emdash 0.37.0 → 0.39.0

package/dist/types-FBBnGZ2Y.d.mts

@@ -0,0 +1,198 @@
+import * as react from "react";
+
+//#region src/auth/types.d.ts
+/**
+ * Auth Provider Types
+ *
+ * Defines the interfaces for pluggable authentication providers.
+ *
+ * Two systems coexist:
+ * - `AuthDescriptor` — transparent auth (Cloudflare Access) that authenticates
+ *   every request via headers/cookies. No login UI needed.
+ * - `AuthProviderDescriptor` — pluggable login methods (GitHub, Google,
+ *   AT Protocol, etc.) that appear as options on the login page and setup
+ *   wizard. Passkey is built-in; providers are additive.
+ */
+/**
+ * Result of authenticating a request via an external auth provider
+ */
+interface AuthResult {
+  /** User's email address */
+  email: string;
+  /** User's display name */
+  name: string;
+  /** Resolved role level (e.g., 50 for Admin, 30 for Editor) */
+  role: number;
+  /** Provider-specific subject ID */
+  subject?: string;
+  /** Additional provider-specific data */
+  metadata?: Record<string, unknown>;
+}
+/**
+ * Auth descriptor — transparent auth providers (e.g., Cloudflare Access).
+ *
+ * These authenticate every request via headers/cookies. No login UI needed.
+ * The module's `authenticate()` function is called by middleware on each request.
+ */
+interface AuthDescriptor {
+  /**
+   * Auth provider type identifier
+   * @example "cloudflare-access", "okta", "auth0"
+   */
+  type: string;
+  /**
+   * Module specifier to import at runtime
+   * The module must export an `authenticate` function.
+   * @example "@emdash-cms/cloudflare/auth"
+   */
+  entrypoint: string;
+  /**
+   * Provider-specific configuration (JSON-serializable)
+   */
+  config: unknown;
+}
+/**
+ * Auth provider module interface
+ *
+ * Modules specified by AuthDescriptor.entrypoint must export
+ * an `authenticate` function matching this signature.
+ */
+interface AuthProviderModule {
+  /**
+   * Authenticate a request using the provider
+   *
+   * @param request - The incoming HTTP request
+   * @param config - Provider-specific configuration from AuthDescriptor
+   * @returns Authentication result if valid, throws if invalid
+   */
+  authenticate(request: Request, config: unknown): Promise<AuthResult>;
+}
+/**
+ * Descriptor for a pluggable auth provider.
+ *
+ * Auth providers appear as login options on the login page and setup wizard.
+ * They coexist with passkey (which is built-in) and with each other.
+ * Any provider can be used to create the initial admin account.
+ *
+ * @example
+ * ```ts
+ * // astro.config.ts
+ * import { atproto } from "@emdash-cms/auth-atproto";
+ *
+ * emdash({
+ *   authProviders: [atproto(), github(), google()],
+ * })
+ * ```
+ */
+interface AuthProviderDescriptor {
+  /** Unique provider ID (e.g., "github", "atproto") */
+  id: string;
+  /** Human-readable label for UI (e.g., "GitHub", "AT Protocol") */
+  label: string;
+  /** Provider-specific config (JSON-serializable) */
+  config?: unknown;
+  /**
+   * Module exporting React components for the admin UI.
+   * Statically imported at build time via virtual module.
+   *
+   * The module should export components matching `AuthProviderAdminExports`.
+   */
+  adminEntry?: string;
+  /**
+   * Astro route handlers this provider needs injected at build time.
+   * Used for login initiation, OAuth callbacks, well-known endpoints, etc.
+   */
+  routes?: AuthRouteDescriptor[];
+  /**
+   * URL prefixes/paths that should bypass auth middleware.
+   * Added to the public routes set so login/callback endpoints work
+   * for unauthenticated users.
+   */
+  publicRoutes?: string[];
+  /**
+   * Storage collections for persistent auth state (e.g., OAuth sessions).
+   * Same format as plugin storage — collections are stored in the shared
+   * `_plugin_storage` table namespaced under `auth:<providerId>`.
+   *
+   * Access via `getAuthProviderStorage()` from `emdash/api/route-utils`.
+   */
+  storage?: Record<string, {
+    indexes?: Array<string | string[]>;
+    uniqueIndexes?: Array<string | string[]>;
+  }>;
+}
+/**
+ * A route that an auth provider needs injected into the Astro app.
+ */
+interface AuthRouteDescriptor {
+  /** URL pattern (e.g., "/_emdash/api/auth/atproto/login") */
+  pattern: string;
+  /** Module specifier for the Astro route handler */
+  entrypoint: string;
+}
+/**
+ * Expected exports from an auth provider's `adminEntry` module.
+ *
+ * All exports are optional. Providers export whichever components
+ * make sense for their auth flow.
+ */
+interface AuthProviderAdminExports {
+  /**
+   * Compact button for the login page (icon + label).
+   * Used for providers with a simple redirect flow (GitHub, Google).
+   * Rendered in the "Or continue with" section.
+   */
+  LoginButton?: react.ComponentType;
+  /**
+   * Full login form for providers that need custom input.
+   * Used for providers like AT Protocol that need a handle field.
+   * Rendered as an expandable section on the login page.
+   */
+  LoginForm?: react.ComponentType;
+  /**
+   * Setup wizard step for creating the admin account via this provider.
+   * When present, this provider appears as an option in the setup wizard's
+   * "Create admin account" step.
+   */
+  SetupStep?: react.ComponentType<{
+    onComplete: () => void;
+  }>;
+}
+/**
+ * Configuration options common to external auth providers
+ */
+interface ExternalAuthConfig {
+  /**
+   * Automatically create EmDash users on first login
+   * @default true
+   */
+  autoProvision?: boolean;
+  /**
+   * Role level for users not matching any group in roleMapping
+   * @default 30 (Editor)
+   */
+  defaultRole?: number;
+  /**
+   * Update user's role on each login based on current IdP groups
+   * When false, role is only set on first provisioning
+   * @default false
+   */
+  syncRoles?: boolean;
+  /**
+   * Map IdP group names to EmDash role levels
+   * First match wins if user is in multiple groups
+   *
+   * @example
+   * ```ts
+   * roleMapping: {
+   *   "Admins": 50,        // Admin
+   *   "Developers": 40,    // Developer
+   *   "Content Team": 30,  // Editor
+   * }
+   * ```
+   */
+  roleMapping?: Record<string, number>;
+}
+//#endregion
+export { AuthResult as a, AuthProviderModule as i, AuthProviderAdminExports as n, AuthRouteDescriptor as o, AuthProviderDescriptor as r, ExternalAuthConfig as s, AuthDescriptor as t };
+//# sourceMappingURL=types-FBBnGZ2Y.d.mts.map

package/dist/types-FBBnGZ2Y.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-FBBnGZ2Y.d.mts","names":[],"sources":["../src/auth/types.ts"],"mappings":";;;;;;AAgBA;;;;;;;;;;;;UAAiB,UAAA;EAmBc;EAjB9B,KAAA;EAiB8B;EAf9B,IAAA;EA2BA;EAzBA,IAAA;EA8BM;EA5BN,OAAA;EAqCgB;EAnChB,QAAA,GAAW,MAAA;AAAA;;;;;;;UASK,cAAA;EAkCH;;;;EA7Bb,IAAA;EA6BmE;AAwBpE;;;;EA9CC,UAAA;EAsFuD;;;EAjFvD,MAAA;AAAA;;;;;;;UASgB,kBAAA;EAsEN;;;;;;;EA9DV,YAAA,CAAa,OAAA,EAAS,OAAA,EAAS,MAAA,YAAkB,OAAA,CAAQ,UAAA;AAAA;;;;AAoF1D;;;;;;;;;;;;;;UA5DiB,sBAAA;EAgFsC;EA9EtD,EAAA;EAoFgB;EAjFhB,KAAA;;EAGA,MAAA;EAmFA;;;;;;EA3EA,UAAA;;;;;EAMA,MAAA,GAAS,mBAAA;;;;;;EAOT,YAAA;;;;;;;;EASA,OAAA,GAAU,MAAA;IAEP,OAAA,GAAU,KAAA;IAA0B,aAAA,GAAgB,KAAA;EAAA;AAAA;;;;UAOvC,mBAAA;;EAEhB,OAAA;;EAEA,UAAA;AAAA;;;;;;;UASgB,wBAAA;;;;;;EAMhB,WAAA,GANwC,KAAA,CAMV,aAAA;;;;;;EAO9B,SAAA,GAP2C,KAAA,CAOf,aAAA;;;;;;EAO5B,SAAA,GAPyC,KAAA,CAOb,aAAA;IAAgB,UAAA;EAAA;AAAA;;;;UAM5B,kBAAA;;;;;EAKhB,aAAA;;;;;EAMA,WAAA;;;;;;EAOA,SAAA;;;;;;;;;;;;;;EAeA,WAAA,GAAc,MAAA;AAAA"}

package/dist/types-ZCnlropY.mjs

@@ -0,0 +1,69 @@
+//#region src/plugins/sandbox/types.ts
+const SANDBOX_ROUTE_ERROR_DEFINITIONS = {
+	MEDIA_USAGE_ACTIVATION_IN_PROGRESS: {
+		message: "Media usage activation is in progress",
+		status: 503
+	},
+	MEDIA_USAGE_ACTIVATION_CHECK_FAILED: {
+		message: "Unable to verify media usage activation state",
+		status: 503
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function isSandboxRouteErrorCode(value) {
+	return typeof value === "string" && value in SANDBOX_ROUTE_ERROR_DEFINITIONS;
+}
+function getSandboxRouteErrorDetails(error) {
+	if (!isRecord(error)) return null;
+	const propertyCode = isSandboxRouteErrorCode(error.code) ? error.code : null;
+	const nameCode = error instanceof Error && isSandboxRouteErrorCode(error.name) ? error.name : null;
+	if (propertyCode && nameCode && propertyCode !== nameCode) return null;
+	const code = propertyCode ?? nameCode;
+	if (!code || error.status !== void 0 && error.status !== 503) return null;
+	return {
+		code,
+		...SANDBOX_ROUTE_ERROR_DEFINITIONS[code]
+	};
+}
+function createSandboxRouteError(code) {
+	const details = {
+		code,
+		...SANDBOX_ROUTE_ERROR_DEFINITIONS[code]
+	};
+	return Object.assign(new Error(details.message), details, { name: code });
+}
+function createSandboxRouteErrorEnvelope(error) {
+	const details = getSandboxRouteErrorDetails(error);
+	return details ? {
+		__emdashSandboxRouteError: true,
+		error: details
+	} : null;
+}
+function getSandboxRouteErrorEnvelope(value) {
+	if (!isRecord(value) || value.__emdashSandboxRouteError !== true) return null;
+	const details = getSandboxRouteErrorDetails(value.error);
+	return details ? {
+		__emdashSandboxRouteError: true,
+		error: details
+	} : null;
+}
+function withUnavailableReason(message, runner) {
+	const reason = runner?.unavailableReason?.();
+	return reason ? `${message}: ${reason}` : message;
+}
+/**
+* Error thrown when the sandbox runtime is unavailable.
+* This happens when the sidecar process has crashed or hasn't started.
+*/
+var SandboxUnavailableError = class extends Error {
+	constructor(pluginId, reason) {
+		super(`Plugin sandbox unavailable for ${pluginId}: ${reason}`);
+		this.name = "SandboxUnavailableError";
+	}
+};
+
+//#endregion
+export { getSandboxRouteErrorEnvelope as a, getSandboxRouteErrorDetails as i, createSandboxRouteError as n, withUnavailableReason as o, createSandboxRouteErrorEnvelope as r, SandboxUnavailableError as t };
+//# sourceMappingURL=types-ZCnlropY.mjs.map

package/dist/types-ZCnlropY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-ZCnlropY.mjs","names":[],"sources":["../src/plugins/sandbox/types.ts"],"sourcesContent":["/**\n * Plugin Sandbox Types\n *\n * Defines interfaces for running plugins in sandboxed V8 isolates.\n * The SandboxRunner interface is implemented by platform adapters\n * (e.g., Cloudflare Worker Loader) to provide isolation.\n *\n */\n\nimport type { PluginUiContext } from \"@emdash-cms/blocks/server\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport type { ContentActionCallbacks } from \"../context.js\";\nimport type {\n\tContentCreateOptions,\n\tContentItem,\n\tContentWriteInput,\n\tPluginComment,\n\tPluginCommentStatus,\n\tPluginManifest,\n\tRequestMeta,\n\tTaxonomyAccessWithWrite,\n\tUserInfo,\n} from \"../types.js\";\n\n/**\n * Resource limits for sandboxed plugins.\n * Enforced by the sandbox runtime (e.g., Worker Loader).\n */\nexport interface ResourceLimits {\n\t/** CPU time per invocation in milliseconds (default: 50ms) */\n\tcpuMs?: number;\n\t/** Memory limit in MB (default: 128MB) */\n\tmemoryMb?: number;\n\t/** Maximum subrequests per invocation (default: 10) */\n\tsubrequests?: number;\n\t/** Wall-clock time limit in milliseconds (default: 30000ms) */\n\twallTimeMs?: number;\n}\n\n/**\n * Storage interface for loading plugin code.\n * Could be R2, local filesystem, or any other storage backend.\n */\nexport interface PluginCodeStorage {\n\t/** Get plugin bundle code by path */\n\tget(path: string): Promise<string | null>;\n\t/** Check if a bundle exists */\n\texists(path: string): Promise<boolean>;\n}\n\n/**\n * Serialized email message for sandbox RPC transport.\n * Matches the core EmailMessage type but uses only serializable fields.\n */\nexport interface SandboxEmailMessage {\n\tto: string;\n\tsubject: string;\n\ttext: string;\n\thtml?: string;\n}\n\n/**\n * Callback for sending email from a sandboxed plugin.\n * The sandbox runner wires this up from the EmailPipeline.\n *\n * @param message - The email message to send\n * @param pluginId - The sending plugin's ID (used as source)\n */\nexport type SandboxEmailSendCallback = (\n\tmessage: SandboxEmailMessage,\n\tpluginId: string,\n) => Promise<void>;\n\nexport type SandboxCommentModerateCallback = (\n\tpluginId: string,\n\tid: string,\n\tstatus: PluginCommentStatus,\n\texpectedStatus: PluginCommentStatus,\n) => Promise<PluginComment>;\n\nexport type SandboxContentCreateCallback = (\n\tpluginId: string,\n\tcollection: string,\n\tdata: ContentWriteInput,\n\toptions?: ContentCreateOptions & {\n\t\toriginHook?: \"content:beforeSave\" | \"content:afterSave\";\n\t\tsandboxOrigin?: true;\n\t},\n) => Promise<ContentItem>;\n\nexport type SandboxHttpFetchCallback = typeof fetch;\n\n/**\n * Options for creating a sandbox runner\n */\nexport interface SandboxOptions {\n\t/** Storage interface for loading plugin code */\n\tstorage?: PluginCodeStorage;\n\t/** Database for bridge operations */\n\tdb: Kysely<Database>;\n\t/** Called immediately before a sandboxed plugin content mutation. */\n\tbeforeContentWrite?: () => Promise<void>;\n\t/** Runtime-owned taxonomy mutation surface used by sandbox bridges. */\n\ttaxonomyWrite?: TaxonomyAccessWithWrite;\n\tcontentActions?: ContentActionCallbacks;\n\t/** Clock used to calculate recurring plugin task schedules. */\n\tnow?: () => Date;\n\t/** Default resource limits */\n\tlimits?: ResourceLimits;\n\t/** Site info for plugin context (injected into wrapper at generation time) */\n\tsiteInfo?: {\n\t\tname: string;\n\t\turl: string;\n\t\tlocale: string;\n\t\ttrailingSlash?: \"always\" | \"never\" | \"ignore\";\n\t};\n\t/** Email send callback, wired from the EmailPipeline by the runtime */\n\temailSend?: SandboxEmailSendCallback;\n\tcommentModerate?: SandboxCommentModerateCallback;\n\t/** Optional host HTTP transport used by test hosts and custom runtimes. */\n\thttpFetch?: SandboxHttpFetchCallback;\n\t/**\n\t * Media storage adapter for sandboxed plugin byte reads, uploads, and deletes.\n\t * Each operation remains gated by its own media capability.\n\t */\n\tmediaStorage?: {\n\t\tupload(options: { key: string; body: Uint8Array; contentType: string }): Promise<unknown>;\n\t\tdownload(key: string): Promise<{\n\t\t\tbody: ReadableStream<Uint8Array>;\n\t\t\tcontentType: string;\n\t\t\tsize: number;\n\t\t}>;\n\t\tdelete(key: string): Promise<unknown>;\n\t};\n\t/** Worker Loader name suffix. The plugin's logical ID remains unchanged. */\n\tisolateKey?: string;\n}\n\n/**\n * Handle to a sandboxed plugin running inside an isolate. Returned\n * by `SandboxRunner.load` and held by the runtime's cache so hooks /\n * routes can be invoked across the isolate boundary. Distinct from\n * the author-facing `SandboxedPlugin` type in `emdash/plugin`, which\n * describes the source-level shape of a plugin's default export.\n */\nexport interface SandboxedPluginInstance {\n\t/** Unique identifier: `${manifest.id}:${manifest.version}` */\n\treadonly id: string;\n\n\t/**\n\t * Invoke a hook in the sandboxed plugin.\n\t *\n\t * @param hookName - Name of the hook (e.g., \"content:beforeSave\")\n\t * @param event - Event data to pass to the hook\n\t * @returns Hook result (transformed content, void, etc.)\n\t */\n\tinvokeHook(hookName: string, event: unknown): Promise<unknown>;\n\n\t/**\n\t * Invoke an API route in the sandboxed plugin.\n\t *\n\t * @param routeName - Name of the route\n\t * @param input - Validated input data\n\t * @param request - Serialized request info for context\n\t * @returns Route response data\n\t */\n\tinvokeRoute(\n\t\trouteName: string,\n\t\tinput: unknown,\n\t\trequest: SerializedRequest,\n\t\toptions?: SandboxInvocationOptions,\n\t): Promise<unknown>;\n\n\t/**\n\t * Terminate the sandboxed plugin.\n\t * Releases resources and prevents further invocations.\n\t */\n\tterminate(): Promise<void>;\n}\n\nexport interface SandboxInvocationOptions {\n\tinvalidateContentCache?: (tags: string[]) => Promise<void>;\n}\n\n/**\n * Serialized request for RPC transport.\n * Worker Loader can't pass Request objects directly.\n */\nexport interface SerializedRequest {\n\turl: string;\n\tmethod: string;\n\theaders: Record<string, string>;\n\t/** Normalized request metadata extracted before RPC serialization */\n\tmeta: RequestMeta;\n\t/** Host-attested context for a validated Block Kit request. */\n\tui?: PluginUiContext;\n\t/**\n\t * Authenticated caller for private routes, resolved by the host before\n\t * dispatch. Undefined for public routes and unbound machine tokens.\n\t */\n\tuser?: UserInfo;\n}\n\nconst SANDBOX_ROUTE_ERROR_DEFINITIONS = {\n\tMEDIA_USAGE_ACTIVATION_IN_PROGRESS: {\n\t\tmessage: \"Media usage activation is in progress\",\n\t\tstatus: 503,\n\t},\n\tMEDIA_USAGE_ACTIVATION_CHECK_FAILED: {\n\t\tmessage: \"Unable to verify media usage activation state\",\n\t\tstatus: 503,\n\t},\n} as const;\n\nexport type SandboxRouteErrorCode = keyof typeof SANDBOX_ROUTE_ERROR_DEFINITIONS;\n\nexport interface SandboxRouteErrorDetails {\n\tcode: SandboxRouteErrorCode;\n\tmessage: string;\n\tstatus: 503;\n}\n\nexport interface SandboxRouteErrorEnvelope {\n\t__emdashSandboxRouteError: true;\n\terror: SandboxRouteErrorDetails;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction isSandboxRouteErrorCode(value: unknown): value is SandboxRouteErrorCode {\n\treturn typeof value === \"string\" && value in SANDBOX_ROUTE_ERROR_DEFINITIONS;\n}\n\nexport function getSandboxRouteErrorDetails(error: unknown): SandboxRouteErrorDetails | null {\n\tif (!isRecord(error)) return null;\n\n\tconst propertyCode = isSandboxRouteErrorCode(error.code) ? error.code : null;\n\tconst nameCode =\n\t\terror instanceof Error && isSandboxRouteErrorCode(error.name) ? error.name : null;\n\tif (propertyCode && nameCode && propertyCode !== nameCode) return null;\n\n\tconst code = propertyCode ?? nameCode;\n\tif (!code || (error.status !== undefined && error.status !== 503)) return null;\n\n\treturn {\n\t\tcode,\n\t\t...SANDBOX_ROUTE_ERROR_DEFINITIONS[code],\n\t};\n}\n\nexport function createSandboxRouteError(\n\tcode: SandboxRouteErrorCode,\n): Error & SandboxRouteErrorDetails {\n\tconst details: SandboxRouteErrorDetails = {\n\t\tcode,\n\t\t...SANDBOX_ROUTE_ERROR_DEFINITIONS[code],\n\t};\n\treturn Object.assign(new Error(details.message), details, { name: code });\n}\n\nexport function createSandboxRouteErrorEnvelope(error: unknown): SandboxRouteErrorEnvelope | null {\n\tconst details = getSandboxRouteErrorDetails(error);\n\treturn details ? { __emdashSandboxRouteError: true, error: details } : null;\n}\n\nexport function getSandboxRouteErrorEnvelope(value: unknown): SandboxRouteErrorEnvelope | null {\n\tif (!isRecord(value) || value.__emdashSandboxRouteError !== true) return null;\n\tconst details = getSandboxRouteErrorDetails(value.error);\n\treturn details ? { __emdashSandboxRouteError: true, error: details } : null;\n}\n\n/**\n * Sandbox runner interface.\n * Platform adapters implement this to provide plugin isolation.\n */\nexport interface SandboxRunner {\n\t/**\n\t * Check if sandboxing is available on this platform.\n\t * Returns false for platforms that don't support isolation.\n\t */\n\tisAvailable(): boolean;\n\n\t/**\n\t * Check if the sandbox runtime is currently healthy.\n\t * For in-process runners this always returns true.\n\t * For sidecar-based runners (workerd), returns false if the\n\t * child process has crashed and hasn't been restarted yet.\n\t */\n\tisHealthy(): boolean;\n\n\t/**\n\t * Why the runner cannot run plugins, once isAvailable() or isHealthy()\n\t * has returned false. A lowercase clause without a final period: callers\n\t * append it to their own message after a colon.\n\t *\n\t * Making this required breaks runners implemented outside this repository.\n\t */\n\tunavailableReason?(): string;\n\n\t/**\n\t * Load a sandboxed plugin from code.\n\t *\n\t * @param manifest - Plugin manifest with metadata and capabilities\n\t * @param code - The bundled plugin JavaScript code\n\t * @returns A sandboxed plugin instance\n\t * @throws If sandboxing is not available or plugin can't be loaded\n\t */\n\tload(manifest: PluginManifest, code: string): Promise<SandboxedPluginInstance>;\n\n\t/**\n\t * Set the email send callback for sandboxed plugins.\n\t * Called after the EmailPipeline is created, since the pipeline\n\t * doesn't exist when the sandbox runner is constructed.\n\t */\n\tsetEmailSend(callback: SandboxEmailSendCallback | null): void;\n\tsetCommentModerate?(callback: SandboxCommentModerateCallback | null): void;\n\tsetContentCreate?(callback: SandboxContentCreateCallback | null): void;\n\tsetContentActions?(callback: ContentActionCallbacks | null): void;\n\n\t/** Wake a long-lived scheduler after a sandboxed plugin changes its tasks. */\n\tsetCronReschedule?(callback: (() => void) | null): void;\n\n\t/**\n\t * Terminate all loaded sandboxed plugins.\n\t * Called during shutdown or when reconfiguring.\n\t */\n\tterminateAll(): Promise<void>;\n}\n\nexport function withUnavailableReason(message: string, runner: SandboxRunner | null): string {\n\tconst reason = runner?.unavailableReason?.();\n\treturn reason ? `${message}: ${reason}` : message;\n}\n\n/**\n * Error thrown when the sandbox runtime is unavailable.\n * This happens when the sidecar process has crashed or hasn't started.\n */\nexport class SandboxUnavailableError extends Error {\n\tconstructor(pluginId: string, reason: string) {\n\t\tsuper(`Plugin sandbox unavailable for ${pluginId}: ${reason}`);\n\t\tthis.name = \"SandboxUnavailableError\";\n\t}\n}\n\n/**\n * Factory function type for creating sandbox runners.\n * Exported by platform adapters (e.g., @emdash-cms/cloudflare/sandbox).\n *\n * @example\n * ```typescript\n * // In @emdash-cms/cloudflare/sandbox\n * export const createSandboxRunner: SandboxRunnerFactory = (options) => {\n *   return new CloudflareSandboxRunner(options);\n * };\n * ```\n */\nexport type SandboxRunnerFactory = (options: SandboxOptions) => SandboxRunner;\n"],"mappings":";AA6MA,MAAM,kCAAkC;CACvC,oCAAoC;EACnC,SAAS;EACT,QAAQ;EACR;CACD,qCAAqC;EACpC,SAAS;EACT,QAAQ;EACR;CACD;AAeD,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,wBAAwB,OAAgD;AAChF,QAAO,OAAO,UAAU,YAAY,SAAS;;AAG9C,SAAgB,4BAA4B,OAAiD;AAC5F,KAAI,CAAC,SAAS,MAAM,CAAE,QAAO;CAE7B,MAAM,eAAe,wBAAwB,MAAM,KAAK,GAAG,MAAM,OAAO;CACxE,MAAM,WACL,iBAAiB,SAAS,wBAAwB,MAAM,KAAK,GAAG,MAAM,OAAO;AAC9E,KAAI,gBAAgB,YAAY,iBAAiB,SAAU,QAAO;CAElE,MAAM,OAAO,gBAAgB;AAC7B,KAAI,CAAC,QAAS,MAAM,WAAW,UAAa,MAAM,WAAW,IAAM,QAAO;AAE1E,QAAO;EACN;EACA,GAAG,gCAAgC;EACnC;;AAGF,SAAgB,wBACf,MACmC;CACnC,MAAM,UAAoC;EACzC;EACA,GAAG,gCAAgC;EACnC;AACD,QAAO,OAAO,OAAO,IAAI,MAAM,QAAQ,QAAQ,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;;AAG1E,SAAgB,gCAAgC,OAAkD;CACjG,MAAM,UAAU,4BAA4B,MAAM;AAClD,QAAO,UAAU;EAAE,2BAA2B;EAAM,OAAO;EAAS,GAAG;;AAGxE,SAAgB,6BAA6B,OAAkD;AAC9F,KAAI,CAAC,SAAS,MAAM,IAAI,MAAM,8BAA8B,KAAM,QAAO;CACzE,MAAM,UAAU,4BAA4B,MAAM,MAAM;AACxD,QAAO,UAAU;EAAE,2BAA2B;EAAM,OAAO;EAAS,GAAG;;AA6DxE,SAAgB,sBAAsB,SAAiB,QAAsC;CAC5F,MAAM,SAAS,QAAQ,qBAAqB;AAC5C,QAAO,SAAS,GAAG,QAAQ,IAAI,WAAW;;;;;;AAO3C,IAAa,0BAAb,cAA6C,MAAM;CAClD,YAAY,UAAkB,QAAgB;AAC7C,QAAM,kCAAkC,SAAS,IAAI,SAAS;AAC9D,OAAK,OAAO"}

package/dist/types-_Qtyawiy.d.mts

@@ -0,0 +1,124 @@
+//#region src/object-cache/types.d.ts
+/**
+ * Object cache types
+ *
+ * The object cache is an optional, distributed read-through cache that sits
+ * *beneath* the per-request cache (`requestCached`) and *above* the database.
+ * Query results (content entries, settings, menus, taxonomies) are stored in a
+ * fast key/value store (Cloudflare KV, or an in-isolate memory store for Node)
+ * so repeat reads across requests and isolates skip the database entirely.
+ *
+ * Backends only ever deal in strings — serialization (including `Date`
+ * preservation) is handled by the core read-through layer in `./codec.ts`, so
+ * every backend behaves identically.
+ */
+/**
+ * A pluggable object-cache backend.
+ *
+ * Implementations must be safe to call concurrently and should never throw on
+ * cache misses — `get` returns `null` for a miss. A backend that throws (e.g.
+ * a transient KV error) degrades gracefully: the read-through layer treats a
+ * thrown `get` as a miss and a thrown `set` as a no-op, so the database
+ * remains the source of truth.
+ */
+interface ObjectCacheBackend {
+  /** Return the stored string for `key`, or `null` on a miss. */
+  get(key: string): Promise<string | null>;
+  /**
+   * Store `value` under `key`.
+   *
+   * @param ttlSeconds Optional time-to-live in seconds. Backends that don't
+   *   support TTLs may ignore it, but distributed backends (KV) should honor
+   *   it so orphaned, epoch-busted keys are eventually reclaimed.
+   */
+  set(key: string, value: string, ttlSeconds?: number): Promise<void>;
+  /** Remove `key`. Idempotent — deleting a missing key is not an error. */
+  delete(key: string): Promise<void>;
+}
+/**
+ * Serializable descriptor for an object-cache backend.
+ *
+ * Mirrors {@link import("../storage/types.js").StorageDescriptor}: `entrypoint`
+ * is a module specifier resolved at build time that exports a
+ * {@link CreateObjectCacheBackendFn} named `createObjectCache`; `config` is the
+ * plain, serializable runtime config passed to it.
+ */
+interface ObjectCacheDescriptor {
+  /** Module path exporting a `createObjectCache` function. */
+  entrypoint: string;
+  /** Serializable config passed to `createObjectCache` at runtime. */
+  config: ObjectCacheRuntimeConfig;
+}
+/**
+ * Runtime config shared by every backend, plus backend-specific keys.
+ *
+ * The read-through layer reads `defaultTtl`, `revalidate`, and `keyPrefix`;
+ * individual backends read their own keys (e.g. the KV backend reads
+ * `binding`).
+ */
+interface ObjectCacheRuntimeConfig {
+  /**
+   * Default time-to-live for cached entries, in seconds.
+   *
+   * Invalidation works by epoch comparison, not key deletion: a stale value
+   * is detected on read (its stored epoch no longer matches) and overwritten
+   * in place under the same key. The TTL is just a backstop that reclaims
+   * keys that are never read again.
+   *
+   * @default 3600 (1 hour)
+   */
+  defaultTtl?: number;
+  /**
+   * How long (milliseconds) an isolate may reuse a cached namespace epoch
+   * before re-reading it from the backend.
+   *
+   * After a write bumps a namespace's epoch, an isolate keeps serving the
+   * previous epoch's keys until its cached epoch expires after this window. It
+   * is only part of the cross-isolate staleness: a distributed backend adds its
+   * own propagation delay (KV's edge cache is eventually consistent, up to
+   * ~60s), so on KV the effective window is that propagation plus this value.
+   * Only anonymous visitors are affected — preview and edit requests bypass the
+   * cache.
+   *
+   * Set to `0` to re-read the epoch on every query (strongest freshness, more
+   * backend reads).
+   *
+   * @default 1000
+   */
+  revalidate?: number;
+  /**
+   * Prefix applied to every cache key. Lets multiple EmDash sites share one
+   * KV namespace without colliding.
+   *
+   * @default "em"
+   */
+  keyPrefix?: string;
+  /**
+   * Maximum time (milliseconds) to wait for a single backend read before
+   * treating it as a cache miss and falling back to the database.
+   *
+   * Guards against a backend operation that stalls without resolving or
+   * rejecting (e.g. a cold cross-region KV read, or one queued behind the
+   * Workers simultaneous-connection limit), which would otherwise hang the
+   * request. A timed-out read degrades to a miss; the database remains the
+   * source of truth.
+   *
+   * Set to `0` to disable the timeout (not recommended on Cloudflare).
+   *
+   * @default 2000
+   */
+  timeout?: number;
+  /** Backend-specific keys (e.g. the KV binding name). */
+  [key: string]: unknown;
+}
+/**
+ * Factory signature exported as `createObjectCache` from a backend entrypoint.
+ *
+ * Each backend accesses its own resources directly: the KV backend imports
+ * bindings from `cloudflare:workers`; the memory backend uses an in-isolate
+ * map.
+ */
+type CreateObjectCacheBackendFn = (config: ObjectCacheRuntimeConfig) => ObjectCacheBackend;
+//#endregion
+export { ObjectCacheRuntimeConfig as i, ObjectCacheBackend as n, ObjectCacheDescriptor as r, CreateObjectCacheBackendFn as t };
+//# sourceMappingURL=types-_Qtyawiy.d.mts.map

package/dist/types-_Qtyawiy.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-_Qtyawiy.d.mts","names":[],"sources":["../src/object-cache/types.ts"],"mappings":";;AAuBA;;;;;;;;;;;;;;;;;;;;;UAAiB,kBAAA;EAuBqB;EArBrC,GAAA,CAAI,GAAA,WAAc,OAAA;EAyBc;;;;;;AAUjC;EA3BC,GAAA,CAAI,GAAA,UAAa,KAAA,UAAe,UAAA,YAAsB,OAAA;;EAEtD,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA;;;;;;;AAwFtB;;UA7EiB,qBAAA;EA6EgF;EA3EhG,UAAA;EA2EyC;EAzEzC,MAAA,EAAQ,wBAAA;AAAA;;;;;;;;UAUQ,wBAAA;;;;;;;;;;;EAWhB,UAAA;;;;;;;;;;;;;;;;;;EAkBA,UAAA;;;;;;;EAOA,SAAA;;;;;;;;;;;;;;;EAeA,OAAA;;GAEC,GAAA;AAAA;;;;;;;;KAUU,0BAAA,IAA8B,MAAA,EAAQ,wBAAA,KAA6B,kBAAA"}

package/dist/types-gC6FAoa_.d.mts

@@ -0,0 +1,75 @@
+//#region src/settings/types.d.ts
+/**
+ * Site Settings Types
+ *
+ * Global configuration for the site (title, logo, social links, etc.)
+ */
+/**
+ * Media reference for logo/favicon/seo.defaultOgImage.
+ *
+ * Stored shape is just `{ mediaId, alt? }`. The remaining fields are
+ * populated by `resolveMediaReference` on read so templates can emit
+ * correct head tags without a second round-trip to the media table.
+ *
+ * The Zod schemas at the REST/MCP boundary are split:
+ *  - `mediaReferenceInput` (used by `settingsUpdateBody`) defines only
+ *    `mediaId` and `alt`. Default strip-mode parsing discards any
+ *    resolved fields a client posts back, so they never reach storage.
+ *  - `mediaReferenceResponse` (used by `siteSettingsSchema`) includes
+ *    the resolved fields so generated OpenAPI clients see them.
+ *
+ * If you ever switch `mediaReferenceInput` to `passthrough`, you must
+ * also strip the resolved fields explicitly in `setSiteSettings`, or
+ * stored options will accumulate stale `url` / `contentType` / `width`
+ * / `height` snapshots.
+ */
+interface MediaReference {
+  mediaId: string;
+  alt?: string;
+  /** Resolved URL. Populated by `resolveMediaReference`; absent on raw stored values. */
+  url?: string;
+  /** Stored MIME type (e.g. `image/svg+xml`). Populated alongside `url`. */
+  contentType?: string;
+  /** Pixel width if known. Populated alongside `url`. */
+  width?: number;
+  /** Pixel height if known. Populated alongside `url`. */
+  height?: number;
+}
+/** Site-level SEO settings */
+interface SeoSettings {
+  /** Separator between page title and site title (e.g., " | ", " — ") */
+  titleSeparator?: string;
+  /** Default OG image when content has no seo_image */
+  defaultOgImage?: MediaReference;
+  /** Custom robots.txt content. If unset, a default is generated. */
+  robotsTxt?: string;
+  /** Google Search Console verification meta tag content */
+  googleVerification?: string;
+  /** Bing Webmaster Tools verification meta tag content */
+  bingVerification?: string;
+}
+/** Site settings schema */
+interface SiteSettings {
+  title: string;
+  tagline?: string;
+  logo?: MediaReference;
+  favicon?: MediaReference;
+  url?: string;
+  postsPerPage: number;
+  dateFormat: string;
+  timezone: string;
+  social?: {
+    twitter?: string;
+    github?: string;
+    facebook?: string;
+    instagram?: string;
+    linkedin?: string;
+    youtube?: string;
+  };
+  seo?: SeoSettings;
+}
+/** Keys that are valid site settings */
+type SiteSettingKey = keyof SiteSettings;
+//#endregion
+export { SiteSettings as i, SeoSettings as n, SiteSettingKey as r, MediaReference as t };
+//# sourceMappingURL=types-gC6FAoa_.d.mts.map

package/dist/types-gC6FAoa_.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-gC6FAoa_.d.mts","names":[],"sources":["../src/settings/types.ts"],"mappings":";;AAyBA;;;;;;;;;;;;AAcA;;;;;;;;;;;UAdiB,cAAA;EAChB,OAAA;EACA,GAAA;;EAEA,GAAA;EA6BU;EA3BV,WAAA;EAgDiB;EA9CjB,KAAA;EAsBA;EApBA,MAAA;AAAA;;UAIgB,WAAA;EAmBN;EAjBV,cAAA;EAuBA;EArBA,cAAA,GAAiB,cAAA;EAuBjB;EArBA,SAAA;EAyBC;EAvBD,kBAAA;EAyBC;EAvBD,gBAAA;AAAA;;UAIgB,YAAA;EAEhB,KAAA;EACA,OAAA;EACA,IAAA,GAAO,cAAA;EACP,OAAA,GAAU,cAAA;EAGV,GAAA;EAGA,YAAA;EACA,UAAA;EACA,QAAA;EAGA,MAAA;IACC,OAAA;IACA,MAAA;IACA,QAAA;IACA,SAAA;IACA,QAAA;IACA,OAAA;EAAA;EAID,GAAA,GAAM,WAAA;AAAA;;KAIK,cAAA,SAAuB,YAAA"}

package/dist/types-k--LneIF.mjs

@@ -0,0 +1,22 @@
+import { CAPABILITY_RENAMES, capabilitiesToDeclaredAccess as capabilitiesToDeclaredAccess$1, declaredAccessToCapabilities as declaredAccessToCapabilities$1, isDeprecatedCapability, normalizeCapabilities, normalizeCapability } from "@emdash-cms/plugin-types";
+
+//#region src/plugins/types.ts
+const PLUGIN_CAPABILITY_IMPLICATIONS = [
+	["content:write", "content:read"],
+	["content:revisions:read", "content:read"],
+	["taxonomies:write", "taxonomies:read"],
+	["content:publish", "content:read"],
+	["media:write", "media:read"],
+	["comments:moderate", "comments:read"],
+	["redirects:write", "redirects:read"],
+	["network:request:unrestricted", "network:request"]
+];
+function normalizePluginCapabilities(capabilities) {
+	const normalized = new Set(normalizeCapabilities(capabilities));
+	for (const [granted, implied] of PLUGIN_CAPABILITY_IMPLICATIONS) if (normalized.has(granted)) normalized.add(implied);
+	return [...normalized];
+}
+
+//#endregion
+export { normalizeCapabilities as a, isDeprecatedCapability as i, capabilitiesToDeclaredAccess$1 as n, normalizeCapability as o, declaredAccessToCapabilities$1 as r, normalizePluginCapabilities as s, CAPABILITY_RENAMES as t };
+//# sourceMappingURL=types-k--LneIF.mjs.map