emdash 0.1.0 → 0.1.1

package/src/plugins/hooks.ts

@@ -17,6 +17,7 @@ import type {
 	PluginContext,
 	ContentHookEvent,
 	ContentDeleteEvent,
+	ContentPublishStateChangeEvent,
 	MediaUploadEvent,
 	MediaAfterUploadEvent,
 	LifecycleEvent,
@@ -30,6 +31,8 @@ import type {
 	ContentAfterSaveHandler,
 	ContentBeforeDeleteHandler,
 	ContentAfterDeleteHandler,
+	ContentAfterPublishHandler,
+	ContentAfterUnpublishHandler,
 	MediaBeforeUploadHandler,
 	MediaAfterUploadHandler,
 	LifecycleHandler,
@@ -61,6 +64,8 @@ type HookNameV2 =
 	| "content:afterSave"
 	| "content:beforeDelete"
 	| "content:afterDelete"
+	| "content:afterPublish"
+	| "content:afterUnpublish"
 	| "media:beforeUpload"
 	| "media:afterUpload"
 	| "cron"
@@ -86,6 +91,8 @@ interface HookHandlerMap {
 	"content:afterSave": ContentAfterSaveHandler;
 	"content:beforeDelete": ContentBeforeDeleteHandler;
 	"content:afterDelete": ContentAfterDeleteHandler;
+	"content:afterPublish": ContentAfterPublishHandler;
+	"content:afterUnpublish": ContentAfterUnpublishHandler;
 	"media:beforeUpload": MediaBeforeUploadHandler;
 	"media:afterUpload": MediaAfterUploadHandler;
 	cron: CronHandler;
@@ -211,6 +218,8 @@ export class HookPipeline {
 			this.registerPluginHook(plugin, "content:afterSave");
 			this.registerPluginHook(plugin, "content:beforeDelete");
 			this.registerPluginHook(plugin, "content:afterDelete");
+			this.registerPluginHook(plugin, "content:afterPublish");
+			this.registerPluginHook(plugin, "content:afterUnpublish");
 			this.registerPluginHook(plugin, "media:beforeUpload");
 			this.registerPluginHook(plugin, "media:afterUpload");
 			this.registerPluginHook(plugin, "cron");
@@ -249,6 +258,8 @@ export class HookPipeline {
 		["content:afterSave", "read:content"],
 		["content:beforeDelete", "read:content"],
 		["content:afterDelete", "read:content"],
+		["content:afterPublish", "read:content"],
+		["content:afterUnpublish", "read:content"],
 		// Media
 		["media:beforeUpload", "write:media"],
 		["media:afterUpload", "read:media"],
@@ -620,6 +631,86 @@ export class HookPipeline {
 		return results;
 	}
 
+	/**
+	 * Run content:afterPublish hooks (fire-and-forget).
+	 */
+	async runContentAfterPublish(
+		content: Record<string, unknown>,
+		collection: string,
+	): Promise<HookResult<void>[]> {
+		const hooks = this.getTypedHooks("content:afterPublish");
+		const results: HookResult<void>[] = [];
+
+		for (const hook of hooks) {
+			const { handler } = hook;
+			const event: ContentPublishStateChangeEvent = { content, collection };
+			const ctx = this.getContext(hook.pluginId);
+			const start = Date.now();
+
+			try {
+				await this.executeWithTimeout(() => handler(event, ctx), hook.timeout);
+				results.push({
+					success: true,
+					pluginId: hook.pluginId,
+					duration: Date.now() - start,
+				});
+			} catch (error) {
+				results.push({
+					success: false,
+					error: error instanceof Error ? error : new Error(String(error)),
+					pluginId: hook.pluginId,
+					duration: Date.now() - start,
+				});
+
+				if (hook.errorPolicy === "abort") {
+					throw error;
+				}
+			}
+		}
+
+		return results;
+	}
+
+	/**
+	 * Run content:afterUnpublish hooks (fire-and-forget).
+	 */
+	async runContentAfterUnpublish(
+		content: Record<string, unknown>,
+		collection: string,
+	): Promise<HookResult<void>[]> {
+		const hooks = this.getTypedHooks("content:afterUnpublish");
+		const results: HookResult<void>[] = [];
+
+		for (const hook of hooks) {
+			const { handler } = hook;
+			const event: ContentPublishStateChangeEvent = { content, collection };
+			const ctx = this.getContext(hook.pluginId);
+			const start = Date.now();
+
+			try {
+				await this.executeWithTimeout(() => handler(event, ctx), hook.timeout);
+				results.push({
+					success: true,
+					pluginId: hook.pluginId,
+					duration: Date.now() - start,
+				});
+			} catch (error) {
+				results.push({
+					success: false,
+					error: error instanceof Error ? error : new Error(String(error)),
+					pluginId: hook.pluginId,
+					duration: Date.now() - start,
+				});
+
+				if (hook.errorPolicy === "abort") {
+					throw error;
+				}
+			}
+		}
+
+		return results;
+	}
+
 	// =========================================================================
 	// Media Hooks
 	// =========================================================================

package/src/plugins/manager.ts

@@ -326,6 +326,28 @@ export class PluginManager {
 		return this.hookPipeline!.runContentAfterDelete(id, collection);
 	}
 
+	/**
+	 * Run content:afterPublish hooks across all active plugins
+	 */
+	async runContentAfterPublish(
+		content: Record<string, unknown>,
+		collection: string,
+	): Promise<HookResult<void>[]> {
+		this.ensureInitialized();
+		return this.hookPipeline!.runContentAfterPublish(content, collection);
+	}
+
+	/**
+	 * Run content:afterUnpublish hooks across all active plugins
+	 */
+	async runContentAfterUnpublish(
+		content: Record<string, unknown>,
+		collection: string,
+	): Promise<HookResult<void>[]> {
+		this.ensureInitialized();
+		return this.hookPipeline!.runContentAfterUnpublish(content, collection);
+	}
+
 	/**
 	 * Run media:beforeUpload hooks across all active plugins
 	 */

package/src/plugins/manifest-schema.ts

@@ -42,6 +42,7 @@ const FIELD_TYPES = [
 	"reference",
 	"json",
 	"slug",
+	"repeater",
 ] as const;
 
 export const HOOK_NAMES = [
@@ -53,6 +54,8 @@ export const HOOK_NAMES = [
 	"content:afterSave",
 	"content:beforeDelete",
 	"content:afterDelete",
+	"content:afterPublish",
+	"content:afterUnpublish",
 	"media:beforeUpload",
 	"media:afterUpload",
 	"cron",

package/src/plugins/marketplace.ts

@@ -204,10 +204,12 @@ export class MarketplaceUnavailableError extends MarketplaceError {
 
 class MarketplaceClientImpl implements MarketplaceClient {
 	private readonly baseUrl: string;
+	private readonly siteOrigin: string | undefined;
 
-	constructor(baseUrl: string) {
+	constructor(baseUrl: string, siteOrigin?: string) {
 		// Strip trailing slash
 		this.baseUrl = baseUrl.replace(TRAILING_SLASHES, "");
+		this.siteOrigin = siteOrigin;
 	}
 
 	async search(query?: string, opts?: MarketplaceSearchOpts): Promise<MarketplaceSearchResult> {
@@ -270,8 +272,8 @@ class MarketplaceClientImpl implements MarketplaceClient {
 	}
 
 	async reportInstall(id: string, version: string): Promise<void> {
-		// Generate a stable site hash (best-effort, non-identifying)
-		const siteHash = await generateSiteHash();
+		// Generate a stable site hash from the site origin (best-effort, non-identifying)
+		const siteHash = await generateSiteHash(this.siteOrigin);
 		const url = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/installs`;
 
 		try {
@@ -433,18 +435,27 @@ async function extractBundle(tarballBytes: Uint8Array): Promise<PluginBundle> {
 
 // ── Helpers ────────────────────────────────────────────────────────
 
-/** Generate a stable non-identifying site hash (best-effort) */
-async function generateSiteHash(): Promise<string> {
-	// Use a timestamp-based approach since we can't reliably get the origin
-	// in all contexts (Workers, Node, etc.)
-	const seed = `emdash-${Date.now()}`;
+/**
+ * Generate a stable non-identifying site hash from the site origin.
+ * The same origin always produces the same hash, so the marketplace
+ * installs table deduplicates correctly per (plugin_id, site_hash).
+ */
+async function generateSiteHash(siteOrigin?: string): Promise<string> {
+	const seed = siteOrigin ? `emdash-site:${siteOrigin}` : `emdash-anonymous`;
 	try {
 		const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(seed));
 		const arr = new Uint8Array(hash);
 		return Array.from(arr.slice(0, 8), (b) => b.toString(16).padStart(2, "0")).join("");
 	} catch {
-		// Fallback for environments without crypto.subtle
-		return Math.random().toString(36).slice(2, 18);
+		// Fallback for environments without crypto.subtle: FNV-1a hash encoded as hex.
+		// Deterministic, uniform distribution, no origin leakage.
+		let h = 0x811c9dc5;
+		for (let i = 0; i < seed.length; i++) {
+			h ^= seed.charCodeAt(i);
+			h = Math.imul(h, 0x01000193);
+		}
+		const h2 = h ^ (h >>> 16);
+		return (h >>> 0).toString(16).padStart(8, "0") + (h2 >>> 0).toString(16).padStart(8, "0");
 	}
 }
 
@@ -454,7 +465,9 @@ async function generateSiteHash(): Promise<string> {
  * Create a MarketplaceClient for the given marketplace URL.
  *
  * @param baseUrl - The marketplace API base URL (e.g. "https://marketplace.emdashcms.com")
+ * @param siteOrigin - The origin of the EmDash site (e.g. "https://myblog.example.com").
+ *   Used to generate a stable, non-identifying site hash for install deduplication.
  */
-export function createMarketplaceClient(baseUrl: string): MarketplaceClient {
-	return new MarketplaceClientImpl(baseUrl);
+export function createMarketplaceClient(baseUrl: string, siteOrigin?: string): MarketplaceClient {
+	return new MarketplaceClientImpl(baseUrl, siteOrigin);
 }

package/src/plugins/types.ts

@@ -659,6 +659,14 @@ export interface ContentDeleteEvent {
 	collection: string;
 }
 
+/**
+ * Content publish state change hook event (fired after publish or unpublish)
+ */
+export interface ContentPublishStateChangeEvent {
+	content: Record<string, unknown>;
+	collection: string;
+}
+
 /**
  * Media hook event
  */
@@ -708,6 +716,16 @@ export type ContentAfterDeleteHandler = (
 	ctx: PluginContext,
 ) => Promise<void>;
 
+export type ContentAfterPublishHandler = (
+	event: ContentPublishStateChangeEvent,
+	ctx: PluginContext,
+) => Promise<void>;
+
+export type ContentAfterUnpublishHandler = (
+	event: ContentPublishStateChangeEvent,
+	ctx: PluginContext,
+) => Promise<void>;
+
 export type MediaBeforeUploadHandler = (
 	event: MediaUploadEvent,
 	ctx: PluginContext,
@@ -857,6 +875,10 @@ export interface PluginHooks {
 	"content:afterSave"?: HookConfig<ContentAfterSaveHandler> | ContentAfterSaveHandler;
 	"content:beforeDelete"?: HookConfig<ContentBeforeDeleteHandler> | ContentBeforeDeleteHandler;
 	"content:afterDelete"?: HookConfig<ContentAfterDeleteHandler> | ContentAfterDeleteHandler;
+	"content:afterPublish"?: HookConfig<ContentAfterPublishHandler> | ContentAfterPublishHandler;
+	"content:afterUnpublish"?:
+		| HookConfig<ContentAfterUnpublishHandler>
+		| ContentAfterUnpublishHandler;
 
 	// Media hooks
 	"media:beforeUpload"?: HookConfig<MediaBeforeUploadHandler> | MediaBeforeUploadHandler;
@@ -1157,6 +1179,8 @@ export interface ResolvedPluginHooks {
 	"content:afterSave"?: ResolvedHook<ContentAfterSaveHandler>;
 	"content:beforeDelete"?: ResolvedHook<ContentBeforeDeleteHandler>;
 	"content:afterDelete"?: ResolvedHook<ContentAfterDeleteHandler>;
+	"content:afterPublish"?: ResolvedHook<ContentAfterPublishHandler>;
+	"content:afterUnpublish"?: ResolvedHook<ContentAfterUnpublishHandler>;
 	"media:beforeUpload"?: ResolvedHook<MediaBeforeUploadHandler>;
 	"media:afterUpload"?: ResolvedHook<MediaAfterUploadHandler>;
 	cron?: ResolvedHook<CronHandler>;

package/src/schema/registry.ts

@@ -540,64 +540,60 @@ export class SchemaRegistry {
 
 		// Create standard indexes
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_status`)} 
-			ON ${sql.ref(tableName)} (status)
-		`.execute(conn);
-
-		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_slug`)} 
+			CREATE INDEX ${sql.ref(`idx_${tableName}_slug`)}
 			ON ${sql.ref(tableName)} (slug)
 		`.execute(conn);
 
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_created`)} 
-			ON ${sql.ref(tableName)} (created_at)
-		`.execute(conn);
-
-		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_deleted`)} 
-			ON ${sql.ref(tableName)} (deleted_at)
-		`.execute(conn);
-
-		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_scheduled`)} 
+			CREATE INDEX ${sql.ref(`idx_${tableName}_scheduled`)}
 			ON ${sql.ref(tableName)} (scheduled_at)
 			WHERE scheduled_at IS NOT NULL
 		`.execute(conn);
 
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_live_revision`)} 
+			CREATE INDEX ${sql.ref(`idx_${tableName}_live_revision`)}
 			ON ${sql.ref(tableName)} (live_revision_id)
 		`.execute(conn);
 
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_draft_revision`)} 
+			CREATE INDEX ${sql.ref(`idx_${tableName}_draft_revision`)}
 			ON ${sql.ref(tableName)} (draft_revision_id)
 		`.execute(conn);
 
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_author`)} 
+			CREATE INDEX ${sql.ref(`idx_${tableName}_author`)}
 			ON ${sql.ref(tableName)} (author_id)
 		`.execute(conn);
 
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_primary_byline`)} 
+			CREATE INDEX ${sql.ref(`idx_${tableName}_primary_byline`)}
 			ON ${sql.ref(tableName)} (primary_byline_id)
 		`.execute(conn);
 
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_updated`)} 
-			ON ${sql.ref(tableName)} (updated_at)
+			CREATE INDEX ${sql.ref(`idx_${tableName}_locale`)}
+			ON ${sql.ref(tableName)} (locale)
 		`.execute(conn);
 
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_locale`)} 
-			ON ${sql.ref(tableName)} (locale)
+			CREATE INDEX ${sql.ref(`idx_${tableName}_translation_group`)}
+			ON ${sql.ref(tableName)} (translation_group)
 		`.execute(conn);
 
+		// Composite indexes for optimized query performance (see migration 033)
 		await sql`
-			CREATE INDEX ${sql.ref(`idx_${tableName}_translation_group`)} 
-			ON ${sql.ref(tableName)} (translation_group)
+			CREATE INDEX ${sql.ref(`idx_${tableName}_deleted_updated_id`)}
+			ON ${sql.ref(tableName)} (deleted_at, updated_at DESC, id DESC)
+		`.execute(conn);
+
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${tableName}_deleted_status`)}
+			ON ${sql.ref(tableName)} (deleted_at, status)
+		`.execute(conn);
+
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${tableName}_deleted_created_id`)}
+			ON ${sql.ref(tableName)} (deleted_at, created_at DESC, id DESC)
 		`.execute(conn);
 	}
 

package/src/schema/types.ts

@@ -22,7 +22,8 @@ export type FieldType =
 	| "file"
 	| "reference"
 	| "json"
-	| "slug";
+	| "slug"
+	| "repeater";
 
 /**
  * Array of all field types for validation
@@ -42,6 +43,7 @@ export const FIELD_TYPES: readonly FieldType[] = [
 	"reference",
 	"json",
 	"slug",
+	"repeater",
 ] as const;
 
 /**
@@ -67,6 +69,7 @@ export const FIELD_TYPE_TO_COLUMN: Record<FieldType, ColumnType> = {
 	reference: "TEXT",
 	json: "JSON",
 	slug: "TEXT",
+	repeater: "JSON",
 };
 
 /**
@@ -93,6 +96,26 @@ export type CollectionSource =
 /**
  * Validation rules for a field
  */
+/** Sub-field definition for repeater fields */
+export interface RepeaterSubField {
+	slug: string;
+	type: "string" | "text" | "number" | "integer" | "boolean" | "datetime" | "select";
+	label: string;
+	required?: boolean;
+	options?: string[]; // For select sub-fields
+}
+
+/** Allowed types for repeater sub-fields (no nesting, no complex types) */
+export const REPEATER_SUB_FIELD_TYPES = [
+	"string",
+	"text",
+	"number",
+	"integer",
+	"boolean",
+	"datetime",
+	"select",
+] as const;
+
 export interface FieldValidation {
 	required?: boolean;
 	min?: number;
@@ -101,6 +124,9 @@ export interface FieldValidation {
 	maxLength?: number;
 	pattern?: string;
 	options?: string[]; // For select/multiSelect
+	subFields?: RepeaterSubField[]; // For repeater fields
+	minItems?: number; // For repeater fields
+	maxItems?: number; // For repeater fields
 }
 
 /**

package/src/search/fts-manager.ts

@@ -360,9 +360,7 @@ export class FTSManager {
 	/**
 	 * Verify FTS index integrity and rebuild if corrupted.
 	 *
-	 * Checks for two corruption indicators:
-	 * 1. Row count mismatch between content table and FTS table
-	 * 2. FTS5 integrity-check failure (catches shadow table inconsistencies)
+	 * Checks for row count mismatch between content table and FTS table.
 	 *
 	 * Returns true if the index was rebuilt, false if it was healthy.
 	 */
@@ -401,21 +399,6 @@ export class FTSManager {
 			return true;
 		}
 
-		// Check 2: FTS5 integrity check (catches shadow table corruption)
-		try {
-			await sql
-				.raw(`INSERT INTO "${ftsTable}"("${ftsTable}") VALUES('integrity-check')`)
-				.execute(this.db);
-		} catch {
-			console.warn(`FTS integrity check failed for "${collectionSlug}". Rebuilding index.`);
-			const fields = await this.getSearchableFields(collectionSlug);
-			const config = await this.getSearchConfig(collectionSlug);
-			if (fields.length > 0) {
-				await this.rebuildIndex(collectionSlug, fields, config?.weights);
-			}
-			return true;
-		}
-
 		return false;
 	}
 

package/src/visual-editing/toolbar.ts

@@ -688,6 +688,11 @@ export function renderToolbar(config: ToolbarConfig): string {
     return f ? f.kind : null;
   }
 
+  // Load manifest early so the first click can resolve field kinds without racing the event.
+  if (isEditMode) {
+    fetchManifest();
+  }
+
   // Save a single field value
   function saveField(collection, id, field, value) {
     setSaveState("saving");
@@ -1149,15 +1154,64 @@ export function renderToolbar(config: ToolbarConfig): string {
     });
 
     dimPromise.then(function(dims) {
-      var formData = new FormData();
-      formData.append("file", file);
-      if (dims.width) formData.append("width", String(dims.width));
-      if (dims.height) formData.append("height", String(dims.height));
-
-      return ecFetch("/_emdash/api/media", {
-        method: "POST",
-        credentials: "same-origin",
-        body: formData
+      // Generate a thumbnail for large images to avoid OOM in server-side
+      // blurhash generation on memory-constrained runtimes (Workers).
+      // Thumbnail fits within a 64x64 box (scale by max dimension) so that
+      // extreme aspect ratios don't explode into a huge canvas client-side.
+      var thumbPromise;
+      if (dims.width && dims.height && dims.width * dims.height * 4 > 32 * 1024 * 1024) {
+        thumbPromise = new Promise(function(resolve) {
+          try {
+            var maxDim = Math.max(dims.width, dims.height);
+            var scale = Math.min(1, 64 / maxDim);
+            var thumbW = Math.max(1, Math.round(dims.width * scale));
+            var thumbH = Math.max(1, Math.round(dims.height * scale));
+            var canvas = document.createElement("canvas");
+            canvas.width = thumbW;
+            canvas.height = thumbH;
+            var ctx = canvas.getContext("2d");
+            if (ctx) {
+              var img = new Image();
+              img.onload = function() {
+                try {
+                  ctx.drawImage(img, 0, 0, thumbW, thumbH);
+                  canvas.toBlob(function(blob) {
+                    URL.revokeObjectURL(img.src);
+                    resolve(blob);
+                  }, "image/png");
+                } catch (e) {
+                  URL.revokeObjectURL(img.src);
+                  resolve(null);
+                }
+              };
+              img.onerror = function() {
+                URL.revokeObjectURL(img.src);
+                resolve(null);
+              };
+              img.src = URL.createObjectURL(file);
+            } else {
+              resolve(null);
+            }
+          } catch (e) {
+            resolve(null);
+          }
+        });
+      } else {
+        thumbPromise = Promise.resolve(null);
+      }
+
+      return thumbPromise.then(function(thumbnail) {
+        var formData = new FormData();
+        formData.append("file", file);
+        if (dims.width) formData.append("width", String(dims.width));
+        if (dims.height) formData.append("height", String(dims.height));
+        if (thumbnail) formData.append("thumbnail", thumbnail, "thumb.png");
+
+        return ecFetch("/_emdash/api/media", {
+          method: "POST",
+          credentials: "same-origin",
+          body: formData
+        });
       });
     })
     .then(function(r) { return r.json(); })
@@ -1187,31 +1241,39 @@ export function renderToolbar(config: ToolbarConfig): string {
 
         var ref = target.getAttribute && target.getAttribute("data-emdash-ref");
         if (ref) {
-          e.preventDefault();
-          e.stopPropagation();
-
           try {
             var annotation = JSON.parse(ref);
 
-            // Entry-level annotation (no field) — ignore, it's a container
-            if (!annotation.field) return;
+            // Entry-level annotation (no field) — keep walking for a field-level ancestor
+            if (!annotation.field) {
+              target = target.parentElement;
+              continue;
+            }
 
-            // Fetch manifest to determine field type, then dispatch
-            fetchManifest().then(function(manifest) {
-              var kind = getFieldKind(manifest, annotation.collection, annotation.field);
-
-              // Close any open image popover before starting a new edit
+            function dispatchInline(kind) {
               closeImagePopover();
-
+              // Portable Text is edited in-page by InlinePortableTextEditor — do not open admin
+              if (kind === "portableText") {
+                return;
+              }
+              e.preventDefault();
+              e.stopPropagation();
               if (kind === "string" || kind === "text") {
                 startTextEdit(target, annotation);
               } else if (kind === "image") {
                 startImageEdit(target, annotation);
               } else {
-                // Fallback: open admin for unsupported types
                 openAdmin(annotation);
               }
-            });
+            }
+
+            if (manifestCache) {
+              dispatchInline(getFieldKind(manifestCache, annotation.collection, annotation.field));
+            } else {
+              fetchManifest().then(function(manifest) {
+                dispatchInline(getFieldKind(manifest, annotation.collection, annotation.field));
+              });
+            }
           } catch (err) {
             console.error("Failed to parse emdash ref:", err);
           }

package/dist/manifest-schema-Dcl0R6nM.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-schema-Dcl0R6nM.mjs","names":[],"sources":["../src/plugins/manifest-schema.ts"],"sourcesContent":["/**\n * Zod schema for PluginManifest validation\n *\n * Used to validate manifest.json from plugin bundles at every parse site:\n * - Client-side download (marketplace.ts extractBundle)\n * - R2 load (api/handlers/marketplace.ts loadBundleFromR2)\n * - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)\n * - Marketplace ingest extends this with publishing-specific fields\n */\n\nimport { z } from \"zod\";\n\n// ── Enum values (must stay in sync with types.ts) ───────────────\n\nexport const PLUGIN_CAPABILITIES = [\n\t\"network:fetch\",\n\t\"network:fetch:any\",\n\t\"read:content\",\n\t\"write:content\",\n\t\"read:media\",\n\t\"write:media\",\n\t\"read:users\",\n\t\"email:send\",\n\t\"email:provide\",\n\t\"email:intercept\",\n\t\"page:inject\",\n] as const;\n\n/** Must stay in sync with FieldType in schema/types.ts */\nconst FIELD_TYPES = [\n\t\"string\",\n\t\"text\",\n\t\"number\",\n\t\"integer\",\n\t\"boolean\",\n\t\"datetime\",\n\t\"select\",\n\t\"multiSelect\",\n\t\"portableText\",\n\t\"image\",\n\t\"file\",\n\t\"reference\",\n\t\"json\",\n\t\"slug\",\n] as const;\n\nexport const HOOK_NAMES = [\n\t\"plugin:install\",\n\t\"plugin:activate\",\n\t\"plugin:deactivate\",\n\t\"plugin:uninstall\",\n\t\"content:beforeSave\",\n\t\"content:afterSave\",\n\t\"content:beforeDelete\",\n\t\"content:afterDelete\",\n\t\"media:beforeUpload\",\n\t\"media:afterUpload\",\n\t\"cron\",\n\t\"email:beforeSend\",\n\t\"email:deliver\",\n\t\"email:afterSend\",\n\t\"comment:beforeCreate\",\n\t\"comment:moderate\",\n\t\"comment:afterCreate\",\n\t\"comment:afterModerate\",\n\t\"page:metadata\",\n\t\"page:fragments\",\n] as const;\n\n/**\n * Structured hook entry for manifest — name plus optional metadata.\n * During a transition period, both plain strings and objects are accepted.\n */\nconst manifestHookEntrySchema = z.object({\n\tname: z.enum(HOOK_NAMES),\n\texclusive: z.boolean().optional(),\n\tpriority: z.number().int().optional(),\n\ttimeout: z.number().int().positive().optional(),\n});\n\n/**\n * Structured route entry for manifest — name plus optional metadata.\n * Both plain strings and objects are accepted; strings are normalized\n * to `{ name }` objects via `normalizeManifestRoute()`.\n */\n/** Route names must be safe path segments — alphanumeric, hyphens, underscores, forward slashes */\nconst routeNamePattern = /^[a-zA-Z0-9][a-zA-Z0-9_\\-/]*$/;\n\nconst manifestRouteEntrySchema = z.object({\n\tname: z.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\tpublic: z.boolean().optional(),\n});\n\n// ── Sub-schemas ─────────────────────────────────────────────────\n\n/** Index field names must be valid identifiers to prevent SQL injection via JSON path expressions */\nconst indexFieldName = z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/);\n\nconst storageCollectionSchema = z.object({\n\tindexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])),\n\tuniqueIndexes: z.array(z.union([indexFieldName, z.array(indexFieldName)])).optional(),\n});\n\nconst baseSettingFields = {\n\tlabel: z.string(),\n\tdescription: z.string().optional(),\n};\n\nconst settingFieldSchema = z.discriminatedUnion(\"type\", [\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"string\"),\n\t\tdefault: z.string().optional(),\n\t\tmultiline: z.boolean().optional(),\n\t}),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"number\"),\n\t\tdefault: z.number().optional(),\n\t\tmin: z.number().optional(),\n\t\tmax: z.number().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"boolean\"), default: z.boolean().optional() }),\n\tz.object({\n\t\t...baseSettingFields,\n\t\ttype: z.literal(\"select\"),\n\t\toptions: z.array(z.object({ value: z.string(), label: z.string() })),\n\t\tdefault: z.string().optional(),\n\t}),\n\tz.object({ ...baseSettingFields, type: z.literal(\"secret\") }),\n]);\n\nconst adminPageSchema = z.object({\n\tpath: z.string(),\n\tlabel: z.string(),\n\ticon: z.string().optional(),\n});\n\nconst dashboardWidgetSchema = z.object({\n\tid: z.string(),\n\tsize: z.enum([\"full\", \"half\", \"third\"]).optional(),\n\ttitle: z.string().optional(),\n});\n\nconst pluginAdminConfigSchema = z.object({\n\tentry: z.string().optional(),\n\tsettingsSchema: z.record(z.string(), settingFieldSchema).optional(),\n\tpages: z.array(adminPageSchema).optional(),\n\twidgets: z.array(dashboardWidgetSchema).optional(),\n\tfieldWidgets: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string().min(1),\n\t\t\t\tlabel: z.string().min(1),\n\t\t\t\tfieldTypes: z.array(z.enum(FIELD_TYPES)),\n\t\t\t\telements: z\n\t\t\t\t\t.array(\n\t\t\t\t\t\tz\n\t\t\t\t\t\t\t.object({\n\t\t\t\t\t\t\t\ttype: z.string(),\n\t\t\t\t\t\t\t\taction_id: z.string(),\n\t\t\t\t\t\t\t\tlabel: z.string().optional(),\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.passthrough(),\n\t\t\t\t\t)\n\t\t\t\t\t.optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\n// ── Main schema ─────────────────────────────────────────────────\n\n/**\n * Zod schema matching the PluginManifest interface from types.ts.\n *\n * Every JSON.parse of a manifest.json should validate through this.\n */\nexport const pluginManifestSchema = z.object({\n\tid: z.string().min(1),\n\tversion: z.string().min(1),\n\tcapabilities: z.array(z.enum(PLUGIN_CAPABILITIES)),\n\tallowedHosts: z.array(z.string()),\n\tstorage: z.record(z.string(), storageCollectionSchema),\n\t/**\n\t * Hook declarations — accepts both plain name strings (legacy) and\n\t * structured objects with exclusive/priority/timeout metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\thooks: z.array(z.union([z.enum(HOOK_NAMES), manifestHookEntrySchema])),\n\t/**\n\t * Route declarations — accepts both plain name strings and\n\t * structured objects with public metadata.\n\t * Plain strings are normalized to `{ name }` objects after parsing.\n\t */\n\troutes: z.array(\n\t\tz.union([\n\t\t\tz.string().min(1).regex(routeNamePattern, \"Route name must be a safe path segment\"),\n\t\t\tmanifestRouteEntrySchema,\n\t\t]),\n\t),\n\tadmin: pluginAdminConfigSchema,\n});\n\nexport type ValidatedPluginManifest = z.infer<typeof pluginManifestSchema>;\n\n/**\n * Normalize a manifest hook entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestHook(\n\tentry: string | { name: string; exclusive?: boolean; priority?: number; timeout?: number },\n): { name: string; exclusive?: boolean; priority?: number; timeout?: number } {\n\tif (typeof entry === \"string\") {\n\t\treturn { name: entry };\n\t}\n\treturn entry;\n}\n\n/**\n * Normalize a manifest route entry — plain strings become `{ name }` objects.\n */\nexport function normalizeManifestRoute(entry: string | { name: string; public?: boolean }): {\n\tname: string;\n\tpublic?: boolean;\n} {\n\tif (typeof entry === \"string\") {\n\t\treturn { name: entry };\n\t}\n\treturn entry;\n}\n"],"mappings":";;;;;;;;;;;;AAcA,MAAa,sBAAsB;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;AAGD,MAAM,cAAc;CACnB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AAED,MAAa,aAAa;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;AAMD,MAAM,0BAA0B,EAAE,OAAO;CACxC,MAAM,EAAE,KAAK,WAAW;CACxB,WAAW,EAAE,SAAS,CAAC,UAAU;CACjC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;CACrC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU;CAC/C,CAAC;;;;;;;AAQF,MAAM,mBAAmB;AAEzB,MAAM,2BAA2B,EAAE,OAAO;CACzC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC;CACzF,QAAQ,EAAE,SAAS,CAAC,UAAU;CAC9B,CAAC;;AAKF,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,0BAA0B;AAElE,MAAM,0BAA0B,EAAE,OAAO;CACxC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC;CACpE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU;CACrF,CAAC;AAEF,MAAM,oBAAoB;CACzB,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACvD,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,WAAW,EAAE,SAAS,CAAC,UAAU;EACjC,CAAC;CACF,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,KAAK,EAAE,QAAQ,CAAC,UAAU;EAC1B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,UAAU;EAAE,SAAS,EAAE,SAAS,CAAC,UAAU;EAAE,CAAC;CAC/F,EAAE,OAAO;EACR,GAAG;EACH,MAAM,EAAE,QAAQ,SAAS;EACzB,SAAS,EAAE,MAAM,EAAE,OAAO;GAAE,OAAO,EAAE,QAAQ;GAAE,OAAO,EAAE,QAAQ;GAAE,CAAC,CAAC;EACpE,SAAS,EAAE,QAAQ,CAAC,UAAU;EAC9B,CAAC;CACF,EAAE,OAAO;EAAE,GAAG;EAAmB,MAAM,EAAE,QAAQ,SAAS;EAAE,CAAC;CAC7D,CAAC;AAEF,MAAM,kBAAkB,EAAE,OAAO;CAChC,MAAM,EAAE,QAAQ;CAChB,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC3B,CAAC;AAEF,MAAM,wBAAwB,EAAE,OAAO;CACtC,IAAI,EAAE,QAAQ;CACd,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAQ;EAAQ,CAAC,CAAC,UAAU;CAClD,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAM,0BAA0B,EAAE,OAAO;CACxC,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC5B,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,UAAU;CACnE,OAAO,EAAE,MAAM,gBAAgB,CAAC,UAAU;CAC1C,SAAS,EAAE,MAAM,sBAAsB,CAAC,UAAU;CAClD,cAAc,EACZ,MACA,EAAE,OAAO;EACR,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE;EACvB,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;EACxB,YAAY,EAAE,MAAM,EAAE,KAAK,YAAY,CAAC;EACxC,UAAU,EACR,MACA,EACE,OAAO;GACP,MAAM,EAAE,QAAQ;GAChB,WAAW,EAAE,QAAQ;GACrB,OAAO,EAAE,QAAQ,CAAC,UAAU;GAC5B,CAAC,CACD,aAAa,CACf,CACA,UAAU;EACZ,CAAC,CACF,CACA,UAAU;CACZ,CAAC;;;;;;AASF,MAAa,uBAAuB,EAAE,OAAO;CAC5C,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;CACrB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,cAAc,EAAE,MAAM,EAAE,KAAK,oBAAoB,CAAC;CAClD,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC;CACjC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB;CAMtD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,WAAW,EAAE,wBAAwB,CAAC,CAAC;CAMtE,QAAQ,EAAE,MACT,EAAE,MAAM,CACP,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,yCAAyC,EACnF,yBACA,CAAC,CACF;CACD,OAAO;CACP,CAAC;;;;AAmBF,SAAgB,uBAAuB,OAGrC;AACD,KAAI,OAAO,UAAU,SACpB,QAAO,EAAE,MAAM,OAAO;AAEvB,QAAO"}