, findings) {
+      return findings.filter(
+        (finding) => !compiled.some((rule) => {
+          if (!rule.matchRoute(context.route)) return false;
+          if (rule.ruleIds !== null && !rule.ruleIds.has(finding.rule_id)) {
+            return false;
+          }
+          if (rule.collections !== null) {
+            if (context.collection === void 0 || !rule.collections.has(context.collection)) {
+              return false;
+            }
+          }
+          if (rule.statuses !== null) {
+            if (context.status === void 0 || !rule.statuses.has(context.status)) {
+              return false;
+            }
+          }
+          return true;
+        })
+      );
+    }
+  };
+}
+var matchAlways = () => true;
+function globToMatcher(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const DOUBLE_STAR_TOKEN = "
";
+  const body = escaped.replace(/\*\*/g, DOUBLE_STAR_TOKEN).replace(/\*/g, "[^/]*").replace(new RegExp(DOUBLE_STAR_TOKEN, "g"), ".*").replace(/\?/g, "[^/]");
+  const re = new RegExp(`^${body}$`);
+  return (route) => re.test(route);
+}
+
+// src/sandbox-entry.ts
+function definePlugin(plugin) {
+  return plugin;
+}
+var sandboxSuppressionFilter = compileSuppressions(
+  void 0
+);
+var adminViewTuning = {
+  emptyFindingsText: "Once a document publishes, its rule findings list here.",
+  emptyScoreText: "No documents saved yet \u2014 score appears after the first emdash save.",
+  refreshFailureVariant: "alert",
+  score: async (documents) => scoreSite(documents),
+  truthLabel: () => "Truth"
+};
+async function handleAdminRoute(input, ctx) {
+  const body = normalizeInteraction(input?.input);
+  ctx.log?.info?.(
+    `aexeo route: type=${body.type} page=${body.type === "page_load" ? body.page : ""}`
+  );
+  const dispatch = { body, kv: ctx.kv, ctx };
+  if (body.type === "page_load") {
+    return handlePageLoad(dispatch, body.page);
+  }
+  if (body.type === "block_action") {
+    return handleBlockAction(
+      dispatch,
+      body.action_id,
+      body.value
+    );
+  }
+  if (body.type === "form_submit") {
+    return handleFormSubmit(
+      dispatch,
+      body.action_id,
+      body.values
+    );
+  }
+  return handlePageLoad(dispatch, "findings");
+}
+async function handleFormSubmit(ctx, actionId, values) {
+  if (actionId === "save_setup") {
+    return handleSetupSubmit(ctx, values);
+  }
+  if (actionId === "view_document") {
+    const picked = values["route_picker"];
+    if (typeof picked === "string" && picked.length > 0) {
+      return renderDocumentPanel(ctx.kv, picked);
+    }
+  }
+  return handlePageLoad(ctx, "findings");
+}
+async function handlePageLoad(ctx, page) {
+  const normalized = page.startsWith("/") ? page.slice(1) : page;
+  if (normalized === "findings") {
+    return renderFindingsPage(ctx.kv, adminViewTuning);
+  }
+  if (normalized === "widget:aexeo-score") {
+    return renderScoreWidget(ctx.kv, adminViewTuning);
+  }
+  if (normalized === "document") {
+    return renderDocumentPanel(ctx.kv);
+  }
+  if (normalized === "setup") {
+    return renderSetupPage(ctx);
+  }
+  return notFound(page);
+}
+async function handleBlockAction(ctx, actionId, value) {
+  if (actionId === "view_document" && typeof value === "string") {
+    return renderDocumentPanel(ctx.kv, value);
+  }
+  if (actionId === "refresh_findings") {
+    return handleRefresh2(ctx);
+  }
+  if (actionId.startsWith("filter:")) {
+    return renderFindingsPage(ctx.kv, adminViewTuning);
+  }
+  return notFound(actionId);
+}
+async function handleRefresh2(ctx) {
+  const sandboxEvaluator = async (documents, context) => {
+    const runtime = await readSidecarConfig(ctx.ctx);
+    if (runtime === null) {
+      return {
+        ok: false,
+        reason: "config_missing",
+        detail: "sidecar not configured \u2014 open the Aexeo Setup page and enter your evaluator URL and token"
+      };
+    }
+    return evaluateViaSidecar(
+      ctx.ctx.http,
+      { url: runtime.url, authToken: runtime.token, log: ctx.ctx.log },
+      documents,
+      context?.collections
+    );
+  };
+  return handleRefresh({
+    ctx: ctx.ctx,
+    // The sandboxed descriptor takes no collection knobs, so the sweep
+    // always covers the default set.
+    collections: DEFAULT_COLLECTIONS,
+    evaluator: sandboxEvaluator,
+    suppressionFilter: sandboxSuppressionFilter,
+    blockMappings: await readSandboxBlockMappings(ctx.ctx),
+    contentFieldsByCollection: await readSandboxContentFields(ctx.ctx),
+    tuning: adminViewTuning
+  });
+}
 async function renderSetupPage(ctx, options = {}) {
-  const existing = await readSidecarConfig(ctx.kv);
+  const existing = await readSidecarConfig(ctx.ctx);
+  const tokenInPlaintext = await isTokenStoredInPlaintext(ctx.ctx);
   const blocks = [
     { type: "header", text: "Aexeo setup" },
     {
       type: "context",
-      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. These are stored in plugin KV and read at runtime \u2014 no rebuild required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
+      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. Saving stores the token encrypted by the emdash host, and fails if the host cannot encrypt it. Both values are read at runtime, so no rebuild is required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
     }
   ];
+  if (tokenInPlaintext) {
+    blocks.push({
+      type: "banner",
+      title: "EVAL_TOKEN is currently stored unencrypted in plugin KV. Save this form to encrypt it.",
+      variant: "alert"
+    });
+  }
   if (options.bannerError !== void 0) {
     blocks.push({
       type: "banner",
@@ -1053,44 +1411,28 @@ async function renderSetupPage(ctx, options = {}) {
     { type: "divider" },
     {
       type: "context",
-      text: existing === null ? "Status: not configured. Refresh on the findings page will fail until both fields are saved." : `Status: configured. Sidecar at ${existing.url}. Token stored \u2014 paste a new one above to rotate.`
+      text: existing === null ? "Status: not configured. Refresh on the findings page will fail until both fields are saved." : `Status: configured. Sidecar at ${existing.url}. Token stored ${tokenInPlaintext ? "unencrypted" : "encrypted"} \u2014 paste a new one above to rotate.`
     }
   );
   return { blocks };
 }
+function runtimeAllowedHosts() {
+  const env = typeof process === "undefined" ? void 0 : process.env;
+  return buildAllowedHosts(env?.["AEXEO_EVALUATOR_HOST"] ?? null);
+}
 async function handleSetupSubmit(ctx, values) {
   const rawUrl = values["evaluator_url"];
   const rawToken = values["eval_token"];
   const url = typeof rawUrl === "string" ? rawUrl.trim() : "";
   const token = typeof rawToken === "string" ? rawToken.trim() : "";
-  if (url.length === 0) {
-    return renderSetupPage(ctx, {
-      bannerError: "Sidecar URL is required.",
-      initialUrl: url
-    });
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return renderSetupPage(ctx, {
-      bannerError: `Sidecar URL is not a valid URL: ${url}`,
-      initialUrl: url
-    });
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    return renderSetupPage(ctx, {
-      bannerError: `Sidecar URL must be http(s): got ${parsed.protocol}`,
-      initialUrl: url
-    });
-  }
-  if (parsed.hostname === "localhost" || parsed.hostname.endsWith(".localhost") || /^127\./.test(parsed.hostname)) {
+  const validated = validateSidecarUrl(url, runtimeAllowedHosts());
+  if (!validated.ok) {
     return renderSetupPage(ctx, {
-      bannerError: "emdash's sandbox blocks fetches to localhost (anti-SSRF). Use the deployed *.workers.dev URL.",
+      bannerError: validated.error,
       initialUrl: url
     });
   }
-  const existing = await readSidecarConfig(ctx.kv);
+  const existing = await readSidecarConfig(ctx.ctx);
   let resolvedToken;
   if (token.length > 0) {
     resolvedToken = token;
@@ -1099,34 +1441,34 @@ async function handleSetupSubmit(ctx, values) {
   } else {
     return renderSetupPage(ctx, {
       bannerError: "EVAL_TOKEN is required on first setup.",
-      initialUrl: url
+      initialUrl: validated.url
+    });
+  }
+  const next = {
+    url: validated.url,
+    token: resolvedToken
+  };
+  try {
+    await writeSidecarConfig(ctx.ctx, next);
+  } catch (err) {
+    if (!(err instanceof TokenStorageError)) throw err;
+    return renderSetupPage(ctx, {
+      bannerError: err.message,
+      initialUrl: validated.url
     });
   }
-  const next = { url, token: resolvedToken };
-  await writeSidecarConfig(ctx.kv, next);
   return renderSetupPage(ctx, {
     bannerSuccess: "Configuration saved. Click Refresh on the findings page to evaluate."
   });
 }
-function notFound(page) {
-  return {
-    blocks: [
-      { type: "header", text: "Not found" },
-      { type: "context", text: `unknown page: ${page}` }
-    ]
-  };
-}
 var sandbox_entry_default = definePlugin({
   hooks: {
-    "content:afterSave": handleAfterSave
+    "content:afterSave": handleAfterSave,
+    "content:afterDelete": handleAfterDelete
   },
   routes: {
     admin: { handler: handleAdminRoute }
-  },
-  // emdash's MCP server picks tools up from this field. The exact
-  // host-side spec for plugin-contributed tools is still being mapped;
-  // the field is harmless if unrecognized.
-  mcpTools: tools
+  }
 });
 export {
   sandbox_entry_default as default