@aeptus/aexeo-emdash 0.8.19 → 0.9.0

package/dist/sandbox-entry.js

@@ -1,11 +1,13 @@
 // src/adapter.ts
-async function adaptContentItemWithContext(content, contentApi, defaultLocale) {
+async function adaptContentItemWithContext(content, contentApi, defaultLocale, blockMappings, contentFields) {
   const publicUrl = content.status === "published" ? await contentApi.getPublicUrl(content.type, content.id) : null;
   const route = publicUrl === null ? deriveRoute(content) : routeFromPublicUrl(publicUrl);
   const adapted = adaptContentItem(content, {
     route,
     publicUrl,
-    ...defaultLocale === void 0 ? {} : { defaultLocale }
+    ...defaultLocale === void 0 ? {} : { defaultLocale },
+    ...blockMappings === void 0 ? {} : { blockMappings },
+    ...contentFields === void 0 ? {} : { contentFields }
   });
   const translationSet = await contentApi.getTranslations(
     content.type,
@@ -47,8 +49,11 @@ function adaptContentItem(content, options = {}) {
   if (typeof locale === "string" && locale.length > 0) {
     document.lang = locale;
   }
-  const body = extractPortableText(content.data);
-  if (body !== null) document.body = body;
+  const body = options.contentFields === void 0 ? extractPortableText(content.data, options.blockMappings) : extractSelectedContent(content.data, options.contentFields, options.blockMappings);
+  if (body !== null) {
+    document.body = body.blocks;
+    if (body.capabilities !== void 0) document.body_capabilities = body.capabilities;
+  }
   return {
     document,
     meta: {
@@ -57,7 +62,8 @@ function adaptContentItem(content, options = {}) {
       slug: content.slug,
       status: content.status,
       title,
-      publicUrl: options.publicUrl ?? null
+      publicUrl: options.publicUrl ?? null,
+      ...content.updatedAt === void 0 ? {} : { updatedAt: content.updatedAt }
     }
   };
 }
@@ -76,24 +82,53 @@ function routeFromPublicUrl(publicUrl) {
 function stringOrEmpty(value) {
   return typeof value === "string" ? value : "";
 }
-function extractPortableText(data) {
+function extractSelectedContent(data, fields, mappings) {
+  if (fields.length === 0 || new Set(fields).size !== fields.length || fields.some((field) => typeof field !== "string" || field.length === 0)) return null;
+  const all = ["text", "headings", "paragraphs", "links"];
+  let capabilities = all;
+  const blocks = [];
+  let observed = false;
+  for (const field of fields) {
+    const value = data[field];
+    if (value === void 0 || value === null) continue;
+    observed = true;
+    const part = extractFirstPortableText({ content: value }, mappings);
+    if (part === null) return { blocks, capabilities: [] };
+    blocks.push(...part.blocks);
+    capabilities = capabilities.filter((capability) => part.capabilities === void 0 || part.capabilities.includes(capability));
+  }
+  if (!observed) return null;
+  return capabilities.length === all.length ? { blocks } : { blocks, capabilities: [...capabilities] };
+}
+function extractPortableText(data, mappings) {
+  const result = extractFirstPortableText(data, mappings);
+  if (result === null) return null;
+  const candidates = Object.entries(data).filter(
+    ([field, value]) => isPortableTextArray(value) || isEmdashBlocksArray(value, field) || (field === "body" || field === "content") && typeof value === "string" && value.trim().length > 0
+  );
+  return candidates.length > 1 ? { blocks: result.blocks, capabilities: [] } : result;
+}
+function extractFirstPortableText(data, mappings) {
+  let foundEmptyBody = false;
   for (const slug of ["body", "content"]) {
     const value = data[slug];
-    if (isPortableTextArray(value)) return value;
-    if (isEmdashBlocksArray(value, slug)) return blocksToPortableText(value);
+    if (Array.isArray(value) && value.length === 0 || typeof value === "string" && value.trim().length === 0) foundEmptyBody = true;
+    if (isPortableTextArray(value)) return { blocks: value };
+    if (isEmdashBlocksArray(value, slug)) return mapCustomBlocks(value, mappings);
     if (typeof value === "string" && value.trim().length > 0) {
-      return [portableTextBlock(value.trim(), `${slug}-text`)];
+      return { blocks: [portableTextBlock(value.trim(), `${slug}-text`)], capabilities: ["text"] };
     }
   }
   const blocks = data["blocks"];
-  if (isPortableTextArray(blocks)) return blocks;
-  if (isEmdashBlocksArray(blocks, "blocks")) return blocksToPortableText(blocks);
+  if (Array.isArray(blocks) && blocks.length === 0) foundEmptyBody = true;
+  if (isPortableTextArray(blocks)) return { blocks };
+  if (isEmdashBlocksArray(blocks, "blocks")) return mapCustomBlocks(blocks, mappings);
   for (const [field, value] of Object.entries(data)) {
     if (field === "body" || field === "content" || field === "blocks") continue;
-    if (isPortableTextArray(value)) return value;
-    if (isEmdashBlocksArray(value, field)) return blocksToPortableText(value);
+    if (isPortableTextArray(value)) return { blocks: value };
+    if (isEmdashBlocksArray(value, field)) return mapCustomBlocks(value, mappings);
   }
-  return null;
+  return foundEmptyBody ? { blocks: [] } : null;
 }
 function isPortableTextArray(value) {
   return Array.isArray(value) && value.length > 0 && value.every(
@@ -108,6 +143,52 @@ function isEmdashBlocksArray(value, field) {
     (item) => isRecord(item) && typeof item["_type"] === "string" && typeof item["_key"] === "string" && (typeof item["_version"] === "number" || field === "blocks")
   );
 }
+function mapCustomBlocks(blocks, mappings) {
+  const unavailable = () => ({ blocks: blocksToPortableText(blocks), capabilities: [] });
+  const result = [];
+  const mapFields = (record, fields, depth) => {
+    if (depth > 8 || fields.length === 0) return false;
+    for (const entry of fields) {
+      if (!entry || typeof entry.field !== "string" || !entry.field || !["heading", "paragraph", "richText", "link", "repeat"].includes(entry.kind)) return false;
+      if (entry.kind === "heading" && entry.level !== void 0 && ![1, 2, 3, 4, 5, 6].includes(entry.level)) return false;
+      if (entry.kind === "link" && (typeof entry.hrefField !== "string" || !entry.hrefField)) return false;
+      if (entry.kind === "repeat" && (!Array.isArray(entry.fields) || entry.fields.length === 0)) return false;
+      const value = record[entry.field];
+      if ((value === void 0 || value === null || value === "") && entry.optional) {
+        if (entry.kind === "link" && record[entry.hrefField] != null && record[entry.hrefField] !== "") return false;
+        continue;
+      }
+      if (entry.kind === "richText") {
+        if (!Array.isArray(value) || value.length > 0 && !isPortableTextArray(value)) return false;
+        result.push(...value);
+      } else if (entry.kind === "heading" || entry.kind === "paragraph") {
+        if (typeof value !== "string") return false;
+        result.push({ ...portableTextBlock(value, ""), style: entry.kind === "heading" ? `h${entry.level ?? 2}` : "normal" });
+      } else if (entry.kind === "link") {
+        const href = record[entry.hrefField];
+        if (typeof value !== "string" || typeof href !== "string" || !href) return false;
+        result.push({
+          _type: "block",
+          children: [{ _type: "span", text: value, marks: ["link"] }],
+          markDefs: [{ _key: "link", _type: "link", href }]
+        });
+      } else if (entry.kind === "repeat") {
+        if (!Array.isArray(value) || !Array.isArray(entry.fields)) return false;
+        for (const item of value) {
+          if (!isRecord(item) || !mapFields(item, entry.fields, depth + 1)) return false;
+        }
+      } else {
+        return false;
+      }
+    }
+    return true;
+  };
+  for (const block of blocks) {
+    const fields = mappings?.[String(block["_type"])];
+    if (!Array.isArray(fields) || !mapFields(block, fields, 0)) return unavailable();
+  }
+  return { blocks: result };
+}
 function blocksToPortableText(blocks) {
   const paragraphs = [];
   for (const block of blocks) {
@@ -191,11 +272,15 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/version.ts
+var PACKAGE_VERSION = "0.9.0";
+
 // src/sidecar.ts
-async function evaluateViaSidecar(http, config, documents) {
+async function evaluateViaSidecar(http, config, documents, collections) {
   const body = {
     documents
   };
+  if (collections !== void 0) body.collections = collections;
   if (config.configJson !== void 0) {
     body.configJson = config.configJson;
   }
@@ -228,6 +313,12 @@ async function evaluateViaSidecar(http, config, documents) {
     }
     return { ok: false, reason: "server_error", detail };
   }
+  const workerVersion = response.headers?.get("x-aexeo-version") ?? "unknown";
+  if (workerVersion !== PACKAGE_VERSION) {
+    config.log?.warn(
+      `Aexeo sidecar is version ${workerVersion} but the plugin is ${PACKAGE_VERSION}; redeploy the Worker so both run the same rules`
+    );
+  }
   let raw;
   try {
     raw = await response.text();
@@ -266,7 +357,21 @@ function normalizeHost(evaluatorHost) {
 var CONFIG_URL_KEY = "config:evaluator_url";
 var CONFIG_TOKEN_KEY = "config:eval_token";
 var SETTINGS_TOKEN_KEY = "eval_token";
+var SETTINGS_BLOCK_MAPPINGS_KEY = "block_mappings";
+var SETTINGS_CONTENT_FIELDS_KEY = "content_fields_by_collection";
 var PLUGIN_SETTINGS_SCHEMA = {
+  [SETTINGS_CONTENT_FIELDS_KEY]: {
+    type: "string",
+    label: "Content fields by collection (JSON)",
+    description: "Ordered rendered body fields per collection.",
+    multiline: true
+  },
+  [SETTINGS_BLOCK_MAPPINGS_KEY]: {
+    type: "string",
+    label: "Custom block mappings (JSON)",
+    description: "Ordered mappings for the rendered fields of each custom block type.",
+    multiline: true
+  },
   [SETTINGS_TOKEN_KEY]: {
     type: "secret",
     label: "EVAL_TOKEN",
@@ -285,10 +390,21 @@ async function readSidecarConfig(store) {
   return { url, token };
 }
 async function writeSidecarConfig(store, config) {
-  await store.kv.set(CONFIG_URL_KEY, config.url);
   await writeStoredToken(store, config.token);
+  await store.kv.set(CONFIG_URL_KEY, config.url);
+}
+async function isTokenStoredInPlaintext(store) {
+  return await readLegacyToken(store) !== null;
+}
+async function readLegacyToken(store) {
+  const legacy = await store.kv.get(CONFIG_TOKEN_KEY);
+  return typeof legacy === "string" && legacy.length > 0 ? legacy : null;
 }
 async function readStoredToken(store) {
+  const legacy = await readLegacyToken(store);
+  if (legacy !== null) {
+    return legacy;
+  }
   const { settings } = store;
   if (settings !== void 0) {
     try {
@@ -298,32 +414,85 @@ async function readStoredToken(store) {
       }
     } catch (err) {
       store.log?.warn?.(
-        `aexeo: could not read the encrypted EVAL_TOKEN from plugin settings, falling back to KV: ${describeError(err, "")}`
+        `aexeo: could not read the encrypted EVAL_TOKEN from plugin settings: ${describeError(err, "")}`
       );
     }
   }
-  const legacy = await store.kv.get(CONFIG_TOKEN_KEY);
-  return typeof legacy === "string" && legacy.length > 0 ? legacy : null;
+  return null;
 }
+var TokenStorageError = class extends Error {
+};
 async function writeStoredToken(store, token) {
   const { settings } = store;
-  if (settings !== void 0) {
-    try {
-      await settings.set(SETTINGS_TOKEN_KEY, token);
-      await store.kv.delete(CONFIG_TOKEN_KEY);
-      return;
-    } catch (err) {
-      store.log?.warn?.(
-        `aexeo: could not store the EVAL_TOKEN encrypted in plugin settings; it will be written to plugin KV in plaintext instead. Set EMDASH_ENCRYPTION_KEY on the emdash host to fix this. Detail: ${describeError(err, token)}`
-      );
-    }
+  if (settings === void 0) {
+    throw new TokenStorageError(
+      "This emdash host does not provide encrypted plugin settings, so EVAL_TOKEN was not saved. Upgrade emdash."
+    );
+  }
+  try {
+    await settings.set(SETTINGS_TOKEN_KEY, token);
+    await store.kv.delete(CONFIG_TOKEN_KEY);
+  } catch (err) {
+    throw new TokenStorageError(
+      `EVAL_TOKEN was not saved because the host could not store it encrypted. Set EMDASH_ENCRYPTION_KEY on the emdash host and try again. Detail: ${describeError(err, token)}`
+    );
   }
-  await store.kv.set(CONFIG_TOKEN_KEY, token);
 }
 function describeError(err, secret) {
   const raw = err instanceof Error ? err.message : String(err);
   return secret.length === 0 ? raw : raw.split(secret).join("[redacted]");
 }
+function recordContentCoverage(ctx, documents) {
+  const counts = { documents: documents.length, complete: 0, partial: 0, unavailable: 0 };
+  for (const document of documents) {
+    if (document.body === void 0 || document.body_capabilities?.length === 0) counts.unavailable++;
+    else if (document.body_capabilities === void 0 || ["text", "headings", "paragraphs", "links"].every(
+      (capability) => document.body_capabilities?.includes(capability)
+    )) counts.complete++;
+    else counts.partial++;
+  }
+  try {
+    ctx.log?.info?.("aexeo.content_coverage", counts);
+  } catch {
+  }
+}
+async function handleAfterDelete(event, ctx) {
+  for (const entry of await ctx.kv.list("document:")) {
+    const stored = toStoredDocument(entry.value);
+    if (stored !== null && stored.meta.id === event.id && stored.meta.collection === event.collection) {
+      await ctx.kv.delete(entry.key);
+      await ctx.kv.delete(findingsKey(stored.document.route));
+    }
+  }
+}
+async function readSandboxBlockMappings(ctx) {
+  if (!ctx.settings) return void 0;
+  try {
+    const raw = await ctx.settings.get(SETTINGS_BLOCK_MAPPINGS_KEY);
+    if (raw === null || raw === "") return void 0;
+    if (typeof raw !== "string" || raw.length > 65536) throw new Error("invalid mapping size or type");
+    const value = JSON.parse(raw);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("mapping must be an object");
+    return value;
+  } catch {
+    ctx.log?.warn?.("Aexeo custom block mappings unavailable; custom content remains unverified");
+    return void 0;
+  }
+}
+async function readSandboxContentFields(ctx) {
+  if (!ctx.settings) return void 0;
+  try {
+    const raw = await ctx.settings.get(SETTINGS_CONTENT_FIELDS_KEY);
+    if (raw === null || raw === "") return void 0;
+    if (typeof raw !== "string" || raw.length > 65536) throw new Error("invalid selection size or type");
+    const value = JSON.parse(raw);
+    if (value === null || typeof value !== "object" || Array.isArray(value) || !Object.values(value).every((fields) => Array.isArray(fields) && fields.length > 0 && fields.every((field) => typeof field === "string" && field.length > 0))) throw new Error("invalid selection");
+    return value;
+  } catch {
+    ctx.log?.warn?.("Aexeo content field selection unavailable; multiple fields remain unverified");
+    return void 0;
+  }
+}
 async function handleAfterSave(event, ctx) {
   const runtime = await readSidecarConfig(ctx);
   if (runtime === null) {
@@ -332,36 +501,73 @@ async function handleAfterSave(event, ctx) {
     );
     return;
   }
+  const [blockMappings, fields] = await Promise.all([readSandboxBlockMappings(ctx), readSandboxContentFields(ctx)]);
   await handleAfterSaveConfigured(
     event,
     ctx,
-    (documents) => evaluateViaSidecar(
+    (documents, context) => evaluateViaSidecar(
       ctx.http,
-      { url: runtime.url, authToken: runtime.token },
-      documents
-    )
+      { url: runtime.url, authToken: runtime.token, log: ctx.log },
+      documents,
+      context?.collections
+    ),
+    void 0,
+    blockMappings,
+    fields?.[event.content.type]
   );
 }
-async function handleAfterSaveConfigured(event, ctx, evaluator, suppressionFilter) {
+var SITE_GRAPH_RULE_IDS = /* @__PURE__ */ new Set([
+  "LNK001",
+  // internal link target missing from the site
+  "LNK002",
+  // no inbound links
+  "LNK003",
+  // weak anchor, checked only when the target route exists
+  "LNK004",
+  // too few inbound links
+  "SEO009",
+  // hreflang alternate target missing from the site
+  "SEO012",
+  // hreflang alternate does not link back
+  "SEO016",
+  // canonical points at another crawlable route
+  "SEO017",
+  // title and description shared with another route
+  "CNT005"
+  // visible text duplicated on another route
+]);
+async function handleAfterSaveConfigured(event, ctx, evaluator, suppressionFilter, blockMappings, contentFields) {
   const adapted = await adaptContentItemWithContext(
     event.content,
     ctx.content,
-    ctx.site?.locale
+    ctx.site?.locale,
+    blockMappings,
+    contentFields
   );
   const document = adapted.document;
+  recordContentCoverage(ctx, [document]);
   const { kv, log } = ctx;
   const stored = { document, meta: adapted.meta };
-  await persistDocument(ctx, stored);
-  const result = await evaluator([document]);
+  if (!await persistDocument(ctx, stored)) {
+    log?.info?.(`Aexeo afterSave skipped: ${document.route} has a newer save`);
+    return;
+  }
+  const result = await evaluator([document], { collections: [adapted.meta.collection] });
   if (!result.ok) {
     log?.error?.(`afterSave evaluator failure (${result.reason})`, {
       detail: result.detail
     });
     return;
   }
-  const pageFindings = result.findings.filter(
-    (finding) => finding.scope === "page"
+  const storedGraphFindings = (await readFindings(kv, document.route)).filter(
+    (finding) => SITE_GRAPH_RULE_IDS.has(finding.rule_id)
   );
+  const pageFindings = [
+    ...result.findings.filter(
+      (finding) => finding.scope === "page" && !SITE_GRAPH_RULE_IDS.has(finding.rule_id)
+    ),
+    ...storedGraphFindings
+  ];
   const filtered = suppressionFilter === void 0 ? pageFindings : suppressionFilter.apply(
     {
       route: document.route,
@@ -370,6 +576,10 @@ async function handleAfterSaveConfigured(event, ctx, evaluator, suppressionFilte
     },
     pageFindings
   );
+  if (await isSuperseded(kv, document.route, adapted.meta.updatedAt)) {
+    log?.info?.(`Aexeo afterSave discarded: ${document.route} changed while evaluating`);
+    return;
+  }
   await kv.set(findingsKey(document.route), {
     route: document.route,
     findings: filtered
@@ -386,7 +596,9 @@ async function evaluateAndPersistAll(ctx, options) {
     totalFindings: 0,
     errors: []
   };
+  const storedAtStart = await readAllStoredDocuments(kv);
   const documents = [];
+  const documentCollections = [];
   const adaptedByRoute = /* @__PURE__ */ new Map();
   const documentRoutes = /* @__PURE__ */ new Set();
   for (const collection of collections) {
@@ -401,9 +613,12 @@ async function evaluateAndPersistAll(ctx, options) {
           const adapted = await adaptContentItemWithContext(
             item,
             ctx.content,
-            ctx.site?.locale
+            ctx.site?.locale,
+            options.blockMappings,
+            options.contentFieldsByCollection?.[collection]
           );
           documents.push(adapted.document);
+          documentCollections.push(adapted.meta.collection);
           documentRoutes.add(adapted.document.route);
           adaptedByRoute.set(adapted.document.route, {
             document: adapted.document,
@@ -419,10 +634,14 @@ async function evaluateAndPersistAll(ctx, options) {
     } while (cursor !== void 0);
   }
   summary.documentsScanned = documents.length;
+  recordContentCoverage(ctx, documents);
   for (const stored of adaptedByRoute.values()) {
-    await kv.set(documentKey(stored.document.route), stored);
+    const current = await readStoredDocument(kv, stored.document.route);
+    if (!isOlderRevision(stored.meta.updatedAt, current?.meta.updatedAt)) {
+      await kv.set(documentKey(stored.document.route), stored);
+    }
   }
-  const result = await options.evaluator(documents);
+  const result = await options.evaluator(documents, { collections: documentCollections });
   if (!result.ok) {
     log?.error?.(`aexeo evaluator failure (${result.reason})`, {
       detail: result.detail
@@ -443,6 +662,9 @@ async function evaluateAndPersistAll(ctx, options) {
   let totalAfterSuppression = 0;
   for (const [route, findings] of findingsByRoute) {
     const stored = adaptedByRoute.get(route);
+    if (stored !== void 0 && await isSuperseded(kv, route, stored.meta.updatedAt)) {
+      continue;
+    }
     const context = {
       route,
       ...stored?.meta.collection === void 0 ? {} : { collection: stored.meta.collection },
@@ -455,29 +677,52 @@ async function evaluateAndPersistAll(ctx, options) {
   }
   summary.totalFindings = totalAfterSuppression;
   if (summary.errors.length === 0) {
-    await removeStaleDocuments(ctx, collections, documentRoutes);
+    await removeStaleDocuments(ctx, collections, documentRoutes, storedAtStart);
   }
   return summary;
 }
+function isOlderRevision(revision, other) {
+  if (revision === void 0 || other === void 0) return false;
+  return Date.parse(revision) < Date.parse(other);
+}
+async function readStoredDocument(kv, route) {
+  return toStoredDocument(await kv.get(documentKey(route)));
+}
+async function isSuperseded(kv, route, revision) {
+  const current = await readStoredDocument(kv, route);
+  return current === null || isOlderRevision(revision, current.meta.updatedAt);
+}
 async function persistDocument(ctx, stored) {
   const route = stored.document.route;
-  const entries = await ctx.kv.list("document:");
-  for (const entry of entries) {
+  const sameEntry = (await ctx.kv.list("document:")).flatMap((entry) => {
     const previous = toStoredDocument(entry.value);
-    if (previous === null || previous.document.route === route || previous.meta.id !== stored.meta.id || previous.meta.collection !== stored.meta.collection) {
-      continue;
-    }
-    await ctx.kv.delete(entry.key);
+    return previous !== null && previous.meta.id === stored.meta.id && previous.meta.collection === stored.meta.collection ? [{ key: entry.key, previous }] : [];
+  });
+  if (sameEntry.some(
+    ({ previous }) => isOlderRevision(stored.meta.updatedAt, previous.meta.updatedAt)
+  )) {
+    return false;
+  }
+  for (const { key, previous } of sameEntry) {
+    if (previous.document.route === route) continue;
+    await ctx.kv.delete(key);
     await ctx.kv.delete(findingsKey(previous.document.route));
   }
   await ctx.kv.set(documentKey(route), stored);
+  return true;
 }
-async function removeStaleDocuments(ctx, collections, currentRoutes) {
+async function removeStaleDocuments(ctx, collections, currentRoutes, storedAtStart) {
   const scannedCollections = new Set(collections);
+  const revisionAtStart = new Map(
+    storedAtStart.map((stored) => [
+      stored.document.route,
+      stored.meta.updatedAt
+    ])
+  );
   const entries = await ctx.kv.list("document:");
   for (const entry of entries) {
     const stored = toStoredDocument(entry.value);
-    if (stored === null || !scannedCollections.has(stored.meta.collection) || currentRoutes.has(stored.document.route)) {
+    if (stored === null || stored.meta.collection !== "" && !scannedCollections.has(stored.meta.collection) || currentRoutes.has(stored.document.route) || !revisionAtStart.has(stored.document.route) || revisionAtStart.get(stored.document.route) !== stored.meta.updatedAt) {
       continue;
     }
     await ctx.kv.delete(entry.key);
@@ -552,6 +797,12 @@ function validateSidecarUrl(raw, allowedHosts = []) {
     };
   }
   const host = parsed.hostname.toLowerCase();
+  if (host.endsWith(".")) {
+    return {
+      ok: false,
+      error: `Sidecar URL host must not end with a dot: ${host}`
+    };
+  }
   if (isBlockedHost(host)) {
     return {
       ok: false,
@@ -628,15 +879,7 @@ function hostMatchesAllowlist(host, allowedHosts) {
 
 // src/evaluator-sandbox.ts
 async function scoreSite(_documents) {
-  return {
-    overall_score: 0,
-    citation_readiness_score: 0,
-    truth_consistency_score: 0,
-    answer_pack_score: 0,
-    external_trust_alignment_score: null,
-    route_scores: [],
-    blockers: []
-  };
+  return null;
 }
 
 // src/findings-view.ts
@@ -675,6 +918,8 @@ async function handleRefresh(options) {
     summary = await evaluateAndPersistAll(options.ctx, {
       collections: options.collections,
       evaluator: options.evaluator,
+      blockMappings: options.blockMappings,
+      contentFieldsByCollection: options.contentFieldsByCollection,
       // Always forwarded. See RefreshOptions.suppressionFilter.
       suppressionFilter: options.suppressionFilter
     });
@@ -815,7 +1060,7 @@ function findingsTable(rows) {
     }))
   };
 }
-async function renderScoreWidget(kv, tuning) {
+async function renderScoreWidget(kv, tuning, log) {
   const documents = await readAllDocuments(kv);
   if (documents.length === 0) {
     return {
@@ -828,28 +1073,48 @@ async function renderScoreWidget(kv, tuning) {
       ]
     };
   }
-  const score = await tuning.score(documents, kv);
+  let score;
+  try {
+    score = await tuning.score(documents, kv);
+  } catch (error) {
+    log?.error("Aexeo score widget failed to initialize", { error });
+    return {
+      blocks: [
+        { type: "banner", title: "SEO score is temporarily unavailable", variant: "alert" },
+        { type: "context", text: "The authoring interface remains available. Retry after the evaluator runtime has been checked." }
+      ]
+    };
+  }
+  if (score === null) {
+    return {
+      blocks: [
+        { type: "header", text: "SEO score" },
+        {
+          type: "context",
+          text: "The site score is unavailable in sandboxed mode. Findings are not affected."
+        }
+      ]
+    };
+  }
   const blocks = [
     {
       type: "stats",
       items: [
-        { label: "Overall", value: `${score.overall_score}` },
-        { label: "Citation", value: `${score.citation_readiness_score}` },
+        {
+          label: "Citation",
+          value: score.citation_readiness_score?.toString() ?? "unknown"
+        },
         {
           label: tuning.truthLabel(score),
-          value: `${score.truth_consistency_score}`
+          value: score.truth_consistency_score?.toString() ?? "unknown"
         },
-        { label: "Answers", value: `${score.answer_pack_score}` }
+        {
+          label: "Answers",
+          value: `${score.answer_pack.routes_with_answer_blocks}/${score.answer_pack.routes_analyzed} routes`
+        }
       ]
     }
   ];
-  if (score.overall_score < 60) {
-    blocks.unshift({
-      type: "banner",
-      title: `Site score is ${score.overall_score} \u2014 below the 60 quality threshold`,
-      variant: "alert"
-    });
-  }
   if (score.blockers.length > 0) {
     blocks.push({
       type: "context",
@@ -1061,7 +1326,7 @@ async function handleBlockAction(ctx, actionId, value) {
   return notFound(actionId);
 }
 async function handleRefresh2(ctx) {
-  const sandboxEvaluator = async (documents) => {
+  const sandboxEvaluator = async (documents, context) => {
     const runtime = await readSidecarConfig(ctx.ctx);
     if (runtime === null) {
       return {
@@ -1072,8 +1337,9 @@ async function handleRefresh2(ctx) {
     }
     return evaluateViaSidecar(
       ctx.ctx.http,
-      { url: runtime.url, authToken: runtime.token },
-      documents
+      { url: runtime.url, authToken: runtime.token, log: ctx.ctx.log },
+      documents,
+      context?.collections
     );
   };
   return handleRefresh({
@@ -1083,18 +1349,28 @@ async function handleRefresh2(ctx) {
     collections: DEFAULT_COLLECTIONS,
     evaluator: sandboxEvaluator,
     suppressionFilter: sandboxSuppressionFilter,
+    blockMappings: await readSandboxBlockMappings(ctx.ctx),
+    contentFieldsByCollection: await readSandboxContentFields(ctx.ctx),
     tuning: adminViewTuning
   });
 }
 async function renderSetupPage(ctx, options = {}) {
   const existing = await readSidecarConfig(ctx.ctx);
+  const tokenInPlaintext = await isTokenStoredInPlaintext(ctx.ctx);
   const blocks = [
     { type: "header", text: "Aexeo setup" },
     {
       type: "context",
-      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. The token is stored encrypted by the emdash host; both values are read at runtime, so no rebuild is required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
+      text: "Paste the URL and auth token of your deployed aexeo-crawl-worker. Saving stores the token encrypted by the emdash host, and fails if the host cannot encrypt it. Both values are read at runtime, so no rebuild is required after a change. Rotate the token here whenever you redeploy the sidecar with a new secret."
     }
   ];
+  if (tokenInPlaintext) {
+    blocks.push({
+      type: "banner",
+      title: "EVAL_TOKEN is currently stored unencrypted in plugin KV. Save this form to encrypt it.",
+      variant: "alert"
+    });
+  }
   if (options.bannerError !== void 0) {
     blocks.push({
       type: "banner",
@@ -1135,7 +1411,7 @@ async function renderSetupPage(ctx, options = {}) {
     { type: "divider" },
     {
       type: "context",
-      text: existing === null ? "Status: not configured. Refresh on the findings page will fail until both fields are saved." : `Status: configured. Sidecar at ${existing.url}. Token stored \u2014 paste a new one above to rotate.`
+      text: existing === null ? "Status: not configured. Refresh on the findings page will fail until both fields are saved." : `Status: configured. Sidecar at ${existing.url}. Token stored ${tokenInPlaintext ? "unencrypted" : "encrypted"} \u2014 paste a new one above to rotate.`
     }
   );
   return { blocks };
@@ -1172,14 +1448,23 @@ async function handleSetupSubmit(ctx, values) {
     url: validated.url,
     token: resolvedToken
   };
-  await writeSidecarConfig(ctx.ctx, next);
+  try {
+    await writeSidecarConfig(ctx.ctx, next);
+  } catch (err) {
+    if (!(err instanceof TokenStorageError)) throw err;
+    return renderSetupPage(ctx, {
+      bannerError: err.message,
+      initialUrl: validated.url
+    });
+  }
   return renderSetupPage(ctx, {
     bannerSuccess: "Configuration saved. Click Refresh on the findings page to evaluate."
   });
 }
 var sandbox_entry_default = definePlugin({
   hooks: {
-    "content:afterSave": handleAfterSave
+    "content:afterSave": handleAfterSave,
+    "content:afterDelete": handleAfterDelete
   },
   routes: {
     admin: { handler: handleAdminRoute }