emdash 1.0.0 → 1.0.1-rc.1

package/src/plugins/route-wire.ts

@@ -0,0 +1,304 @@
+import {
+	PLUGIN_ROUTE_DEFAULT_BODY_BYTES,
+	PLUGIN_ROUTE_MAX_BODY_BYTES,
+	PLUGIN_ROUTE_MAX_FILENAME_BYTES,
+	PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES,
+	PLUGIN_ROUTE_MAX_MULTIPART_PARTS,
+	type PluginRouteRequest,
+} from "@emdash-cms/plugin-types";
+
+import type { PluginFormData, PluginResponse } from "../plugin-types.js";
+import { readPluginHttpBytes } from "./http-wire.js";
+
+const UTF8 = new TextEncoder();
+const FILENAME_PATH_SEPARATOR_PATTERN = /[/\\]/;
+const SCRIPT_MEDIA_TYPE_PATTERN = /(?:java|ecma)script/;
+const ALLOWED_RESPONSE_HEADERS = new Set([
+	"accept-ranges",
+	"content-disposition",
+	"content-encoding",
+	"content-language",
+	"content-range",
+	"content-type",
+	"etag",
+	"last-modified",
+	"retry-after",
+]);
+const ACTIVE_RESPONSE_TYPES = new Set([
+	"application/ecmascript",
+	"application/javascript",
+	"application/wasm",
+	"application/xhtml+xml",
+	"application/xml",
+	"image/svg+xml",
+	"multipart/related",
+	"multipart/x-mixed-replace",
+	"text/css",
+	"text/ecmascript",
+	"text/html",
+	"text/javascript",
+	"text/jscript",
+	"text/livescript",
+	"text/xml",
+]);
+
+export interface PluginRouteResponseWire {
+	status: number;
+	headers: Array<[string, string]>;
+	body: Uint8Array;
+}
+
+export interface PluginRouteResponseWireOptions {
+	allowExternalLocation?: boolean;
+	publicRequestUrl?: string;
+}
+
+export class PluginRouteRequestError extends Error {
+	constructor(
+		message: string,
+		readonly status: 400 | 413 | 415,
+	) {
+		super(message);
+		this.name = "PluginRouteRequestError";
+	}
+}
+
+function parseQuery(request: Request): Record<string, string | string[]> {
+	const input: Record<string, string | string[]> = {};
+	const params = new URL(request.url).searchParams;
+	for (const key of new Set(params.keys())) {
+		const values = params.getAll(key);
+		input[key] = values.length > 1 ? values : values[0];
+	}
+	return input;
+}
+
+async function readRouteBody(request: Request, limit: number): Promise<Uint8Array> {
+	const declaredLength = request.headers.get("content-length");
+	if (declaredLength !== null) {
+		const parsed = Number(declaredLength);
+		if (Number.isFinite(parsed) && parsed > limit) {
+			throw new PluginRouteRequestError(`Plugin route request body exceeds ${limit} bytes`, 413);
+		}
+	}
+	try {
+		return await readPluginHttpBytes(request.body, limit, "request");
+	} catch (error) {
+		if (!(error instanceof Error) || !error.message.includes("exceeds")) {
+			throw new PluginRouteRequestError("Plugin route request body could not be read", 400);
+		}
+		throw new PluginRouteRequestError(`Plugin route request body exceeds ${limit} bytes`, 413);
+	}
+}
+
+function decodeText(bytes: Uint8Array): string {
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		throw new PluginRouteRequestError("Plugin route request body is not valid UTF-8", 400);
+	}
+}
+
+async function parseFormData(request: Request, bytes: Uint8Array): Promise<PluginFormData> {
+	const contentType = request.headers.get("content-type") ?? "";
+	if (
+		!contentType.toLowerCase().startsWith("multipart/form-data;") &&
+		!contentType.toLowerCase().startsWith("application/x-www-form-urlencoded")
+	) {
+		throw new PluginRouteRequestError(
+			"Plugin route form-data requests require multipart/form-data or application/x-www-form-urlencoded",
+			415,
+		);
+	}
+
+	let parsed: FormData;
+	try {
+		parsed = await new Request(request.url, {
+			method: "POST",
+			headers: { "content-type": contentType },
+			body: new Uint8Array(bytes).buffer,
+		}).formData();
+	} catch {
+		throw new PluginRouteRequestError("Plugin route form-data body is malformed", 400);
+	}
+
+	const entries: PluginFormData["entries"] = [];
+	for (const [name, value] of parsed.entries()) {
+		if (entries.length >= PLUGIN_ROUTE_MAX_MULTIPART_PARTS) {
+			throw new PluginRouteRequestError(
+				`Plugin route form-data exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PARTS} parts`,
+				413,
+			);
+		}
+		if (typeof value === "string") {
+			if (UTF8.encode(value).byteLength > PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES) {
+				throw new PluginRouteRequestError(
+					`Plugin route form-data part exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES} bytes`,
+					413,
+				);
+			}
+			entries.push({ name, kind: "text", value });
+			continue;
+		}
+
+		const filename = value.name;
+		let hasControlCharacter = false;
+		for (const character of filename) {
+			const codePoint = character.codePointAt(0);
+			if (codePoint !== undefined && (codePoint < 32 || codePoint === 127)) {
+				hasControlCharacter = true;
+				break;
+			}
+		}
+		if (
+			UTF8.encode(filename).byteLength > PLUGIN_ROUTE_MAX_FILENAME_BYTES ||
+			hasControlCharacter ||
+			FILENAME_PATH_SEPARATOR_PATTERN.test(filename)
+		) {
+			throw new PluginRouteRequestError("Plugin route form-data filename is invalid", 400);
+		}
+		if (value.size > PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES) {
+			throw new PluginRouteRequestError(
+				`Plugin route form-data part exceeds ${PLUGIN_ROUTE_MAX_MULTIPART_PART_BYTES} bytes`,
+				413,
+			);
+		}
+		entries.push({
+			name,
+			kind: "file",
+			filename,
+			contentType: value.type || "application/octet-stream",
+			bytes: new Uint8Array(await value.arrayBuffer()),
+		});
+	}
+	return { entries };
+}
+
+export async function parseDeclaredPluginRouteInput(
+	request: Request,
+	declaration: PluginRouteRequest,
+): Promise<unknown> {
+	if (declaration.body === "none") {
+		await readRouteBody(request, 0);
+		return parseQuery(request);
+	}
+	const limit = declaration.maxBytes ?? PLUGIN_ROUTE_DEFAULT_BODY_BYTES;
+	const bytes = await readRouteBody(request, Math.min(limit, PLUGIN_ROUTE_MAX_BODY_BYTES));
+
+	switch (declaration.body) {
+		case "bytes":
+			return bytes;
+		case "text":
+			return decodeText(bytes);
+		case "json":
+			try {
+				return JSON.parse(decodeText(bytes));
+			} catch (error) {
+				if (error instanceof PluginRouteRequestError) throw error;
+				throw new PluginRouteRequestError("Plugin route request body is not valid JSON", 400);
+			}
+		case "form-data":
+			return parseFormData(request, bytes);
+	}
+}
+
+export function isPluginResponse(value: unknown): value is PluginResponse {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		(value as { __emdashPluginResponse?: unknown }).__emdashPluginResponse === true
+	);
+}
+
+export async function pluginRouteResponseToWire(
+	value: unknown,
+	options: PluginRouteResponseWireOptions = {},
+): Promise<PluginRouteResponseWire> {
+	if (!isPluginResponse(value)) {
+		throw new TypeError("Raw plugin routes must return pluginResponse()");
+	}
+	if (!Number.isInteger(value.status) || value.status < 200 || value.status > 599) {
+		throw new TypeError("Raw plugin route status must be an integer from 200 to 599");
+	}
+	if (!Array.isArray(value.headers)) {
+		throw new TypeError("Raw plugin route headers are invalid");
+	}
+
+	const sourceHeaders = new Headers();
+	for (const entry of value.headers) {
+		if (
+			!Array.isArray(entry) ||
+			entry.length !== 2 ||
+			typeof entry[0] !== "string" ||
+			typeof entry[1] !== "string"
+		) {
+			throw new TypeError("Raw plugin route headers are invalid");
+		}
+		sourceHeaders.append(entry[0], entry[1]);
+	}
+
+	const headers = new Headers();
+	sourceHeaders.forEach((headerValue, name) => {
+		if (ALLOWED_RESPONSE_HEADERS.has(name)) {
+			headers.set(name, headerValue);
+			return;
+		}
+		if (name !== "location") return;
+		if (options.allowExternalLocation) {
+			headers.set(name, headerValue);
+			return;
+		}
+		if (options.publicRequestUrl) {
+			try {
+				const requestUrl = new URL(options.publicRequestUrl);
+				if (new URL(headerValue, requestUrl).origin === requestUrl.origin) {
+					headers.set(name, headerValue);
+					return;
+				}
+			} catch {}
+		}
+		throw new TypeError("Public raw plugin route redirects must stay on the site origin");
+	});
+	if (!headers.has("content-type")) headers.set("content-type", "application/octet-stream");
+	const mediaType = (headers.get("content-type") ?? "application/octet-stream")
+		.split(";", 1)[0]
+		.trim()
+		.toLowerCase();
+	if (ACTIVE_RESPONSE_TYPES.has(mediaType) || SCRIPT_MEDIA_TYPE_PATTERN.test(mediaType)) {
+		throw new TypeError(`Raw plugin route content type "${mediaType}" is not allowed`);
+	}
+	headers.set("x-content-type-options", "nosniff");
+	headers.set("content-security-policy", "sandbox; default-src 'none'");
+	headers.set("referrer-policy", "no-referrer");
+
+	let body = new Uint8Array();
+	if (value.body !== null) {
+		if (value.body.kind === "text" && typeof value.body.value === "string") {
+			body = UTF8.encode(value.body.value);
+		} else if (value.body.kind === "bytes" && value.body.value instanceof Uint8Array) {
+			body = new Uint8Array(value.body.value);
+		} else {
+			throw new TypeError("Raw plugin route body is invalid");
+		}
+	}
+	if (body.byteLength > PLUGIN_ROUTE_MAX_BODY_BYTES) {
+		throw new TypeError(
+			`Raw plugin route response body exceeds ${PLUGIN_ROUTE_MAX_BODY_BYTES} bytes`,
+		);
+	}
+
+	return {
+		status: value.status,
+		headers: [...headers.entries()],
+		body,
+	};
+}
+
+export function pluginRouteResponseFromWire(
+	wire: PluginRouteResponseWire,
+	method: string,
+): Response {
+	const nullBodyStatus = wire.status === 204 || wire.status === 205 || wire.status === 304;
+	const body = method === "HEAD" || nullBodyStatus ? null : new Uint8Array(wire.body).buffer;
+	return new Response(body, { status: wire.status, headers: wire.headers });
+}

package/src/plugins/routes.ts

@@ -8,9 +8,59 @@
  *
  */
 
+import type { PluginUiContext } from "@emdash-cms/blocks/server";
+import type {
+	PluginRouteMethod,
+	PluginRouteRequest,
+	PluginRouteResponseMode,
+} from "@emdash-cms/plugin-types";
+import { routeNameSchema } from "@emdash-cms/plugin-types";
+import { z } from "zod";
+
+import { SiteWriteBlockedError } from "../transfer/fence.js";
 import { PluginContextFactory, type PluginContextFactoryOptions } from "./context.js";
 import { extractRequestMeta } from "./request-meta.js";
-import type { ResolvedPlugin, RouteContext, PluginRoute } from "./types.js";
+import { PluginRouteError } from "./route-error.js";
+import { parseDeclaredPluginRouteInput } from "./route-wire.js";
+import type { ResolvedPlugin, RouteContext, PluginRoute, UserInfo } from "./types.js";
+
+export { PluginRouteError };
+
+/**
+ * Body-reading methods on `Request`. EmDash parses the request body once before
+ * the handler runs and exposes the result as `ctx.input`, leaving the underlying
+ * stream consumed. Calling any of these on `ctx.request` would re-read a spent
+ * stream and throw an opaque platform error ("Body is unusable: Body has already
+ * been read") with no hint about `ctx.input` — so the guard replaces them with an
+ * actionable message instead.
+ */
+const CONSUMED_BODY_METHODS = new Set(["json", "text", "arrayBuffer", "blob", "formData", "bytes"]);
+
+/**
+ * Wrap the request handed to a plugin route handler so an accidental
+ * `ctx.request.json()` (or `.text()`, `.formData()`, …) fails with a message
+ * pointing at `ctx.input` rather than the runtime's cryptic "body already read"
+ * error. Every non-body member passes through unchanged; function members are
+ * bound to the underlying request so methods like `clone()` don't throw an
+ * "Illegal invocation" when called on the proxy.
+ */
+function guardConsumedRequestBody(request: Request): Request {
+	return new Proxy(request, {
+		get(target, prop) {
+			if (typeof prop === "string" && CONSUMED_BODY_METHODS.has(prop)) {
+				return () => {
+					throw new Error(
+						`[emdash] ctx.request.${prop}() is not available inside a plugin route handler: ` +
+							`EmDash has already parsed the request body and exposes it as ctx.input. ` +
+							`Read ctx.input instead of ctx.request.${prop}().`,
+					);
+				};
+			}
+			const value = Reflect.get(target, prop, target);
+			return typeof value === "function" ? value.bind(target) : value;
+		},
+	});
+}
 
 /**
  * Route metadata (public flag) without the handler.
@@ -18,6 +68,88 @@ import type { ResolvedPlugin, RouteContext, PluginRoute } from "./types.js";
  */
 export interface RouteMeta {
 	public: boolean;
+	permission?: string;
+	/**
+	 * Cache-Control value for successful GET responses. Only ever set for
+	 * public routes — authenticated responses must stay `private, no-store`.
+	 */
+	cacheControl?: string;
+	methods?: PluginRouteMethod[];
+	request?: PluginRouteRequest;
+	response?: PluginRouteResponseMode;
+}
+
+export const pluginPublicRouteAcknowledgementSchema = z.array(routeNameSchema);
+
+export type PluginContentCacheInvalidator = (tags: string[]) => Promise<void>;
+
+/**
+ * Build RouteMeta from a route's `public`/`cacheControl` flags. Single source
+ * of truth for the "cacheControl is only ever exposed on public routes"
+ * invariant — used for trusted routes and manifest-declared sandboxed routes.
+ */
+export function buildRouteMeta(route: {
+	public?: boolean;
+	permission?: string;
+	cacheControl?: string;
+	methods?: PluginRouteMethod[];
+	request?: PluginRouteRequest;
+	response?: PluginRouteResponseMode;
+}): RouteMeta {
+	const meta: RouteMeta = { public: route.public === true };
+	if (route.permission !== undefined) meta.permission = route.permission;
+	if (route.methods !== undefined) meta.methods = [...route.methods];
+	if (route.request !== undefined) {
+		meta.request = {
+			...route.request,
+			...(route.request.headers ? { headers: [...route.request.headers] } : {}),
+		};
+	}
+	if (route.response !== undefined) meta.response = route.response;
+	// Private responses are per-user and must never become cacheable, even if
+	// a route sets both flags.
+	if (meta.public && typeof route.cacheControl === "string" && route.cacheControl.length > 0) {
+		meta.cacheControl = route.cacheControl;
+	}
+	return meta;
+}
+
+/**
+ * HTTP methods that carry a request body. Everything else (GET, HEAD, DELETE)
+ * takes its route input from the URL query string.
+ */
+const BODY_METHODS = new Set(["POST", "PUT", "PATCH"]);
+
+/**
+ * Parse a plugin route's input from the request, by method.
+ *
+ * Body methods (POST/PUT/PATCH) parse the JSON body as before. Bodyless
+ * methods (GET/HEAD/DELETE) have no body, so `request.json()` resolves to
+ * undefined and fails schema validation, so parse the query string into
+ * an object instead. Repeated keys (`?tag=a&tag=b`) become an array so array
+ * schemas work; a single key stays a scalar.
+ */
+export async function parseRouteInput(
+	request: Request,
+	declaration?: PluginRouteRequest,
+): Promise<unknown> {
+	if (declaration) return parseDeclaredPluginRouteInput(request, declaration);
+	if (BODY_METHODS.has(request.method.toUpperCase())) {
+		try {
+			return await request.json();
+		} catch {
+			// No body or not JSON
+			return undefined;
+		}
+	}
+
+	const params = new URL(request.url).searchParams;
+	const input: Record<string, string | string[]> = {};
+	for (const key of new Set(params.keys())) {
+		const values = params.getAll(key);
+		input[key] = values.length > 1 ? values : values[0];
+	}
+	return input;
 }
 
 /**
@@ -34,6 +166,34 @@ export interface RouteResult<T = unknown> {
 	status: number;
 }
 
+/**
+ * Host-side user shape accepted when dispatching a plugin route. Structurally
+ * matches `User` from `@emdash-cms/auth` so hosts can pass `locals.user`
+ * directly without the plugin layer depending on the auth package.
+ */
+export interface RouteCallerInput {
+	id: string;
+	email: string;
+	name: string | null;
+	role: number;
+	createdAt: Date | string;
+}
+
+/**
+ * Convert the host's authenticated user into the read-only `UserInfo` shape
+ * exposed to plugins as `ctx.user`. Strips sensitive/irrelevant fields and
+ * keeps the value structured-clone-safe for sandboxed plugins.
+ */
+export function toRouteCallerInfo(user: RouteCallerInput): UserInfo {
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		role: user.role,
+		createdAt: typeof user.createdAt === "string" ? user.createdAt : user.createdAt.toISOString(),
+	};
+}
+
 /**
  * Route invocation options
  */
@@ -42,6 +202,13 @@ export interface InvokeRouteOptions {
 	request: Request;
 	/** Request body (already parsed) */
 	body?: unknown;
+	/**
+	 * Authenticated caller resolved by the host, exposed to the handler as
+	 * `ctx.user`. Undefined for public routes and unbound machine tokens.
+	 */
+	user?: UserInfo;
+	/** Host-attested context for a validated Block Kit request. */
+	ui?: PluginUiContext;
 }
 
 /**
@@ -85,7 +252,7 @@ export class PluginRouteHandler {
 					error: {
 						code: "VALIDATION_ERROR",
 						message: "Invalid request body",
-						details: parseResult.error.format(),
+						details: z.formatError(parseResult.error),
 					},
 					status: 400,
 				};
@@ -100,8 +267,13 @@ export class PluginRouteHandler {
 		const routeContext: RouteContext = {
 			...baseContext,
 			input: validatedInput,
-			request: options.request,
+			// The body is already parsed into `input`; guard `ctx.request`'s
+			// body-reading methods so a re-read fails with an actionable message.
+			// Metadata extraction uses the original request (headers only).
+			request: guardConsumedRequestBody(options.request),
 			requestMeta: extractRequestMeta(options.request, this.trustedProxyHeaders),
+			user: options.user,
+			ui: options.ui,
 		};
 
 		// Execute handler
@@ -113,6 +285,13 @@ export class PluginRouteHandler {
 				status: 200,
 			};
 		} catch (error) {
+			if (error instanceof SiteWriteBlockedError) {
+				return {
+					success: false,
+					error: { code: error.code, message: error.message },
+					status: error.status,
+				};
+			}
 			// Handle known error types
 			if (error instanceof PluginRouteError) {
 				return {
@@ -160,65 +339,7 @@ export class PluginRouteHandler {
 	getRouteMeta(name: string): RouteMeta | null {
 		const route: PluginRoute | undefined = this.plugin.routes[name];
 		if (!route) return null;
-		return { public: route.public === true };
-	}
-}
-
-/**
- * Error class for plugin routes
- * Allows plugins to return structured errors with specific HTTP status codes
- */
-export class PluginRouteError extends Error {
-	constructor(
-		public code: string,
-		message: string,
-		public status: number = 400,
-		public details?: unknown,
-	) {
-		super(message);
-		this.name = "PluginRouteError";
-	}
-
-	/**
-	 * Create a bad request error (400)
-	 */
-	static badRequest(message: string, details?: unknown): PluginRouteError {
-		return new PluginRouteError("BAD_REQUEST", message, 400, details);
-	}
-
-	/**
-	 * Create an unauthorized error (401)
-	 */
-	static unauthorized(message: string = "Unauthorized"): PluginRouteError {
-		return new PluginRouteError("UNAUTHORIZED", message, 401);
-	}
-
-	/**
-	 * Create a forbidden error (403)
-	 */
-	static forbidden(message: string = "Forbidden"): PluginRouteError {
-		return new PluginRouteError("FORBIDDEN", message, 403);
-	}
-
-	/**
-	 * Create a not found error (404)
-	 */
-	static notFound(message: string = "Not found"): PluginRouteError {
-		return new PluginRouteError("NOT_FOUND", message, 404);
-	}
-
-	/**
-	 * Create a conflict error (409)
-	 */
-	static conflict(message: string, details?: unknown): PluginRouteError {
-		return new PluginRouteError("CONFLICT", message, 409, details);
-	}
-
-	/**
-	 * Create an internal error (500)
-	 */
-	static internal(message: string = "Internal error"): PluginRouteError {
-		return new PluginRouteError("INTERNAL_ERROR", message, 500);
+		return buildRouteMeta(route);
 	}
 }
 

package/src/plugins/sandbox/hook-result.ts

@@ -0,0 +1,52 @@
+/** Current wire-format version for sandbox hook result envelopes. */
+export const SANDBOX_HOOK_RESULT_VERSION = 1 as const;
+
+/** Maximum editor-facing rejection reason accepted from a sandboxed plugin. */
+export const MAX_SANDBOX_SAVE_REJECTION_REASON_LENGTH = 500;
+
+export interface SandboxSaveRejectedError {
+	code: "SAVE_REJECTED";
+	reason: string;
+}
+
+/**
+ * Returned from a sandboxed `content:beforeSave` hook to reject the save.
+ * The host validates every field before exposing the reason to an editor.
+ */
+export interface SandboxHookErrorEnvelope {
+	__emdashSandboxHookResult: true;
+	version: typeof SANDBOX_HOOK_RESULT_VERSION;
+	error: SandboxSaveRejectedError;
+}
+
+export type SandboxHookResultInspection =
+	| { kind: "value" }
+	| { kind: "malformed" }
+	| { kind: "error"; error: SandboxSaveRejectedError };
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Validate and normalize an untrusted value returned across the sandbox boundary. */
+export function inspectSandboxHookResult(value: unknown): SandboxHookResultInspection {
+	if (!isRecord(value) || !Object.hasOwn(value, "__emdashSandboxHookResult")) {
+		return { kind: "value" };
+	}
+	if (
+		value.__emdashSandboxHookResult !== true ||
+		value.version !== SANDBOX_HOOK_RESULT_VERSION ||
+		!isRecord(value.error) ||
+		value.error.code !== "SAVE_REJECTED" ||
+		typeof value.error.reason !== "string"
+	) {
+		return { kind: "malformed" };
+	}
+
+	const reason = value.error.reason.trim();
+	if (reason.length === 0 || reason.length > MAX_SANDBOX_SAVE_REJECTION_REASON_LENGTH) {
+		return { kind: "malformed" };
+	}
+
+	return { kind: "error", error: { code: "SAVE_REJECTED", reason } };
+}

package/src/plugins/sandbox/index.ts

@@ -4,15 +4,39 @@
  */
 
 export { NoopSandboxRunner, SandboxNotAvailableError, createNoopSandboxRunner } from "./noop.js";
+export {
+	SandboxUnavailableError,
+	createSandboxRouteError,
+	createSandboxRouteErrorEnvelope,
+	getSandboxRouteErrorDetails,
+	getSandboxRouteErrorEnvelope,
+} from "./types.js";
+export {
+	MAX_SANDBOX_SAVE_REJECTION_REASON_LENGTH,
+	SANDBOX_HOOK_RESULT_VERSION,
+	inspectSandboxHookResult,
+} from "./hook-result.js";
 
 export type {
 	SandboxRunner,
-	SandboxedPlugin,
+	SandboxedPluginInstance,
+	SandboxInvocationOptions,
 	SandboxRunnerFactory,
 	SandboxOptions,
 	SandboxEmailMessage,
 	SandboxEmailSendCallback,
+	SandboxCommentModerateCallback,
+	SandboxContentCreateCallback,
+	SandboxHttpFetchCallback,
 	ResourceLimits,
 	PluginCodeStorage,
 	SerializedRequest,
+	SandboxRouteErrorCode,
+	SandboxRouteErrorDetails,
+	SandboxRouteErrorEnvelope,
 } from "./types.js";
+export type {
+	SandboxHookErrorEnvelope,
+	SandboxHookResultInspection,
+	SandboxSaveRejectedError,
+} from "./hook-result.js";