emdash 0.14.0 → 0.15.0

package/src/loader.ts

@@ -471,7 +471,7 @@ export async function getDb(): Promise<Kysely<Database>> {
 	// Per-request DB override via ALS (normal mode)
 	const ctx = getRequestContext();
 	if (ctx?.db) {
-		return ctx.db as Kysely<Database>; // eslint-disable-line typescript-eslint(no-unsafe-type-assertion) -- db is typed as unknown in RequestContext to avoid circular deps
+		return ctx.db as Kysely<Database>; // eslint-disable-line typescript/no-unsafe-type-assertion -- db is typed as unknown in RequestContext to avoid circular deps
 	}
 
 	if (!dbInstance) {

package/src/mcp/server.ts

@@ -511,12 +511,12 @@ export function createMcpServer(): McpServer {
 			if (result.success && !canReadDrafts(extra)) {
 				const data =
 					result.data && typeof result.data === "object"
-						? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown data; narrowed by typeof check
+						? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check
 							(result.data as Record<string, unknown>)
 						: undefined;
 				const item =
 					data?.item && typeof data.item === "object"
-						? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowed by typeof check
+						? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check
 							(data.item as Record<string, unknown>)
 						: undefined;
 				const status = typeof item?.status === "string" ? item.status : null;
@@ -1140,7 +1140,7 @@ export function createMcpServer(): McpServer {
 			if (result.success && !canReadDrafts(extra)) {
 				const data =
 					result.data && typeof result.data === "object"
-						? // eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler returns unknown data; narrowed by typeof check
+						? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check
 							(result.data as Record<string, unknown>)
 						: undefined;
 				const translations = Array.isArray(data?.translations) ? data.translations : [];

package/src/media/mime.ts

@@ -1,5 +1,5 @@
 export function normalizeMime(mime: string): string {
-	return mime.split(";")[0]!.trim().toLowerCase();
+	return mime.split(";")[0].trim().toLowerCase();
 }
 
 export function matchesMimeAllowlist(mime: string, allowList: readonly string[]): boolean {

package/src/page/absolute-url.ts

@@ -44,7 +44,7 @@ const OTHER_SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
  * exploitable, plus more pathological shapes like leading newlines that
  * could inject across header boundaries downstream.
  */
-// eslint-disable-next-line eslint(no-control-regex) -- intentional: rejecting control chars is the whole point of this regex
+// eslint-disable-next-line no-control-regex -- intentional: rejecting control chars is the whole point of this regex
 const WHITESPACE_OR_CONTROL_RE = /[\s\u0000-\u001f\u007f-\u009f]/;
 const TRAILING_SLASH_RE = /\/$/;
 

package/src/plugins/adapt-sandbox-entry.ts

@@ -11,7 +11,7 @@
  */
 
 import type { PluginDescriptor } from "../astro/integration/runtime.js";
-import type { SandboxedPlugin } from "../plugin-types.js";
+import type { RouteEntry, RouteHandler, SandboxedPlugin } from "../plugin-types.js";
 import { PLUGIN_CAPABILITIES, HOOK_NAMES } from "./manifest-schema.js";
 import { normalizeCapabilities } from "./types.js";
 import type {
@@ -96,6 +96,31 @@ function resolveSandboxedHook(entry: AnyHookEntry, pluginId: string): ResolvedHo
 	};
 }
 
+/**
+ * Normalise a `RouteEntry` (bare handler or `{ handler, public?, input? }`
+ * config) to the config form. The `input` schema is intentionally typed
+ * `unknown` in `RouteEntry` — sandboxed plugins describe it loosely
+ * because the strict `z.ZodType<TInput>` constraint of the runtime's
+ * `PluginRoute` only narrows once the route is wired into the router.
+ * The wider type flows through to the runtime which validates at
+ * invocation time.
+ */
+function normalizeRouteEntry(entry: RouteEntry): {
+	handler: RouteHandler;
+	public?: boolean;
+	input?: PluginRoute["input"];
+} {
+	if (typeof entry === "function") {
+		return { handler: entry };
+	}
+	return {
+		handler: entry.handler,
+		public: entry.public,
+		// eslint-disable-next-line typescript-eslint/no-unsafe-type-assertion -- RouteEntry.input is intentionally `unknown` (sandboxed plugins) and validated by the runtime at invocation time
+		input: entry.input as PluginRoute["input"],
+	};
+}
+
 const VALID_CAPABILITIES_SET = new Set<string>(PLUGIN_CAPABILITIES);
 
 const VALID_HOOK_NAMES_SET = new Set<string>(HOOK_NAMES);
@@ -136,9 +161,13 @@ export function adaptSandboxEntry(
 	// Resolve hooks. `SandboxedPlugin.hooks` is keyed by hook name with
 	// per-key entry types; iterating with `Object.entries` collapses
 	// keys to `string`, so we treat each entry as the union `AnyHookEntry`
-	// for the duration of the loop.
+	// for the duration of the loop. The widening from the strict mapped
+	// type to a plain record is sound because each entry still matches
+	// one of the bare-handler / config-object shapes captured by
+	// `AnyHookEntry`.
 	const resolvedHooks: ResolvedPluginHooks = {};
 	if (definition.hooks) {
+		// eslint-disable-next-line typescript-eslint/no-unsafe-type-assertion -- widening the strict mapped type to a string-keyed record for iteration; entries still match AnyHookEntry
 		const hookMap = definition.hooks as Record<string, AnyHookEntry>;
 		for (const [hookName, entry] of Object.entries(hookMap)) {
 			if (!VALID_HOOK_NAMES_SET.has(hookName)) {
@@ -166,49 +195,25 @@ export function adaptSandboxEntry(
 	const resolvedRoutes: Record<string, PluginRoute> = {};
 	if (definition.routes) {
 		for (const [routeName, rawEntry] of Object.entries(definition.routes)) {
-			const isConfig = typeof rawEntry === "object" && rawEntry !== null && "handler" in rawEntry;
-			const handler = isConfig
-				? (rawEntry as { handler: (...args: unknown[]) => Promise<unknown> }).handler
-				: (rawEntry as (...args: unknown[]) => Promise<unknown>);
-			const publicFlag = isConfig ? (rawEntry as { public?: boolean }).public : undefined;
-			const inputSchema = isConfig ? (rawEntry as { input?: unknown }).input : undefined;
+			const normalized = normalizeRouteEntry(rawEntry);
+			const { handler, public: publicFlag, input: inputSchema } = normalized;
 			resolvedRoutes[routeName] = {
-				// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- route entry.input is intentionally loosely typed; callers validate at runtime
-				input: inputSchema as PluginRoute["input"],
+				input: inputSchema,
 				public: publicFlag,
 				handler: async (ctx) => {
-					// In-process, `ctx.request` is a real WHATWG `Request`
-					// with a `Headers` object. The author-facing
-					// `SandboxedRequest` type promises a plain
-					// `Record<string, string>` (the shape the sandbox's
-					// serialised form delivers). Normalise so handlers
-					// behave the same in-process and in-isolate.
+					// `ctx.request` is a real WHATWG `Request` (this is the
+					// in-process adapter; the worker-sandbox adapter handles
+					// the serialised case). Flatten `Headers` to the plain
+					// `Record<string, string>` shape that author-facing
+					// `SandboxedRequest` promises so handler bodies are
+					// identical across both adapters.
 					const headers: Record<string, string> = {};
-					if (ctx.request && typeof ctx.request === "object") {
-						const h: unknown = (ctx.request as { headers?: unknown }).headers;
-						if (h && typeof h === "object") {
-							if (typeof (h as Headers).forEach === "function") {
-								(h as Headers).forEach((value, name) => {
-									headers[name] = value;
-								});
-							} else {
-								for (const [name, value] of Object.entries(h as Record<string, string>)) {
-									headers[name] = value;
-								}
-							}
-						}
-					}
+					ctx.request.headers.forEach((value, name) => {
+						headers[name] = value;
+					});
 					const requestShape = {
-						url:
-							(ctx.request as { url?: unknown } | undefined)?.url &&
-							typeof (ctx.request as { url: unknown }).url === "string"
-								? (ctx.request as { url: string }).url
-								: "",
-						method:
-							(ctx.request as { method?: unknown } | undefined)?.method &&
-							typeof (ctx.request as { method: unknown }).method === "string"
-								? (ctx.request as { method: string }).method
-								: "GET",
+						url: ctx.request.url,
+						method: ctx.request.method,
 						headers,
 					};
 					const routeCtx = {

package/src/plugins/email-console.ts

@@ -33,7 +33,7 @@ export interface StoredEmail {
 const GLOBAL_KEY = Symbol.for("emdash:dev-emails");
 const g = globalThis as Record<symbol, unknown>;
 const storedEmails: StoredEmail[] = (() => {
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- globalThis singleton pattern (see request-context.ts)
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)
 	const existing = g[GLOBAL_KEY] as StoredEmail[] | undefined;
 	if (existing) return existing;
 	const fresh: StoredEmail[] = [];

package/src/plugins/index.ts

@@ -67,6 +67,7 @@ export type { PluginManagerOptions, PluginState } from "./manager.js";
 export {
 	NoopSandboxRunner,
 	SandboxNotAvailableError,
+	SandboxUnavailableError,
 	createNoopSandboxRunner,
 } from "./sandbox/index.js";
 export type {

package/src/plugins/marketplace.ts

@@ -509,7 +509,7 @@ export async function extractBundle(tarballBytes: Uint8Array): Promise<PluginBun
 	}
 
 	// Compute SHA-256 checksum of the tarball for verification
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Uint8Array is a valid BufferSource at runtime; TS lib mismatch
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Uint8Array is a valid BufferSource at runtime; TS lib mismatch
 	const hashBuffer = await crypto.subtle.digest("SHA-256", tarballBytes as unknown as BufferSource);
 	const hashArray = new Uint8Array(hashBuffer);
 	const checksum = Array.from(hashArray, (b) => b.toString(16).padStart(2, "0")).join("");

package/src/plugins/sandbox/index.ts

@@ -4,6 +4,7 @@
  */
 
 export { NoopSandboxRunner, SandboxNotAvailableError, createNoopSandboxRunner } from "./noop.js";
+export { SandboxUnavailableError } from "./types.js";
 
 export type {
 	SandboxRunner,

package/src/plugins/sandbox/noop.ts

@@ -15,9 +15,10 @@ import type { SandboxRunner, SandboxedPluginInstance, SandboxOptions } from "./t
 export class SandboxNotAvailableError extends Error {
 	constructor() {
 		super(
-			"Plugin sandboxing is not available on this platform. " +
-				"Sandboxed plugins require Cloudflare Workers with Worker Loader. " +
-				"Use trusted plugins (from config) instead, or deploy to Cloudflare.",
+			"Plugin sandboxing is not available. " +
+				"Configure a sandbox runner: use @emdash-cms/cloudflare/sandbox on Cloudflare, " +
+				"or @emdash-cms/sandbox-workerd/sandbox on Node.js (requires workerd). " +
+				"Without sandboxing, use trusted plugins (from config) instead.",
 		);
 		this.name = "SandboxNotAvailableError";
 	}
@@ -40,6 +41,13 @@ export class NoopSandboxRunner implements SandboxRunner {
 		return false;
 	}
 
+	/**
+	 * Always returns false - no sandbox runtime to be healthy.
+	 */
+	isHealthy(): boolean {
+		return false;
+	}
+
 	/**
 	 * Always throws - can't load sandboxed plugins without isolation.
 	 */

package/src/plugins/sandbox/types.ts

@@ -75,6 +75,15 @@ export interface SandboxOptions {
 	siteInfo?: { name: string; url: string; locale: string };
 	/** Email send callback, wired from the EmailPipeline by the runtime */
 	emailSend?: SandboxEmailSendCallback;
+	/**
+	 * Media storage adapter for sandboxed plugin uploads and deletes.
+	 * When provided, plugins with write:media can upload and delete files
+	 * via ctx.media.upload() and ctx.media.delete().
+	 */
+	mediaStorage?: {
+		upload(options: { key: string; body: Uint8Array; contentType: string }): Promise<unknown>;
+		delete(key: string): Promise<unknown>;
+	};
 }
 
 /**
@@ -137,6 +146,14 @@ export interface SandboxRunner {
 	 */
 	isAvailable(): boolean;
 
+	/**
+	 * Check if the sandbox runtime is currently healthy.
+	 * For in-process runners this always returns true.
+	 * For sidecar-based runners (workerd), returns false if the
+	 * child process has crashed and hasn't been restarted yet.
+	 */
+	isHealthy(): boolean;
+
 	/**
 	 * Load a sandboxed plugin from code.
 	 *
@@ -161,6 +178,17 @@ export interface SandboxRunner {
 	terminateAll(): Promise<void>;
 }
 
+/**
+ * Error thrown when the sandbox runtime is unavailable.
+ * This happens when the sidecar process has crashed or hasn't started.
+ */
+export class SandboxUnavailableError extends Error {
+	constructor(pluginId: string, reason: string) {
+		super(`Plugin sandbox unavailable for ${pluginId}: ${reason}`);
+		this.name = "SandboxUnavailableError";
+	}
+}
+
 /**
  * Factory function type for creating sandbox runners.
  * Exported by platform adapters (e.g., @emdash-cms/adapter-cloudflare/sandbox).

package/src/query.ts

@@ -715,9 +715,24 @@ async function hydrateEntryBylines<D>(type: string, entries: ContentEntry<D>[]):
 			.map((e) => {
 				const data = entryData(e);
 				const id = dataStr(data, "id");
-				return id ? { id, authorId: dataStr(data, "authorId") || null } : null;
+				if (!id) return null;
+				return {
+					id,
+					authorId: dataStr(data, "authorId") || null,
+					primaryBylineId: dataStr(data, "primaryBylineId") || null,
+					locale: dataStr(data, "locale") || null,
+				};
 			})
-			.filter((r): r is { id: string; authorId: string | null } => r !== null);
+			.filter(
+				(
+					r,
+				): r is {
+					id: string;
+					authorId: string | null;
+					primaryBylineId: string | null;
+					locale: string | null;
+				} => r !== null,
+			);
 		if (refs.length === 0) return;
 
 		const bylinesMap = await getBylinesForEntries(type, refs);

package/src/registry/config.ts

@@ -130,7 +130,7 @@ export function parseDurationSeconds(duration: string | number): number {
 		);
 	}
 
-	const value = parseInt(match[1]!, 10);
+	const value = parseInt(match[1], 10);
 	const unit = match[2];
 
 	switch (unit) {

package/src/request-cache.ts

@@ -22,7 +22,7 @@ type CacheStore = WeakMap<EmDashRequestContext, Map<string, Promise<unknown>>>;
 const STORE_KEY = Symbol.for("emdash:request-cache");
 const g = globalThis as Record<symbol, unknown>;
 const store: CacheStore =
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- globalThis singleton pattern (see request-context.ts)
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)
 	(g[STORE_KEY] as CacheStore | undefined) ??
 	(() => {
 		const wm: CacheStore = new WeakMap();
@@ -50,7 +50,7 @@ export function requestCached<T>(key: string, fn: () => Promise<T>): Promise<T>
 	const existing = cache.get(key);
 	if (existing) {
 		if (ctx.metrics) ctx.metrics.cacheHits += 1;
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- heterogeneous cache; key namespacing guarantees the stored promise resolves to T
+		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- heterogeneous cache; key namespacing guarantees the stored promise resolves to T
 		return existing as Promise<T>;
 	}
 	if (ctx.metrics) ctx.metrics.cacheMisses += 1;
@@ -80,7 +80,7 @@ export function peekRequestCache<T>(key: string): Promise<T> | undefined {
 	const ctx = getRequestContext();
 	if (!ctx) return undefined;
 	const cache = store.get(ctx);
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- heterogeneous cache; caller is responsible for using a T-compatible key
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- heterogeneous cache; caller is responsible for using a T-compatible key
 	return cache?.get(key) as Promise<T> | undefined;
 }
 

package/src/request-context.ts

@@ -99,7 +99,7 @@ export interface EmDashRequestContext {
 const ALS_KEY = Symbol.for("emdash:request-context");
 
 const storage: AsyncLocalStorage<EmDashRequestContext> =
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- globalThis singleton pattern
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern
 	((globalThis as Record<symbol, unknown>)[ALS_KEY] as
 		| AsyncLocalStorage<EmDashRequestContext>
 		| undefined) ??

package/src/settings/index.ts

@@ -44,7 +44,7 @@ interface SiteSettingsHolder {
 const SITE_SETTINGS_CACHE_KEY = Symbol.for("emdash:site-settings");
 const g = globalThis as Record<symbol, unknown>;
 const holder: SiteSettingsHolder =
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- globalThis singleton pattern (see request-context.ts)
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)
 	(g[SITE_SETTINGS_CACHE_KEY] as SiteSettingsHolder | undefined) ??
 	(() => {
 		const h: SiteSettingsHolder = { version: 0, cached: null, cachedVersion: -1 };
@@ -174,19 +174,19 @@ export async function getSiteSettingWithDb<K extends SiteSettingKey>(
 	// We use the non-generic getSiteSettingsWithDb for media resolution instead.
 	if ((key === "logo" || key === "favicon") && isMediaReference(value)) {
 		const resolved = await resolveMediaReference(value, db, storage);
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- TS can't narrow generic K from key equality; resolved type is correct
+		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- TS can't narrow generic K from key equality; resolved type is correct
 		return resolved as SiteSettings[K] | undefined;
 	}
 
 	if (key === "seo" && value && typeof value === "object") {
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- TS can't narrow generic K from key equality
+		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- TS can't narrow generic K from key equality
 		const seo = value as SeoSettings;
 		if (seo.defaultOgImage) {
 			const resolved = {
 				...seo,
 				defaultOgImage: await resolveMediaReference(seo.defaultOgImage, db, storage),
 			};
-			// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- TS can't narrow generic K from key equality
+			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- TS can't narrow generic K from key equality
 			return resolved as SiteSettings[K] | undefined;
 		}
 	}

package/src/storage/local.ts

@@ -121,7 +121,7 @@ export class LocalStorage implements Storage {
 			// Convert Node.js stream to web ReadableStream
 			// Readable.toWeb returns ReadableStream (which is ReadableStream<unknown>),
 			// but Node ReadStreams produce Buffer/Uint8Array chunks
-			// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Readable.toWeb returns ReadableStream<unknown>; Node ReadStreams produce Uint8Array chunks
+			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Readable.toWeb returns ReadableStream<unknown>; Node ReadStreams produce Uint8Array chunks
 			const webStream: ReadableStream<Uint8Array> = Readable.toWeb(
 				nodeStream,
 			) as ReadableStream<Uint8Array>;

package/src/storage/s3.ts

@@ -134,7 +134,7 @@ export class S3Storage implements Storage {
 
 		// S3ClientConfig types `credentials` as required, but the SDK accepts
 		// omitted credentials at runtime (falls back to the provider chain).
-		/* eslint-disable typescript-eslint(no-unsafe-type-assertion) -- upstream @aws-sdk/client-s3 overstates required fields */
+		/* eslint-disable typescript/no-unsafe-type-assertion -- upstream @aws-sdk/client-s3 overstates required fields */
 		const clientConfig = {
 			endpoint: config.endpoint,
 			region: config.region || "auto",
@@ -149,7 +149,7 @@ export class S3Storage implements Storage {
 					}
 				: {}),
 		} as S3ClientConfig;
-		/* eslint-enable typescript-eslint(no-unsafe-type-assertion) */
+		/* eslint-enable typescript/no-unsafe-type-assertion */
 		this.client = new S3Client(clientConfig);
 	}
 
@@ -260,7 +260,7 @@ export class S3Storage implements Storage {
 
 	async list(options: ListOptions = {}): Promise<ListResult> {
 		try {
-			// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- S3 client.send returns generic output; narrowing to ListObjectsV2Response
+			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- S3 client.send returns generic output; narrowing to ListObjectsV2Response
 			const response = (await this.client.send(
 				new ListObjectsV2Command({
 					Bucket: this.bucket,

package/src/widgets/index.ts

@@ -55,7 +55,7 @@ export async function getWidgetArea(name: string): Promise<WidgetArea | null> {
 		// they're all non-null once w_id is (we match on widgets.area_id, so
 		// a widget row always has the not-null columns filled). Cast is the
 		// price of that structural fact.
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- left-join row is non-null when w_id is set; see above
+		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- left-join row is non-null when w_id is set; see above
 		const widgetRow = {
 			id: row.w_id,
 			type: row.w_type,