@tideworthy/tidysites-platform 0.1.6

package/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+## 0.1.3
+
+- Renamed to `@tideworthy/tidysites-platform`: the npm scope is the parent brand, the package name says which product it serves. First version actually published to npm. No code changes.
+
+## 0.1.2
+
+- Release workflow publishes on version tags with provenance. Never reached npm (no scope yet).
+
+## 0.1.1
+
+- Fix: the routes read the worker env from `cloudflare:workers` only. 0.1.0 touched `locals.runtime.env` first, which the Cloudflare adapter for Astro 6+ removed with a throwing getter, so every gated route failed on Astro 7. Not usable; use 0.1.1.
+
+## 0.1.0
+
+First release. Replaces the routes and plugin that lived inline in `template-home-services`.
+
+- Astro integration `tidyPlatform()` injecting `/_tidy/bootstrap`, `/_tidy/session`, `/_tidy/session/claim`, `/_tidy/health`, `/_tidy/rotate-token`, `/_tidy/maintenance` as server routes. The routes reach the database through `getDb()`, so the old worker-level `/_tidy/*` rewrite and edit-mode cookie trick are gone.
+- EmDash plugin descriptor `tidyPlatformPlugin()` and `createPlugin()` with `content:afterPublish`, `content:afterUnpublish`, `content:afterDelete` hooks (`errorPolicy: "continue"`, 8 s timeout) that post `{ reason, collection, id }` to the control plane over the `PLATFORM` binding.
+- One-time sign-in links: mint with the site secret, claim from a browser, single use, 30 to 600 s lifetime, local redirects only.
+- Token rotation by email or by token name; health with migration status.
+- `@tideworthy/tidysites-platform/client`: a typed caller for all routes.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 4 Sons Holdings Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,117 @@
+# @tideworthy/tidysites-platform
+
+The Tidysites platform integration for [EmDash](https://emdash.dev) sites on Astro. It adds a small set of platform routes under `/_tidy/*` and an EmDash plugin whose publish hooks tell the platform to ship the site live.
+
+It is the only code in a Tidysites template that knows about the platform, and it does nothing when the platform's secret is not bound to the worker. A site exported from the platform keeps this package installed and runs unchanged.
+
+## Install
+
+```sh
+npm install @tideworthy/tidysites-platform
+```
+
+Peer dependencies: `astro` 7, `emdash` and `@emdash-cms/auth` 0.37.x, `kysely`. Published on npm as `@tideworthy/tidysites-platform`; GitHub tags `vX.Y.Z` match each version.
+
+## Wire it up
+
+```js
+// astro.config.mjs
+import emdash from "emdash/astro";
+import { tidyPlatform, tidyPlatformPlugin } from "@tideworthy/tidysites-platform";
+
+export default defineConfig({
+	integrations: [
+		tidyPlatform(),
+		emdash({
+			// database, storage, ...
+			plugins: [tidyPlatformPlugin()]
+		})
+	]
+});
+```
+
+`tidyPlatform()` is an Astro integration that injects the routes below as server routes. `tidyPlatformPlugin()` is the EmDash plugin descriptor that registers the publish hooks. Both are needed.
+
+The worker entry stays EmDash's own:
+
+```ts
+// src/worker.ts
+export { default, PluginBridge } from "@emdash-cms/cloudflare/worker";
+```
+
+## Bindings the routes read
+
+| Binding | Type | Purpose |
+|---|---|---|
+| `TIDY_PLATFORM_SECRET` | secret | Bearer token every `/_tidy/*` route requires. When absent, every route answers 404. |
+| `TIDY_CONTROL_ORIGIN` | var | Control plane origin the publish hooks call. |
+| `TIDY_SITE_ID` | var | This site's id on the platform. |
+| `PLATFORM` | service binding | The control plane worker. Publish requests go over this binding, never over public fetch. |
+
+Without the last three, the publish hooks are a no-op.
+
+## Routes
+
+All routes are under `/_tidy/` on the staging hostname. Every route except the session claim requires `Authorization: Bearer <TIDY_PLATFORM_SECRET>`. Wrong or missing bearer: 401. No secret bound: 404. JSON in, JSON out, `cache-control: no-store`.
+
+### `POST /_tidy/bootstrap`
+
+Headless first run for a freshly provisioned site. Applies the template seed, creates the platform's admin user, marks setup complete, and mints an API token with every scope.
+
+```json
+{ "adminEmail": "platform@example.com", "adminName": "Platform", "title": "Acme Plumbing", "tagline": "Fast fixes", "siteUrl": "https://acme.example.com", "tokenName": "platform" }
+```
+
+Returns `{ ok, userId, token, steps }`. The token is only ever returned here and by `rotate-token`; store it. Idempotent: a later call skips the seed and setup, keeps the user, and replaces the token of that name.
+
+### `POST /_tidy/session`
+
+Mints a one-time sign-in link for a person the platform has already authenticated.
+
+```json
+{ "email": "jo@agency.com", "name": "Jo", "role": "admin", "redirect": "/_emdash/admin", "editMode": false, "ttlSeconds": 120 }
+```
+
+`role` is `admin` or `editor` and is applied to the EmDash user every time, so the platform's role mapping wins. `redirect` must be a local path. `ttlSeconds` is clamped to 30 to 600. Returns `{ ok, userId, claimUrl, expiresAt }`. Send the browser to `claimUrl`.
+
+### `GET /_tidy/session/claim?t=…`
+
+The browser lands here. Signs the user in (an Astro session, exactly as EmDash's own login does), sets or clears the visual-editing cookie, and redirects with 303 to the requested path. A link can be used once. Expired, reused, or unknown links get a 410 page.
+
+### `GET /_tidy/health`
+
+`{ ok, plugin, setupComplete, siteTitle, siteUrl, migrations: { applied, pending }, time }`. `ok` is false and the status is 503 when migrations are pending.
+
+### `POST /_tidy/rotate-token`
+
+Replaces the platform API token. `{ "email": "...", "tokenName": "platform" }`. Both optional: with no email, the token's current owner is used. Returns `{ ok, userId, token }`.
+
+### `POST /_tidy/maintenance?cron=…`
+
+Runs EmDash's scheduled work now (scheduled publishing, cleanup) and returns what it published. Workers in a dispatch namespace never receive cron triggers, so the platform's cron calls this on every site each minute.
+
+## Publish hooks
+
+The plugin registers `content:afterPublish`, `content:afterUnpublish`, and `content:afterDelete`. Each posts `{ reason, collection, id }` to `POST <TIDY_CONTROL_ORIGIN>/sites/<TIDY_SITE_ID>/publish` over the `PLATFORM` binding with the site secret as bearer. Hooks run with `errorPolicy: "continue"` and an 8 second timeout, so a slow or failing control plane never fails the editor's publish.
+
+## Calling the routes
+
+```ts
+import { createTidySiteClient } from "@tideworthy/tidysites-platform/client";
+
+const site = createTidySiteClient({ origin: "https://staging-acme.example.dev", secret, fetch: (r) => namespace.get("site-acme").fetch(r) });
+await site.health();
+const { claimUrl } = await site.mintSession({ email, role: "editor", editMode: true, redirect: "/" });
+```
+
+## Security model
+
+- The secret is compared in constant time and never echoed.
+- Every route disappears (404) when the secret is not bound, so an exported site exposes nothing.
+- Sign-in links are random 256-bit tokens, single use, and expire within ten minutes. Redirect targets must be local paths.
+- The plugin never reads or writes content; it only notifies the platform.
+- Nothing in this package holds a credential. Secrets arrive as worker bindings.
+
+## License
+
+MIT.

package/package.json

@@ -0,0 +1,57 @@
+{
+	"name": "@tideworthy/tidysites-platform",
+	"version": "0.1.6",
+	"description": "The Tidysites platform integration for EmDash sites: bootstrap, sessions, maintenance, health, and publish hooks under /_tidy/*.",
+	"license": "MIT",
+	"type": "module",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/4sons/tidysites-platform.git"
+	},
+	"homepage": "https://github.com/4sons/tidysites-platform#readme",
+	"files": [
+		"src",
+		"README.md",
+		"LICENSE",
+		"CHANGELOG.md"
+	],
+	"exports": {
+		".": "./src/index.ts",
+		"./plugin": "./src/plugin.ts",
+		"./client": "./src/client.ts",
+		"./routes/bootstrap": "./src/routes/bootstrap.ts",
+		"./routes/session": "./src/routes/session.ts",
+		"./routes/session-claim": "./src/routes/session-claim.ts",
+		"./routes/health": "./src/routes/health.ts",
+		"./routes/rotate-token": "./src/routes/rotate-token.ts",
+		"./routes/maintenance": "./src/routes/maintenance.ts"
+	},
+	"scripts": {
+		"typecheck": "tsc --noEmit",
+		"test": "vitest run",
+		"check": "npm run typecheck && npm run test"
+	},
+	"peerDependencies": {
+		"@emdash-cms/auth": ">=0.37.0 <0.38.0",
+		"astro": "^7.0.0",
+		"emdash": ">=0.37.0 <0.38.0",
+		"kysely": ">=0.29.0"
+	},
+	"devDependencies": {
+		"@astrojs/react": "^6.0.0",
+		"@cloudflare/workers-types": "^5.20260915.1",
+		"@emdash-cms/auth": "0.37.0",
+		"@emdash-cms/auth-atproto": ">=0.2.8",
+		"astro": "^7.3.2",
+		"emdash": "0.37.0",
+		"kysely": "^0.29.0",
+		"react": "19.2.4",
+		"react-dom": "19.2.4",
+		"typescript": "^5.9.0",
+		"vitest": "^3.2.0"
+	},
+	"publishConfig": {
+		"access": "public",
+		"provenance": true
+	}
+}

package/src/client.ts

@@ -0,0 +1,63 @@
+/**
+ * A typed caller for the /_tidy/* routes, for the control plane and the
+ * platform app. Pass `fetch` to route calls through a dispatch-namespace
+ * binding instead of the public internet.
+ */
+import type { BootstrapInput, BootstrapResult, HealthResult, MintSessionInput, MintSessionResult, RotateTokenInput } from "./lib/handlers";
+
+export type { BootstrapInput, BootstrapResult, HealthResult, MintSessionInput, MintSessionResult, RotateTokenInput };
+
+export interface MaintenanceResult {
+	ok: true;
+	cron: string | null;
+	published: number;
+	refs: Array<{ collection: string; id: string }>;
+	ms: number;
+	at: string;
+}
+
+export class TidySiteError extends Error {
+	constructor(
+		public status: number,
+		public body: unknown
+	) {
+		super(`tidy site route failed: ${status}`);
+	}
+}
+
+export interface TidySiteClientOptions {
+	/** The site's staging origin, e.g. https://staging-acme.tidysites.dev */
+	origin: string;
+	/** The per-site TIDY_PLATFORM_SECRET. */
+	secret: string;
+	/** A fetch to use, e.g. a dispatch namespace binding's `.fetch`. Defaults to global fetch. */
+	fetch?: (input: Request) => Promise<Response>;
+}
+
+export function createTidySiteClient(options: TidySiteClientOptions) {
+	const origin = options.origin.replace(/\/+$/, "");
+	const doFetch = options.fetch ?? ((r: Request) => fetch(r));
+
+	async function call<T>(method: "GET" | "POST", path: string, body?: unknown): Promise<T> {
+		const r = await doFetch(
+			new Request(`${origin}${path}`, {
+				method,
+				headers: { authorization: `Bearer ${options.secret}`, ...(body !== undefined ? { "content-type": "application/json" } : {}) },
+				...(body !== undefined ? { body: JSON.stringify(body) } : {})
+			})
+		);
+		const data: unknown = await r.json().catch(() => null);
+		if (!r.ok) throw new TidySiteError(r.status, data);
+		return data as T;
+	}
+
+	return {
+		bootstrap: (input: BootstrapInput) => call<BootstrapResult>("POST", "/_tidy/bootstrap", input),
+		mintSession: (input: MintSessionInput) => call<MintSessionResult>("POST", "/_tidy/session", input),
+		health: () => call<HealthResult>("GET", "/_tidy/health"),
+		rotateToken: (input: RotateTokenInput = {}) => call<{ ok: true; userId: string; token: string }>("POST", "/_tidy/rotate-token", input),
+		maintenance: (cron?: string) => call<MaintenanceResult>("POST", `/_tidy/maintenance${cron ? `?cron=${encodeURIComponent(cron)}` : ""}`)
+	};
+}
+
+export type TidySiteClient = ReturnType<typeof createTidySiteClient>;

package/src/index.ts

@@ -0,0 +1,53 @@
+/**
+ * @tideworthy/tidysites-platform
+ *
+ * Two exports a template wires into astro.config.mjs:
+ *
+ *   import emdash from "emdash/astro";
+ *   import { tidyPlatform, tidyPlatformPlugin } from "@tideworthy/tidysites-platform";
+ *
+ *   integrations: [
+ *     tidyPlatform(),
+ *     emdash({ ..., plugins: [tidyPlatformPlugin()] }),
+ *   ]
+ *
+ * `tidyPlatform()` injects the /_tidy/* routes. `tidyPlatformPlugin()` is the
+ * EmDash plugin descriptor for the publish hooks. See README.md.
+ */
+import type { AstroIntegration } from "astro";
+import { PLUGIN_ID, VERSION } from "./version";
+
+export { VERSION, PLUGIN_ID };
+
+const PACKAGE = "@tideworthy/tidysites-platform";
+
+export const PLATFORM_ROUTES = [
+	{ pattern: "/_tidy/bootstrap", entrypoint: `${PACKAGE}/routes/bootstrap` },
+	{ pattern: "/_tidy/session", entrypoint: `${PACKAGE}/routes/session` },
+	{ pattern: "/_tidy/session/claim", entrypoint: `${PACKAGE}/routes/session-claim` },
+	{ pattern: "/_tidy/health", entrypoint: `${PACKAGE}/routes/health` },
+	{ pattern: "/_tidy/rotate-token", entrypoint: `${PACKAGE}/routes/rotate-token` },
+	{ pattern: "/_tidy/maintenance", entrypoint: `${PACKAGE}/routes/maintenance` }
+] as const;
+
+/** Astro integration: registers every platform route as a server route. */
+export function tidyPlatform(): AstroIntegration {
+	return {
+		name: PACKAGE,
+		hooks: {
+			"astro:config:setup": ({ injectRoute }) => {
+				for (const route of PLATFORM_ROUTES) injectRoute({ pattern: route.pattern, entrypoint: route.entrypoint, prerender: false });
+			}
+		}
+	};
+}
+
+/** EmDash plugin descriptor for `emdash({ plugins: [tidyPlatformPlugin()] })`. */
+export function tidyPlatformPlugin() {
+	return {
+		id: PLUGIN_ID,
+		version: VERSION,
+		format: "native" as const,
+		entrypoint: `${PACKAGE}/plugin`
+	};
+}

package/src/lib/auth.ts

@@ -0,0 +1,50 @@
+/**
+ * Bearer-secret gate for every /_tidy/* route.
+ *
+ * Two outcomes matter for security:
+ * - No secret bound on the worker (an exported site, or a misconfigured one):
+ *   every platform route answers 404, so the site shows no trace of the platform.
+ * - Secret bound but the request does not carry it: 401.
+ * The comparison is constant-time so response timing does not leak the secret.
+ */
+
+export const SECRET_BINDING = "TIDY_PLATFORM_SECRET";
+
+export function bearerToken(request: Request): string | null {
+	const header = request.headers.get("authorization") ?? "";
+	if (!/^Bearer\s+/i.test(header)) return null;
+	const token = header.replace(/^Bearer\s+/i, "").trim();
+	return token.length > 0 ? token : null;
+}
+
+/** Constant-time string equality. Never early-returns on the first mismatching byte. */
+export function secretMatches(provided: string | null | undefined, expected: string | null | undefined): boolean {
+	if (!provided || !expected) return false;
+	const enc = new TextEncoder();
+	const a = enc.encode(provided);
+	const b = enc.encode(expected);
+	let diff = a.length ^ b.length;
+	for (let i = 0; i < b.length; i++) diff |= (a[i % a.length] ?? 0) ^ (b[i] ?? 0);
+	return diff === 0;
+}
+
+export type Gate = { ok: true } | { ok: false; response: Response };
+
+export function readSecret(env: Record<string, unknown> | undefined): string | null {
+	const v = env?.[SECRET_BINDING];
+	return typeof v === "string" && v.length > 0 ? v : null;
+}
+
+/**
+ * Gate a platform route. `requireBearer: false` is for the one route a browser
+ * reaches (the session claim); it still disappears when no secret is bound.
+ */
+export function gate(request: Request, env: Record<string, unknown> | undefined, requireBearer = true): Gate {
+	const secret = readSecret(env);
+	if (!secret) return { ok: false, response: new Response("Not found", { status: 404 }) };
+	if (!requireBearer) return { ok: true };
+	if (!secretMatches(bearerToken(request), secret)) {
+		return { ok: false, response: new Response("Unauthorized", { status: 401, headers: { "www-authenticate": "Bearer" } }) };
+	}
+	return { ok: true };
+}

package/src/lib/env.ts

@@ -0,0 +1,26 @@
+/**
+ * The worker env (bindings, vars, secrets), resolved from the `cloudflare:workers`
+ * module at call time.
+ *
+ * Why not `locals.runtime.env`: the Cloudflare adapter for Astro 6+ removed it
+ * and its getter throws. Why a dynamic import: EmDash probes plugin modules at
+ * build time in Node, where `cloudflare:workers` does not exist, and the routes
+ * must stay importable in tests.
+ */
+export type WorkerEnv = Record<string, unknown>;
+
+type Importer = () => Promise<unknown>;
+
+const defaultImporter: Importer = () => import("cloudflare:workers");
+
+export async function workerEnv(importer: Importer = defaultImporter): Promise<WorkerEnv | undefined> {
+	try {
+		const mod = (await importer()) as { env?: WorkerEnv } | undefined;
+		return mod?.env && typeof mod.env === "object" ? mod.env : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Alias kept for the hook plugin, which runs outside any request. */
+export const hookEnv = workerEnv;

package/src/lib/handlers.ts

@@ -0,0 +1,245 @@
+/**
+ * Route logic, free of Astro and EmDash imports. Each handler takes validated
+ * JSON in and returns plain data or throws HttpError. The route modules in
+ * src/routes wire real dependencies; the tests wire an in-memory store.
+ */
+import { HttpError, isEmail, isHttpUrl, isSafeLocalPath, randomToken } from "./http";
+import type { PlatformStore, Role } from "./store";
+import { ROLE_LEVEL } from "./store";
+import { VERSION } from "../version";
+
+export interface SeedOps {
+	load(): Promise<Record<string, unknown> & { settings?: Record<string, unknown> }>;
+	validate(seed: unknown): { valid: boolean; errors?: unknown };
+	apply(seed: Record<string, unknown>): Promise<{ collections?: unknown; content?: unknown }>;
+}
+
+export interface TokenOps {
+	/** Returns the raw token to hand out and the hash to store. */
+	generate(): { raw: string; hash: string; prefix: string };
+	scopes: readonly string[];
+}
+
+export interface Deps {
+	store: PlatformStore;
+	seed: SeedOps;
+	tokens: TokenOps;
+	now?: () => number;
+}
+
+const TOKEN_NAME = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+const DEFAULT_TOKEN_NAME = "platform";
+const ROLES: readonly Role[] = ["admin", "editor"];
+export const HANDOFF_TTL = { default: 120, min: 30, max: 600 } as const;
+export const DEFAULT_REDIRECT = "/_emdash/admin";
+
+function tokenName(value: unknown): string {
+	if (value === undefined || value === null) return DEFAULT_TOKEN_NAME;
+	if (typeof value !== "string" || !TOKEN_NAME.test(value)) throw new HttpError(400, "tokenName must be 1 to 64 letters, digits, - or _");
+	return value;
+}
+
+// ---------------------------------------------------------------------------
+// Bootstrap
+// ---------------------------------------------------------------------------
+
+export interface BootstrapInput {
+	adminEmail?: unknown;
+	adminName?: unknown;
+	title?: unknown;
+	tagline?: unknown;
+	siteUrl?: unknown;
+	tokenName?: unknown;
+}
+
+export interface BootstrapResult {
+	ok: true;
+	userId: string;
+	token: string;
+	steps: Record<string, unknown>;
+}
+
+/**
+ * Headless first run for a freshly provisioned site: apply the template seed,
+ * create the platform's admin user, mark setup complete, mint an API token.
+ * Idempotent: a later call skips the seed and setup, and re-mints the token.
+ */
+export async function bootstrap(input: BootstrapInput, deps: Deps, requestOrigin: string): Promise<BootstrapResult> {
+	if (!isEmail(input.adminEmail)) throw new HttpError(400, "adminEmail must be an email address");
+	if (input.title !== undefined && (typeof input.title !== "string" || input.title.length > 200)) throw new HttpError(400, "title must be a string of at most 200 characters");
+	if (input.tagline !== undefined && (typeof input.tagline !== "string" || input.tagline.length > 500)) throw new HttpError(400, "tagline must be a string of at most 500 characters");
+	if (input.siteUrl !== undefined && !isHttpUrl(input.siteUrl)) throw new HttpError(400, "siteUrl must be an http(s) URL");
+	if (input.adminName !== undefined && (typeof input.adminName !== "string" || input.adminName.length > 200)) throw new HttpError(400, "adminName must be a string of at most 200 characters");
+	const name = tokenName(input.tokenName);
+	const { store, seed, tokens } = deps;
+	const steps: Record<string, unknown> = {};
+
+	const alreadyComplete = (await store.getOption("emdash:setup_complete")) === true;
+	steps.alreadyComplete = alreadyComplete;
+
+	if (!alreadyComplete) {
+		const data = await seed.load();
+		data.settings = {
+			...(data.settings ?? {}),
+			...(typeof input.title === "string" ? { title: input.title } : {}),
+			...(typeof input.tagline === "string" ? { tagline: input.tagline } : {})
+		};
+		const v = seed.validate(data);
+		if (!v.valid) throw new HttpError(500, "invalid seed", v.errors);
+		const result = await seed.apply(data);
+		steps.seed = { collections: result.collections, content: result.content };
+	}
+
+	let user = await store.findUserByEmail(input.adminEmail);
+	if (!user) {
+		user = await store.createUser({ email: input.adminEmail, name: typeof input.adminName === "string" ? input.adminName : "Platform", role: "admin" });
+		steps.userCreated = true;
+	} else if (user.role < ROLE_LEVEL.admin) {
+		await store.setUserRole(user.id, "admin");
+		steps.userPromoted = true;
+	}
+	await store.markEmailVerified(user.id);
+
+	if (!alreadyComplete) {
+		if (typeof input.title === "string") await store.setOption("emdash:site_title", input.title);
+		if (typeof input.tagline === "string") await store.setOption("emdash:site_tagline", input.tagline);
+		await store.setOptionIfAbsent("emdash:site_url", typeof input.siteUrl === "string" ? input.siteUrl : requestOrigin);
+		await store.setOption("emdash:setup_complete", true);
+		await store.deleteOption("emdash:setup_state");
+	}
+
+	const t = tokens.generate();
+	await store.replaceToken({ userId: user.id, name, hash: t.hash, prefix: t.prefix, scopes: [...tokens.scopes] });
+	return { ok: true, userId: user.id, token: t.raw, steps };
+}
+
+// ---------------------------------------------------------------------------
+// Sessions: mint a one-time handoff, then a browser claims it
+// ---------------------------------------------------------------------------
+
+export interface MintSessionInput {
+	email?: unknown;
+	name?: unknown;
+	role?: unknown;
+	redirect?: unknown;
+	editMode?: unknown;
+	ttlSeconds?: unknown;
+}
+
+export interface MintSessionResult {
+	ok: true;
+	userId: string;
+	claimUrl: string;
+	expiresAt: string;
+}
+
+export async function mintSession(input: MintSessionInput, deps: Deps, requestOrigin: string): Promise<MintSessionResult> {
+	if (!isEmail(input.email)) throw new HttpError(400, "email must be an email address");
+	if (typeof input.role !== "string" || !ROLES.includes(input.role as Role)) throw new HttpError(400, `role must be one of ${ROLES.join(", ")}`);
+	const role = input.role as Role;
+	if (input.name !== undefined && (typeof input.name !== "string" || input.name.length > 200)) throw new HttpError(400, "name must be a string of at most 200 characters");
+	const redirect = input.redirect === undefined ? DEFAULT_REDIRECT : input.redirect;
+	if (!isSafeLocalPath(redirect)) throw new HttpError(400, "redirect must be a local path starting with /");
+	if (input.editMode !== undefined && typeof input.editMode !== "boolean") throw new HttpError(400, "editMode must be a boolean");
+	let ttl: number = HANDOFF_TTL.default;
+	if (input.ttlSeconds !== undefined) {
+		if (typeof input.ttlSeconds !== "number" || !Number.isFinite(input.ttlSeconds)) throw new HttpError(400, "ttlSeconds must be a number");
+		ttl = Math.min(HANDOFF_TTL.max, Math.max(HANDOFF_TTL.min, Math.floor(input.ttlSeconds)));
+	}
+	const now = (deps.now ?? Date.now)();
+	const { store } = deps;
+
+	let user = await store.findUserByEmail(input.email);
+	if (!user) {
+		user = await store.createUser({ email: input.email, name: typeof input.name === "string" ? input.name : input.email, role });
+		await store.markEmailVerified(user.id);
+	} else {
+		if (user.disabled) throw new HttpError(403, "this user is disabled on the site");
+		if (user.role !== ROLE_LEVEL[role]) await store.setUserRole(user.id, role);
+	}
+
+	await store.sweepHandoffs(now);
+	const token = randomToken(32);
+	const expiresAt = now + ttl * 1000;
+	await store.putHandoff(token, { userId: user.id, redirect, editMode: input.editMode === true, expiresAt });
+	return {
+		ok: true,
+		userId: user.id,
+		claimUrl: `${requestOrigin}/_tidy/session/claim?t=${encodeURIComponent(token)}`,
+		expiresAt: new Date(expiresAt).toISOString()
+	};
+}
+
+export type ClaimResult = { kind: "redirect"; userId: string; redirect: string; editMode: boolean } | { kind: "expired" } | { kind: "invalid" };
+
+export async function claimSession(token: unknown, deps: Deps): Promise<ClaimResult> {
+	if (typeof token !== "string" || token.length < 16 || token.length > 128 || !/^[A-Za-z0-9_-]+$/.test(token)) return { kind: "invalid" };
+	const handoff = await deps.store.takeHandoff(token);
+	if (!handoff) return { kind: "invalid" };
+	const now = (deps.now ?? Date.now)();
+	if (handoff.expiresAt <= now) return { kind: "expired" };
+	const user = await deps.store.findUserById(handoff.userId);
+	if (!user || user.disabled) return { kind: "invalid" };
+	if (!isSafeLocalPath(handoff.redirect)) return { kind: "invalid" };
+	return { kind: "redirect", userId: user.id, redirect: handoff.redirect, editMode: handoff.editMode };
+}
+
+// ---------------------------------------------------------------------------
+// Token rotation
+// ---------------------------------------------------------------------------
+
+export interface RotateTokenInput {
+	email?: unknown;
+	tokenName?: unknown;
+}
+
+export async function rotateToken(input: RotateTokenInput, deps: Deps): Promise<{ ok: true; userId: string; token: string }> {
+	const name = tokenName(input.tokenName);
+	const { store, tokens } = deps;
+	let userId: string | null = null;
+	if (input.email !== undefined) {
+		if (!isEmail(input.email)) throw new HttpError(400, "email must be an email address");
+		const user = await store.findUserByEmail(input.email);
+		if (!user) throw new HttpError(404, "no user with that email");
+		userId = user.id;
+	} else {
+		userId = await store.findTokenOwner(name);
+		if (!userId) throw new HttpError(404, `no token named ${name} exists; pass email to create one`);
+	}
+	const t = tokens.generate();
+	await store.replaceToken({ userId, name, hash: t.hash, prefix: t.prefix, scopes: [...tokens.scopes] });
+	return { ok: true, userId, token: t.raw };
+}
+
+// ---------------------------------------------------------------------------
+// Health
+// ---------------------------------------------------------------------------
+
+export interface HealthResult {
+	ok: boolean;
+	plugin: string;
+	setupComplete: boolean;
+	siteTitle: string | null;
+	siteUrl: string | null;
+	migrations: { applied: number; pending: number };
+	time: string;
+}
+
+export async function health(deps: Deps): Promise<HealthResult> {
+	const { store } = deps;
+	const [setupComplete, siteTitle, siteUrl, migrations] = await Promise.all([
+		store.getOption("emdash:setup_complete"),
+		store.getOption<string>("emdash:site_title"),
+		store.getOption<string>("emdash:site_url"),
+		store.migrationStatus()
+	]);
+	return {
+		ok: migrations.pending === 0,
+		plugin: VERSION,
+		setupComplete: setupComplete === true,
+		siteTitle: siteTitle ?? null,
+		siteUrl: siteUrl ?? null,
+		migrations,
+		time: new Date((deps.now ?? Date.now)()).toISOString()
+	};
+}

package/src/lib/http.ts

@@ -0,0 +1,81 @@
+export class HttpError extends Error {
+	constructor(
+		public status: number,
+		message: string,
+		public details?: unknown
+	) {
+		super(message);
+	}
+}
+
+export function json(body: unknown, status = 200, headers: Record<string, string> = {}): Response {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", ...headers }
+	});
+}
+
+export function errorResponse(err: unknown): Response {
+	if (err instanceof HttpError) {
+		return json({ ok: false, error: err.message, ...(err.details !== undefined ? { details: err.details } : {}) }, err.status);
+	}
+	console.error("[tidy-platform]", err);
+	return json({ ok: false, error: "internal error" }, 500);
+}
+
+export async function readJson<T>(request: Request): Promise<T> {
+	const text = await request.text();
+	if (!text.trim()) return {} as T;
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new HttpError(400, "body must be a JSON object");
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new HttpError(400, "body must be a JSON object");
+	return parsed as T;
+}
+
+/**
+ * A redirect target we will send a browser to after sign-in. Only a local
+ * absolute path is allowed: no scheme, no protocol-relative `//host`, no
+ * backslash tricks, no control characters.
+ */
+export function isSafeLocalPath(value: unknown): value is string {
+	if (typeof value !== "string" || value.length === 0 || value.length > 2048) return false;
+	if (!value.startsWith("/")) return false;
+	if (value.startsWith("//") || value.startsWith("/\\")) return false;
+	for (let i = 0; i < value.length; i++) {
+		const c = value.charCodeAt(i);
+		if (c < 0x20 || c === 0x7f) return false;
+	}
+	try {
+		const u = new URL(value, "https://placeholder.invalid");
+		return u.origin === "https://placeholder.invalid" && u.pathname.startsWith("/");
+	} catch {
+		return false;
+	}
+}
+
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+export function isEmail(value: unknown): value is string {
+	return typeof value === "string" && value.length <= 254 && EMAIL.test(value);
+}
+
+export function isHttpUrl(value: unknown): value is string {
+	if (typeof value !== "string") return false;
+	try {
+		const u = new URL(value);
+		return u.protocol === "https:" || u.protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+
+export function randomToken(bytes = 32): string {
+	const buf = new Uint8Array(bytes);
+	crypto.getRandomValues(buf);
+	let s = "";
+	for (const b of buf) s += String.fromCharCode(b);
+	return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}

package/src/lib/publish.ts

@@ -0,0 +1,42 @@
+/**
+ * Ask the control plane to snapshot staging into the live site. Called by the
+ * EmDash hook plugin after publish, unpublish, and delete.
+ *
+ * The call goes over the PLATFORM service binding: a Worker cannot reach
+ * another Worker on the same zone with plain fetch. Without the bindings this
+ * is a no-op, which is what an exported site needs.
+ */
+export interface PublishEnv {
+	TIDY_CONTROL_ORIGIN?: unknown;
+	TIDY_SITE_ID?: unknown;
+	TIDY_PLATFORM_SECRET?: unknown;
+	PLATFORM?: { fetch(input: string, init?: RequestInit): Promise<Response> };
+}
+
+export interface PublishEvent {
+	reason: "publish" | "unpublish" | "delete";
+	collection?: string;
+	id?: string;
+}
+
+export type PublishOutcome = { sent: false; why: "no-bindings" } | { sent: true; status: number } | { sent: false; why: "error"; error: string };
+
+export async function requestPublish(env: PublishEnv | undefined, event: PublishEvent): Promise<PublishOutcome> {
+	const origin = env?.TIDY_CONTROL_ORIGIN;
+	const siteId = env?.TIDY_SITE_ID;
+	const secret = env?.TIDY_PLATFORM_SECRET;
+	const platform = env?.PLATFORM;
+	if (!platform || typeof origin !== "string" || typeof siteId !== "string" || typeof secret !== "string") return { sent: false, why: "no-bindings" };
+	try {
+		const r = await platform.fetch(`${origin.replace(/\/+$/, "")}/sites/${encodeURIComponent(siteId)}/publish`, {
+			method: "POST",
+			headers: { authorization: `Bearer ${secret}`, "content-type": "application/json" },
+			body: JSON.stringify(event)
+		});
+		if (!r.ok) console.error("[tidy-platform] publish request failed:", r.status);
+		return { sent: true, status: r.status };
+	} catch (err) {
+		console.error("[tidy-platform] publish request error:", err);
+		return { sent: false, why: "error", error: String(err) };
+	}
+}

package/src/lib/runtime.ts

@@ -0,0 +1,33 @@
+/**
+ * Glue between an Astro request on Cloudflare and the pure handlers: resolve
+ * the worker env, build the store over EmDash's database, and provide the
+ * seed and token operations from EmDash's public exports.
+ *
+ * This is the only file (besides src/plugin.ts) that imports EmDash. Keep it
+ * that way: it is the list of things to re-verify on an EmDash upgrade.
+ */
+import { OptionsRepository, UserRepository, applySeed, getMigrationStatus, ulid, validateSeed } from "emdash";
+import { getDb } from "emdash/runtime";
+import { loadSeed } from "emdash/seed";
+import { VALID_SCOPES, generatePrefixedToken } from "@emdash-cms/auth";
+import type { Deps } from "./handlers";
+import { createEmdashStore } from "./store";
+
+export { workerEnv } from "./env";
+
+export async function buildDeps(): Promise<Deps> {
+	const db = await getDb();
+	const store = createEmdashStore(db, { OptionsRepository, UserRepository, ulid, getMigrationStatus });
+	return {
+		store,
+		seed: {
+			load: async () => (await loadSeed()) as unknown as Record<string, unknown> & { settings?: Record<string, unknown> },
+			validate: (seed) => validateSeed(seed),
+			apply: (seed) => applySeed(db, seed as unknown as Parameters<typeof applySeed>[1], { includeContent: true, onConflict: "skip" })
+		},
+		tokens: {
+			generate: () => generatePrefixedToken("ec_pat_"),
+			scopes: [...VALID_SCOPES]
+		}
+	};
+}

package/src/lib/store.ts

@@ -0,0 +1,156 @@
+/**
+ * The narrow view of an EmDash database the platform routes need. Handlers
+ * depend on this interface only, so they are unit-tested against an in-memory
+ * store and run in production against `createEmdashStore(db)`.
+ *
+ * Every EmDash internal we touch is listed in MAINTAINING.md; when EmDash
+ * changes, that list is what to re-verify.
+ */
+import type { Kysely } from "kysely";
+
+export type Role = "admin" | "editor";
+
+export interface StoreUser {
+	id: string;
+	email: string;
+	name: string | null;
+	role: number;
+	disabled: boolean;
+}
+
+export interface Handoff {
+	userId: string;
+	redirect: string;
+	editMode: boolean;
+	expiresAt: number;
+}
+
+export interface PlatformStore {
+	getOption<T = unknown>(name: string): Promise<T | null>;
+	setOption(name: string, value: unknown): Promise<void>;
+	setOptionIfAbsent(name: string, value: unknown): Promise<void>;
+	deleteOption(name: string): Promise<void>;
+
+	findUserByEmail(email: string): Promise<StoreUser | null>;
+	findUserById(id: string): Promise<StoreUser | null>;
+	createUser(input: { email: string; name: string; role: Role }): Promise<StoreUser>;
+	setUserRole(id: string, role: Role): Promise<void>;
+	markEmailVerified(id: string): Promise<void>;
+
+	/** Replace the token named `name` for `userId` (at most one per name per user). */
+	replaceToken(input: { userId: string; name: string; hash: string; prefix: string; scopes: string[] }): Promise<void>;
+	findTokenOwner(name: string): Promise<string | null>;
+
+	putHandoff(token: string, handoff: Handoff): Promise<void>;
+	/** Read and delete in one go; a second call for the same token returns null. */
+	takeHandoff(token: string): Promise<Handoff | null>;
+	sweepHandoffs(now: number): Promise<number>;
+
+	migrationStatus(): Promise<{ applied: number; pending: number }>;
+}
+
+const HANDOFF_PREFIX = "tidy:handoff:";
+export const ROLE_LEVEL: Record<Role, number> = { admin: 50, editor: 40 };
+
+type RepoUser = { id: string; email: string; name: string | null; role: number };
+
+/** The slice of the `emdash` module the store uses. Injected so tests never import EmDash. */
+export interface EmdashModule {
+	OptionsRepository: new (db: Kysely<any>) => {
+		get<T>(name: string): Promise<T | null>;
+		set<T>(name: string, value: T): Promise<void>;
+		setIfAbsent<T>(name: string, value: T): Promise<unknown>;
+		delete(name: string): Promise<unknown>;
+	};
+	UserRepository: new (db: Kysely<any>) => {
+		findByEmail(email: string): Promise<RepoUser | null>;
+		findById(id: string): Promise<RepoUser | null>;
+		create(input: { email: string; name?: string; role?: Role }): Promise<RepoUser>;
+	};
+	ulid: () => string;
+	getMigrationStatus: (db: Kysely<any>) => Promise<{ applied: string[]; pending: string[] }>;
+}
+
+/** Production store over EmDash's repositories plus a little direct Kysely for what they do not expose. */
+export function createEmdashStore(db: Kysely<any>, emdash: EmdashModule): PlatformStore {
+	const options = new emdash.OptionsRepository(db);
+	const users = new emdash.UserRepository(db);
+
+	async function disabledFlag(id: string): Promise<boolean> {
+		const row = await db.selectFrom("users").select("disabled").where("id", "=", id).executeTakeFirst();
+		return Boolean(row?.disabled);
+	}
+	async function toStoreUser(u: RepoUser | null): Promise<StoreUser | null> {
+		if (!u) return null;
+		return { id: u.id, email: u.email, name: u.name, role: u.role, disabled: await disabledFlag(u.id) };
+	}
+
+	return {
+		getOption: (name) => options.get(name),
+		setOption: (name, value) => options.set(name, value),
+		setOptionIfAbsent: async (name, value) => {
+			await options.setIfAbsent(name, value);
+		},
+		deleteOption: async (name) => {
+			await options.delete(name);
+		},
+
+		findUserByEmail: async (email) => toStoreUser(await users.findByEmail(email)),
+		findUserById: async (id) => toStoreUser(await users.findById(id)),
+		createUser: async (input) => (await toStoreUser(await users.create(input)))!,
+		setUserRole: async (id, role) => {
+			await db.updateTable("users").set({ role: ROLE_LEVEL[role], updated_at: new Date().toISOString() }).where("id", "=", id).execute();
+		},
+		markEmailVerified: async (id) => {
+			await db.updateTable("users").set({ email_verified: 1 }).where("id", "=", id).execute();
+		},
+
+		replaceToken: async ({ userId, name, hash, prefix, scopes }) => {
+			await db.deleteFrom("_emdash_api_tokens").where("user_id", "=", userId).where("name", "=", name).execute();
+			await db
+				.insertInto("_emdash_api_tokens")
+				.values({ id: emdash.ulid(), name, token_hash: hash, prefix, user_id: userId, scopes: JSON.stringify(scopes), expires_at: null })
+				.execute();
+		},
+		findTokenOwner: async (name) => {
+			const row = await db
+				.selectFrom("_emdash_api_tokens")
+				.select("user_id")
+				.where("name", "=", name)
+				.orderBy("created_at", "desc")
+				.executeTakeFirst();
+			return (row?.user_id as string | undefined) ?? null;
+		},
+
+		putHandoff: (token, handoff) => options.set(HANDOFF_PREFIX + token, handoff),
+		takeHandoff: async (token) => {
+			const name = HANDOFF_PREFIX + token;
+			const value = await options.get<Handoff>(name);
+			if (!value) return null;
+			await options.delete(name);
+			return value;
+		},
+		sweepHandoffs: async (now) => {
+			const rows = await db.selectFrom("options").select(["name", "value"]).where("name", "like", `${HANDOFF_PREFIX}%`).execute();
+			let removed = 0;
+			for (const row of rows) {
+				let expiresAt = 0;
+				try {
+					expiresAt = Number((JSON.parse(String(row.value)) as Handoff).expiresAt ?? 0);
+				} catch {
+					/* unreadable row: remove it */
+				}
+				if (expiresAt <= now) {
+					await options.delete(String(row.name));
+					removed++;
+				}
+			}
+			return removed;
+		},
+
+		migrationStatus: async () => {
+			const s = await emdash.getMigrationStatus(db);
+			return { applied: s.applied.length, pending: s.pending.length };
+		}
+	};
+}

package/src/plugin.ts

@@ -0,0 +1,47 @@
+/**
+ * The EmDash hook plugin (native, in-process). Loaded by EmDash through the
+ * descriptor from `tidyPlatformPlugin()`; EmDash imports `createPlugin` from
+ * this module and calls it with the descriptor's options.
+ *
+ * After a publish, unpublish, or delete it asks the control plane to snapshot
+ * staging into the live site. Every hook is `errorPolicy: "continue"` with a
+ * short timeout, so a control-plane hiccup never fails an editor's publish.
+ */
+import { definePlugin } from "emdash";
+import { hookEnv } from "./lib/env";
+import { requestPublish, type PublishEnv, type PublishEvent } from "./lib/publish";
+import { PLUGIN_ID, VERSION } from "./version";
+
+export const HOOK_TIMEOUT_MS = 8000;
+
+type ContentEvent = { content?: { id?: unknown }; collection?: string; id?: unknown };
+
+async function notify(reason: PublishEvent["reason"], event: ContentEvent): Promise<void> {
+	const env = (await hookEnv()) as PublishEnv | undefined;
+	const id = event.content?.id ?? event.id;
+	await requestPublish(env, { reason, collection: event.collection, ...(typeof id === "string" ? { id } : {}) });
+}
+
+function hook(reason: PublishEvent["reason"]) {
+	return {
+		errorPolicy: "continue" as const,
+		timeout: HOOK_TIMEOUT_MS,
+		handler: async (event: ContentEvent) => {
+			await notify(reason, event);
+		}
+	};
+}
+
+export function createPlugin(_options: Record<string, unknown> = {}) {
+	return definePlugin({
+		id: PLUGIN_ID,
+		version: VERSION,
+		// Content hooks are only registered for plugins that may read content.
+		capabilities: ["content:read"],
+		hooks: {
+			"content:afterPublish": hook("publish"),
+			"content:afterUnpublish": hook("unpublish"),
+			"content:afterDelete": hook("delete")
+		}
+	});
+}

package/src/routes/_shared.ts

@@ -0,0 +1,35 @@
+import type { APIContext, APIRoute } from "astro";
+import { gate } from "../lib/auth";
+import { errorResponse } from "../lib/http";
+import { buildDeps, workerEnv } from "../lib/runtime";
+import type { Deps } from "../lib/handlers";
+
+/**
+ * Wrap a platform route: resolve env, apply the secret gate, build deps, and
+ * turn thrown HttpErrors into JSON. `requireBearer: false` only for the
+ * browser-facing session claim.
+ */
+export function platformRoute(
+	handler: (context: APIContext, deps: Deps, env: Record<string, unknown>) => Promise<Response>,
+	options: { requireBearer?: boolean } = {}
+): APIRoute {
+	return async (context) => {
+		const env = await workerEnv();
+		const g = gate(context.request, env, options.requireBearer ?? true);
+		if (!g.ok) return g.response;
+		try {
+			const deps = await buildDeps();
+			return await handler(context, deps, env!);
+		} catch (err) {
+			return errorResponse(err);
+		}
+	};
+}
+
+export function methodNotAllowed(allow: string): APIRoute {
+	return () => new Response("Method not allowed", { status: 405, headers: { allow } });
+}
+
+export function requestOrigin(context: APIContext): string {
+	return new URL(context.request.url).origin;
+}

package/src/routes/bootstrap.ts

@@ -0,0 +1,13 @@
+/** POST /_tidy/bootstrap: seed, first admin, setup complete, platform token. */
+import { bootstrap, type BootstrapInput } from "../lib/handlers";
+import { json, readJson } from "../lib/http";
+import { methodNotAllowed, platformRoute, requestOrigin } from "./_shared";
+
+export const prerender = false;
+
+export const POST = platformRoute(async (context, deps) => {
+	const body = await readJson<BootstrapInput>(context.request);
+	return json(await bootstrap(body, deps, requestOrigin(context)));
+});
+
+export const ALL = methodNotAllowed("POST");

package/src/routes/health.ts

@@ -0,0 +1,13 @@
+/** GET /_tidy/health: plugin version, setup state, migration status. */
+import { health } from "../lib/handlers";
+import { json } from "../lib/http";
+import { methodNotAllowed, platformRoute } from "./_shared";
+
+export const prerender = false;
+
+export const GET = platformRoute(async (_context, deps) => {
+	const result = await health(deps);
+	return json(result, result.ok ? 200 : 503);
+});
+
+export const ALL = methodNotAllowed("GET");

package/src/routes/maintenance.ts

@@ -0,0 +1,25 @@
+/**
+ * POST /_tidy/maintenance: run EmDash's scheduled work (scheduled publishing,
+ * cleanup) now. Dispatch-namespace scripts never receive cron triggers, so the
+ * control plane's cron calls this on every site instead.
+ */
+import { runScheduledTasks } from "emdash/middleware";
+import { json } from "../lib/http";
+import { methodNotAllowed, platformRoute } from "./_shared";
+
+export const prerender = false;
+
+export const POST = platformRoute(async (context) => {
+	const started = Date.now();
+	const { published } = await runScheduledTasks();
+	return json({
+		ok: true,
+		cron: context.url.searchParams.get("cron") ?? null,
+		published: published.length,
+		refs: published.map((r) => ({ collection: r.collection, id: r.id })),
+		ms: Date.now() - started,
+		at: new Date().toISOString()
+	});
+});
+
+export const ALL = methodNotAllowed("POST");

package/src/routes/rotate-token.ts

@@ -0,0 +1,13 @@
+/** POST /_tidy/rotate-token: replace the platform API token. */
+import { rotateToken, type RotateTokenInput } from "../lib/handlers";
+import { json, readJson } from "../lib/http";
+import { methodNotAllowed, platformRoute } from "./_shared";
+
+export const prerender = false;
+
+export const POST = platformRoute(async (context, deps) => {
+	const body = await readJson<RotateTokenInput>(context.request);
+	return json(await rotateToken(body, deps));
+});
+
+export const ALL = methodNotAllowed("POST");

package/src/routes/session-claim.ts

@@ -0,0 +1,33 @@
+/**
+ * GET /_tidy/session/claim?t=…: the browser lands here from a minted link.
+ * Signs the EmDash user in (Astro session, exactly as EmDash's own login
+ * does), sets or clears edit mode, and redirects to the requested local path.
+ */
+import { claimSession } from "../lib/handlers";
+import { HttpError } from "../lib/http";
+import { methodNotAllowed, platformRoute } from "./_shared";
+
+export const prerender = false;
+
+const EDIT_COOKIE = "emdash-edit-mode";
+
+function expiredPage(): Response {
+	const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Link expired</title><meta name="robots" content="noindex"></head><body style="font-family:system-ui,sans-serif;margin:3rem auto;max-width:32rem;padding:0 1rem"><p>This sign-in link has expired or was already used.</p></body></html>`;
+	return new Response(html, { status: 410, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } });
+}
+
+export const GET = platformRoute(
+	async (context, deps) => {
+		const result = await claimSession(context.url.searchParams.get("t"), deps);
+		if (result.kind !== "redirect") return expiredPage();
+		if (!context.session) throw new HttpError(500, "sessions are not configured on this site");
+		context.session.set("user", { id: result.userId });
+		const secure = context.url.protocol === "https:";
+		if (result.editMode) context.cookies.set(EDIT_COOKIE, "true", { path: "/", sameSite: "lax", secure });
+		else context.cookies.delete(EDIT_COOKIE, { path: "/" });
+		return new Response(null, { status: 303, headers: { location: result.redirect, "cache-control": "no-store" } });
+	},
+	{ requireBearer: false }
+);
+
+export const ALL = methodNotAllowed("GET");

package/src/routes/session.ts

@@ -0,0 +1,13 @@
+/** POST /_tidy/session: mint a one-time sign-in link for a platform person. */
+import { mintSession, type MintSessionInput } from "../lib/handlers";
+import { json, readJson } from "../lib/http";
+import { methodNotAllowed, platformRoute, requestOrigin } from "./_shared";
+
+export const prerender = false;
+
+export const POST = platformRoute(async (context, deps) => {
+	const body = await readJson<MintSessionInput>(context.request);
+	return json(await mintSession(body, deps, requestOrigin(context)));
+});
+
+export const ALL = methodNotAllowed("POST");

package/src/version.ts

@@ -0,0 +1,3 @@
+/** Kept in step with package.json by the release checklist in MAINTAINING.md. */
+export const VERSION = "0.1.6";
+export const PLUGIN_ID = "tidy-platform";