emdash 1.3.0 → 1.3.1

package/dist/types-CadaL_k8.d.mts

@@ -0,0 +1,366 @@
+import { PortableTextBlock } from "@emdash-cms/gutenberg-to-portable-text";
+
+//#region src/import/types.d.ts
+/** Author info from WordPress */
+interface WpAuthorInfo {
+  id?: number;
+  login?: string;
+  email?: string;
+  displayName?: string;
+  postCount: number;
+}
+/** File-based input (WXR upload) */
+interface FileInput {
+  type: "file";
+  file: File;
+}
+/** URL-based input (REST API probe) */
+interface UrlInput {
+  type: "url";
+  url: string;
+  /** Optional auth token for authenticated requests */
+  token?: string;
+}
+/** OAuth-based input (WordPress.com) */
+interface OAuthInput {
+  type: "oauth";
+  url: string;
+  accessToken: string;
+  /** Site ID for WordPress.com */
+  siteId?: string;
+}
+type SourceInput = FileInput | UrlInput | OAuthInput;
+/** Auth requirements for an import source */
+interface SourceAuth {
+  type: "oauth" | "token" | "password" | "none";
+  /** OAuth provider identifier */
+  provider?: string;
+  /** OAuth authorization URL */
+  oauthUrl?: string;
+  /** Human-readable instructions */
+  instructions?: string;
+}
+/** What the source can provide */
+interface SourceCapabilities {
+  /** Can fetch published content without auth */
+  publicContent: boolean;
+  /** Can fetch drafts/private (may need auth) */
+  privateContent: boolean;
+  /** Can fetch all custom post types */
+  customPostTypes: boolean;
+  /** Can fetch all meta fields */
+  allMeta: boolean;
+  /** Can stream media directly */
+  mediaStream: boolean;
+}
+/** Suggested next action after probe */
+type SuggestedAction = {
+  type: "proceed";
+} | {
+  type: "oauth";
+  url: string;
+  provider: string;
+} | {
+  type: "upload";
+  instructions: string;
+} | {
+  type: "install-plugin";
+  instructions: string;
+};
+/** Detected i18n/multilingual plugin info */
+interface I18nDetection {
+  /** Multilingual plugin name (e.g. "wpml", "polylang") */
+  plugin: string;
+  /** BCP 47 default locale */
+  defaultLocale: string;
+  /** All configured locales */
+  locales: string[];
+}
+/** Result of probing a URL for a specific source */
+interface SourceProbeResult {
+  /** Which source can handle this */
+  sourceId: string;
+  /** Confidence level */
+  confidence: "definite" | "likely" | "possible";
+  /** What we detected */
+  detected: {
+    platform: string;
+    version?: string;
+    siteTitle?: string;
+    siteUrl?: string;
+  };
+  /** What capabilities are available */
+  capabilities: SourceCapabilities;
+  /** What auth is needed, if any */
+  auth?: SourceAuth;
+  /** Suggested next step */
+  suggestedAction: SuggestedAction;
+  /** Preview data if available (e.g., post counts from REST API) */
+  preview?: {
+    posts?: number;
+    pages?: number;
+    media?: number;
+  };
+  /** Detected multilingual plugin. Absent when none detected. */
+  i18n?: I18nDetection;
+}
+/** Combined probe result from all sources */
+interface ProbeResult {
+  url: string;
+  isWordPress: boolean;
+  /** Best matching source (highest confidence) */
+  bestMatch: SourceProbeResult | null;
+  /** All matching sources */
+  allMatches: SourceProbeResult[];
+  /** No source matched because a bot-protection challenge blocked the probe */
+  challenged?: boolean;
+}
+/** Field definition for import */
+interface ImportFieldDef {
+  slug: string;
+  label: string;
+  type: string;
+  required: boolean;
+  searchable?: boolean;
+}
+/** Field compatibility with existing schema */
+type FieldCompatibility = "compatible" | "type_mismatch" | "missing";
+/** Schema status for a collection */
+interface CollectionSchemaStatus {
+  exists: boolean;
+  fieldStatus: Record<string, {
+    status: FieldCompatibility;
+    existingType?: string;
+    requiredType: string;
+  }>;
+  canImport: boolean;
+  reason?: string;
+}
+/** Analysis of a single post type */
+interface PostTypeAnalysis {
+  name: string;
+  count: number;
+  suggestedCollection: string;
+  requiredFields: ImportFieldDef[];
+  schemaStatus: CollectionSchemaStatus;
+}
+/** Attachment/media info */
+interface AttachmentInfo {
+  id?: number;
+  title?: string;
+  url?: string;
+  filename?: string;
+  mimeType?: string;
+  alt?: string;
+  caption?: string;
+  width?: number;
+  height?: number;
+}
+/** Navigation menu analysis */
+interface NavMenuAnalysis {
+  /** Menu name/slug */
+  name: string;
+  /** Menu display label */
+  label: string;
+  /** Number of items in this menu */
+  itemCount: number;
+}
+/** Custom taxonomy analysis */
+interface TaxonomyAnalysis {
+  /** Taxonomy slug (e.g., 'genre', 'portfolio_category') */
+  slug: string;
+  /** Number of terms in this taxonomy */
+  termCount: number;
+  /** Sample term names */
+  sampleTerms: string[];
+}
+/** Reusable block analysis (wp_block post type) */
+interface ReusableBlockAnalysis {
+  /** Original WP ID */
+  id: number;
+  /** Block title */
+  title: string;
+  /** Block slug */
+  slug: string;
+}
+/** Normalized analysis result - same format for all sources */
+interface ImportAnalysis {
+  /** Source that produced this analysis */
+  sourceId: string;
+  site: {
+    title: string;
+    url: string;
+  };
+  postTypes: PostTypeAnalysis[];
+  attachments: {
+    count: number;
+    items: AttachmentInfo[];
+  };
+  categories: number;
+  tags: number;
+  authors: WpAuthorInfo[];
+  /** Navigation menus found in the export */
+  navMenus?: NavMenuAnalysis[];
+  /** Custom taxonomies (beyond categories/tags) */
+  customTaxonomies?: TaxonomyAnalysis[];
+  /** Reusable blocks (wp_block post type) - will be imported as sections */
+  reusableBlocks?: ReusableBlockAnalysis[];
+  /** Source-specific custom fields analysis */
+  customFields?: Array<{
+    key: string;
+    count: number;
+    samples: string[];
+    suggestedField: string;
+    suggestedType: "string" | "number" | "boolean" | "date" | "json";
+    isInternal: boolean;
+  }>;
+  /** Detected multilingual plugin. Absent when none detected. */
+  i18n?: I18nDetection;
+}
+/** Normalized content item - produced by all sources */
+interface NormalizedItem {
+  /** Original ID from source */
+  sourceId: string | number;
+  /** WordPress post type */
+  postType: string;
+  /** Content status */
+  status: "publish" | "draft" | "pending" | "private" | "future";
+  /** URL slug */
+  slug: string;
+  /** Title */
+  title: string;
+  /** Content as Portable Text (already converted) */
+  content: PortableTextBlock[];
+  /** Excerpt/summary */
+  excerpt?: string;
+  /** Publication date */
+  date: Date;
+  /** Last modified date */
+  modified?: Date;
+  /** Author identifier */
+  author?: string;
+  /** Category slugs */
+  categories?: string[];
+  /** Tag slugs */
+  tags?: string[];
+  /** Custom meta fields */
+  meta?: Record<string, unknown>;
+  /** Featured image URL */
+  featuredImage?: string;
+  /** Parent post ID (for hierarchical content like pages) */
+  parentId?: string | number;
+  /** Menu order for sorting */
+  menuOrder?: number;
+  /** Custom taxonomy assignments beyond categories/tags */
+  customTaxonomies?: Record<string, string[]>;
+  /** BCP 47 locale code. When omitted, defaults to defaultLocale. */
+  locale?: string;
+  /**
+   * Source-side translation group ID (opaque string from the origin system).
+   * Items sharing the same translationGroup are linked as translations.
+   * Resolved to an EmDash translation_group ULID during execute.
+   */
+  translationGroup?: string;
+}
+/** Post type mapping configuration */
+interface PostTypeMapping {
+  enabled: boolean;
+  collection: string;
+}
+/** Import configuration */
+interface ImportConfig {
+  postTypeMappings: Record<string, PostTypeMapping>;
+  skipExisting?: boolean;
+}
+/** Options for fetching content */
+interface FetchOptions {
+  /** Post types to fetch */
+  postTypes: string[];
+  /** Whether to include drafts */
+  includeDrafts?: boolean;
+  /** Limit number of items (for testing) */
+  limit?: number;
+}
+/** Import result */
+interface ImportResult {
+  success: boolean;
+  imported: number;
+  /** Entries not imported because the slug already exists in the collection and locale. */
+  skipped: number;
+  errors: Array<{
+    title: string;
+    error: string;
+  }>;
+  byCollection: Record<string, number>;
+  /** Number of taxonomy term assignments written (plugin import) */
+  taxonomyAssignments?: number;
+  /** Source taxonomies skipped because no matching EmDash taxonomy def exists */
+  missingTaxonomies?: string[];
+  /** Custom taxonomy defs auto-created during the import (plugin import) */
+  taxonomiesCreated?: string[];
+  /** Navigation menu import summary (plugin import) */
+  menus?: {
+    created: number;
+    items: number;
+  };
+  /** Comment import summary (plugin import) */
+  comments?: {
+    imported: number;
+    skipped: number;
+  };
+  /** Site settings applied from the source (plugin import) */
+  siteSettings?: string[];
+}
+/**
+ * An import source provides content from an external system.
+ * All sources produce the same normalized analysis and content format.
+ */
+interface ImportSource {
+  /** Unique identifier */
+  id: string;
+  /** Display name */
+  name: string;
+  /** Description for UI */
+  description: string;
+  /** Icon identifier */
+  icon: "upload" | "globe" | "wordpress" | "plug";
+  /** Whether this source requires a file upload */
+  requiresFile?: boolean;
+  /** Whether this source can probe URLs */
+  canProbe?: boolean;
+  /**
+   * Probe a URL to see if this source can handle it.
+   * Returns null if not applicable.
+   */
+  probe?(url: string): Promise<SourceProbeResult | null>;
+  /**
+   * Analyze content from this source.
+   * Returns normalized ImportAnalysis.
+   */
+  analyze(input: SourceInput, context: ImportContext): Promise<ImportAnalysis>;
+  /**
+   * Stream content items for import.
+   * Yields normalized content items.
+   */
+  fetchContent(input: SourceInput, options: FetchOptions): AsyncGenerator<NormalizedItem>;
+  /**
+   * Fetch a media item's data.
+   * Used for media import.
+   */
+  fetchMedia?(url: string, input: SourceInput): Promise<Blob>;
+}
+/** Context passed to import sources */
+interface ImportContext {
+  /** Database connection for schema checks */
+  db?: unknown;
+  /** Function to check existing collections */
+  getExistingCollections?: () => Promise<Map<string, {
+    slug: string;
+    fields: Map<string, {
+      type: string;
+    }>;
+  }>>;
+}
+//#endregion
+export { UrlInput as S, SourceAuth as _, FileInput as a, SourceProbeResult as b, ImportContext as c, ImportSource as d, NormalizedItem as f, ProbeResult as g, PostTypeMapping as h, FieldCompatibility as i, ImportFieldDef as l, PostTypeAnalysis as m, CollectionSchemaStatus as n, ImportAnalysis as o, OAuthInput as p, FetchOptions as r, ImportConfig as s, AttachmentInfo as t, ImportResult as u, SourceCapabilities as v, SuggestedAction as x, SourceInput as y };
+//# sourceMappingURL=types-CadaL_k8.d.mts.map

package/dist/types-CadaL_k8.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-CadaL_k8.d.mts","names":[],"sources":["../src/import/types.ts"],"mappings":";;;;UAciB,YAAA;EAChB,EAAA;EACA,KAAA;EACA,KAAA;EACA,WAAA;EACA,SAAA;AAAA;;UAQgB,SAAA;EAChB,IAAA;EACA,IAAA,EAAM,IAAA;AAAA;;UAIU,QAAA;EAChB,IAAA;EACA,GAAA;EAFwB;EAIxB,KAAA;AAAA;;UAIgB,UAAA;EAChB,IAAA;EACA,GAAA;EACA,WAAA;EAHgB;EAKhB,MAAA;AAAA;AAAA,KAGW,WAAA,GAAc,SAAA,GAAY,QAAA,GAAW,UAAA;;UAOhC,UAAA;EAChB,IAAA;EAXA;EAaA,QAAA;EAbM;EAeN,QAAA;EAZsB;EActB,YAAA;AAAA;;UAIgB,kBAAA;EAlB0C;EAoB1D,aAAA;EApByB;EAsBzB,cAAA;EAtBgD;EAwBhD,eAAA;EAxB0D;EA0B1D,OAAA;EAnB0B;EAqB1B,WAAA;AAAA;;KAIW,eAAA;EACP,IAAA;AAAA;EACA,IAAA;EAAe,GAAA;EAAa,QAAA;AAAA;EAC5B,IAAA;EAAgB,YAAA;AAAA;EAChB,IAAA;EAAwB,YAAA;AAAA;;UAGZ,aAAA;EAXL;EAaX,MAAA;EAT0B;EAW1B,aAAA;EAX0B;EAa1B,OAAA;AAAA;;UAIgB,iBAAA;EAdZ;EAgBJ,QAAA;EAfI;EAkBJ,UAAA;EAlBwC;EAqBxC,QAAA;IACC,QAAA;IACA,OAAA;IACA,SAAA;IACA,OAAA;EAAA;EAlBD;EAsBA,YAAA,EAAc,kBAAA;EApBP;EAuBP,IAAA,GAAO,UAAA;EAnBS;EAsBhB,eAAA,EAAiB,eAAA;;EAGjB,OAAA;IACC,KAAA;IACA,KAAA;IACA,KAAA;EAAA;EAImB;EAApB,IAAA,GAAO,aAAA;AAAA;;UAIS,WAAA;EAChB,GAAA;EACA,WAAA;EA1BC;EA4BD,SAAA,EAAW,iBAAA;EAxBG;EA0Bd,UAAA,EAAY,iBAAA;EAvBL;EAyBP,UAAA;AAAA;;UAQgB,cAAA;EAChB,IAAA;EACA,KAAA;EACA,IAAA;EACA,QAAA;EACA,UAAA;AAAA;AArBD;AAAA,KAyBY,kBAAA;;UAGK,sBAAA;EAChB,MAAA;EACA,WAAA,EAAa,MAAA;IAGX,MAAA,EAAQ,kBAAA;IACR,YAAA;IACA,YAAA;EAAA;EAGF,SAAA;EACA,MAAA;AAAA;AAvBD;AAAA,UA2BiB,gBAAA;EAChB,IAAA;EACA,KAAA;EACA,mBAAA;EACA,cAAA,EAAgB,cAAA;EAChB,YAAA,EAAc,sBAAA;AAAA;;UAIE,cAAA;EAChB,EAAA;EACA,KAAA;EACA,GAAA;EACA,QAAA;EACA,QAAA;EACA,GAAA;EACA,OAAA;EACA,KAAA;EACA,MAAA;AAAA;;UAIgB,eAAA;EAnCH;EAqCb,IAAA;EAlCU;EAoCV,KAAA;EAlCE;EAoCF,SAAA;AAAA;;UAIgB,gBAAA;EAhCA;EAkChB,IAAA;;EAEA,SAAA;EAnCA;EAqCA,WAAA;AAAA;;UAIgB,qBAAA;EArChB;EAuCA,EAAA;EAvCoC;EAyCpC,KAAA;EArCgB;EAuChB,IAAA;AAAA;;UAIgB,cAAA;EAzChB;EA2CA,QAAA;EAEA,IAAA;IACC,KAAA;IACA,GAAA;EAAA;EAGD,SAAA,EAAW,gBAAA;EAEX,WAAA;IACC,KAAA;IACA,KAAA,EAAO,cAAA;EAAA;EAGR,UAAA;EACA,IAAA;EACA,OAAA,EAAS,YAAA;EA9CT;EAiDA,QAAA,GAAW,eAAA;EA7CX;EAgDA,gBAAA,GAAmB,gBAAA;EAhDV;EAmDT,cAAA,GAAiB,qBAAA;EA/Ce;EAkDhC,YAAA,GAAe,KAAA;IACd,GAAA;IACA,KAAA;IACA,OAAA;IACA,cAAA;IACA,aAAA;IACA,UAAA;EAAA;EA9CoC;EAkDrC,IAAA,GAAO,aAAA;AAAA;;UAQS,cAAA;EApDhB;EAsDA,QAAA;EAtDI;EAwDJ,QAAA;EApD8B;EAsD9B,MAAA;EA7CW;EA+CX,IAAA;EAtCS;EAwCT,KAAA;EAlCmB;EAoCnB,OAAA,EAAS,iBAAA;EA9BM;EAgCf,OAAA;EAtBoB;EAwBpB,IAAA,EAAM,IAAA;EA9DN;EAgEA,QAAA,GAAW,IAAA;EA7DV;EA+DD,MAAA;EA3DA;EA6DA,UAAA;EA3DA;EA6DA,IAAA;EA3DC;EA6DD,IAAA,GAAO,MAAA;EA1DP;EA4DA,aAAA;EA1DA;EA4DA,QAAA;EAzDA;EA2DA,SAAA;EAxDA;EA0DA,gBAAA,GAAmB,MAAA;EAvDnB;EA0DA,MAAA;EAvDA;;;;;EA8DA,gBAAA;AAAA;;UAQgB,eAAA;EAChB,OAAA;EACA,UAAA;AAAA;AAtDD;AAAA,UA0DiB,YAAA;EAChB,gBAAA,EAAkB,MAAA,SAAe,eAAA;EACjC,YAAA;AAAA;;UAIgB,YAAA;EA9BG;EAgCnB,SAAA;EAhCyB;EAkCzB,aAAA;EAhEA;EAkEA,KAAA;AAAA;;UAIgB,YAAA;EAChB,OAAA;EACA,QAAA;EA5DA;EA8DA,OAAA;EACA,MAAA,EAAQ,KAAA;IAAQ,KAAA;IAAe,KAAA;EAAA;EAC/B,YAAA,EAAc,MAAA;EAtDd;EAwDA,mBAAA;EAtDA;EAwDA,iBAAA;EApDA;EAsDA,iBAAA;EApDmB;EAsDnB,KAAA;IAAU,OAAA;IAAiB,KAAA;EAAA;EApCX;EAsChB,QAAA;IAAa,QAAA;IAAkB,OAAA;EAAA;EAhCf;EAkChB,YAAA;AAAA;;;;;UAWgB,YAAA;EA3CJ;EA6CZ,EAAA;EAzCgB;EA4ChB,IAAA;;EAGA,WAAA;EA7CA;EAgDA,IAAA;EA5CA;EA+CA,YAAA;EA/CK;EAkDL,QAAA;EA9C4B;;;;EAoD5B,KAAA,EAAO,GAAA,WAAc,OAAA,CAAQ,iBAAA;EAhD7B;;;;EAsDA,OAAA,CAAQ,KAAA,EAAO,WAAA,EAAa,OAAA,EAAS,aAAA,GAAgB,OAAA,CAAQ,cAAA;EApD7D;;;;EA0DA,YAAA,CAAa,KAAA,EAAO,WAAA,EAAa,OAAA,EAAS,YAAA,GAAe,cAAA,CAAe,cAAA;EAlDxE;;;;EAwDA,UAAA,EAAY,GAAA,UAAa,KAAA,EAAO,WAAA,GAAc,OAAA,CAAQ,IAAA;AAAA;;UAItC,aAAA;EAxDJ;EA0DZ,EAAA;EA/C4B;EAiD5B,sBAAA,SAA+B,OAAA,CAC9B,GAAA;IAAc,IAAA;IAAc,MAAA,EAAQ,GAAA;MAAc,IAAA;IAAA;EAAA;AAAA"}

package/dist/types-DVbTb4Hk.mjs

@@ -0,0 +1,77 @@
+//#region src/plugins/sandbox/types.ts
+const SANDBOX_ROUTE_ERROR_DEFINITIONS = {
+	MEDIA_USAGE_ACTIVATION_IN_PROGRESS: {
+		message: "Media usage activation is in progress",
+		status: 503
+	},
+	MEDIA_USAGE_ACTIVATION_CHECK_FAILED: {
+		message: "Unable to verify media usage activation state",
+		status: 503
+	},
+	TRANSFER_IMPORT_IN_PROGRESS: {
+		message: "A site import is in progress or incomplete; writes are disabled",
+		status: 503
+	},
+	TRANSFER_FENCE_CHECK_FAILED: {
+		message: "Unable to verify whether site writes are allowed",
+		status: 503
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function isSandboxRouteErrorCode(value) {
+	return typeof value === "string" && value in SANDBOX_ROUTE_ERROR_DEFINITIONS;
+}
+function getSandboxRouteErrorDetails(error) {
+	if (!isRecord(error)) return null;
+	const propertyCode = isSandboxRouteErrorCode(error.code) ? error.code : null;
+	const nameCode = error instanceof Error && isSandboxRouteErrorCode(error.name) ? error.name : null;
+	if (propertyCode && nameCode && propertyCode !== nameCode) return null;
+	const code = propertyCode ?? nameCode;
+	if (!code || error.status !== void 0 && error.status !== 503) return null;
+	return {
+		code,
+		...SANDBOX_ROUTE_ERROR_DEFINITIONS[code]
+	};
+}
+function createSandboxRouteError(code) {
+	const details = {
+		code,
+		...SANDBOX_ROUTE_ERROR_DEFINITIONS[code]
+	};
+	return Object.assign(new Error(details.message), details, { name: code });
+}
+function createSandboxRouteErrorEnvelope(error) {
+	const details = getSandboxRouteErrorDetails(error);
+	return details ? {
+		__emdashSandboxRouteError: true,
+		error: details
+	} : null;
+}
+function getSandboxRouteErrorEnvelope(value) {
+	if (!isRecord(value) || value.__emdashSandboxRouteError !== true) return null;
+	const details = getSandboxRouteErrorDetails(value.error);
+	return details ? {
+		__emdashSandboxRouteError: true,
+		error: details
+	} : null;
+}
+function withUnavailableReason(message, runner) {
+	const reason = runner?.unavailableReason?.();
+	return reason ? `${message}: ${reason}` : message;
+}
+/**
+* Error thrown when the sandbox runtime is unavailable.
+* This happens when the sidecar process has crashed or hasn't started.
+*/
+var SandboxUnavailableError = class extends Error {
+	constructor(pluginId, reason) {
+		super(`Plugin sandbox unavailable for ${pluginId}: ${reason}`);
+		this.name = "SandboxUnavailableError";
+	}
+};
+
+//#endregion
+export { getSandboxRouteErrorEnvelope as a, getSandboxRouteErrorDetails as i, createSandboxRouteError as n, withUnavailableReason as o, createSandboxRouteErrorEnvelope as r, SandboxUnavailableError as t };
+//# sourceMappingURL=types-DVbTb4Hk.mjs.map

package/dist/types-DVbTb4Hk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-DVbTb4Hk.mjs","names":[],"sources":["../src/plugins/sandbox/types.ts"],"sourcesContent":["/**\n * Plugin Sandbox Types\n *\n * Defines interfaces for running plugins in sandboxed V8 isolates.\n * The SandboxRunner interface is implemented by platform adapters\n * (e.g., Cloudflare Worker Loader) to provide isolation.\n *\n */\n\nimport type { PluginUiContext } from \"@emdash-cms/blocks/server\";\nimport type { Kysely } from \"kysely\";\n\nimport type { Database } from \"../../database/types.js\";\nimport type { ContentActionCallbacks } from \"../context.js\";\nimport type {\n\tContentCreateOptions,\n\tContentItem,\n\tContentWriteInput,\n\tPluginComment,\n\tPluginCommentStatus,\n\tPluginManifest,\n\tRequestMeta,\n\tTaxonomyAccessWithWrite,\n\tUserInfo,\n} from \"../types.js\";\n\n/**\n * Resource limits for sandboxed plugins.\n * Enforced by the sandbox runtime (e.g., Worker Loader).\n */\nexport interface ResourceLimits {\n\t/** CPU time per invocation in milliseconds (default: 50ms) */\n\tcpuMs?: number;\n\t/** Memory limit in MB (default: 128MB) */\n\tmemoryMb?: number;\n\t/** Maximum subrequests per invocation (default: 10) */\n\tsubrequests?: number;\n\t/** Wall-clock time limit in milliseconds (default: 30000ms) */\n\twallTimeMs?: number;\n}\n\n/**\n * Storage interface for loading plugin code.\n * Could be R2, local filesystem, or any other storage backend.\n */\nexport interface PluginCodeStorage {\n\t/** Get plugin bundle code by path */\n\tget(path: string): Promise<string | null>;\n\t/** Check if a bundle exists */\n\texists(path: string): Promise<boolean>;\n}\n\n/**\n * Serialized email message for sandbox RPC transport.\n * Matches the core EmailMessage type but uses only serializable fields.\n */\nexport interface SandboxEmailMessage {\n\tto: string;\n\tcc?: string[];\n\treplyTo?: string;\n\tsubject: string;\n\ttext: string;\n\thtml?: string;\n}\n\n/**\n * Callback for sending email from a sandboxed plugin.\n * The sandbox runner wires this up from the EmailPipeline.\n *\n * @param message - The email message to send\n * @param pluginId - The sending plugin's ID (used as source)\n */\nexport type SandboxEmailSendCallback = (\n\tmessage: SandboxEmailMessage,\n\tpluginId: string,\n) => Promise<void>;\n\nexport type SandboxCommentModerateCallback = (\n\tpluginId: string,\n\tid: string,\n\tstatus: PluginCommentStatus,\n\texpectedStatus: PluginCommentStatus,\n) => Promise<PluginComment>;\n\nexport type SandboxContentCreateCallback = (\n\tpluginId: string,\n\tcollection: string,\n\tdata: ContentWriteInput,\n\toptions?: ContentCreateOptions & {\n\t\toriginHook?: \"content:beforeSave\" | \"content:afterSave\";\n\t\tsandboxOrigin?: true;\n\t},\n) => Promise<ContentItem>;\n\nexport type SandboxHttpFetchCallback = typeof fetch;\n\n/**\n * Options for creating a sandbox runner\n */\nexport interface SandboxOptions {\n\t/** Storage interface for loading plugin code */\n\tstorage?: PluginCodeStorage;\n\t/** Database for bridge operations */\n\tdb: Kysely<Database>;\n\t/**\n\t * Called immediately before a sandboxed plugin content mutation; it throws\n\t * to refuse the write. When it returns a function, the bridge calls that\n\t * function once the write has succeeded.\n\t */\n\tbeforeContentWrite?: () => Promise<void | (() => Promise<void>)>;\n\t/** Runtime-owned taxonomy mutation surface used by sandbox bridges. */\n\ttaxonomyWrite?: TaxonomyAccessWithWrite;\n\tcontentActions?: ContentActionCallbacks;\n\t/** Clock used to calculate recurring plugin task schedules. */\n\tnow?: () => Date;\n\t/** Default resource limits */\n\tlimits?: ResourceLimits;\n\t/** Site info for plugin context (injected into wrapper at generation time) */\n\tsiteInfo?: {\n\t\tname: string;\n\t\turl: string;\n\t\tlocale: string;\n\t\ttrailingSlash?: \"always\" | \"never\" | \"ignore\";\n\t};\n\t/** Email send callback, wired from the EmailPipeline by the runtime */\n\temailSend?: SandboxEmailSendCallback;\n\tcommentModerate?: SandboxCommentModerateCallback;\n\t/** Optional host HTTP transport used by test hosts and custom runtimes. */\n\thttpFetch?: SandboxHttpFetchCallback;\n\t/**\n\t * Media storage adapter for sandboxed plugin byte reads, uploads, and deletes.\n\t * Each operation remains gated by its own media capability.\n\t */\n\tmediaStorage?: {\n\t\tupload(options: { key: string; body: Uint8Array; contentType: string }): Promise<unknown>;\n\t\tdownload(key: string): Promise<{\n\t\t\tbody: ReadableStream<Uint8Array>;\n\t\t\tcontentType: string;\n\t\t\tsize: number;\n\t\t}>;\n\t\tdelete(key: string): Promise<unknown>;\n\t};\n\t/** Worker Loader name suffix. The plugin's logical ID remains unchanged. */\n\tisolateKey?: string;\n}\n\n/**\n * Handle to a sandboxed plugin running inside an isolate. Returned\n * by `SandboxRunner.load` and held by the runtime's cache so hooks /\n * routes can be invoked across the isolate boundary. Distinct from\n * the author-facing `SandboxedPlugin` type in `emdash/plugin`, which\n * describes the source-level shape of a plugin's default export.\n */\nexport interface SandboxedPluginInstance {\n\t/** Unique identifier: `${manifest.id}:${manifest.version}` */\n\treadonly id: string;\n\n\t/**\n\t * Invoke a hook in the sandboxed plugin.\n\t *\n\t * @param hookName - Name of the hook (e.g., \"content:beforeSave\")\n\t * @param event - Event data to pass to the hook\n\t * @returns Hook result (transformed content, void, etc.)\n\t */\n\tinvokeHook(hookName: string, event: unknown): Promise<unknown>;\n\n\t/**\n\t * Invoke an API route in the sandboxed plugin.\n\t *\n\t * @param routeName - Name of the route\n\t * @param input - Validated input data\n\t * @param request - Serialized request info for context\n\t * @returns Route response data\n\t */\n\tinvokeRoute(\n\t\trouteName: string,\n\t\tinput: unknown,\n\t\trequest: SerializedRequest,\n\t\toptions?: SandboxInvocationOptions,\n\t): Promise<unknown>;\n\n\t/**\n\t * Change whether the plugin may access host services.\n\t * Deactivation revokes credentials synchronously; reactivation issues fresh credentials.\n\t */\n\tsetActive?(active: boolean): void;\n\n\t/**\n\t * Terminate the sandboxed plugin.\n\t * Releases resources and prevents further invocations.\n\t */\n\tterminate(): Promise<void>;\n}\n\nexport interface SandboxInvocationOptions {\n\tinvalidateContentCache?: (tags: string[]) => Promise<void>;\n}\n\n/**\n * Serialized request for RPC transport.\n * Worker Loader can't pass Request objects directly.\n */\nexport interface SerializedRequest {\n\turl: string;\n\tmethod: string;\n\theaders: Record<string, string>;\n\t/** Normalized request metadata extracted before RPC serialization */\n\tmeta: RequestMeta;\n\t/** Host-attested context for a validated Block Kit request. */\n\tui?: PluginUiContext;\n\t/**\n\t * Authenticated caller for private routes, resolved by the host before\n\t * dispatch. Undefined for public routes and unbound machine tokens.\n\t */\n\tuser?: UserInfo;\n}\n\nconst SANDBOX_ROUTE_ERROR_DEFINITIONS = {\n\tMEDIA_USAGE_ACTIVATION_IN_PROGRESS: {\n\t\tmessage: \"Media usage activation is in progress\",\n\t\tstatus: 503,\n\t},\n\tMEDIA_USAGE_ACTIVATION_CHECK_FAILED: {\n\t\tmessage: \"Unable to verify media usage activation state\",\n\t\tstatus: 503,\n\t},\n\tTRANSFER_IMPORT_IN_PROGRESS: {\n\t\tmessage: \"A site import is in progress or incomplete; writes are disabled\",\n\t\tstatus: 503,\n\t},\n\tTRANSFER_FENCE_CHECK_FAILED: {\n\t\tmessage: \"Unable to verify whether site writes are allowed\",\n\t\tstatus: 503,\n\t},\n} as const;\n\nexport type SandboxRouteErrorCode = keyof typeof SANDBOX_ROUTE_ERROR_DEFINITIONS;\n\nexport interface SandboxRouteErrorDetails {\n\tcode: SandboxRouteErrorCode;\n\tmessage: string;\n\tstatus: 503;\n}\n\nexport interface SandboxRouteErrorEnvelope {\n\t__emdashSandboxRouteError: true;\n\terror: SandboxRouteErrorDetails;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction isSandboxRouteErrorCode(value: unknown): value is SandboxRouteErrorCode {\n\treturn typeof value === \"string\" && value in SANDBOX_ROUTE_ERROR_DEFINITIONS;\n}\n\nexport function getSandboxRouteErrorDetails(error: unknown): SandboxRouteErrorDetails | null {\n\tif (!isRecord(error)) return null;\n\n\tconst propertyCode = isSandboxRouteErrorCode(error.code) ? error.code : null;\n\tconst nameCode =\n\t\terror instanceof Error && isSandboxRouteErrorCode(error.name) ? error.name : null;\n\tif (propertyCode && nameCode && propertyCode !== nameCode) return null;\n\n\tconst code = propertyCode ?? nameCode;\n\tif (!code || (error.status !== undefined && error.status !== 503)) return null;\n\n\treturn {\n\t\tcode,\n\t\t...SANDBOX_ROUTE_ERROR_DEFINITIONS[code],\n\t};\n}\n\nexport function createSandboxRouteError(\n\tcode: SandboxRouteErrorCode,\n): Error & SandboxRouteErrorDetails {\n\tconst details: SandboxRouteErrorDetails = {\n\t\tcode,\n\t\t...SANDBOX_ROUTE_ERROR_DEFINITIONS[code],\n\t};\n\treturn Object.assign(new Error(details.message), details, { name: code });\n}\n\nexport function createSandboxRouteErrorEnvelope(error: unknown): SandboxRouteErrorEnvelope | null {\n\tconst details = getSandboxRouteErrorDetails(error);\n\treturn details ? { __emdashSandboxRouteError: true, error: details } : null;\n}\n\nexport function getSandboxRouteErrorEnvelope(value: unknown): SandboxRouteErrorEnvelope | null {\n\tif (!isRecord(value) || value.__emdashSandboxRouteError !== true) return null;\n\tconst details = getSandboxRouteErrorDetails(value.error);\n\treturn details ? { __emdashSandboxRouteError: true, error: details } : null;\n}\n\n/**\n * Sandbox runner interface.\n * Platform adapters implement this to provide plugin isolation.\n */\nexport interface SandboxRunner {\n\t/**\n\t * Check if sandboxing is available on this platform.\n\t * Returns false for platforms that don't support isolation.\n\t */\n\tisAvailable(): boolean;\n\n\t/**\n\t * Check if the sandbox runtime is currently healthy.\n\t * For in-process runners this always returns true.\n\t * For sidecar-based runners (workerd), returns false if the\n\t * child process has crashed and hasn't been restarted yet.\n\t */\n\tisHealthy(): boolean;\n\n\t/**\n\t * Why the runner cannot run plugins, once isAvailable() or isHealthy()\n\t * has returned false. A lowercase clause without a final period: callers\n\t * append it to their own message after a colon.\n\t *\n\t * Making this required breaks runners implemented outside this repository.\n\t */\n\tunavailableReason?(): string;\n\n\t/**\n\t * Load a sandboxed plugin from code.\n\t *\n\t * @param manifest - Plugin manifest with metadata and capabilities\n\t * @param code - The bundled plugin JavaScript code\n\t * @returns A sandboxed plugin instance\n\t * @throws If sandboxing is not available or plugin can't be loaded\n\t */\n\tload(manifest: PluginManifest, code: string): Promise<SandboxedPluginInstance>;\n\n\t/**\n\t * Set the email send callback for sandboxed plugins.\n\t * Called after the EmailPipeline is created, since the pipeline\n\t * doesn't exist when the sandbox runner is constructed.\n\t */\n\tsetEmailSend(callback: SandboxEmailSendCallback | null): void;\n\tsetCommentModerate?(callback: SandboxCommentModerateCallback | null): void;\n\tsetContentCreate?(callback: SandboxContentCreateCallback | null): void;\n\tsetContentActions?(callback: ContentActionCallbacks | null): void;\n\n\t/** Wake a long-lived scheduler after a sandboxed plugin changes its tasks. */\n\tsetCronReschedule?(callback: (() => void) | null): void;\n\n\t/**\n\t * Terminate all loaded sandboxed plugins.\n\t * Called during shutdown or when reconfiguring.\n\t */\n\tterminateAll(): Promise<void>;\n}\n\nexport function withUnavailableReason(message: string, runner: SandboxRunner | null): string {\n\tconst reason = runner?.unavailableReason?.();\n\treturn reason ? `${message}: ${reason}` : message;\n}\n\n/**\n * Error thrown when the sandbox runtime is unavailable.\n * This happens when the sidecar process has crashed or hasn't started.\n */\nexport class SandboxUnavailableError extends Error {\n\tconstructor(pluginId: string, reason: string) {\n\t\tsuper(`Plugin sandbox unavailable for ${pluginId}: ${reason}`);\n\t\tthis.name = \"SandboxUnavailableError\";\n\t}\n}\n\n/**\n * Factory function type for creating sandbox runners.\n * Exported by platform adapters (e.g., @emdash-cms/cloudflare/sandbox).\n *\n * @example\n * ```typescript\n * // In @emdash-cms/cloudflare/sandbox\n * export const createSandboxRunner: SandboxRunnerFactory = (options) => {\n *   return new CloudflareSandboxRunner(options);\n * };\n * ```\n */\nexport type SandboxRunnerFactory = (options: SandboxOptions) => SandboxRunner;\n"],"mappings":";AAyNA,MAAM,kCAAkC;CACvC,oCAAoC;EACnC,SAAS;EACT,QAAQ;EACR;CACD,qCAAqC;EACpC,SAAS;EACT,QAAQ;EACR;CACD,6BAA6B;EAC5B,SAAS;EACT,QAAQ;EACR;CACD,6BAA6B;EAC5B,SAAS;EACT,QAAQ;EACR;CACD;AAeD,SAAS,SAAS,OAAkD;AACnE,QAAO,OAAO,UAAU,YAAY,UAAU;;AAG/C,SAAS,wBAAwB,OAAgD;AAChF,QAAO,OAAO,UAAU,YAAY,SAAS;;AAG9C,SAAgB,4BAA4B,OAAiD;AAC5F,KAAI,CAAC,SAAS,MAAM,CAAE,QAAO;CAE7B,MAAM,eAAe,wBAAwB,MAAM,KAAK,GAAG,MAAM,OAAO;CACxE,MAAM,WACL,iBAAiB,SAAS,wBAAwB,MAAM,KAAK,GAAG,MAAM,OAAO;AAC9E,KAAI,gBAAgB,YAAY,iBAAiB,SAAU,QAAO;CAElE,MAAM,OAAO,gBAAgB;AAC7B,KAAI,CAAC,QAAS,MAAM,WAAW,UAAa,MAAM,WAAW,IAAM,QAAO;AAE1E,QAAO;EACN;EACA,GAAG,gCAAgC;EACnC;;AAGF,SAAgB,wBACf,MACmC;CACnC,MAAM,UAAoC;EACzC;EACA,GAAG,gCAAgC;EACnC;AACD,QAAO,OAAO,OAAO,IAAI,MAAM,QAAQ,QAAQ,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;;AAG1E,SAAgB,gCAAgC,OAAkD;CACjG,MAAM,UAAU,4BAA4B,MAAM;AAClD,QAAO,UAAU;EAAE,2BAA2B;EAAM,OAAO;EAAS,GAAG;;AAGxE,SAAgB,6BAA6B,OAAkD;AAC9F,KAAI,CAAC,SAAS,MAAM,IAAI,MAAM,8BAA8B,KAAM,QAAO;CACzE,MAAM,UAAU,4BAA4B,MAAM,MAAM;AACxD,QAAO,UAAU;EAAE,2BAA2B;EAAM,OAAO;EAAS,GAAG;;AA6DxE,SAAgB,sBAAsB,SAAiB,QAAsC;CAC5F,MAAM,SAAS,QAAQ,qBAAqB;AAC5C,QAAO,SAAS,GAAG,QAAQ,IAAI,WAAW;;;;;;AAO3C,IAAa,0BAAb,cAA6C,MAAM;CAClD,YAAY,UAAkB,QAAgB;AAC7C,QAAM,kCAAkC,SAAS,IAAI,SAAS;AAC9D,OAAK,OAAO"}

package/dist/types-Ddku19Zw.d.mts

@@ -0,0 +1,209 @@
+import * as react from "react";
+
+//#region src/auth/types.d.ts
+/**
+ * Auth Provider Types
+ *
+ * Defines the interfaces for pluggable authentication providers.
+ *
+ * Two systems coexist:
+ * - `AuthDescriptor` — transparent auth (Cloudflare Access) that authenticates
+ *   every request via headers/cookies. No login UI needed.
+ * - `AuthProviderDescriptor` — pluggable login methods (GitHub, Google,
+ *   AT Protocol, etc.) that appear as options on the login page and setup
+ *   wizard. Passkey is built-in; providers are additive.
+ */
+/**
+ * Result of authenticating a request via an external auth provider
+ */
+interface AuthResult {
+  /** User's email address */
+  email: string;
+  /** User's display name */
+  name: string;
+  /** Resolved role level (e.g., 50 for Admin, 40 for Editor, 30 for Author) */
+  role: number;
+  /** Provider-specific subject ID */
+  subject?: string;
+  /** Additional provider-specific data */
+  metadata?: Record<string, unknown>;
+}
+/**
+ * Auth descriptor — transparent auth providers (e.g., Cloudflare Access).
+ *
+ * These authenticate every request via headers/cookies. No login UI needed.
+ * The module's `authenticate()` function is called by middleware on each request.
+ */
+interface AuthDescriptor {
+  /**
+   * Auth provider type identifier
+   * @example "cloudflare-access", "okta", "auth0"
+   */
+  type: string;
+  /**
+   * Module specifier to import at runtime
+   * The module must export an `authenticate` function.
+   * @example "@emdash-cms/cloudflare/auth"
+   */
+  entrypoint: string;
+  /**
+   * Provider-specific configuration (JSON-serializable)
+   */
+  config: unknown;
+}
+/**
+ * Auth provider module interface
+ *
+ * Modules specified by AuthDescriptor.entrypoint must export
+ * an `authenticate` function matching this signature.
+ */
+interface AuthProviderModule {
+  /**
+   * Authenticate a request using the provider
+   *
+   * @param request - The incoming HTTP request
+   * @param config - Provider-specific configuration from AuthDescriptor
+   * @returns Authentication result if valid, throws if invalid
+   */
+  authenticate(request: Request, config: unknown): Promise<AuthResult>;
+}
+/**
+ * Descriptor for a pluggable auth provider.
+ *
+ * Auth providers appear as login options on the login page and setup wizard.
+ * They coexist with passkey (which is built-in) and with each other.
+ * Any provider can be used to create the initial admin account.
+ *
+ * @example
+ * ```ts
+ * // astro.config.ts
+ * import { atproto } from "@emdash-cms/auth-atproto";
+ *
+ * emdash({
+ *   authProviders: [atproto(), github(), google()],
+ * })
+ * ```
+ */
+interface AuthProviderDescriptor {
+  /** Unique provider ID (e.g., "github", "atproto") */
+  id: string;
+  /** Human-readable label for UI (e.g., "GitHub", "AT Protocol") */
+  label: string;
+  /** Provider-specific config (JSON-serializable) */
+  config?: unknown;
+  /**
+   * Module exporting React components for the admin UI.
+   * Statically imported at build time via virtual module.
+   *
+   * The module should export components matching `AuthProviderAdminExports`.
+   */
+  adminEntry?: string;
+  /**
+   * Astro route handlers this provider needs injected at build time.
+   * Used for login initiation, OAuth callbacks, well-known endpoints, etc.
+   */
+  routes?: AuthRouteDescriptor[];
+  /**
+   * URL prefixes/paths that should bypass auth middleware.
+   * Added to the public routes set so login/callback endpoints work
+   * for unauthenticated users.
+   */
+  publicRoutes?: string[];
+  /**
+   * Storage collections for persistent auth state (e.g., OAuth sessions).
+   * Same format as plugin storage — collections are stored in the shared
+   * `_plugin_storage` table namespaced under `auth:<providerId>`.
+   *
+   * Access via `getAuthProviderStorage()` from `emdash/api/route-utils`.
+   */
+  storage?: Record<string, {
+    indexes?: Array<string | string[]>;
+    uniqueIndexes?: Array<string | string[]>;
+  }>;
+}
+/**
+ * A route that an auth provider needs injected into the Astro app.
+ */
+interface AuthRouteDescriptor {
+  /** URL pattern (e.g., "/_emdash/api/auth/atproto/login") */
+  pattern: string;
+  /** Module specifier for the Astro route handler */
+  entrypoint: string;
+}
+/**
+ * Expected exports from an auth provider's `adminEntry` module.
+ *
+ * All exports are optional. Providers export whichever components
+ * make sense for their auth flow.
+ */
+interface AuthProviderAdminExports {
+  /**
+   * Compact button for the login page (icon + label).
+   * Used for providers with a simple redirect flow (GitHub, Google).
+   * Rendered in the "Or continue with" section.
+   */
+  LoginButton?: react.ComponentType;
+  /**
+   * Full login form for providers that need custom input.
+   * Used for providers like AT Protocol that need a handle field.
+   * Rendered as an expandable section on the login page.
+   */
+  LoginForm?: react.ComponentType;
+  /**
+   * Optional help text shown below the provider's LoginForm. Providers can
+   * export a string or a component; components keep text localisable.
+   */
+  loginHelp?: string | react.ComponentType;
+  /**
+   * Setup wizard step for creating the admin account via this provider.
+   * When present, this provider appears as an option in the setup wizard's
+   * "Create admin account" step.
+   */
+  SetupStep?: react.ComponentType<{
+    onComplete: () => void;
+  }>;
+}
+/**
+ * Configuration options common to external auth providers
+ */
+interface ExternalAuthConfig {
+  /**
+   * Automatically create EmDash users on first login
+   * @default true
+   */
+  autoProvision?: boolean;
+  /**
+   * Role level for users not matching any group in roleMapping
+   * @default 30 (Author, who can publish their own content)
+   */
+  defaultRole?: number;
+  /**
+   * Update user's role on each login based on current IdP groups
+   * When false, role is only set on first provisioning
+   * @default false
+   */
+  syncRoles?: boolean;
+  /**
+   * Update user's name from the IdP on every authenticated request
+   * When false, name is only set on first provisioning, so names edited in the admin are kept
+   * @default true
+   */
+  syncName?: boolean;
+  /**
+   * Map IdP group names to EmDash role levels
+   * First match wins if user is in multiple groups
+   *
+   * @example
+   * ```ts
+   * roleMapping: {
+   *   "Admins": 50,        // Admin
+   *   "Editors": 40,       // Editor
+   *   "Content Team": 30,  // Author
+   * }
+   * ```
+   */
+  roleMapping?: Record<string, number>;
+}
+//#endregion
+export { AuthResult as a, AuthProviderModule as i, AuthProviderAdminExports as n, AuthRouteDescriptor as o, AuthProviderDescriptor as r, ExternalAuthConfig as s, AuthDescriptor as t };
+//# sourceMappingURL=types-Ddku19Zw.d.mts.map