emdash 0.40.1 → 0.41.0

package/dist/route-wire-C9PJV9aL.mjs

@@ -0,0 +1,197 @@
+import { readPluginHttpBytes } from "./plugins/http-wire.mjs";
+import { PLUGIN_ROUTE_DEFAULT_BODY_BYTES, PLUGIN_ROUTE_MAX_BODY_BYTES, PLUGIN_ROUTE_MAX_FILENAME_BYTES, PLUGIN_ROUTE_MAX_MULTIPART_PARTS, PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES } from "@emdash-cms/plugin-types";
+
+//#region src/plugins/route-wire.ts
+const UTF8 = new TextEncoder();
+const FILENAME_PATH_SEPARATOR_PATTERN = /[/\\]/;
+const SCRIPT_MEDIA_TYPE_PATTERN = /(?:java|ecma)script/;
+const ALLOWED_RESPONSE_HEADERS = new Set([
+	"accept-ranges",
+	"content-disposition",
+	"content-encoding",
+	"content-language",
+	"content-range",
+	"content-type",
+	"etag",
+	"last-modified",
+	"retry-after"
+]);
+const ACTIVE_RESPONSE_TYPES = new Set([
+	"application/ecmascript",
+	"application/javascript",
+	"application/wasm",
+	"application/xhtml+xml",
+	"application/xml",
+	"image/svg+xml",
+	"multipart/related",
+	"multipart/x-mixed-replace",
+	"text/css",
+	"text/ecmascript",
+	"text/html",
+	"text/javascript",
+	"text/jscript",
+	"text/livescript",
+	"text/xml"
+]);
+var PluginRouteRequestError = class extends Error {
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "PluginRouteRequestError";
+	}
+};
+function parseQuery(request) {
+	const input = {};
+	const params = new URL(request.url).searchParams;
+	for (const key of new Set(params.keys())) {
+		const values = params.getAll(key);
+		input[key] = values.length > 1 ? values : values[0];
+	}
+	return input;
+}
+async function readRouteBody(request, limit) {
+	const declaredLength = request.headers.get("content-length");
+	if (declaredLength !== null) {
+		const parsed = Number(declaredLength);
+		if (Number.isFinite(parsed) && parsed > limit) throw new PluginRouteRequestError(`Plugin route request body exceeds ${limit} bytes`, 413);
+	}
+	try {
+		return await readPluginHttpBytes(request.body, limit, "request");
+	} catch (error) {
+		if (!(error instanceof Error) || !error.message.includes("exceeds")) throw new PluginRouteRequestError("Plugin route request body could not be read", 400);
+		throw new PluginRouteRequestError(`Plugin route request body exceeds ${limit} bytes`, 413);
+	}
+}
+function decodeText(bytes) {
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		throw new PluginRouteRequestError("Plugin route request body is not valid UTF-8", 400);
+	}
+}
+async function parseFormData(request, bytes) {
+	const contentType = request.headers.get("content-type") ?? "";
+	if (!contentType.toLowerCase().startsWith("multipart/form-data;") && !contentType.toLowerCase().startsWith("application/x-www-form-urlencoded")) throw new PluginRouteRequestError("Plugin route form-data requests require multipart/form-data or application/x-www-form-urlencoded", 415);
+	let parsed;
+	try {
+		parsed = await new Request(request.url, {
+			method: "POST",
+			headers: { "content-type": contentType },
+			body: new Uint8Array(bytes).buffer
+		}).formData();
+	} catch {
+		throw new PluginRouteRequestError("Plugin route form-data body is malformed", 400);
+	}
+	const entries = [];
+	for (const [name, value] of parsed.entries()) {
+		if (entries.length >= PLUGIN_ROUTE_MAX_MULTIPART_PARTS) throw new PluginRouteRequestError(`Plugin route form-data exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PARTS} parts`, 413);
+		if (typeof value === "string") {
+			if (UTF8.encode(value).byteLength > PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES) throw new PluginRouteRequestError(`Plugin route form-data part exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES} bytes`, 413);
+			entries.push({
+				name,
+				kind: "text",
+				value
+			});
+			continue;
+		}
+		const filename = value.name;
+		let hasControlCharacter = false;
+		for (const character of filename) {
+			const codePoint = character.codePointAt(0);
+			if (codePoint !== void 0 && (codePoint < 32 || codePoint === 127)) {
+				hasControlCharacter = true;
+				break;
+			}
+		}
+		if (UTF8.encode(filename).byteLength > PLUGIN_ROUTE_MAX_FILENAME_BYTES || hasControlCharacter || FILENAME_PATH_SEPARATOR_PATTERN.test(filename)) throw new PluginRouteRequestError("Plugin route form-data filename is invalid", 400);
+		if (value.size > PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES) throw new PluginRouteRequestError(`Plugin route form-data part exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES} bytes`, 413);
+		entries.push({
+			name,
+			kind: "file",
+			filename,
+			contentType: value.type || "application/octet-stream",
+			bytes: new Uint8Array(await value.arrayBuffer())
+		});
+	}
+	return { entries };
+}
+async function parseDeclaredPluginRouteInput(request, declaration) {
+	if (declaration.body === "none") {
+		await readRouteBody(request, 0);
+		return parseQuery(request);
+	}
+	const limit = declaration.maxBytes ?? PLUGIN_ROUTE_DEFAULT_BODY_BYTES;
+	const bytes = await readRouteBody(request, Math.min(limit, PLUGIN_ROUTE_MAX_BODY_BYTES));
+	switch (declaration.body) {
+		case "bytes": return bytes;
+		case "text": return decodeText(bytes);
+		case "json": try {
+			return JSON.parse(decodeText(bytes));
+		} catch (error) {
+			if (error instanceof PluginRouteRequestError) throw error;
+			throw new PluginRouteRequestError("Plugin route request body is not valid JSON", 400);
+		}
+		case "form-data": return parseFormData(request, bytes);
+	}
+}
+function isPluginResponse(value) {
+	return typeof value === "object" && value !== null && value.__emdashPluginResponse === true;
+}
+async function pluginRouteResponseToWire(value, options = {}) {
+	if (!isPluginResponse(value)) throw new TypeError("Raw plugin routes must return pluginResponse()");
+	if (!Number.isInteger(value.status) || value.status < 200 || value.status > 599) throw new TypeError("Raw plugin route status must be an integer from 200 to 599");
+	if (!Array.isArray(value.headers)) throw new TypeError("Raw plugin route headers are invalid");
+	const sourceHeaders = new Headers();
+	for (const entry of value.headers) {
+		if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string" || typeof entry[1] !== "string") throw new TypeError("Raw plugin route headers are invalid");
+		sourceHeaders.append(entry[0], entry[1]);
+	}
+	const headers = new Headers();
+	sourceHeaders.forEach((headerValue, name) => {
+		if (ALLOWED_RESPONSE_HEADERS.has(name)) {
+			headers.set(name, headerValue);
+			return;
+		}
+		if (name !== "location") return;
+		if (options.allowExternalLocation) {
+			headers.set(name, headerValue);
+			return;
+		}
+		if (options.publicRequestUrl) try {
+			const requestUrl = new URL(options.publicRequestUrl);
+			if (new URL(headerValue, requestUrl).origin === requestUrl.origin) {
+				headers.set(name, headerValue);
+				return;
+			}
+		} catch {}
+		throw new TypeError("Public raw plugin route redirects must stay on the site origin");
+	});
+	if (!headers.has("content-type")) headers.set("content-type", "application/octet-stream");
+	const mediaType = (headers.get("content-type") ?? "application/octet-stream").split(";", 1)[0].trim().toLowerCase();
+	if (ACTIVE_RESPONSE_TYPES.has(mediaType) || SCRIPT_MEDIA_TYPE_PATTERN.test(mediaType)) throw new TypeError(`Raw plugin route content type "${mediaType}" is not allowed`);
+	headers.set("x-content-type-options", "nosniff");
+	headers.set("content-security-policy", "sandbox; default-src 'none'");
+	headers.set("referrer-policy", "no-referrer");
+	let body = new Uint8Array();
+	if (value.body !== null) if (value.body.kind === "text" && typeof value.body.value === "string") body = UTF8.encode(value.body.value);
+	else if (value.body.kind === "bytes" && value.body.value instanceof Uint8Array) body = new Uint8Array(value.body.value);
+	else throw new TypeError("Raw plugin route body is invalid");
+	if (body.byteLength > PLUGIN_ROUTE_MAX_BODY_BYTES) throw new TypeError(`Raw plugin route response body exceeds ${PLUGIN_ROUTE_MAX_BODY_BYTES} bytes`);
+	return {
+		status: value.status,
+		headers: [...headers.entries()],
+		body
+	};
+}
+function pluginRouteResponseFromWire(wire, method) {
+	const nullBodyStatus = wire.status === 204 || wire.status === 205 || wire.status === 304;
+	const body = method === "HEAD" || nullBodyStatus ? null : new Uint8Array(wire.body).buffer;
+	return new Response(body, {
+		status: wire.status,
+		headers: wire.headers
+	});
+}
+
+//#endregion
+export { pluginRouteResponseToWire as i, parseDeclaredPluginRouteInput as n, pluginRouteResponseFromWire as r, PluginRouteRequestError as t };
+//# sourceMappingURL=route-wire-C9PJV9aL.mjs.map

package/dist/route-wire-C9PJV9aL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-wire-C9PJV9aL.mjs","names":[],"sources":["../src/plugins/route-wire.ts"],"sourcesContent":["import {\n\tPLUGIN_ROUTE_DEFAULT_BODY_BYTES,\n\tPLUGIN_ROUTE_MAX_BODY_BYTES,\n\tPLUGIN_ROUTE_MAX_FILENAME_BYTES,\n\tPLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES,\n\tPLUGIN_ROUTE_MAX_MULTIPART_PARTS,\n\ttype PluginRouteRequest,\n} from \"@emdash-cms/plugin-types\";\n\nimport type { PluginFormData, PluginResponse } from \"../plugin-types.js\";\nimport { readPluginHttpBytes } from \"./http-wire.js\";\n\nconst UTF8 = new TextEncoder();\nconst FILENAME_PATH_SEPARATOR_PATTERN = /[/\\\\]/;\nconst SCRIPT_MEDIA_TYPE_PATTERN = /(?:java|ecma)script/;\nconst ALLOWED_RESPONSE_HEADERS = new Set([\n\t\"accept-ranges\",\n\t\"content-disposition\",\n\t\"content-encoding\",\n\t\"content-language\",\n\t\"content-range\",\n\t\"content-type\",\n\t\"etag\",\n\t\"last-modified\",\n\t\"retry-after\",\n]);\nconst ACTIVE_RESPONSE_TYPES = new Set([\n\t\"application/ecmascript\",\n\t\"application/javascript\",\n\t\"application/wasm\",\n\t\"application/xhtml+xml\",\n\t\"application/xml\",\n\t\"image/svg+xml\",\n\t\"multipart/related\",\n\t\"multipart/x-mixed-replace\",\n\t\"text/css\",\n\t\"text/ecmascript\",\n\t\"text/html\",\n\t\"text/javascript\",\n\t\"text/jscript\",\n\t\"text/livescript\",\n\t\"text/xml\",\n]);\n\nexport interface PluginRouteResponseWire {\n\tstatus: number;\n\theaders: Array<[string, string]>;\n\tbody: Uint8Array;\n}\n\nexport interface PluginRouteResponseWireOptions {\n\tallowExternalLocation?: boolean;\n\tpublicRequestUrl?: string;\n}\n\nexport class PluginRouteRequestError extends Error {\n\tconstructor(\n\t\tmessage: string,\n\t\treadonly status: 400 | 413 | 415,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"PluginRouteRequestError\";\n\t}\n}\n\nfunction parseQuery(request: Request): Record<string, string | string[]> {\n\tconst input: Record<string, string | string[]> = {};\n\tconst params = new URL(request.url).searchParams;\n\tfor (const key of new Set(params.keys())) {\n\t\tconst values = params.getAll(key);\n\t\tinput[key] = values.length > 1 ? values : values[0];\n\t}\n\treturn input;\n}\n\nasync function readRouteBody(request: Request, limit: number): Promise<Uint8Array> {\n\tconst declaredLength = request.headers.get(\"content-length\");\n\tif (declaredLength !== null) {\n\t\tconst parsed = Number(declaredLength);\n\t\tif (Number.isFinite(parsed) && parsed > limit) {\n\t\t\tthrow new PluginRouteRequestError(`Plugin route request body exceeds ${limit} bytes`, 413);\n\t\t}\n\t}\n\ttry {\n\t\treturn await readPluginHttpBytes(request.body, limit, \"request\");\n\t} catch (error) {\n\t\tif (!(error instanceof Error) || !error.message.includes(\"exceeds\")) {\n\t\t\tthrow new PluginRouteRequestError(\"Plugin route request body could not be read\", 400);\n\t\t}\n\t\tthrow new PluginRouteRequestError(`Plugin route request body exceeds ${limit} bytes`, 413);\n\t}\n}\n\nfunction decodeText(bytes: Uint8Array): string {\n\ttry {\n\t\treturn new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n\t} catch {\n\t\tthrow new PluginRouteRequestError(\"Plugin route request body is not valid UTF-8\", 400);\n\t}\n}\n\nasync function parseFormData(request: Request, bytes: Uint8Array): Promise<PluginFormData> {\n\tconst contentType = request.headers.get(\"content-type\") ?? \"\";\n\tif (\n\t\t!contentType.toLowerCase().startsWith(\"multipart/form-data;\") &&\n\t\t!contentType.toLowerCase().startsWith(\"application/x-www-form-urlencoded\")\n\t) {\n\t\tthrow new PluginRouteRequestError(\n\t\t\t\"Plugin route form-data requests require multipart/form-data or application/x-www-form-urlencoded\",\n\t\t\t415,\n\t\t);\n\t}\n\n\tlet parsed: FormData;\n\ttry {\n\t\tparsed = await new Request(request.url, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"content-type\": contentType },\n\t\t\tbody: new Uint8Array(bytes).buffer,\n\t\t}).formData();\n\t} catch {\n\t\tthrow new PluginRouteRequestError(\"Plugin route form-data body is malformed\", 400);\n\t}\n\n\tconst entries: PluginFormData[\"entries\"] = [];\n\tfor (const [name, value] of parsed.entries()) {\n\t\tif (entries.length >= PLUGIN_ROUTE_MAX_MULTIPART_PARTS) {\n\t\t\tthrow new PluginRouteRequestError(\n\t\t\t\t`Plugin route form-data exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PARTS} parts`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\t\tif (typeof value === \"string\") {\n\t\t\tif (UTF8.encode(value).byteLength > PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES) {\n\t\t\t\tthrow new PluginRouteRequestError(\n\t\t\t\t\t`Plugin route form-data part exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES} bytes`,\n\t\t\t\t\t413,\n\t\t\t\t);\n\t\t\t}\n\t\t\tentries.push({ name, kind: \"text\", value });\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst filename = value.name;\n\t\tlet hasControlCharacter = false;\n\t\tfor (const character of filename) {\n\t\t\tconst codePoint = character.codePointAt(0);\n\t\t\tif (codePoint !== undefined && (codePoint < 32 || codePoint === 127)) {\n\t\t\t\thasControlCharacter = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tif (\n\t\t\tUTF8.encode(filename).byteLength > PLUGIN_ROUTE_MAX_FILENAME_BYTES ||\n\t\t\thasControlCharacter ||\n\t\t\tFILENAME_PATH_SEPARATOR_PATTERN.test(filename)\n\t\t) {\n\t\t\tthrow new PluginRouteRequestError(\"Plugin route form-data filename is invalid\", 400);\n\t\t}\n\t\tif (value.size > PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES) {\n\t\t\tthrow new PluginRouteRequestError(\n\t\t\t\t`Plugin route form-data part exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES} bytes`,\n\t\t\t\t413,\n\t\t\t);\n\t\t}\n\t\tentries.push({\n\t\t\tname,\n\t\t\tkind: \"file\",\n\t\t\tfilename,\n\t\t\tcontentType: value.type || \"application/octet-stream\",\n\t\t\tbytes: new Uint8Array(await value.arrayBuffer()),\n\t\t});\n\t}\n\treturn { entries };\n}\n\nexport async function parseDeclaredPluginRouteInput(\n\trequest: Request,\n\tdeclaration: PluginRouteRequest,\n): Promise<unknown> {\n\tif (declaration.body === \"none\") {\n\t\tawait readRouteBody(request, 0);\n\t\treturn parseQuery(request);\n\t}\n\tconst limit = declaration.maxBytes ?? PLUGIN_ROUTE_DEFAULT_BODY_BYTES;\n\tconst bytes = await readRouteBody(request, Math.min(limit, PLUGIN_ROUTE_MAX_BODY_BYTES));\n\n\tswitch (declaration.body) {\n\t\tcase \"bytes\":\n\t\t\treturn bytes;\n\t\tcase \"text\":\n\t\t\treturn decodeText(bytes);\n\t\tcase \"json\":\n\t\t\ttry {\n\t\t\t\treturn JSON.parse(decodeText(bytes));\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof PluginRouteRequestError) throw error;\n\t\t\t\tthrow new PluginRouteRequestError(\"Plugin route request body is not valid JSON\", 400);\n\t\t\t}\n\t\tcase \"form-data\":\n\t\t\treturn parseFormData(request, bytes);\n\t}\n}\n\nexport function isPluginResponse(value: unknown): value is PluginResponse {\n\treturn (\n\t\ttypeof value === \"object\" &&\n\t\tvalue !== null &&\n\t\t(value as { __emdashPluginResponse?: unknown }).__emdashPluginResponse === true\n\t);\n}\n\nexport async function pluginRouteResponseToWire(\n\tvalue: unknown,\n\toptions: PluginRouteResponseWireOptions = {},\n): Promise<PluginRouteResponseWire> {\n\tif (!isPluginResponse(value)) {\n\t\tthrow new TypeError(\"Raw plugin routes must return pluginResponse()\");\n\t}\n\tif (!Number.isInteger(value.status) || value.status < 200 || value.status > 599) {\n\t\tthrow new TypeError(\"Raw plugin route status must be an integer from 200 to 599\");\n\t}\n\tif (!Array.isArray(value.headers)) {\n\t\tthrow new TypeError(\"Raw plugin route headers are invalid\");\n\t}\n\n\tconst sourceHeaders = new Headers();\n\tfor (const entry of value.headers) {\n\t\tif (\n\t\t\t!Array.isArray(entry) ||\n\t\t\tentry.length !== 2 ||\n\t\t\ttypeof entry[0] !== \"string\" ||\n\t\t\ttypeof entry[1] !== \"string\"\n\t\t) {\n\t\t\tthrow new TypeError(\"Raw plugin route headers are invalid\");\n\t\t}\n\t\tsourceHeaders.append(entry[0], entry[1]);\n\t}\n\n\tconst headers = new Headers();\n\tsourceHeaders.forEach((headerValue, name) => {\n\t\tif (ALLOWED_RESPONSE_HEADERS.has(name)) {\n\t\t\theaders.set(name, headerValue);\n\t\t\treturn;\n\t\t}\n\t\tif (name !== \"location\") return;\n\t\tif (options.allowExternalLocation) {\n\t\t\theaders.set(name, headerValue);\n\t\t\treturn;\n\t\t}\n\t\tif (options.publicRequestUrl) {\n\t\t\ttry {\n\t\t\t\tconst requestUrl = new URL(options.publicRequestUrl);\n\t\t\t\tif (new URL(headerValue, requestUrl).origin === requestUrl.origin) {\n\t\t\t\t\theaders.set(name, headerValue);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t} catch {}\n\t\t}\n\t\tthrow new TypeError(\"Public raw plugin route redirects must stay on the site origin\");\n\t});\n\tif (!headers.has(\"content-type\")) headers.set(\"content-type\", \"application/octet-stream\");\n\tconst mediaType = (headers.get(\"content-type\") ?? \"application/octet-stream\")\n\t\t.split(\";\", 1)[0]\n\t\t.trim()\n\t\t.toLowerCase();\n\tif (ACTIVE_RESPONSE_TYPES.has(mediaType) || SCRIPT_MEDIA_TYPE_PATTERN.test(mediaType)) {\n\t\tthrow new TypeError(`Raw plugin route content type \"${mediaType}\" is not allowed`);\n\t}\n\theaders.set(\"x-content-type-options\", \"nosniff\");\n\theaders.set(\"content-security-policy\", \"sandbox; default-src 'none'\");\n\theaders.set(\"referrer-policy\", \"no-referrer\");\n\n\tlet body = new Uint8Array();\n\tif (value.body !== null) {\n\t\tif (value.body.kind === \"text\" && typeof value.body.value === \"string\") {\n\t\t\tbody = UTF8.encode(value.body.value);\n\t\t} else if (value.body.kind === \"bytes\" && value.body.value instanceof Uint8Array) {\n\t\t\tbody = new Uint8Array(value.body.value);\n\t\t} else {\n\t\t\tthrow new TypeError(\"Raw plugin route body is invalid\");\n\t\t}\n\t}\n\tif (body.byteLength > PLUGIN_ROUTE_MAX_BODY_BYTES) {\n\t\tthrow new TypeError(\n\t\t\t`Raw plugin route response body exceeds ${PLUGIN_ROUTE_MAX_BODY_BYTES} bytes`,\n\t\t);\n\t}\n\n\treturn {\n\t\tstatus: value.status,\n\t\theaders: [...headers.entries()],\n\t\tbody,\n\t};\n}\n\nexport function pluginRouteResponseFromWire(\n\twire: PluginRouteResponseWire,\n\tmethod: string,\n): Response {\n\tconst nullBodyStatus = wire.status === 204 || wire.status === 205 || wire.status === 304;\n\tconst body = method === \"HEAD\" || nullBodyStatus ? null : new Uint8Array(wire.body).buffer;\n\treturn new Response(body, { status: wire.status, headers: wire.headers });\n}\n"],"mappings":";;;;AAYA,MAAM,OAAO,IAAI,aAAa;AAC9B,MAAM,kCAAkC;AACxC,MAAM,4BAA4B;AAClC,MAAM,2BAA2B,IAAI,IAAI;CACxC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AACF,MAAM,wBAAwB,IAAI,IAAI;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,CAAC;AAaF,IAAa,0BAAb,cAA6C,MAAM;CAClD,YACC,SACA,AAAS,QACR;AACD,QAAM,QAAQ;EAFL;AAGT,OAAK,OAAO;;;AAId,SAAS,WAAW,SAAqD;CACxE,MAAM,QAA2C,EAAE;CACnD,MAAM,SAAS,IAAI,IAAI,QAAQ,IAAI,CAAC;AACpC,MAAK,MAAM,OAAO,IAAI,IAAI,OAAO,MAAM,CAAC,EAAE;EACzC,MAAM,SAAS,OAAO,OAAO,IAAI;AACjC,QAAM,OAAO,OAAO,SAAS,IAAI,SAAS,OAAO;;AAElD,QAAO;;AAGR,eAAe,cAAc,SAAkB,OAAoC;CAClF,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,iBAAiB;AAC5D,KAAI,mBAAmB,MAAM;EAC5B,MAAM,SAAS,OAAO,eAAe;AACrC,MAAI,OAAO,SAAS,OAAO,IAAI,SAAS,MACvC,OAAM,IAAI,wBAAwB,qCAAqC,MAAM,SAAS,IAAI;;AAG5F,KAAI;AACH,SAAO,MAAM,oBAAoB,QAAQ,MAAM,OAAO,UAAU;UACxD,OAAO;AACf,MAAI,EAAE,iBAAiB,UAAU,CAAC,MAAM,QAAQ,SAAS,UAAU,CAClE,OAAM,IAAI,wBAAwB,+CAA+C,IAAI;AAEtF,QAAM,IAAI,wBAAwB,qCAAqC,MAAM,SAAS,IAAI;;;AAI5F,SAAS,WAAW,OAA2B;AAC9C,KAAI;AACH,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC,OAAO,MAAM;SACvD;AACP,QAAM,IAAI,wBAAwB,gDAAgD,IAAI;;;AAIxF,eAAe,cAAc,SAAkB,OAA4C;CAC1F,MAAM,cAAc,QAAQ,QAAQ,IAAI,eAAe,IAAI;AAC3D,KACC,CAAC,YAAY,aAAa,CAAC,WAAW,uBAAuB,IAC7D,CAAC,YAAY,aAAa,CAAC,WAAW,oCAAoC,CAE1E,OAAM,IAAI,wBACT,oGACA,IACA;CAGF,IAAI;AACJ,KAAI;AACH,WAAS,MAAM,IAAI,QAAQ,QAAQ,KAAK;GACvC,QAAQ;GACR,SAAS,EAAE,gBAAgB,aAAa;GACxC,MAAM,IAAI,WAAW,MAAM,CAAC;GAC5B,CAAC,CAAC,UAAU;SACN;AACP,QAAM,IAAI,wBAAwB,4CAA4C,IAAI;;CAGnF,MAAM,UAAqC,EAAE;AAC7C,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,SAAS,EAAE;AAC7C,MAAI,QAAQ,UAAU,iCACrB,OAAM,IAAI,wBACT,kCAAkC,iCAAiC,SACnE,IACA;AAEF,MAAI,OAAO,UAAU,UAAU;AAC9B,OAAI,KAAK,OAAO,MAAM,CAAC,aAAa,sCACnC,OAAM,IAAI,wBACT,uCAAuC,sCAAsC,SAC7E,IACA;AAEF,WAAQ,KAAK;IAAE;IAAM,MAAM;IAAQ;IAAO,CAAC;AAC3C;;EAGD,MAAM,WAAW,MAAM;EACvB,IAAI,sBAAsB;AAC1B,OAAK,MAAM,aAAa,UAAU;GACjC,MAAM,YAAY,UAAU,YAAY,EAAE;AAC1C,OAAI,cAAc,WAAc,YAAY,MAAM,cAAc,MAAM;AACrE,0BAAsB;AACtB;;;AAGF,MACC,KAAK,OAAO,SAAS,CAAC,aAAa,mCACnC,uBACA,gCAAgC,KAAK,SAAS,CAE9C,OAAM,IAAI,wBAAwB,8CAA8C,IAAI;AAErF,MAAI,MAAM,OAAO,sCAChB,OAAM,IAAI,wBACT,uCAAuC,sCAAsC,SAC7E,IACA;AAEF,UAAQ,KAAK;GACZ;GACA,MAAM;GACN;GACA,aAAa,MAAM,QAAQ;GAC3B,OAAO,IAAI,WAAW,MAAM,MAAM,aAAa,CAAC;GAChD,CAAC;;AAEH,QAAO,EAAE,SAAS;;AAGnB,eAAsB,8BACrB,SACA,aACmB;AACnB,KAAI,YAAY,SAAS,QAAQ;AAChC,QAAM,cAAc,SAAS,EAAE;AAC/B,SAAO,WAAW,QAAQ;;CAE3B,MAAM,QAAQ,YAAY,YAAY;CACtC,MAAM,QAAQ,MAAM,cAAc,SAAS,KAAK,IAAI,OAAO,4BAA4B,CAAC;AAExF,SAAQ,YAAY,MAApB;EACC,KAAK,QACJ,QAAO;EACR,KAAK,OACJ,QAAO,WAAW,MAAM;EACzB,KAAK,OACJ,KAAI;AACH,UAAO,KAAK,MAAM,WAAW,MAAM,CAAC;WAC5B,OAAO;AACf,OAAI,iBAAiB,wBAAyB,OAAM;AACpD,SAAM,IAAI,wBAAwB,+CAA+C,IAAI;;EAEvF,KAAK,YACJ,QAAO,cAAc,SAAS,MAAM;;;AAIvC,SAAgB,iBAAiB,OAAyC;AACzE,QACC,OAAO,UAAU,YACjB,UAAU,QACT,MAA+C,2BAA2B;;AAI7E,eAAsB,0BACrB,OACA,UAA0C,EAAE,EACT;AACnC,KAAI,CAAC,iBAAiB,MAAM,CAC3B,OAAM,IAAI,UAAU,iDAAiD;AAEtE,KAAI,CAAC,OAAO,UAAU,MAAM,OAAO,IAAI,MAAM,SAAS,OAAO,MAAM,SAAS,IAC3E,OAAM,IAAI,UAAU,6DAA6D;AAElF,KAAI,CAAC,MAAM,QAAQ,MAAM,QAAQ,CAChC,OAAM,IAAI,UAAU,uCAAuC;CAG5D,MAAM,gBAAgB,IAAI,SAAS;AACnC,MAAK,MAAM,SAAS,MAAM,SAAS;AAClC,MACC,CAAC,MAAM,QAAQ,MAAM,IACrB,MAAM,WAAW,KACjB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO,SAEpB,OAAM,IAAI,UAAU,uCAAuC;AAE5D,gBAAc,OAAO,MAAM,IAAI,MAAM,GAAG;;CAGzC,MAAM,UAAU,IAAI,SAAS;AAC7B,eAAc,SAAS,aAAa,SAAS;AAC5C,MAAI,yBAAyB,IAAI,KAAK,EAAE;AACvC,WAAQ,IAAI,MAAM,YAAY;AAC9B;;AAED,MAAI,SAAS,WAAY;AACzB,MAAI,QAAQ,uBAAuB;AAClC,WAAQ,IAAI,MAAM,YAAY;AAC9B;;AAED,MAAI,QAAQ,iBACX,KAAI;GACH,MAAM,aAAa,IAAI,IAAI,QAAQ,iBAAiB;AACpD,OAAI,IAAI,IAAI,aAAa,WAAW,CAAC,WAAW,WAAW,QAAQ;AAClE,YAAQ,IAAI,MAAM,YAAY;AAC9B;;UAEM;AAET,QAAM,IAAI,UAAU,iEAAiE;GACpF;AACF,KAAI,CAAC,QAAQ,IAAI,eAAe,CAAE,SAAQ,IAAI,gBAAgB,2BAA2B;CACzF,MAAM,aAAa,QAAQ,IAAI,eAAe,IAAI,4BAChD,MAAM,KAAK,EAAE,CAAC,GACd,MAAM,CACN,aAAa;AACf,KAAI,sBAAsB,IAAI,UAAU,IAAI,0BAA0B,KAAK,UAAU,CACpF,OAAM,IAAI,UAAU,kCAAkC,UAAU,kBAAkB;AAEnF,SAAQ,IAAI,0BAA0B,UAAU;AAChD,SAAQ,IAAI,2BAA2B,8BAA8B;AACrE,SAAQ,IAAI,mBAAmB,cAAc;CAE7C,IAAI,OAAO,IAAI,YAAY;AAC3B,KAAI,MAAM,SAAS,KAClB,KAAI,MAAM,KAAK,SAAS,UAAU,OAAO,MAAM,KAAK,UAAU,SAC7D,QAAO,KAAK,OAAO,MAAM,KAAK,MAAM;UAC1B,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK,iBAAiB,WACrE,QAAO,IAAI,WAAW,MAAM,KAAK,MAAM;KAEvC,OAAM,IAAI,UAAU,mCAAmC;AAGzD,KAAI,KAAK,aAAa,4BACrB,OAAM,IAAI,UACT,0CAA0C,4BAA4B,QACtE;AAGF,QAAO;EACN,QAAQ,MAAM;EACd,SAAS,CAAC,GAAG,QAAQ,SAAS,CAAC;EAC/B;EACA;;AAGF,SAAgB,4BACf,MACA,QACW;CACX,MAAM,iBAAiB,KAAK,WAAW,OAAO,KAAK,WAAW,OAAO,KAAK,WAAW;CACrF,MAAM,OAAO,WAAW,UAAU,iBAAiB,OAAO,IAAI,WAAW,KAAK,KAAK,CAAC;AACpF,QAAO,IAAI,SAAS,MAAM;EAAE,QAAQ,KAAK;EAAQ,SAAS,KAAK;EAAS,CAAC"}

package/dist/routes-lyYw0mMf.mjs

@@ -0,0 +1,272 @@
+import { p as PluginRouteError, t as PluginContextFactory } from "./context-CGQLA1-a.mjs";
+import { t as extractRequestMeta } from "./request-meta-D47mqyev.mjs";
+import { t as SiteWriteBlockedError } from "./fence-Bb_IbCxI.mjs";
+import { n as parseDeclaredPluginRouteInput } from "./route-wire-C9PJV9aL.mjs";
+import { z } from "zod";
+import { routeNameSchema } from "@emdash-cms/plugin-types";
+
+//#region src/plugins/routes.ts
+/**
+* Body-reading methods on `Request`. EmDash parses the request body once before
+* the handler runs and exposes the result as `ctx.input`, leaving the underlying
+* stream consumed. Calling any of these on `ctx.request` would re-read a spent
+* stream and throw an opaque platform error ("Body is unusable: Body has already
+* been read") with no hint about `ctx.input` — so the guard replaces them with an
+* actionable message instead.
+*/
+const CONSUMED_BODY_METHODS = new Set([
+	"json",
+	"text",
+	"arrayBuffer",
+	"blob",
+	"formData",
+	"bytes"
+]);
+/**
+* Wrap the request handed to a plugin route handler so an accidental
+* `ctx.request.json()` (or `.text()`, `.formData()`, …) fails with a message
+* pointing at `ctx.input` rather than the runtime's cryptic "body already read"
+* error. Every non-body member passes through unchanged; function members are
+* bound to the underlying request so methods like `clone()` don't throw an
+* "Illegal invocation" when called on the proxy.
+*/
+function guardConsumedRequestBody(request) {
+	return new Proxy(request, { get(target, prop) {
+		if (typeof prop === "string" && CONSUMED_BODY_METHODS.has(prop)) return () => {
+			throw new Error(`[emdash] ctx.request.${prop}() is not available inside a plugin route handler: EmDash has already parsed the request body and exposes it as ctx.input. Read ctx.input instead of ctx.request.${prop}().`);
+		};
+		const value = Reflect.get(target, prop, target);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+const pluginPublicRouteAcknowledgementSchema = z.array(routeNameSchema);
+/**
+* Build RouteMeta from a route's `public`/`cacheControl` flags. Single source
+* of truth for the "cacheControl is only ever exposed on public routes"
+* invariant — used for trusted routes and manifest-declared sandboxed routes.
+*/
+function buildRouteMeta(route) {
+	const meta = { public: route.public === true };
+	if (route.permission !== void 0) meta.permission = route.permission;
+	if (route.methods !== void 0) meta.methods = [...route.methods];
+	if (route.request !== void 0) meta.request = {
+		...route.request,
+		...route.request.headers ? { headers: [...route.request.headers] } : {}
+	};
+	if (route.response !== void 0) meta.response = route.response;
+	if (meta.public && typeof route.cacheControl === "string" && route.cacheControl.length > 0) meta.cacheControl = route.cacheControl;
+	return meta;
+}
+/**
+* HTTP methods that carry a request body. Everything else (GET, HEAD, DELETE)
+* takes its route input from the URL query string.
+*/
+const BODY_METHODS = new Set([
+	"POST",
+	"PUT",
+	"PATCH"
+]);
+/**
+* Parse a plugin route's input from the request, by method.
+*
+* Body methods (POST/PUT/PATCH) parse the JSON body as before. Bodyless
+* methods (GET/HEAD/DELETE) have no body, so `request.json()` resolves to
+* undefined and fails schema validation, so parse the query string into
+* an object instead. Repeated keys (`?tag=a&tag=b`) become an array so array
+* schemas work; a single key stays a scalar.
+*/
+async function parseRouteInput(request, declaration) {
+	if (declaration) return parseDeclaredPluginRouteInput(request, declaration);
+	if (BODY_METHODS.has(request.method.toUpperCase())) try {
+		return await request.json();
+	} catch {
+		return;
+	}
+	const params = new URL(request.url).searchParams;
+	const input = {};
+	for (const key of new Set(params.keys())) {
+		const values = params.getAll(key);
+		input[key] = values.length > 1 ? values : values[0];
+	}
+	return input;
+}
+/**
+* Convert the host's authenticated user into the read-only `UserInfo` shape
+* exposed to plugins as `ctx.user`. Strips sensitive/irrelevant fields and
+* keeps the value structured-clone-safe for sandboxed plugins.
+*/
+function toRouteCallerInfo(user) {
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		role: user.role,
+		createdAt: typeof user.createdAt === "string" ? user.createdAt : user.createdAt.toISOString()
+	};
+}
+/**
+* Route handler for a plugin
+*/
+var PluginRouteHandler = class {
+	contextFactory;
+	plugin;
+	trustedProxyHeaders;
+	constructor(plugin, factoryOptions) {
+		this.plugin = plugin;
+		this.contextFactory = new PluginContextFactory(factoryOptions);
+		this.trustedProxyHeaders = factoryOptions.trustedProxyHeaders ?? [];
+	}
+	/**
+	* Invoke a route by name
+	*/
+	async invoke(routeName, options) {
+		const route = this.plugin.routes[routeName];
+		if (!route) return {
+			success: false,
+			error: {
+				code: "ROUTE_NOT_FOUND",
+				message: `Route "${routeName}" not found in plugin "${this.plugin.id}"`
+			},
+			status: 404
+		};
+		let validatedInput;
+		if (route.input) {
+			const parseResult = route.input.safeParse(options.body);
+			if (!parseResult.success) return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: "Invalid request body",
+					details: z.formatError(parseResult.error)
+				},
+				status: 400
+			};
+			validatedInput = parseResult.data;
+		} else validatedInput = options.body;
+		const routeContext = {
+			...this.contextFactory.createContext(this.plugin),
+			input: validatedInput,
+			request: guardConsumedRequestBody(options.request),
+			requestMeta: extractRequestMeta(options.request, this.trustedProxyHeaders),
+			user: options.user,
+			ui: options.ui
+		};
+		try {
+			return {
+				success: true,
+				data: await route.handler(routeContext),
+				status: 200
+			};
+		} catch (error) {
+			if (error instanceof SiteWriteBlockedError) return {
+				success: false,
+				error: {
+					code: error.code,
+					message: error.message
+				},
+				status: error.status
+			};
+			if (error instanceof PluginRouteError) return {
+				success: false,
+				error: {
+					code: error.code,
+					message: error.message,
+					details: error.details
+				},
+				status: error.status
+			};
+			console.error(`[plugin:${this.plugin.id}] Route handler failed:`, error);
+			return {
+				success: false,
+				error: {
+					code: "INTERNAL_ERROR",
+					message: "An internal error occurred"
+				},
+				status: 500
+			};
+		}
+	}
+	/**
+	* Get all route names
+	*/
+	getRouteNames() {
+		return Object.keys(this.plugin.routes);
+	}
+	/**
+	* Check if a route exists
+	*/
+	hasRoute(name) {
+		return name in this.plugin.routes;
+	}
+	/**
+	* Get route metadata without invoking the handler.
+	* Returns null if the route doesn't exist.
+	*/
+	getRouteMeta(name) {
+		const route = this.plugin.routes[name];
+		if (!route) return null;
+		return buildRouteMeta(route);
+	}
+};
+/**
+* Registry for all plugin route handlers
+*/
+var PluginRouteRegistry = class {
+	handlers = /* @__PURE__ */ new Map();
+	constructor(factoryOptions) {
+		this.factoryOptions = factoryOptions;
+	}
+	/**
+	* Register a plugin's routes
+	*/
+	register(plugin) {
+		const handler = new PluginRouteHandler(plugin, this.factoryOptions);
+		this.handlers.set(plugin.id, handler);
+	}
+	/**
+	* Unregister a plugin's routes
+	*/
+	unregister(pluginId) {
+		this.handlers.delete(pluginId);
+	}
+	/**
+	* Invoke a plugin route
+	*/
+	async invoke(pluginId, routeName, options) {
+		const handler = this.handlers.get(pluginId);
+		if (!handler) return {
+			success: false,
+			error: {
+				code: "PLUGIN_NOT_FOUND",
+				message: `Plugin "${pluginId}" not found`
+			},
+			status: 404
+		};
+		return handler.invoke(routeName, options);
+	}
+	/**
+	* Get all registered plugin IDs
+	*/
+	getPluginIds() {
+		return [...this.handlers.keys()];
+	}
+	/**
+	* Get routes for a plugin
+	*/
+	getRoutes(pluginId) {
+		return this.handlers.get(pluginId)?.getRouteNames() ?? [];
+	}
+	/**
+	* Get route metadata for a specific plugin route.
+	* Returns null if the plugin or route doesn't exist.
+	*/
+	getRouteMeta(pluginId, routeName) {
+		const handler = this.handlers.get(pluginId);
+		if (!handler) return null;
+		return handler.getRouteMeta(routeName);
+	}
+};
+
+//#endregion
+export { toRouteCallerInfo as a, pluginPublicRouteAcknowledgementSchema as i, buildRouteMeta as n, parseRouteInput as r, PluginRouteRegistry as t };
+//# sourceMappingURL=routes-lyYw0mMf.mjs.map

package/dist/routes-lyYw0mMf.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-lyYw0mMf.mjs","names":[],"sources":["../src/plugins/routes.ts"],"sourcesContent":["/**\n * Plugin Routes v2\n *\n * Handles plugin API route invocation with:\n * - Input validation via Zod schemas\n * - Route context creation\n * - Error handling\n *\n */\n\nimport type { PluginUiContext } from \"@emdash-cms/blocks/server\";\nimport type {\n\tPluginRouteMethod,\n\tPluginRouteRequest,\n\tPluginRouteResponseMode,\n} from \"@emdash-cms/plugin-types\";\nimport { routeNameSchema } from \"@emdash-cms/plugin-types\";\nimport { z } from \"zod\";\n\nimport { SiteWriteBlockedError } from \"../transfer/fence.js\";\nimport { PluginContextFactory, type PluginContextFactoryOptions } from \"./context.js\";\nimport { extractRequestMeta } from \"./request-meta.js\";\nimport { PluginRouteError } from \"./route-error.js\";\nimport { parseDeclaredPluginRouteInput } from \"./route-wire.js\";\nimport type { ResolvedPlugin, RouteContext, PluginRoute, UserInfo } from \"./types.js\";\n\nexport { PluginRouteError };\n\n/**\n * Body-reading methods on `Request`. EmDash parses the request body once before\n * the handler runs and exposes the result as `ctx.input`, leaving the underlying\n * stream consumed. Calling any of these on `ctx.request` would re-read a spent\n * stream and throw an opaque platform error (\"Body is unusable: Body has already\n * been read\") with no hint about `ctx.input` — so the guard replaces them with an\n * actionable message instead.\n */\nconst CONSUMED_BODY_METHODS = new Set([\"json\", \"text\", \"arrayBuffer\", \"blob\", \"formData\", \"bytes\"]);\n\n/**\n * Wrap the request handed to a plugin route handler so an accidental\n * `ctx.request.json()` (or `.text()`, `.formData()`, …) fails with a message\n * pointing at `ctx.input` rather than the runtime's cryptic \"body already read\"\n * error. Every non-body member passes through unchanged; function members are\n * bound to the underlying request so methods like `clone()` don't throw an\n * \"Illegal invocation\" when called on the proxy.\n */\nfunction guardConsumedRequestBody(request: Request): Request {\n\treturn new Proxy(request, {\n\t\tget(target, prop) {\n\t\t\tif (typeof prop === \"string\" && CONSUMED_BODY_METHODS.has(prop)) {\n\t\t\t\treturn () => {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`[emdash] ctx.request.${prop}() is not available inside a plugin route handler: ` +\n\t\t\t\t\t\t\t`EmDash has already parsed the request body and exposes it as ctx.input. ` +\n\t\t\t\t\t\t\t`Read ctx.input instead of ctx.request.${prop}().`,\n\t\t\t\t\t);\n\t\t\t\t};\n\t\t\t}\n\t\t\tconst value = Reflect.get(target, prop, target);\n\t\t\treturn typeof value === \"function\" ? value.bind(target) : value;\n\t\t},\n\t});\n}\n\n/**\n * Route metadata (public flag) without the handler.\n * Used by the catch-all route to decide auth before dispatch.\n */\nexport interface RouteMeta {\n\tpublic: boolean;\n\tpermission?: string;\n\t/**\n\t * Cache-Control value for successful GET responses. Only ever set for\n\t * public routes — authenticated responses must stay `private, no-store`.\n\t */\n\tcacheControl?: string;\n\tmethods?: PluginRouteMethod[];\n\trequest?: PluginRouteRequest;\n\tresponse?: PluginRouteResponseMode;\n}\n\nexport const pluginPublicRouteAcknowledgementSchema = z.array(routeNameSchema);\n\nexport type PluginContentCacheInvalidator = (tags: string[]) => Promise<void>;\n\n/**\n * Build RouteMeta from a route's `public`/`cacheControl` flags. Single source\n * of truth for the \"cacheControl is only ever exposed on public routes\"\n * invariant — used for trusted routes and manifest-declared sandboxed routes.\n */\nexport function buildRouteMeta(route: {\n\tpublic?: boolean;\n\tpermission?: string;\n\tcacheControl?: string;\n\tmethods?: PluginRouteMethod[];\n\trequest?: PluginRouteRequest;\n\tresponse?: PluginRouteResponseMode;\n}): RouteMeta {\n\tconst meta: RouteMeta = { public: route.public === true };\n\tif (route.permission !== undefined) meta.permission = route.permission;\n\tif (route.methods !== undefined) meta.methods = [...route.methods];\n\tif (route.request !== undefined) {\n\t\tmeta.request = {\n\t\t\t...route.request,\n\t\t\t...(route.request.headers ? { headers: [...route.request.headers] } : {}),\n\t\t};\n\t}\n\tif (route.response !== undefined) meta.response = route.response;\n\t// Private responses are per-user and must never become cacheable, even if\n\t// a route sets both flags.\n\tif (meta.public && typeof route.cacheControl === \"string\" && route.cacheControl.length > 0) {\n\t\tmeta.cacheControl = route.cacheControl;\n\t}\n\treturn meta;\n}\n\n/**\n * HTTP methods that carry a request body. Everything else (GET, HEAD, DELETE)\n * takes its route input from the URL query string.\n */\nconst BODY_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\"]);\n\n/**\n * Parse a plugin route's input from the request, by method.\n *\n * Body methods (POST/PUT/PATCH) parse the JSON body as before. Bodyless\n * methods (GET/HEAD/DELETE) have no body, so `request.json()` resolves to\n * undefined and fails schema validation, so parse the query string into\n * an object instead. Repeated keys (`?tag=a&tag=b`) become an array so array\n * schemas work; a single key stays a scalar.\n */\nexport async function parseRouteInput(\n\trequest: Request,\n\tdeclaration?: PluginRouteRequest,\n): Promise<unknown> {\n\tif (declaration) return parseDeclaredPluginRouteInput(request, declaration);\n\tif (BODY_METHODS.has(request.method.toUpperCase())) {\n\t\ttry {\n\t\t\treturn await request.json();\n\t\t} catch {\n\t\t\t// No body or not JSON\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tconst params = new URL(request.url).searchParams;\n\tconst input: Record<string, string | string[]> = {};\n\tfor (const key of new Set(params.keys())) {\n\t\tconst values = params.getAll(key);\n\t\tinput[key] = values.length > 1 ? values : values[0];\n\t}\n\treturn input;\n}\n\n/**\n * Result from a route invocation\n */\nexport interface RouteResult<T = unknown> {\n\tsuccess: boolean;\n\tdata?: T;\n\terror?: {\n\t\tcode: string;\n\t\tmessage: string;\n\t\tdetails?: unknown;\n\t};\n\tstatus: number;\n}\n\n/**\n * Host-side user shape accepted when dispatching a plugin route. Structurally\n * matches `User` from `@emdash-cms/auth` so hosts can pass `locals.user`\n * directly without the plugin layer depending on the auth package.\n */\nexport interface RouteCallerInput {\n\tid: string;\n\temail: string;\n\tname: string | null;\n\trole: number;\n\tcreatedAt: Date | string;\n}\n\n/**\n * Convert the host's authenticated user into the read-only `UserInfo` shape\n * exposed to plugins as `ctx.user`. Strips sensitive/irrelevant fields and\n * keeps the value structured-clone-safe for sandboxed plugins.\n */\nexport function toRouteCallerInfo(user: RouteCallerInput): UserInfo {\n\treturn {\n\t\tid: user.id,\n\t\temail: user.email,\n\t\tname: user.name,\n\t\trole: user.role,\n\t\tcreatedAt: typeof user.createdAt === \"string\" ? user.createdAt : user.createdAt.toISOString(),\n\t};\n}\n\n/**\n * Route invocation options\n */\nexport interface InvokeRouteOptions {\n\t/** The original request */\n\trequest: Request;\n\t/** Request body (already parsed) */\n\tbody?: unknown;\n\t/**\n\t * Authenticated caller resolved by the host, exposed to the handler as\n\t * `ctx.user`. Undefined for public routes and unbound machine tokens.\n\t */\n\tuser?: UserInfo;\n\t/** Host-attested context for a validated Block Kit request. */\n\tui?: PluginUiContext;\n}\n\n/**\n * Route handler for a plugin\n */\nexport class PluginRouteHandler {\n\tprivate contextFactory: PluginContextFactory;\n\tprivate plugin: ResolvedPlugin;\n\tprivate trustedProxyHeaders: string[];\n\n\tconstructor(plugin: ResolvedPlugin, factoryOptions: PluginContextFactoryOptions) {\n\t\tthis.plugin = plugin;\n\t\tthis.contextFactory = new PluginContextFactory(factoryOptions);\n\t\tthis.trustedProxyHeaders = factoryOptions.trustedProxyHeaders ?? [];\n\t}\n\n\t/**\n\t * Invoke a route by name\n\t */\n\tasync invoke(routeName: string, options: InvokeRouteOptions): Promise<RouteResult> {\n\t\tconst route = this.plugin.routes[routeName];\n\n\t\tif (!route) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"ROUTE_NOT_FOUND\",\n\t\t\t\t\tmessage: `Route \"${routeName}\" not found in plugin \"${this.plugin.id}\"`,\n\t\t\t\t},\n\t\t\t\tstatus: 404,\n\t\t\t};\n\t\t}\n\n\t\t// Validate input if schema is provided\n\t\tlet validatedInput: unknown;\n\t\tif (route.input) {\n\t\t\tconst parseResult = route.input.safeParse(options.body);\n\t\t\tif (!parseResult.success) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: \"VALIDATION_ERROR\",\n\t\t\t\t\t\tmessage: \"Invalid request body\",\n\t\t\t\t\t\tdetails: z.formatError(parseResult.error),\n\t\t\t\t\t},\n\t\t\t\t\tstatus: 400,\n\t\t\t\t};\n\t\t\t}\n\t\t\tvalidatedInput = parseResult.data;\n\t\t} else {\n\t\t\tvalidatedInput = options.body;\n\t\t}\n\n\t\t// Create route context\n\t\tconst baseContext = this.contextFactory.createContext(this.plugin);\n\t\tconst routeContext: RouteContext = {\n\t\t\t...baseContext,\n\t\t\tinput: validatedInput,\n\t\t\t// The body is already parsed into `input`; guard `ctx.request`'s\n\t\t\t// body-reading methods so a re-read fails with an actionable message.\n\t\t\t// Metadata extraction uses the original request (headers only).\n\t\t\trequest: guardConsumedRequestBody(options.request),\n\t\t\trequestMeta: extractRequestMeta(options.request, this.trustedProxyHeaders),\n\t\t\tuser: options.user,\n\t\t\tui: options.ui,\n\t\t};\n\n\t\t// Execute handler\n\t\ttry {\n\t\t\tconst result = await route.handler(routeContext);\n\t\t\treturn {\n\t\t\t\tsuccess: true,\n\t\t\t\tdata: result,\n\t\t\t\tstatus: 200,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (error instanceof SiteWriteBlockedError) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: { code: error.code, message: error.message },\n\t\t\t\t\tstatus: error.status,\n\t\t\t\t};\n\t\t\t}\n\t\t\t// Handle known error types\n\t\t\tif (error instanceof PluginRouteError) {\n\t\t\t\treturn {\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terror: {\n\t\t\t\t\t\tcode: error.code,\n\t\t\t\t\t\tmessage: error.message,\n\t\t\t\t\t\tdetails: error.details,\n\t\t\t\t\t},\n\t\t\t\t\tstatus: error.status,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Unknown error -- log internally, return generic message\n\t\t\tconsole.error(`[plugin:${this.plugin.id}] Route handler failed:`, error);\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"INTERNAL_ERROR\",\n\t\t\t\t\tmessage: \"An internal error occurred\",\n\t\t\t\t},\n\t\t\t\tstatus: 500,\n\t\t\t};\n\t\t}\n\t}\n\n\t/**\n\t * Get all route names\n\t */\n\tgetRouteNames(): string[] {\n\t\treturn Object.keys(this.plugin.routes);\n\t}\n\n\t/**\n\t * Check if a route exists\n\t */\n\thasRoute(name: string): boolean {\n\t\treturn name in this.plugin.routes;\n\t}\n\n\t/**\n\t * Get route metadata without invoking the handler.\n\t * Returns null if the route doesn't exist.\n\t */\n\tgetRouteMeta(name: string): RouteMeta | null {\n\t\tconst route: PluginRoute | undefined = this.plugin.routes[name];\n\t\tif (!route) return null;\n\t\treturn buildRouteMeta(route);\n\t}\n}\n\n/**\n * Registry for all plugin route handlers\n */\nexport class PluginRouteRegistry {\n\tprivate handlers: Map<string, PluginRouteHandler> = new Map();\n\n\tconstructor(private factoryOptions: PluginContextFactoryOptions) {}\n\n\t/**\n\t * Register a plugin's routes\n\t */\n\tregister(plugin: ResolvedPlugin): void {\n\t\tconst handler = new PluginRouteHandler(plugin, this.factoryOptions);\n\t\tthis.handlers.set(plugin.id, handler);\n\t}\n\n\t/**\n\t * Unregister a plugin's routes\n\t */\n\tunregister(pluginId: string): void {\n\t\tthis.handlers.delete(pluginId);\n\t}\n\n\t/**\n\t * Invoke a plugin route\n\t */\n\tasync invoke(\n\t\tpluginId: string,\n\t\trouteName: string,\n\t\toptions: InvokeRouteOptions,\n\t): Promise<RouteResult> {\n\t\tconst handler = this.handlers.get(pluginId);\n\n\t\tif (!handler) {\n\t\t\treturn {\n\t\t\t\tsuccess: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: \"PLUGIN_NOT_FOUND\",\n\t\t\t\t\tmessage: `Plugin \"${pluginId}\" not found`,\n\t\t\t\t},\n\t\t\t\tstatus: 404,\n\t\t\t};\n\t\t}\n\n\t\treturn handler.invoke(routeName, options);\n\t}\n\n\t/**\n\t * Get all registered plugin IDs\n\t */\n\tgetPluginIds(): string[] {\n\t\treturn [...this.handlers.keys()];\n\t}\n\n\t/**\n\t * Get routes for a plugin\n\t */\n\tgetRoutes(pluginId: string): string[] {\n\t\treturn this.handlers.get(pluginId)?.getRouteNames() ?? [];\n\t}\n\n\t/**\n\t * Get route metadata for a specific plugin route.\n\t * Returns null if the plugin or route doesn't exist.\n\t */\n\tgetRouteMeta(pluginId: string, routeName: string): RouteMeta | null {\n\t\tconst handler = this.handlers.get(pluginId);\n\t\tif (!handler) return null;\n\t\treturn handler.getRouteMeta(routeName);\n\t}\n}\n\n/**\n * Create a route registry\n */\nexport function createRouteRegistry(\n\tfactoryOptions: PluginContextFactoryOptions,\n): PluginRouteRegistry {\n\treturn new PluginRouteRegistry(factoryOptions);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,MAAM,wBAAwB,IAAI,IAAI;CAAC;CAAQ;CAAQ;CAAe;CAAQ;CAAY;CAAQ,CAAC;;;;;;;;;AAUnG,SAAS,yBAAyB,SAA2B;AAC5D,QAAO,IAAI,MAAM,SAAS,EACzB,IAAI,QAAQ,MAAM;AACjB,MAAI,OAAO,SAAS,YAAY,sBAAsB,IAAI,KAAK,CAC9D,cAAa;AACZ,SAAM,IAAI,MACT,wBAAwB,KAAK,mKAEa,KAAK,KAC/C;;EAGH,MAAM,QAAQ,QAAQ,IAAI,QAAQ,MAAM,OAAO;AAC/C,SAAO,OAAO,UAAU,aAAa,MAAM,KAAK,OAAO,GAAG;IAE3D,CAAC;;AAoBH,MAAa,yCAAyC,EAAE,MAAM,gBAAgB;;;;;;AAS9E,SAAgB,eAAe,OAOjB;CACb,MAAM,OAAkB,EAAE,QAAQ,MAAM,WAAW,MAAM;AACzD,KAAI,MAAM,eAAe,OAAW,MAAK,aAAa,MAAM;AAC5D,KAAI,MAAM,YAAY,OAAW,MAAK,UAAU,CAAC,GAAG,MAAM,QAAQ;AAClE,KAAI,MAAM,YAAY,OACrB,MAAK,UAAU;EACd,GAAG,MAAM;EACT,GAAI,MAAM,QAAQ,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,QAAQ,QAAQ,EAAE,GAAG,EAAE;EACxE;AAEF,KAAI,MAAM,aAAa,OAAW,MAAK,WAAW,MAAM;AAGxD,KAAI,KAAK,UAAU,OAAO,MAAM,iBAAiB,YAAY,MAAM,aAAa,SAAS,EACxF,MAAK,eAAe,MAAM;AAE3B,QAAO;;;;;;AAOR,MAAM,eAAe,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAQ,CAAC;;;;;;;;;;AAWtD,eAAsB,gBACrB,SACA,aACmB;AACnB,KAAI,YAAa,QAAO,8BAA8B,SAAS,YAAY;AAC3E,KAAI,aAAa,IAAI,QAAQ,OAAO,aAAa,CAAC,CACjD,KAAI;AACH,SAAO,MAAM,QAAQ,MAAM;SACpB;AAEP;;CAIF,MAAM,SAAS,IAAI,IAAI,QAAQ,IAAI,CAAC;CACpC,MAAM,QAA2C,EAAE;AACnD,MAAK,MAAM,OAAO,IAAI,IAAI,OAAO,MAAM,CAAC,EAAE;EACzC,MAAM,SAAS,OAAO,OAAO,IAAI;AACjC,QAAM,OAAO,OAAO,SAAS,IAAI,SAAS,OAAO;;AAElD,QAAO;;;;;;;AAmCR,SAAgB,kBAAkB,MAAkC;AACnE,QAAO;EACN,IAAI,KAAK;EACT,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,MAAM,KAAK;EACX,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU,aAAa;EAC7F;;;;;AAuBF,IAAa,qBAAb,MAAgC;CAC/B,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAY,QAAwB,gBAA6C;AAChF,OAAK,SAAS;AACd,OAAK,iBAAiB,IAAI,qBAAqB,eAAe;AAC9D,OAAK,sBAAsB,eAAe,uBAAuB,EAAE;;;;;CAMpE,MAAM,OAAO,WAAmB,SAAmD;EAClF,MAAM,QAAQ,KAAK,OAAO,OAAO;AAEjC,MAAI,CAAC,MACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,UAAU,UAAU,yBAAyB,KAAK,OAAO,GAAG;IACrE;GACD,QAAQ;GACR;EAIF,IAAI;AACJ,MAAI,MAAM,OAAO;GAChB,MAAM,cAAc,MAAM,MAAM,UAAU,QAAQ,KAAK;AACvD,OAAI,CAAC,YAAY,QAChB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT,SAAS,EAAE,YAAY,YAAY,MAAM;KACzC;IACD,QAAQ;IACR;AAEF,oBAAiB,YAAY;QAE7B,kBAAiB,QAAQ;EAK1B,MAAM,eAA6B;GAClC,GAFmB,KAAK,eAAe,cAAc,KAAK,OAAO;GAGjE,OAAO;GAIP,SAAS,yBAAyB,QAAQ,QAAQ;GAClD,aAAa,mBAAmB,QAAQ,SAAS,KAAK,oBAAoB;GAC1E,MAAM,QAAQ;GACd,IAAI,QAAQ;GACZ;AAGD,MAAI;AAEH,UAAO;IACN,SAAS;IACT,MAHc,MAAM,MAAM,QAAQ,aAAa;IAI/C,QAAQ;IACR;WACO,OAAO;AACf,OAAI,iBAAiB,sBACpB,QAAO;IACN,SAAS;IACT,OAAO;KAAE,MAAM,MAAM;KAAM,SAAS,MAAM;KAAS;IACnD,QAAQ,MAAM;IACd;AAGF,OAAI,iBAAiB,iBACpB,QAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM,MAAM;KACZ,SAAS,MAAM;KACf,SAAS,MAAM;KACf;IACD,QAAQ,MAAM;IACd;AAIF,WAAQ,MAAM,WAAW,KAAK,OAAO,GAAG,0BAA0B,MAAM;AACxE,UAAO;IACN,SAAS;IACT,OAAO;KACN,MAAM;KACN,SAAS;KACT;IACD,QAAQ;IACR;;;;;;CAOH,gBAA0B;AACzB,SAAO,OAAO,KAAK,KAAK,OAAO,OAAO;;;;;CAMvC,SAAS,MAAuB;AAC/B,SAAO,QAAQ,KAAK,OAAO;;;;;;CAO5B,aAAa,MAAgC;EAC5C,MAAM,QAAiC,KAAK,OAAO,OAAO;AAC1D,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,eAAe,MAAM;;;;;;AAO9B,IAAa,sBAAb,MAAiC;CAChC,AAAQ,2BAA4C,IAAI,KAAK;CAE7D,YAAY,AAAQ,gBAA6C;EAA7C;;;;;CAKpB,SAAS,QAA8B;EACtC,MAAM,UAAU,IAAI,mBAAmB,QAAQ,KAAK,eAAe;AACnE,OAAK,SAAS,IAAI,OAAO,IAAI,QAAQ;;;;;CAMtC,WAAW,UAAwB;AAClC,OAAK,SAAS,OAAO,SAAS;;;;;CAM/B,MAAM,OACL,UACA,WACA,SACuB;EACvB,MAAM,UAAU,KAAK,SAAS,IAAI,SAAS;AAE3C,MAAI,CAAC,QACJ,QAAO;GACN,SAAS;GACT,OAAO;IACN,MAAM;IACN,SAAS,WAAW,SAAS;IAC7B;GACD,QAAQ;GACR;AAGF,SAAO,QAAQ,OAAO,WAAW,QAAQ;;;;;CAM1C,eAAyB;AACxB,SAAO,CAAC,GAAG,KAAK,SAAS,MAAM,CAAC;;;;;CAMjC,UAAU,UAA4B;AACrC,SAAO,KAAK,SAAS,IAAI,SAAS,EAAE,eAAe,IAAI,EAAE;;;;;;CAO1D,aAAa,UAAkB,WAAqC;EACnE,MAAM,UAAU,KAAK,SAAS,IAAI,SAAS;AAC3C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,aAAa,UAAU"}