emdash 0.28.1 → 0.30.0

package/dist/{menus-b2T4clbO.mjs → menus-BcyElFtI.mjs}

@@ -1,21 +1,144 @@
 import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
 import { n as cachedQuery, t as CacheNamespace } from "./object-cache-Bok5j2ae.mjs";
-import { t as CommentRepository } from "./comment-CzeatwBV.mjs";
-import { t as OptionsRepository } from "./options-DTTML-Tx.mjs";
-import { t as PluginContextFactory } from "./context-BRIpHARC.mjs";
-import { r as requestCached } from "./request-cache-KCNHp_RJ.mjs";
-import { a as getDb } from "./loader-CB6YHeul.mjs";
-import { i as resolveLocaleChain, r as resolveLocale } from "./resolve-DR3wqMTy.mjs";
-import { a as normalizeCapabilities } from "./types-DROWRxYV.mjs";
-import { dt as sanitizeHref } from "./redirects-DXEXBAII.mjs";
-import { t as extractRequestMeta } from "./request-meta-DbvXaAvU.mjs";
-import { r as setCronTasksEnabled } from "./cron-v4FTEFR_.mjs";
-import { t as CommentReactionRepository } from "./comment-reaction-Cj9QJY7I.mjs";
+import { a as encodeCursor, i as decodeCursor } from "./types-D1iJ3DpO.mjs";
+import { t as CommentRepository } from "./comment-DPT0WKyd.mjs";
+import { t as OptionsRepository } from "./options-BlmBHTvX.mjs";
+import { t as PluginContextFactory } from "./context-B6hc7zJL.mjs";
+import { r as requestCached } from "./request-cache-BSUptuJR.mjs";
+import { i as resolveLocaleChain, r as resolveLocale } from "./resolve-Cd9dzclN.mjs";
+import { a as getDb } from "./loader-Be3ouI5L.mjs";
+import { a as normalizeCapabilities } from "./types-CK0LxPUQ.mjs";
+import { dt as sanitizeHref } from "./redirects-BBq3n2Rj.mjs";
+import { t as extractRequestMeta } from "./request-meta-DzXYYI-n.mjs";
+import { r as setCronTasksEnabled } from "./cron-BlKIMD_e.mjs";
+import { t as CommentReactionRepository } from "./comment-reaction-C65MldIB.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "astro/zod";
 
+//#region src/database/repositories/audit.ts
+/**
+* Audit repository for logging system events
+*
+* Tracks user actions for security, debugging, and compliance.
+* All mutations should create an audit log entry.
+*/
+var AuditRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	/**
+	* Create an audit log entry
+	*/
+	async log(input) {
+		const id = ulid();
+		const row = {
+			id,
+			actor_id: input.actorId ?? null,
+			actor_ip: input.actorIp ?? null,
+			action: input.action,
+			resource_type: input.resourceType ?? null,
+			resource_id: input.resourceId ?? null,
+			details: input.details ? JSON.stringify(input.details) : null,
+			status: input.status ?? null
+		};
+		await this.db.insertInto("audit_logs").values(row).execute();
+		const log = await this.findById(id);
+		if (!log) throw new Error("Failed to create audit log");
+		return log;
+	}
+	/**
+	* Find audit log by ID
+	*/
+	async findById(id) {
+		const row = await this.db.selectFrom("audit_logs").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? this.rowToAuditLog(row) : null;
+	}
+	/**
+	* Query audit logs with filters and cursor-based pagination
+	*/
+	async findMany(query = {}) {
+		const limit = Math.min(Math.max(1, query.limit || 50), 100);
+		let q = this.db.selectFrom("audit_logs").selectAll().orderBy("timestamp", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
+		if (query.action) q = q.where("action", "=", query.action);
+		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
+		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
+		if (query.status) q = q.where("status", "=", query.status);
+		if (query.since) q = q.where("timestamp", ">=", query.since);
+		if (query.until) q = q.where("timestamp", "<=", query.until);
+		if (query.cursor) {
+			const decoded = decodeCursor(query.cursor);
+			q = q.where((eb) => eb.or([eb("timestamp", "<", decoded.orderValue), eb.and([eb("timestamp", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		const rows = await q.execute();
+		const items = rows.slice(0, limit).map((row) => this.rowToAuditLog(row));
+		const result = { items };
+		if (rows.length > limit && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.timestamp, last.id);
+		}
+		return result;
+	}
+	/**
+	* Get all logs for a specific resource
+	*/
+	async findByResource(resourceType, resourceId, options = {}) {
+		let query = this.db.selectFrom("audit_logs").selectAll().where("resource_type", "=", resourceType).where("resource_id", "=", resourceId).orderBy("timestamp", "desc");
+		if (options.limit) query = query.limit(options.limit);
+		return (await query.execute()).map((row) => this.rowToAuditLog(row));
+	}
+	/**
+	* Get all logs for a specific user
+	*/
+	async findByActor(actorId, options = {}) {
+		let query = this.db.selectFrom("audit_logs").selectAll().where("actor_id", "=", actorId).orderBy("timestamp", "desc");
+		if (options.since) query = query.where("timestamp", ">=", options.since);
+		if (options.limit) query = query.limit(options.limit);
+		return (await query.execute()).map((row) => this.rowToAuditLog(row));
+	}
+	/**
+	* Count logs matching a query
+	*/
+	async count(query = {}) {
+		let q = this.db.selectFrom("audit_logs").select((eb) => eb.fn.count("id").as("count"));
+		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
+		if (query.action) q = q.where("action", "=", query.action);
+		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
+		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
+		if (query.status) q = q.where("status", "=", query.status);
+		if (query.since) q = q.where("timestamp", ">=", query.since);
+		if (query.until) q = q.where("timestamp", "<=", query.until);
+		const result = await q.executeTakeFirst();
+		return Number(result?.count || 0);
+	}
+	/**
+	* Delete old audit logs (for retention policy)
+	*/
+	async deleteOlderThan(date) {
+		const result = await this.db.deleteFrom("audit_logs").where("timestamp", "<", date).executeTakeFirst();
+		return Number(result.numDeletedRows ?? 0);
+	}
+	/**
+	* Convert database row to AuditLog object
+	*/
+	rowToAuditLog(row) {
+		return {
+			id: row.id,
+			timestamp: row.timestamp,
+			actorId: row.actor_id,
+			actorIp: row.actor_ip,
+			action: row.action,
+			resourceType: row.resource_type,
+			resourceId: row.resource_id,
+			details: row.details ? JSON.parse(row.details) : null,
+			status: row.status
+		};
+	}
+};
+
+//#endregion
 //#region src/fields/image.ts
 const imageSchema = z.object({
 	id: z.string(),
@@ -401,6 +524,24 @@ function portableTextToProsemirror(blocks) {
 				} else break;
 			}
 			content.push(convertList(listBlocks, listType));
+		} else if (isTextBlock(block) && block.style === "blockquote") {
+			const quoteBlocks = [];
+			while (i < blocks.length) {
+				const current = blocks[i];
+				if (!isTextBlock(current) || current.style !== "blockquote" || current.listItem !== void 0) break;
+				quoteBlocks.push(current);
+				i++;
+			}
+			content.push({
+				type: "blockquote",
+				content: quoteBlocks.map((quoteBlock) => {
+					const paragraph = convertSpans(quoteBlock.children, quoteBlock.markDefs || []);
+					return {
+						type: "paragraph",
+						content: paragraph.length > 0 ? paragraph : void 0
+					};
+				})
+			});
 		} else {
 			const converted = convertBlock(block);
 			if (converted) content.push(converted);
@@ -684,6 +825,7 @@ function convertCodeBlock(block) {
 * annotation from `emdash/plugin`. See the `emdash` changeset for the
 * authoring shape.
 */
+const MCP_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
 /**
 * Define a native EmDash plugin.
 *
@@ -735,15 +877,23 @@ function defineNativePlugin(definition) {
 	const SIMPLE_ID = /^[a-z0-9-]+$/;
 	const SCOPED_ID = /^@[a-z0-9-]+\/[a-z0-9-]+$/;
 	const SEMVER_PATTERN = /^\d+\.\d+\.\d+/;
-	const { id, version, capabilities = [], allowedHosts = [], hooks = {}, routes = {}, admin = {} } = definition;
+	const { id, version, capabilities = [], allowedHosts = [], hooks = {}, routes = {}, mcp = { tools: {} }, admin = {} } = definition;
 	const storage = definition.storage ?? {};
 	if (!SIMPLE_ID.test(id) && !SCOPED_ID.test(id)) throw new Error(`Invalid plugin id "${id}". Must be lowercase alphanumeric with dashes (e.g., "my-plugin" or "@scope/my-plugin").`);
 	if (!SEMVER_PATTERN.test(version)) throw new Error(`Invalid plugin version "${version}". Must be semver format (e.g., "1.0.0").`);
+	for (const [name, tool] of Object.entries(mcp.tools)) {
+		if (!MCP_TOOL_NAME_PATTERN.test(name)) throw new Error(`Invalid MCP tool name "${name}" in plugin "${id}".`);
+		const route = routes[tool.route];
+		if (!route) throw new Error(`MCP tool "${name}" references unknown route "${tool.route}".`);
+		if (route.public) throw new Error(`MCP tool "${name}" cannot reference a public route.`);
+		if (!route.permission) throw new Error(`MCP route "${tool.route}" must declare a permission.`);
+	}
 	const validCapabilities = new Set([
 		"network:request",
 		"network:request:unrestricted",
 		"content:read",
 		"content:write",
+		"taxonomies:read",
 		"media:read",
 		"media:write",
 		"users:read",
@@ -776,6 +926,7 @@ function defineNativePlugin(definition) {
 		storage,
 		hooks: resolveHooks(hooks, id),
 		routes,
+		mcp,
 		admin
 	};
 }
@@ -1957,6 +2108,17 @@ function guardConsumedRequestBody(request) {
 	} });
 }
 /**
+* Build RouteMeta from a route's `public`/`cacheControl` flags. Single source
+* of truth for the "cacheControl is only ever exposed on public routes"
+* invariant — used for trusted routes and manifest-declared sandboxed routes.
+*/
+function buildRouteMeta(route) {
+	const meta = { public: route.public === true };
+	if (route.permission !== void 0) meta.permission = route.permission;
+	if (meta.public && typeof route.cacheControl === "string" && route.cacheControl.length > 0) meta.cacheControl = route.cacheControl;
+	return meta;
+}
+/**
 * Route handler for a plugin
 */
 var PluginRouteHandler = class {
@@ -2047,7 +2209,7 @@ var PluginRouteHandler = class {
 	getRouteMeta(name) {
 		const route = this.plugin.routes[name];
 		if (!route) return null;
-		return { public: route.public === true };
+		return buildRouteMeta(route);
 	}
 };
 /**
@@ -3065,5 +3227,5 @@ async function resolveTaxonomyUrl(referenceGroup, db, locale) {
 }
 
 //#endregion
-export { file as C, reference as S, resolveExclusiveHooks as _, SandboxUnavailableError as a, prosemirrorToPortableText as b, createNoopSandboxRunner as c, createPluginManager as d, PluginRouteError as f, createHookPipeline as g, HookPipeline as h, getComments as i, NodeCronScheduler as l, EmailPipeline as m, getMenus as n, NoopSandboxRunner as o, PluginRouteRegistry as p, getCommentCount as r, SandboxNotAvailableError as s, getMenu as t, PluginManager as u, definePlugin as v, image as w, portableText as x, portableTextToProsemirror as y };
-//# sourceMappingURL=menus-b2T4clbO.mjs.map
+export { reference as C, AuditRepository as E, portableText as S, image as T, createHookPipeline as _, SandboxUnavailableError as a, portableTextToProsemirror as b, createNoopSandboxRunner as c, createPluginManager as d, PluginRouteError as f, HookPipeline as g, EmailPipeline as h, getComments as i, NodeCronScheduler as l, buildRouteMeta as m, getMenus as n, NoopSandboxRunner as o, PluginRouteRegistry as p, getCommentCount as r, SandboxNotAvailableError as s, getMenu as t, PluginManager as u, resolveExclusiveHooks as v, file as w, prosemirrorToPortableText as x, definePlugin as y };
+//# sourceMappingURL=menus-BcyElFtI.mjs.map