From e36ac5d697f229d7559d65fa26bda0639e3d8e67 Mon Sep 17 00:00:00 2001
From: zumbrunn <chris@zumbrunn.com>
Date: Sat, 7 Nov 2026 18:07:50 +0100
Subject: [PATCH 1/6] feat!: the bar declares bar.actions and reads per request
 from ctx.capabilities (#127)

BarAction and BarActionContext live here; the key is declared by declaration
merging. transformResponse reads the contributions and the admin.prefix slot
from ResponseTransformContext.capabilities.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md               |  8 +++++
 README.md                  |  5 +--
 src/bar-actions.ts         | 67 ++++++++++++++++++++++++++++++++++++++
 src/bar.ts                 | 12 +++----
 src/mod.ts                 | 13 ++++++--
 tests/capabilities_test.ts | 51 ++++++++++++++++++++++++-----
 6 files changed, 138 insertions(+), 18 deletions(-)
 create mode 100644 src/bar-actions.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64c8374..15dc740 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@
 
 ### Changed — BREAKING
 
+- **The bar declares its own extension point, and reads what it needs per request (#127).**
+  `bar.actions` is declared here, by declaration merging, with its types `BarAction` and
+  `BarActionContext` (renamed from core's `AdminBarAction` / `AdminBarActionContext`, which
+  left core's contract; the context no longer carries `adminPrefix`). A plugin that adds a
+  button imports the types from `@dune/plugin-inline-edit`. `transformResponse` reads the
+  contributions and the `admin.prefix` slot from `ResponseTransformContext.capabilities`
+  instead of `barActions` / `adminPrefix`. With no `admin.prefix` provider no bar is injected,
+  as before (the bar's endpoints are still the admin's).
 - **Provides the `editor.inline` capability and reads `bar.actions`, instead of
   `adminServices` and `ctx.plugins` (duneorg/dune#97, `@dune/core` 0.36).** The manager
   is declared in `setup()` with `api.capabilities.provide("editor.inline", ...)`; the admin
diff --git a/README.md b/README.md
index 5e8a593..12512f8 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,9 @@ point in `transformResponse`:
   manager, and the admin's content endpoints use it for commits and presence.
   Any plugin can provide the same slot to replace it.
 - **Renders `bar.actions`** — buttons that other plugins contribute with
-  `api.capabilities.contribute("bar.actions", ({ page, adminPrefix }) => [...])`
-  show up in the admin bar; this plugin does not know what they do.
+  `api.capabilities.contribute("bar.actions", ({ page }) => [...])` show up in the
+  bar; this plugin does not know what they do. It declares the point, so import
+  `BarAction` / `BarActionContext` from `@dune/plugin-inline-edit`.
 
 Admin identity comes from whichever plugin provides `auth.session` (the admin
 plugin does); with none, no bar is injected.
diff --git a/src/bar-actions.ts b/src/bar-actions.ts
new file mode 100644
index 0000000..f65ebd1
--- /dev/null
+++ b/src/bar-actions.ts
@@ -0,0 +1,67 @@
+/**
+ * The bar's extension point.
+ *
+ * This plugin renders the editing bar and is the only reader of `bar.actions`,
+ * so it declares the key (and its types) itself instead of core's contract
+ * carrying it. A plugin that adds a button imports the types from
+ * `@dune/plugin-inline-edit`; importing them also makes the key known to
+ * TypeScript:
+ *
+ * ```ts
+ * api.capabilities.contribute("bar.actions", ({ page }) =>
+ *   page ? [{ id: "pdf:download", label: "PDF", href: `/pdf${page.route}` }] : []);
+ * ```
+ *
+ * @module
+ */
+
+/**
+ * Context passed to a `bar.actions` contribution: what belongs on the bar for
+ * this response. A plugin that links to its own pages builds the URLs itself
+ * (the admin knows its prefix); the bar passes none.
+ *
+ * @since 3.0.0
+ */
+export interface BarActionContext {
+  /** Content page matching the current URL, or null for non-content routes. */
+  page: { sourcePath: string; route: string; title: string | null; template: string } | null;
+}
+
+/**
+ * A button contributed to the editing bar through the `bar.actions`
+ * contribution point. This plugin owns the bar; the contributing plugin controls
+ * only the button's appearance and behavior, not its position or styling.
+ *
+ * @since 3.0.0
+ */
+export interface BarAction {
+  /**
+   * Unique id — namespace by plugin name to avoid collisions across
+   * plugins, e.g. `"pdf-export:download"`.
+   */
+  id: string;
+  /** Button label. */
+  label: string;
+  /** Optional emoji/icon prefix. */
+  icon?: string;
+  /**
+   * Renders as a plain link (`<a href>`) when set — the common case for
+   * downloads and navigation. Mutually exclusive with `onClick`; `href`
+   * takes precedence if both are set.
+   */
+  href?: string;
+  /**
+   * Renders as a `<button>` running this literal JavaScript on click, when
+   * `href` is not set. Trusted content from a loaded plugin, not user
+   * input — no sanitization is applied, the same trust level as any other
+   * server-rendered admin-only script.
+   */
+  onClick?: string;
+}
+
+declare module "@dune/core/plugin-api" {
+  interface Contributions {
+    /** Buttons for the editing bar. Consumer: `@dune/plugin-inline-edit`. */
+    "bar.actions": (ctx: BarActionContext) => BarAction[];
+  }
+}
diff --git a/src/bar.ts b/src/bar.ts
index 0a59df7..ba6b139 100644
--- a/src/bar.ts
+++ b/src/bar.ts
@@ -22,7 +22,7 @@
  *      lazy-imported only when a body edit starts, so browsing costs nothing.
  */
 
-import type { AdminBarAction } from "@dune/core/plugins";
+import type { BarAction } from "./bar-actions.ts";
 
 // ── HTML annotation pass ──────────────────────────────────────────────────────
 
@@ -100,9 +100,9 @@ function jsonStr(s: string): string {
  * Render buttons contributed by other plugins through the `bar.actions` capability point
  * (see mod.ts, which collects them and passes the result in here). `label`/
  * `icon`/`href` are escaped as untrusted display content; `onClick` is not —
- * see {@link AdminBarAction.onClick}'s own doc for why that's the right call.
+ * see {@link BarAction.onClick}'s own doc for why that's the right call.
  */
-function renderAdminBarActions(actions: AdminBarAction[]): string {
+function renderBarActions(actions: BarAction[]): string {
   return actions.map((a) => {
     const label = `${a.icon ? escapeHtml(a.icon) + " " : ""}${
       escapeHtml(a.label)
@@ -132,7 +132,7 @@ export function buildAdminBarHtml(opts: {
   userName: string;
   pluginVersion: string;
   /** Buttons contributed by other plugins through the `bar.actions` capability point — see mod.ts. */
-  actions?: AdminBarAction[];
+  actions?: BarAction[];
   /**
    * Whether `annotateEditableElements()` found anything to annotate on this
    * page (a title `<h1>` or a `data-dune-body` element). When false, the
@@ -340,7 +340,7 @@ export function buildAdminBarHtml(opts: {
       : ""
   }
   <button id="dune-ab-edit-source">✎ Edit source</button>
-  ${renderAdminBarActions(actions)}
+  ${renderBarActions(actions)}
   <a href="${adminPageUrl}" class="dune-ab-escape" title="Open full admin editor">Open in admin →</a>
   <span class="dune-ab-user">${escapeHtml(userName)}</span>
 </div>
@@ -760,7 +760,7 @@ export async function injectAdminBar(
     userName: string;
     pluginVersion: string;
     /** Buttons contributed by other plugins through the `bar.actions` capability point. */
-    actions?: AdminBarAction[];
+    actions?: BarAction[];
   },
 ): Promise<Response> {
   if (!response.body) return response;
diff --git a/src/mod.ts b/src/mod.ts
index b94f662..e4ec178 100644
--- a/src/mod.ts
+++ b/src/mod.ts
@@ -38,6 +38,7 @@
 import type { DunePlugin } from "@dune/core/plugins";
 import { createInlineEditManager } from "./manager.ts";
 import { injectAdminBar } from "./bar.ts";
+import "./bar-actions.ts";
 
 const plugin: DunePlugin = {
   name: "inline-edit",
@@ -63,7 +64,7 @@ const plugin: DunePlugin = {
     );
   },
 
-  transformResponse({ req, response, auth, page, adminPrefix, barActions }) {
+  transformResponse({ req, response, auth, page, capabilities }) {
     // Only inject for authenticated admins with edit rights on content pages.
     if (!auth || !auth.hasPermission("pages.update")) return response;
     if (!page) return response;
@@ -72,13 +73,20 @@ const plugin: DunePlugin = {
     const contentType = response.headers.get("Content-Type") ?? "";
     if (!contentType.includes("text/html")) return response;
 
+    // The bar's edit, save and source controls talk to the admin's endpoints
+    // for now, so it needs to know where the admin is mounted; without one
+    // there is nothing for them to call. Read per request: this module is
+    // shared between sites.
+    const adminPrefix = capabilities.get("admin.prefix")?.prefix;
+    if (!adminPrefix) return response;
+
     // Never inject into admin paths.
     const url = new URL(req.url);
     if (url.pathname.startsWith(adminPrefix)) return response;
 
     // Buttons any plugin contributed to the `bar.actions` point. This bar
     // renders them without knowing what they do.
-    const actions = barActions.flatMap((contribute) => contribute({ page, adminPrefix }));
+    const actions = capabilities.list("bar.actions").flatMap((contribute) => contribute({ page }));
 
     return injectAdminBar(response, {
       sourcePath: page.sourcePath,
@@ -94,6 +102,7 @@ const plugin: DunePlugin = {
 export default plugin;
 
 export { createInlineEditManager } from "./manager.ts";
+export type { BarAction, BarActionContext } from "./bar-actions.ts";
 export type {
   InlineEditClient,
   InlineEditManagerOptions,
diff --git a/tests/capabilities_test.ts b/tests/capabilities_test.ts
index 55af8aa..3015ee2 100644
--- a/tests/capabilities_test.ts
+++ b/tests/capabilities_test.ts
@@ -1,7 +1,7 @@
 /**
  * The plugin meets core through the capability registry: it provides the
- * `inline-edit` slot in `setup()` and renders the `bar.actions` contributions
- * that arrive as `ResponseTransformContext.barActions`.
+ * `editor.inline` slot in `setup()` and renders the `bar.actions` contributions
+ * it reads from `ResponseTransformContext.capabilities`.
  */
 
 import { assertEquals, assertExists, assertStringIncludes } from "@std/assert";
@@ -40,7 +40,16 @@ Deno.test("setup() provides the inline-edit slot, built from the capability cont
   }
 });
 
-Deno.test("transformResponse renders the buttons delivered as barActions", async () => {
+/** A reader holding the `admin.prefix` slot and the given `bar.actions` contributions. */
+function reader(barActions: unknown[], prefix: string | null = "/admin") {
+  return {
+    get: (name: string) => (name === "admin.prefix" && prefix ? { prefix } : undefined),
+    list: (point: string) => (point === "bar.actions" ? barActions : []),
+    providers: () => [],
+  };
+}
+
+Deno.test("transformResponse renders the buttons read from the bar.actions contributions", async () => {
   const response = new Response("<html><body><h1>Hi</h1></body></html>", {
     headers: { "Content-Type": "text/html; charset=utf-8" },
   });
@@ -50,13 +59,12 @@ Deno.test("transformResponse renders the buttons delivered as barActions", async
     response,
     auth: { username: "alice", role: "admin", hasPermission: () => true },
     page: { sourcePath: "content/about.md", route: "/about", title: "About", template: "post" },
-    adminPrefix: "/admin",
     config: {},
-    barActions: [
+    capabilities: reader([
       () => [{ id: "pdf:download", label: "PDF export", href: "/pdf/about" }],
       ({ page }: { page: { template: string } | null }) =>
         page?.template === "post" ? [{ id: "x:post-only", label: "Post only", href: "/x" }] : [],
-    ],
+    ]),
   }) as Response;
   const html = await out.text();
   assertStringIncludes(html, "PDF export");
@@ -71,9 +79,36 @@ Deno.test("transformResponse does nothing for visitors without edit rights", asy
     response,
     auth: null,
     page: { sourcePath: "content/about.md", route: "/about", title: "About", template: "post" },
-    adminPrefix: "/admin",
     config: {},
-    barActions: [() => [{ id: "a", label: "Never shown", href: "/a" }]],
+    capabilities: reader([() => [{ id: "a", label: "Never shown", href: "/a" }]]),
+  }) as Response;
+  assertEquals(out, response);
+});
+
+Deno.test("transformResponse injects nothing when no plugin provides admin.prefix", async () => {
+  const response = new Response("<html><body>x</body></html>", { headers: { "Content-Type": "text/html" } });
+  // deno-lint-ignore no-explicit-any
+  const out = await (plugin.transformResponse as any)({
+    req: new Request("http://localhost/about"),
+    response,
+    auth: { username: "alice", role: "admin", hasPermission: () => true },
+    page: { sourcePath: "content/about.md", route: "/about", title: "About", template: "post" },
+    config: {},
+    capabilities: reader([], null),
+  }) as Response;
+  assertEquals(out, response);
+});
+
+Deno.test("transformResponse skips the admin's own pages, using the prefix the admin provides", async () => {
+  const response = new Response("<html><body>x</body></html>", { headers: { "Content-Type": "text/html" } });
+  // deno-lint-ignore no-explicit-any
+  const out = await (plugin.transformResponse as any)({
+    req: new Request("http://localhost/panel/pages"),
+    response,
+    auth: { username: "alice", role: "admin", hasPermission: () => true },
+    page: { sourcePath: "content/about.md", route: "/about", title: "About", template: "post" },
+    config: {},
+    capabilities: reader([], "/panel"),
   }) as Response;
   assertEquals(out, response);
 });

From 5fa302ba4953fe2198862c22a7c4fe8c976b45d8 Mon Sep 17 00:00:00 2001
From: zumbrunn <chris@zumbrunn.com>
Date: Sat, 7 Nov 2026 21:16:57 +0100
Subject: [PATCH 2/6] feat!: serve source/commit/fields at
 /api/inline-edit/content/*, with no admin needed (duneorg/dune#127)

handleRequest implements the three routes that lived in the admin's
/admin/api/content/*, with the TSX and page-ownership rules they enforced.
Core decides who may edit; the bar is injected for any signed-in editor, with or
without an admin, and no longer renders the admin's "Edit source" overlay or
"Open in admin" link (the admin contributes those as bar actions). onPageUpdate
carries the editor's name as actor.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 src/bar.ts                 |  87 ++--------------------
 src/commit.ts              |   4 +-
 src/http.ts                | 125 ++++++++++++++++++++++++++++++++
 src/manager.ts             |  27 ++++++-
 src/mod.ts                 |  34 ++++-----
 src/types.ts               |   2 +
 tests/bar_test.ts          |  53 ++++----------
 tests/capabilities_test.ts |  15 ++--
 tests/commit_test.ts       |   8 +--
 tests/http_test.ts         | 143 +++++++++++++++++++++++++++++++++++++
 10 files changed, 346 insertions(+), 152 deletions(-)
 create mode 100644 src/http.ts
 create mode 100644 tests/http_test.ts

diff --git a/src/bar.ts b/src/bar.ts
index ba6b139..8747772 100644
--- a/src/bar.ts
+++ b/src/bar.ts
@@ -128,7 +128,6 @@ function renderBarActions(actions: BarAction[]): string {
 export function buildAdminBarHtml(opts: {
   sourcePath: string;
   pageTitle: string | null;
-  adminPrefix: string;
   userName: string;
   pluginVersion: string;
   /** Buttons contributed by other plugins through the `bar.actions` capability point — see mod.ts. */
@@ -138,9 +137,8 @@ export function buildAdminBarHtml(opts: {
    * page (a title `<h1>` or a `data-dune-body` element). When false, the
    * "Editing"/"Save" buttons are pure no-ops — clicking "Editing" enables
    * hover handles that will never find a target, and there's nothing a
-   * field-level Save could ever commit — so both are omitted. "Edit source"
-   * stays: it always works, regardless of whether inline annotation found
-   * anything. Defaults to true (render normally) for callers that haven't
+   * field-level Save could ever commit — so both are omitted. Buttons other
+   * plugins contribute stay. Defaults to true (render normally) for callers that haven't
    * computed it, e.g. call sites predating this option.
    */
   hasEditableContent?: boolean;
@@ -148,25 +146,16 @@ export function buildAdminBarHtml(opts: {
   const {
     sourcePath,
     pageTitle,
-    adminPrefix,
     userName,
     pluginVersion,
     actions = [],
     hasEditableContent = true,
   } = opts;
   const encodedPath = encodeURIComponent(sourcePath);
-  // Was `${adminPrefix}/pages/${encodedPath}` — no such route exists
-  // (plugin-admin registers /admin/pages/edit?path=..., not a
-  // /admin/pages/<path> segment route); that 404'd. Fixed alongside adding
-  // the "Edit source" overlay below, which opens the same URL in an iframe.
-  const adminPageUrl = `${adminPrefix}/pages/edit?path=${encodedPath}`;
-  // The overlay iframe gets `embedded=1` (plugin-admin's _layout.tsx drops
-  // the sidebar/topbar chrome for it — redundant floated over a content
-  // page, nowhere to navigate to). The escape link stays un-embedded since
-  // that's a real full-page navigation, where the full admin shell belongs.
-  const adminPageUrlEmbedded = `${adminPageUrl}&embedded=1`;
-  const commitUrl = `${adminPrefix}/api/content/${encodedPath}/commit`;
-  const fieldsUrl = `${adminPrefix}/api/content/${encodedPath}/fields`;
+  // The routes below are this plugin's own (core gates them and hands the
+  // request to `handleRequest`), so the bar works with or without an admin.
+  const commitUrl = `/api/inline-edit/content/${encodedPath}/commit`;
+  const fieldsUrl = `/api/inline-edit/content/${encodedPath}/fields`;
 
   return `
 <style>
@@ -214,7 +203,6 @@ export function buildAdminBarHtml(opts: {
   @media print {
     #dune-admin-bar,
     #dune-ao-edit-handle,
-    #dune-source-overlay,
     .dune-bubble-menu,
     .dune-ao-body-toolbar {
       display: none !important;
@@ -222,31 +210,6 @@ export function buildAdminBarHtml(opts: {
     body { padding-top: 0 !important; }
   }
 
-  /* Source-editing overlay — full MDX/markdown source editor (the same
-     /admin/pages/edit view used from the admin panel) in an on-page modal,
-     so editing MDX-heavy pages (which inline body-editing can't handle,
-     since there's no single data-dune-body element to annotate) doesn't
-     require leaving the page. */
-  #dune-ab-edit-source { background: rgba(255,255,255,.12); color: #fff; }
-  #dune-source-overlay {
-    display: none; position: fixed; inset: 0; z-index: 100000;
-    background: rgba(0,0,0,.5);
-  }
-  #dune-source-overlay.dune-open { display: flex; flex-direction: column; }
-  #dune-source-overlay-bar {
-    flex: none; display: flex; align-items: center; justify-content: flex-end;
-    padding: 8px 16px; background: #1a1a2e;
-  }
-  #dune-source-overlay-close {
-    background: rgba(255,255,255,.15); color: #fff; border: none;
-    border-radius: 4px; padding: 4px 12px; font-size: 12px; cursor: pointer;
-    font-family: inherit;
-  }
-  #dune-source-overlay-close:hover { background: rgba(255,255,255,.25); }
-  #dune-source-overlay-frame {
-    flex: 1; width: 100%; border: none; background: #fff;
-  }
-
   /* Marker hover indicators (active when edit mode is on).
      Activation happens via the floating ✎ handle, never by clicking the
      content itself, so links inside editable regions stay followable. */
@@ -339,17 +302,9 @@ export function buildAdminBarHtml(opts: {
   <button id="dune-ab-save">Save</button>`
       : ""
   }
-  <button id="dune-ab-edit-source">✎ Edit source</button>
   ${renderBarActions(actions)}
-  <a href="${adminPageUrl}" class="dune-ab-escape" title="Open full admin editor">Open in admin →</a>
   <span class="dune-ab-user">${escapeHtml(userName)}</span>
 </div>
-<div id="dune-source-overlay">
-  <div id="dune-source-overlay-bar">
-    <button id="dune-source-overlay-close" type="button">✕ Close</button>
-  </div>
-  <iframe id="dune-source-overlay-frame" title="Edit source"></iframe>
-</div>
 <script>
 (function() {
   'use strict';
@@ -364,35 +319,6 @@ export function buildAdminBarHtml(opts: {
   };
   window.__DUNE_USER_NAME__ = ${jsonStr(userName)};
   window.__DUNE_EDIT_WS_PATH__ = "/api/inline-edit/ws";
-  window.__DUNE_ADMIN_PAGE_URL__ = ${jsonStr(adminPageUrlEmbedded)};
-
-  // ── Source-editing overlay ───────────────────────────────────────────────────
-  (function() {
-    var overlay = document.getElementById('dune-source-overlay');
-    var frame = document.getElementById('dune-source-overlay-frame');
-    var openBtn = document.getElementById('dune-ab-edit-source');
-    var closeBtn = document.getElementById('dune-source-overlay-close');
-    var loaded = false;
-
-    function open() {
-      if (!loaded) {
-        frame.src = window.__DUNE_ADMIN_PAGE_URL__;
-        loaded = true;
-      }
-      overlay.classList.add('dune-open');
-    }
-    function close() {
-      overlay.classList.remove('dune-open');
-    }
-    openBtn.addEventListener('click', open);
-    closeBtn.addEventListener('click', close);
-    overlay.addEventListener('keydown', function(e) {
-      if (e.key === 'Escape') close();
-    });
-    document.addEventListener('keydown', function(e) {
-      if (e.key === 'Escape' && overlay.classList.contains('dune-open')) close();
-    });
-  })();
 
   var editMode = true;
   document.body.classList.add('dune-edit-mode');
@@ -756,7 +682,6 @@ export async function injectAdminBar(
   opts: {
     sourcePath: string;
     pageTitle: string | null;
-    adminPrefix: string;
     userName: string;
     pluginVersion: string;
     /** Buttons contributed by other plugins through the `bar.actions` capability point. */
diff --git a/src/commit.ts b/src/commit.ts
index 20a9453..a004c92 100644
--- a/src/commit.ts
+++ b/src/commit.ts
@@ -108,7 +108,7 @@ export async function commitDoc(opts: {
   // Write to disk.
   await storage.write(filePath, committed);
 
-  hooks?.fire("onPageUpdate", { sourcePath }).catch((err) =>
+  hooks?.fire("onPageUpdate", { sourcePath, actor: author }).catch((err) =>
     warnThrottled("hook", "onPageUpdate hook failed", err)
   );
 }
@@ -173,7 +173,7 @@ export async function patchFrontmatterFields(opts: {
 
   await storage.write(filePath, patched);
 
-  hooks?.fire("onPageUpdate", { sourcePath }).catch((err) =>
+  hooks?.fire("onPageUpdate", { sourcePath, actor: author }).catch((err) =>
     warnThrottled("hook", "onPageUpdate hook failed", err)
   );
 }
diff --git a/src/http.ts b/src/http.ts
new file mode 100644
index 0000000..241de6c
--- /dev/null
+++ b/src/http.ts
@@ -0,0 +1,125 @@
+/**
+ * The plugin's HTTP routes, below `/api/inline-edit/`.
+ *
+ * Core has already authenticated the editor, checked `pages.update` and the
+ * origin of writes (see `InlineEditManager.handleRequest`); what is left is
+ * what is specific to a page: which files this editor may write.
+ *
+ *   GET   content/:encodedSourcePath/source   the Markdown body, no frontmatter
+ *   POST  content/:encodedSourcePath/commit   flush the live session to history and disk
+ *   PATCH content/:encodedSourcePath/fields   `{ fields: { title: "…", __body: "…" } }`
+ *
+ * `:encodedSourcePath` is the URL-encoded page source path,
+ * e.g. `pages%2Fabout%2Fdefault.md`.
+ *
+ * @module
+ */
+
+import type { InlineEditRequestContext } from "@dune/core/inline-edit";
+import type { StorageAdapter } from "@dune/core";
+import { splitFile } from "./commit.ts";
+import { warnThrottled } from "./log.ts";
+
+/** Frontmatter key the admin stamps on create; the author of a page owns it. */
+const PAGE_OWNER_KEY = "createdBy";
+
+/** What the routes need from the manager that serves them. */
+export interface RequestHandlerOptions {
+  storage: StorageAdapter;
+  contentDir: string;
+  /** Roles that may write `.tsx` pages (`system.content.allow_tsx_format`); default admin only. */
+  allowTsxFormat?: readonly string[];
+  commit(sourcePath: string, author: string): Promise<void>;
+  patchFields(sourcePath: string, fields: Record<string, unknown>, author: string): Promise<void>;
+}
+
+const json = (body: unknown, status = 200) => Response.json(body, { status });
+
+/**
+ * A page path from a URL: relative, no traversal, nothing outside
+ * `[a-zA-Z0-9._@-]` per segment.
+ */
+export function validatePagePath(p: string): boolean {
+  if (p.length === 0 || p.length > 1024) return false;
+  if (p.includes("\0") || p.includes("\\") || p.startsWith("/")) return false;
+  const lower = p.toLowerCase();
+  if (lower.includes("%2e%2e") || lower.includes("%00")) return false;
+  if (/^[a-zA-Z]:\//.test(p)) return false;
+  return p.split("/").every((seg) => seg !== "" && seg !== "." && seg !== ".." && /^[a-zA-Z0-9._@-]+$/.test(seg));
+}
+
+/** Build `InlineEditManager.handleRequest`. */
+export function createRequestHandler(opts: RequestHandlerOptions) {
+  const { storage, contentDir, commit, patchFields } = opts;
+  const allowTsx = opts.allowTsxFormat ?? ["admin"];
+
+  return async function handleRequest(req: Request, ctx: InlineEditRequestContext): Promise<Response> {
+    const parts = ctx.path.split("/");
+    if (parts.length !== 3 || parts[0] !== "content") return json({ error: "Not found" }, 404);
+
+    let sourcePath: string;
+    try {
+      sourcePath = decodeURIComponent(parts[1]);
+    } catch {
+      return json({ error: "Invalid path" }, 400);
+    }
+    if (!validatePagePath(sourcePath)) return json({ error: "Invalid path" }, 400);
+    const action = parts[2];
+
+    if (action === "source") {
+      if (req.method !== "GET") return json({ error: "Use GET" }, 405);
+      return await readSource(sourcePath);
+    }
+    if (action !== "commit" && action !== "fields") return json({ error: "Not found" }, 404);
+    const expected = action === "commit" ? "POST" : "PATCH";
+    if (req.method !== expected) return json({ error: `Use ${expected}` }, 405);
+
+    // Writes: TSX executes server-side code, so only the roles named for it may
+    // rewrite one; and authors may only write their own pages.
+    const { editor } = ctx;
+    if (/\.tsx$/i.test(sourcePath) && !editor.roles.some((r) => allowTsx.includes(r))) {
+      return json({
+        error: "TSX format requires admin role. TSX pages execute server-side code and must be edited by trusted authors.",
+      }, 403);
+    }
+    if (!editor.roles.includes("admin") && !editor.roles.includes("editor")) {
+      const frontmatter = await ctx.pageFrontmatter(sourcePath);
+      if (!frontmatter) return json({ error: "Page not found" }, 404);
+      if (frontmatter[PAGE_OWNER_KEY] !== editor.id) return json({ error: "Forbidden" }, 403);
+    } else if (!await ctx.pageFrontmatter(sourcePath)) {
+      return json({ error: "Page not found" }, 404);
+    }
+
+    try {
+      if (action === "commit") {
+        await commit(sourcePath, editor.username);
+        return json({ ok: true });
+      }
+      let body: unknown;
+      try {
+        body = await req.json();
+      } catch {
+        return json({ error: "Invalid JSON body" }, 400);
+      }
+      const fields = (body as { fields?: unknown } | null)?.fields;
+      if (!fields || typeof fields !== "object" || Array.isArray(fields)) {
+        return json({ error: "Body must be { fields: { ... } }" }, 400);
+      }
+      await patchFields(sourcePath, fields as Record<string, unknown>, editor.username);
+      return json({ ok: true });
+    } catch (err) {
+      warnThrottled(`http:${action}`, `${action} failed`, err);
+      return json({ error: "Internal error" }, 500);
+    }
+  };
+
+  async function readSource(sourcePath: string): Promise<Response> {
+    try {
+      const raw = await storage.readText(`${contentDir}/${sourcePath}`);
+      return json({ body: splitFile(raw).body });
+    } catch (err) {
+      warnThrottled("http:source", "source read failed", err);
+      return json({ error: "Internal error" }, 500);
+    }
+  }
+}
diff --git a/src/manager.ts b/src/manager.ts
index b844252..017d2d8 100644
--- a/src/manager.ts
+++ b/src/manager.ts
@@ -14,6 +14,7 @@ import type { InlineEditManagerOptions, InlineEditSession, InlineEditClient } fr
 import { loadYDoc, persistYDoc, deleteYDoc } from "./ydoc-manager.ts";
 import { connectClient } from "./ws-server.ts";
 import { commitDoc, patchFrontmatterFields, splitFile } from "./commit.ts";
+import { createRequestHandler } from "./http.ts";
 
 // ── Security limits ────────────────────────────────────────────────────────────
 
@@ -22,6 +23,16 @@ const SESSION_IDLE_TTL_MS = 5 * 60 * 1000;
 
 let _gcHandle: ReturnType<typeof setInterval> | undefined;
 
+/**
+ * What the manager does with a committed edit. Not part of core's
+ * `InlineEditManager` (core never calls it: the routes in `http.ts` do), but
+ * kept on the object so tests and scripts can drive it directly.
+ */
+export interface InlineEditWriter {
+  commit(sourcePath: string, author: string): Promise<void>;
+  patchFields(sourcePath: string, fields: Record<string, unknown>, author: string): Promise<void>;
+}
+
 // ── Factory ────────────────────────────────────────────────────────────────────
 
 /**
@@ -36,7 +47,7 @@ let _gcHandle: ReturnType<typeof setInterval> | undefined;
  */
 export function createInlineEditManager(
   opts: InlineEditManagerOptions,
-): InlineEditManager {
+): InlineEditManager & InlineEditWriter {
   const { storage, history, dataDir, contentDir, hooks } = opts;
   const autoFlushMs = opts.autoFlushMs ?? 120_000;
 
@@ -132,7 +143,7 @@ export function createInlineEditManager(
 
   // ── Public API ───────────────────────────────────────────────────────────────
 
-  return {
+  const manager: InlineEditManager & InlineEditWriter = {
     handleUpgrade(req: Request, user: { id: string; name: string }): Response {
       if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") {
         return new Response("Expected WebSocket upgrade", { status: 426 });
@@ -233,6 +244,8 @@ export function createInlineEditManager(
       });
     },
 
+    handleRequest: (req, ctx) => requestHandler(req, ctx),
+
     getPresence() {
       const result: import("@dune/core/inline-edit").DocumentPresence[] = [];
       for (const [sourcePath, { session }] of sessions) {
@@ -249,4 +262,14 @@ export function createInlineEditManager(
       return result;
     },
   };
+
+  const requestHandler = createRequestHandler({
+    storage,
+    contentDir,
+    allowTsxFormat: opts.allowTsxFormat,
+    commit: manager.commit,
+    patchFields: manager.patchFields,
+  });
+
+  return manager;
 }
diff --git a/src/mod.ts b/src/mod.ts
index e4ec178..e831846 100644
--- a/src/mod.ts
+++ b/src/mod.ts
@@ -43,7 +43,7 @@ import "./bar-actions.ts";
 const plugin: DunePlugin = {
   name: "inline-edit",
   version: "2.2.3",
-  description: "Y.js-backed real-time inline content editing (TipTap WYSIWYG) with admin bar.",
+  description: "Y.js-backed real-time inline content editing (TipTap WYSIWYG) with an editing bar, for any signed-in editor.",
   hooks: {},
 
   // Browser editor bundle — built by core at startup (deno bundle, resolving
@@ -53,19 +53,28 @@ const plugin: DunePlugin = {
     editor: import.meta.resolve("./client/editor.ts"),
   },
 
-  // The `editor.inline` capability: core's `/api/inline-edit/ws` upgrades through
-  // this manager, and the admin's content endpoints use it for commits and
+  // The `editor.inline` capability: core gates `/api/inline-edit/*` (who may
+  // edit, same-origin writes) and hands the WebSocket upgrade and every other
+  // request to this manager; the admin uses it for its collab socket and
   // presence. Core builds it once the history engine and storage exist.
   setup(api) {
     api.capabilities.provide(
       "editor.inline",
-      ({ storage, history, dataDir, contentDir, hooks }) =>
-        createInlineEditManager({ storage, history, dataDir, contentDir, hooks }),
+      ({ storage, history, dataDir, contentDir, hooks, config }) =>
+        createInlineEditManager({
+          storage,
+          history,
+          dataDir,
+          contentDir,
+          hooks,
+          allowTsxFormat: config.system.content.allow_tsx_format,
+        }),
     );
   },
 
   transformResponse({ req, response, auth, page, capabilities }) {
-    // Only inject for authenticated admins with edit rights on content pages.
+    // Only inject for signed-in editors (a site user or the admin's user, core has
+    // checked pages.update) on content pages.
     if (!auth || !auth.hasPermission("pages.update")) return response;
     if (!page) return response;
 
@@ -73,16 +82,10 @@ const plugin: DunePlugin = {
     const contentType = response.headers.get("Content-Type") ?? "";
     if (!contentType.includes("text/html")) return response;
 
-    // The bar's edit, save and source controls talk to the admin's endpoints
-    // for now, so it needs to know where the admin is mounted; without one
-    // there is nothing for them to call. Read per request: this module is
-    // shared between sites.
+    // Never inject into the admin's own pages (core keeps transforms off them
+    // already). Read per request: this module is shared between sites.
     const adminPrefix = capabilities.get("admin.prefix")?.prefix;
-    if (!adminPrefix) return response;
-
-    // Never inject into admin paths.
-    const url = new URL(req.url);
-    if (url.pathname.startsWith(adminPrefix)) return response;
+    if (adminPrefix && new URL(req.url).pathname.startsWith(adminPrefix)) return response;
 
     // Buttons any plugin contributed to the `bar.actions` point. This bar
     // renders them without knowing what they do.
@@ -91,7 +94,6 @@ const plugin: DunePlugin = {
     return injectAdminBar(response, {
       sourcePath: page.sourcePath,
       pageTitle: page.title,
-      adminPrefix,
       userName: auth.username,
       pluginVersion: plugin.version,
       actions,
diff --git a/src/types.ts b/src/types.ts
index 00a7b2d..0a4319b 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -53,4 +53,6 @@ export interface InlineEditManagerOptions {
    * the hook. Core passes it through the capability context.
    */
   hooks?: HookRegistry;
+  /** Roles allowed to write `.tsx` pages through the HTTP routes (`system.content.allow_tsx_format`); default `["admin"]`. */
+  allowTsxFormat?: readonly string[];
 }
diff --git a/tests/bar_test.ts b/tests/bar_test.ts
index 0eff1cd..0694151 100644
--- a/tests/bar_test.ts
+++ b/tests/bar_test.ts
@@ -7,7 +7,6 @@ import { annotateEditableElements, buildAdminBarHtml } from "../src/bar.ts";
 const baseOpts = {
   sourcePath: "03.arbeitswelt/01.test.mdx",
   pageTitle: "Test",
-  adminPrefix: "/admin",
   userName: "admin",
   pluginVersion: "2.1.8",
 };
@@ -19,46 +18,21 @@ Deno.test("buildAdminBarHtml: no actions — bar renders with no action elements
   assertEquals(html.includes('class="dune-ab-action"'), false);
 });
 
-Deno.test("buildAdminBarHtml: escape link and source overlay point at /pages/edit?path=..., not the nonexistent /pages/<path>", () => {
-  // Regression test: adminPageUrl used to be `${adminPrefix}/pages/${encodedPath}`,
-  // a route that was never registered (plugin-admin only has
-  // /admin/pages/edit?path=... and /admin/pages/builder) — 404'd every time.
+Deno.test("buildAdminBarHtml: save, source and field calls go to this plugin's own /api/inline-edit routes, with no admin involved", () => {
   const html = buildAdminBarHtml(baseOpts);
-  const expectedUrl = "/admin/pages/edit?path=03.arbeitswelt%2F01.test.mdx";
-  // The escape link is a real full-page navigation — no embedded=1, full
-  // admin shell. The overlay iframe gets embedded=1 so plugin-admin's
-  // _layout.tsx drops the redundant sidebar/topbar chrome (see its own
-  // handling of that param).
-  assertStringIncludes(html, `<a href="${expectedUrl}" class="dune-ab-escape"`);
-  assertStringIncludes(
-    html,
-    `window.__DUNE_ADMIN_PAGE_URL__ = ${
-      JSON.stringify(expectedUrl + "&embedded=1")
-    }`,
-  );
-  assertEquals(html.includes(`/pages/03.arbeitswelt`), false);
-});
-
-Deno.test("buildAdminBarHtml: renders the source-editing overlay markup and open button", () => {
-  const html = buildAdminBarHtml(baseOpts);
-  assertStringIncludes(
-    html,
-    `<button id="dune-ab-edit-source">✎ Edit source</button>`,
-  );
-  assertStringIncludes(html, `<div id="dune-source-overlay">`);
-  assertStringIncludes(html, `<iframe id="dune-source-overlay-frame"`);
-  // Iframe src is set lazily by the client script on first open, not
-  // server-rendered — the overlay must not eagerly load the editor.
-  assertEquals(
-    html.includes(`<iframe id="dune-source-overlay-frame" src=`),
-    false,
-  );
+  const enc = "03.arbeitswelt%2F01.test.mdx";
+  assertStringIncludes(html, `window.__DUNE_COMMIT_URL__ = "/api/inline-edit/content/${enc}/commit"`);
+  assertStringIncludes(html, `window.__DUNE_FIELDS_URL__ = "/api/inline-edit/content/${enc}/fields"`);
+  assertStringIncludes(html, `window.__DUNE_SOURCE_URL__ = "/api/inline-edit/content/${enc}/source"`);
+  // Nothing of the admin's is baked in: its links and overlay are bar.actions it contributes.
+  assertEquals(html.includes("/admin"), false);
+  assertEquals(html.includes("dune-source-overlay"), false);
+  assertEquals(html.includes("Open in admin"), false);
 });
 
 Deno.test("buildAdminBarHtml: @media print hides the admin bar and its overlays", () => {
   // An admin printing straight from the browser (Ctrl+P / print-to-PDF)
-  // while viewing a page would otherwise get the fixed toolbar (and the
-  // source-editing overlay, if open) baked into the printout. The scripted
+  // while viewing a page would otherwise get the fixed toolbar baked into the printout. The scripted
   // PDF export (scripts/export-pdf.ts) browses anonymously and never sees
   // any of this to begin with — this covers the manual-print path only.
   const html = buildAdminBarHtml(baseOpts);
@@ -66,7 +40,6 @@ Deno.test("buildAdminBarHtml: @media print hides the admin bar and its overlays"
   if (!printBlock) throw new Error("no @media print block found");
   assertStringIncludes(printBlock, "#dune-admin-bar");
   assertStringIncludes(printBlock, "#dune-ao-edit-handle");
-  assertStringIncludes(printBlock, "#dune-source-overlay");
   assertStringIncludes(printBlock, ".dune-bubble-menu");
   assertStringIncludes(printBlock, ".dune-ao-body-toolbar");
   assertStringIncludes(printBlock, "display: none !important");
@@ -130,21 +103,19 @@ Deno.test("buildAdminBarHtml: label/icon/href are HTML-escaped", () => {
 
 // ---------------------------------------------------------------------------
 // The "Editing"/"Save" buttons are omitted entirely on pages with nothing
-// to edit — "Edit source" always stays, since it works regardless.
+// to edit; buttons other plugins contribute stay.
 // ---------------------------------------------------------------------------
 
 Deno.test("buildAdminBarHtml: hasEditableContent defaults to true — Editing/Save render", () => {
   const html = buildAdminBarHtml(baseOpts);
   assertStringIncludes(html, `<button id="dune-ab-edit-toggle">`);
   assertStringIncludes(html, `<button id="dune-ab-save">`);
-  assertStringIncludes(html, `<button id="dune-ab-edit-source">`);
 });
 
-Deno.test("buildAdminBarHtml: hasEditableContent:false omits Editing/Save but keeps Edit source", () => {
+Deno.test("buildAdminBarHtml: hasEditableContent:false omits Editing/Save", () => {
   const html = buildAdminBarHtml({ ...baseOpts, hasEditableContent: false });
   assertEquals(html.includes(`id="dune-ab-edit-toggle"`), false);
   assertEquals(html.includes(`id="dune-ab-save"`), false);
-  assertStringIncludes(html, `<button id="dune-ab-edit-source">`);
 });
 
 // ---------------------------------------------------------------------------
diff --git a/tests/capabilities_test.ts b/tests/capabilities_test.ts
index 3015ee2..6428007 100644
--- a/tests/capabilities_test.ts
+++ b/tests/capabilities_test.ts
@@ -30,10 +30,11 @@ Deno.test("setup() provides the inline-edit slot, built from the capability cont
       dataDir: ".dune/admin",
       contentDir: "content",
       hooks: undefined,
-    }) as { handleUpgrade?: unknown; commit?: unknown; getPresence?: unknown };
+      config: { system: { content: {} } },
+    }) as { handleUpgrade?: unknown; handleRequest?: unknown; getPresence?: unknown };
     assertExists(manager);
     assertEquals(typeof manager.handleUpgrade, "function");
-    assertEquals(typeof manager.commit, "function");
+    assertEquals(typeof manager.handleRequest, "function");
     assertEquals(typeof manager.getPresence, "function");
   } finally {
     await Deno.remove(root, { recursive: true }).catch(() => {});
@@ -85,18 +86,20 @@ Deno.test("transformResponse does nothing for visitors without edit rights", asy
   assertEquals(out, response);
 });
 
-Deno.test("transformResponse injects nothing when no plugin provides admin.prefix", async () => {
-  const response = new Response("<html><body>x</body></html>", { headers: { "Content-Type": "text/html" } });
+Deno.test("transformResponse injects the bar on a site with no admin at all", async () => {
+  const response = new Response("<html><body><h1>Hi</h1></body></html>", { headers: { "Content-Type": "text/html" } });
   // deno-lint-ignore no-explicit-any
   const out = await (plugin.transformResponse as any)({
     req: new Request("http://localhost/about"),
     response,
-    auth: { username: "alice", role: "admin", hasPermission: () => true },
+    auth: { username: "alice", role: "editor", hasPermission: () => true },
     page: { sourcePath: "content/about.md", route: "/about", title: "About", template: "post" },
     config: {},
     capabilities: reader([], null),
   }) as Response;
-  assertEquals(out, response);
+  const html = await out.text();
+  assertStringIncludes(html, 'id="dune-admin-bar"');
+  assertStringIncludes(html, "/api/inline-edit/content/content%2Fabout.md/commit");
 });
 
 Deno.test("transformResponse skips the admin's own pages, using the prefix the admin provides", async () => {
diff --git a/tests/commit_test.ts b/tests/commit_test.ts
index 1f5b08c..abdfe03 100644
--- a/tests/commit_test.ts
+++ b/tests/commit_test.ts
@@ -153,7 +153,7 @@ Deno.test("commitDoc: works for a brand-new draft with no existing file", async
   Deno.removeSync(rootDir, { recursive: true });
 });
 
-Deno.test("commitDoc: fires onPageUpdate with the sourcePath when hooks is provided", async () => {
+Deno.test("commitDoc: fires onPageUpdate with the sourcePath and the author as actor when hooks is provided", async () => {
   const { rootDir, storage, history, contentDir } = makeEnv();
   const sourcePath = "01.page/default.md";
   await storage.write(`${contentDir}/${sourcePath}`, "---\ntitle: Page\n---\nOriginal.\n");
@@ -163,7 +163,7 @@ Deno.test("commitDoc: fires onPageUpdate with the sourcePath when hooks is provi
   doc.transact(() => doc.getText("body").insert(0, "Edited."));
   await commitDoc({ doc, sourcePath, author: "alice", storage, history, contentDir, hooks });
 
-  assertEquals(fired, [{ event: "onPageUpdate", data: { sourcePath } }]);
+  assertEquals(fired, [{ event: "onPageUpdate", data: { sourcePath, actor: "alice" } }]);
   Deno.removeSync(rootDir, { recursive: true });
 });
 
@@ -252,7 +252,7 @@ Deno.test("patchFrontmatterFields: __body replaces the body via the auto-overlay
   Deno.removeSync(rootDir, { recursive: true });
 });
 
-Deno.test("patchFrontmatterFields: fires onPageUpdate with the sourcePath when hooks is provided", async () => {
+Deno.test("patchFrontmatterFields: fires onPageUpdate with the sourcePath and the author as actor when hooks is provided", async () => {
   const { rootDir, storage, history, contentDir } = makeEnv();
   const sourcePath = "01.page/default.md";
   await storage.write(`${contentDir}/${sourcePath}`, "---\ntitle: Old\n---\nBody.\n");
@@ -268,6 +268,6 @@ Deno.test("patchFrontmatterFields: fires onPageUpdate with the sourcePath when h
     hooks,
   });
 
-  assertEquals(fired, [{ event: "onPageUpdate", data: { sourcePath } }]);
+  assertEquals(fired, [{ event: "onPageUpdate", data: { sourcePath, actor: "carol" } }]);
   Deno.removeSync(rootDir, { recursive: true });
 });
diff --git a/tests/http_test.ts b/tests/http_test.ts
new file mode 100644
index 0000000..36c0bb8
--- /dev/null
+++ b/tests/http_test.ts
@@ -0,0 +1,143 @@
+/**
+ * The routes below /api/inline-edit/: source, commit, fields. Core has already
+ * decided who may edit; these tests cover what the plugin decides on top.
+ */
+
+import { assertEquals } from "@std/assert";
+import { createRequestHandler } from "../src/http.ts";
+
+const PAGE = "pages%2Fabout%2Fdefault.md";
+const FILE = "pages/about/default.md";
+
+function setup(opts: { allowTsxFormat?: string[]; frontmatter?: Record<string, unknown> | null } = {}) {
+  const calls: unknown[][] = [];
+  const handle = createRequestHandler({
+    storage: {
+      readText: (p: string) => {
+        if (p !== `content/${FILE}`) return Promise.reject(new Error("missing"));
+        return Promise.resolve("---\ntitle: About\n---\n\nHello\n");
+      },
+    } as never,
+    contentDir: "content",
+    allowTsxFormat: opts.allowTsxFormat,
+    commit: (...a) => (calls.push(["commit", ...a]), Promise.resolve()),
+    patchFields: (...a) => (calls.push(["fields", ...a]), Promise.resolve()),
+  });
+  const frontmatter = opts.frontmatter === undefined ? { title: "About" } : opts.frontmatter;
+  const run = (
+    method: string,
+    path: string,
+    editor: { id?: string; roles: string[] } = { roles: ["editor"] },
+    body?: unknown,
+  ) =>
+    handle(
+      new Request(`http://localhost/api/inline-edit/${path}`, {
+        method,
+        body: body === undefined ? undefined : JSON.stringify(body),
+      }),
+      {
+        editor: { id: editor.id ?? "u1", username: "alice", roles: editor.roles, source: "site" },
+        path,
+        pageFrontmatter: () => Promise.resolve(frontmatter),
+      },
+    );
+  return { run, calls };
+}
+
+Deno.test("source: returns the Markdown body without frontmatter", async () => {
+  const { run } = setup();
+  const res = await run("GET", `content/${PAGE}/source`);
+  assertEquals(res.status, 200);
+  assertEquals(await res.json(), { body: "\nHello\n" });
+});
+
+Deno.test("commit: POST commits as the editor's name", async () => {
+  const { run, calls } = setup();
+  const res = await run("POST", `content/${PAGE}/commit`);
+  assertEquals(res.status, 200);
+  assertEquals(calls, [["commit", FILE, "alice"]]);
+});
+
+Deno.test("fields: PATCH writes the given fields", async () => {
+  const { run, calls } = setup();
+  const res = await run("PATCH", `content/${PAGE}/fields`, undefined, { fields: { title: "New" } });
+  assertEquals(res.status, 200);
+  assertEquals(calls, [["fields", FILE, { title: "New" }, "alice"]]);
+});
+
+Deno.test("fields: a body that is not { fields: {} } is a 400, bad JSON too", async () => {
+  const { run, calls } = setup();
+  assertEquals((await run("PATCH", `content/${PAGE}/fields`, undefined, { fields: "x" })).status, 400);
+  assertEquals((await run("PATCH", `content/${PAGE}/fields`, undefined, { nope: 1 })).status, 400);
+  assertEquals((await run("PATCH", `content/${PAGE}/fields`, undefined, { fields: [] })).status, 400);
+  assertEquals(calls, []);
+});
+
+Deno.test("wrong method, unknown action and unknown root are 405 / 404", async () => {
+  const { run } = setup();
+  assertEquals((await run("POST", `content/${PAGE}/source`)).status, 405);
+  assertEquals((await run("GET", `content/${PAGE}/commit`)).status, 405);
+  assertEquals((await run("POST", `content/${PAGE}/fields`)).status, 405);
+  assertEquals((await run("POST", `content/${PAGE}/other`)).status, 404);
+  assertEquals((await run("GET", `other/${PAGE}/source`)).status, 404);
+  assertEquals((await run("GET", `content/${PAGE}`)).status, 404);
+});
+
+Deno.test("a path that escapes the content directory is refused", async () => {
+  const { run, calls } = setup();
+  for (const bad of ["..%2Fsecret.md", "%2Fetc%2Fpasswd", "pages%2F..%2Fx.md", "a%5Cb.md", "pages%2F%2Fx.md", "%E0%A4%A"]) {
+    assertEquals((await run("POST", `content/${bad}/commit`)).status, 400, bad);
+  }
+  assertEquals(calls, []);
+});
+
+Deno.test("an author writes only a page they created; admin and editor write any", async () => {
+  const mine = setup({ frontmatter: { createdBy: "u1" } });
+  assertEquals((await mine.run("POST", `content/${PAGE}/commit`, { roles: ["author"] })).status, 200);
+  const theirs = setup({ frontmatter: { createdBy: "someone-else" } });
+  assertEquals((await theirs.run("POST", `content/${PAGE}/commit`, { roles: ["author"] })).status, 403);
+  assertEquals((await theirs.run("PATCH", `content/${PAGE}/fields`, { roles: ["author"] }, { fields: {} })).status, 403);
+  assertEquals(theirs.calls, []);
+  for (const role of ["editor", "admin"]) {
+    assertEquals((await theirs.run("POST", `content/${PAGE}/commit`, { roles: [role] })).status, 200, role);
+  }
+});
+
+Deno.test("a role list that mixes tags with an editing role counts as that role", async () => {
+  const { run } = setup({ frontmatter: { createdBy: "someone-else" } });
+  assertEquals((await run("POST", `content/${PAGE}/commit`, { roles: ["member", "editor"] })).status, 200);
+});
+
+Deno.test("a path that is not a page is 404 for writes", async () => {
+  const { run, calls } = setup({ frontmatter: null });
+  assertEquals((await run("POST", `content/${PAGE}/commit`)).status, 404);
+  assertEquals((await run("POST", `content/${PAGE}/commit`, { roles: ["author"] })).status, 404);
+  assertEquals(calls, []);
+});
+
+Deno.test("TSX pages: only the roles named for them may write; the default is admin only", async () => {
+  const tsx = "pages%2Fapp%2Fdefault.tsx";
+  const dflt = setup();
+  assertEquals((await dflt.run("POST", `content/${tsx}/commit`, { roles: ["editor"] })).status, 403);
+  assertEquals((await dflt.run("POST", `content/${tsx}/commit`, { roles: ["admin"] })).status, 200);
+  const widened = setup({ allowTsxFormat: ["admin", "editor"] });
+  assertEquals((await widened.run("POST", `content/${tsx}/commit`, { roles: ["editor"] })).status, 200);
+  const none = setup({ allowTsxFormat: [] });
+  assertEquals((await none.run("POST", `content/${tsx}/commit`, { roles: ["admin"] })).status, 403);
+});
+
+Deno.test("a failing commit is a 500 that does not leak the error", async () => {
+  const handle = createRequestHandler({
+    storage: {} as never,
+    contentDir: "content",
+    commit: () => Promise.reject(new Error("disk /secret/path full")),
+    patchFields: () => Promise.resolve(),
+  });
+  const res = await handle(new Request("http://localhost/x", { method: "POST" }), {
+    editor: { id: "u1", username: "alice", roles: ["admin"], source: "site" },
+    path: `content/${PAGE}/commit`,
+    pageFrontmatter: () => Promise.resolve({}),
+  });
+  assertEquals(res.status, 500);
+  assertEquals(await res.json(), { error: "Internal error" });
+});

From 8bfdba0def943754f76a827f19f8d81cf3e07459 Mon Sep 17 00:00:00 2001
From: zumbrunn <chris@zumbrunn.com>
Date: Sat, 7 Nov 2026 21:20:11 +0100
Subject: [PATCH 3/6] test: a site user edits end to end through
 /api/inline-edit with no admin

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/core_integration_test.ts | 97 ++++++++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)

diff --git a/tests/core_integration_test.ts b/tests/core_integration_test.ts
index d267fc0..082bb5c 100644
--- a/tests/core_integration_test.ts
+++ b/tests/core_integration_test.ts
@@ -54,3 +54,100 @@ Deno.test(
     });
   },
 );
+
+// ── End to end: a site user edits with no admin plugin ─────────────────────────
+
+import { createLocalUserStore } from "@dune/core/auth/user-store";
+import { createSessionManager, createSessionStore } from "@dune/core/session";
+import { createStorage } from "@dune/core/storage";
+
+const opts = { sanitizeOps: false, sanitizeResources: false };
+
+/** A site with a login, an editor and a plain member, and this plugin; no admin. */
+async function withLogin(
+  fn: (api: {
+    handler: (req: Request) => Promise<Response>;
+    cookies: { editor: string; member: string };
+    read: () => Promise<string>;
+  }) => Promise<void>,
+) {
+  const root = await Deno.makeTempDir({ prefix: "dune_inline_edit_login_" });
+  try {
+    await Deno.mkdir(join(root, "content", "01.home"), { recursive: true });
+    await Deno.writeTextFile(join(root, "content", "01.home", "default.md"), "---\ntitle: Home\n---\n\nHello\n");
+    await Deno.mkdir(join(root, "config"), { recursive: true });
+    await Deno.writeTextFile(join(root, "config", "site.yaml"), "title: T\nurl: http://localhost\nauth:\n  mode: dune\n");
+    const users = createLocalUserStore({ storage: createStorage({ rootDir: root }), usersDir: "data/users" });
+    const ids = {
+      editor: (await users.create({ email: "e@example.com", provider: "local", roles: ["editor"] })).id,
+      member: (await users.create({ email: "m@example.com", provider: "local", roles: ["member"] })).id,
+    };
+    // deno-lint-ignore no-explicit-any
+    const ctx = await bootstrap(root, { plugins: [plugin] as any });
+    const { app } = await createDuneApp(ctx, { root, port: 0, dev: false });
+    const sessions = createSessionManager(
+      await createSessionStore({
+        type: "local",
+        storage: ctx.storage,
+        sessionsDir: ".dune/admin/site-sessions",
+        lifetimeMs: 60_000,
+      }),
+      60_000,
+    );
+    const cookie = async (id: string) => `dune_auth=${(await sessions.create(id)).id}`;
+    await fn({
+      handler: app.handler(),
+      cookies: { editor: await cookie(ids.editor), member: await cookie(ids.member) },
+      read: () => Deno.readTextFile(join(root, "content", "01.home", "default.md")),
+    });
+  } finally {
+    await Deno.remove(root, { recursive: true }).catch(() => {});
+  }
+}
+
+const PAGE = "01.home%2Fdefault.md";
+
+Deno.test("a site user who may edit gets the bar and can read, patch and commit through /api/inline-edit", opts, async () => {
+  await withLogin(async ({ handler, cookies, read }) => {
+    // The bar is on the page, with no admin anywhere.
+    const page = await handler(new Request("http://localhost/", { headers: { cookie: cookies.editor } }));
+    const html = await page.text();
+    assertEquals(html.includes('id="dune-admin-bar"'), true);
+    assertEquals(html.includes(`/api/inline-edit/content/${PAGE}/commit`), true);
+
+    // Plain visitors and members get no bar and no data-dune markers.
+    for (const headers of [{} as Record<string, string>, { cookie: cookies.member }]) {
+      const other = await (await handler(new Request("http://localhost/", { headers }))).text();
+      assertEquals(other.includes("dune-admin-bar"), false);
+    }
+
+    const source = await handler(
+      new Request(`http://localhost/api/inline-edit/content/${PAGE}/source`, { headers: { cookie: cookies.editor } }),
+    );
+    assertEquals(source.status, 200);
+    assertEquals((await source.json()).body.trim(), "Hello");
+
+    const patch = await handler(
+      new Request(`http://localhost/api/inline-edit/content/${PAGE}/fields`, {
+        method: "PATCH",
+        headers: { cookie: cookies.editor, origin: "http://localhost" },
+        body: JSON.stringify({ fields: { title: "Renamed" } }),
+      }),
+    );
+    assertEquals(patch.status, 200);
+    assertEquals((await read()).includes("title: Renamed"), true);
+  });
+});
+
+Deno.test("a member, an anonymous visitor and a cross-origin write are all refused", opts, async () => {
+  await withLogin(async ({ handler, cookies, read }) => {
+    const url = `http://localhost/api/inline-edit/content/${PAGE}/fields`;
+    const body = JSON.stringify({ fields: { title: "Hacked" } });
+    const patch = (headers: Record<string, string>) =>
+      handler(new Request(url, { method: "PATCH", headers: { origin: "http://localhost", ...headers }, body }));
+    assertEquals((await patch({})).status, 401);
+    assertEquals((await patch({ cookie: cookies.member })).status, 403);
+    assertEquals((await patch({ cookie: cookies.editor, origin: "http://evil.test" })).status, 403);
+    assertEquals((await read()).includes("Hacked"), false);
+  });
+});

From 5af4ee801dac374769442b9e572ca95a458cc2ad Mon Sep 17 00:00:00 2001
From: zumbrunn <chris@zumbrunn.com>
Date: Sat, 7 Nov 2026 21:20:52 +0100
Subject: [PATCH 4/6] docs: changelog for the inline-edit HTTP gate and
 page-event actor (#127)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 15dc740..c1632ca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,15 @@
 
 ### Changed — BREAKING
 
+- **Serves its own HTTP routes, so the bar works without an admin (#127).** `source`, `commit` and
+  `fields` are at `/api/inline-edit/content/<encoded path>/...` (core gates them: signed-in editor
+  holding `pages.update`, same-origin writes), with the TSX and page-ownership rules the admin's
+  routes enforced. The bar is injected for any such editor, including a site user on a site with no
+  admin, and no longer requires an `admin.prefix` provider. The bar no longer renders "Edit source"
+  or "Open in admin": the admin contributes those through `bar.actions`. `commit()` and
+  `patchFields()` stay on the manager object but are not part of core's `InlineEditManager`.
+  `onPageUpdate` carries the editor's name as `actor`.
+
 - **The bar declares its own extension point, and reads what it needs per request (#127).**
   `bar.actions` is declared here, by declaration merging, with its types `BarAction` and
   `BarActionContext` (renamed from core's `AdminBarAction` / `AdminBarActionContext`, which

From 69788ca275c7ea3763bddfe8198dabf20f9c95c2 Mon Sep 17 00:00:00 2001
From: zumbrunn <chris@zumbrunn.com>
Date: Sat, 7 Nov 2026 21:20:57 +0100
Subject: [PATCH 5/6] docs: drop the stale admin.prefix remark from the
 changelog

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1632ca..7211c28 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,8 +19,7 @@
   left core's contract; the context no longer carries `adminPrefix`). A plugin that adds a
   button imports the types from `@dune/plugin-inline-edit`. `transformResponse` reads the
   contributions and the `admin.prefix` slot from `ResponseTransformContext.capabilities`
-  instead of `barActions` / `adminPrefix`. With no `admin.prefix` provider no bar is injected,
-  as before (the bar's endpoints are still the admin's).
+  instead of `barActions` / `adminPrefix`.
 - **Provides the `editor.inline` capability and reads `bar.actions`, instead of
   `adminServices` and `ctx.plugins` (duneorg/dune#97, `@dune/core` 0.36).** The manager
   is declared in `setup()` with `api.capabilities.provide("editor.inline", ...)`; the admin

From 19c4cd86ea82c60bda1d85580da6b191f18595eb Mon Sep 17 00:00:00 2001
From: zumbrunn <chris@zumbrunn.com>
Date: Sun, 8 Nov 2026 11:18:59 +0100
Subject: [PATCH 6/6] feat!: export extension points as typed capability keys,
 not module augmentation (duneorg/dune#127)

JSR rejects 'declare module' in a published package.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md               |  5 +++--
 src/bar-actions.ts         | 21 +++++++++++----------
 src/mod.ts                 |  5 +++--
 tests/capabilities_test.ts |  2 +-
 4 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7211c28..200adf9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,10 +14,11 @@
   `onPageUpdate` carries the editor's name as `actor`.
 
 - **The bar declares its own extension point, and reads what it needs per request (#127).**
-  `bar.actions` is declared here, by declaration merging, with its types `BarAction` and
+  `bar.actions` is declared here, as the typed key `BAR_ACTIONS`, with its types `BarAction` and
   `BarActionContext` (renamed from core's `AdminBarAction` / `AdminBarActionContext`, which
   left core's contract; the context no longer carries `adminPrefix`). A plugin that adds a
-  button imports the types from `@dune/plugin-inline-edit`. `transformResponse` reads the
+  button imports the types and `BAR_ACTIONS` from `@dune/plugin-inline-edit` (or recreates the key from
+  the name `bar.actions`). `transformResponse` reads the
   contributions and the `admin.prefix` slot from `ResponseTransformContext.capabilities`
   instead of `barActions` / `adminPrefix`.
 - **Provides the `editor.inline` capability and reads `bar.actions`, instead of
diff --git a/src/bar-actions.ts b/src/bar-actions.ts
index f65ebd1..8642d46 100644
--- a/src/bar-actions.ts
+++ b/src/bar-actions.ts
@@ -3,18 +3,20 @@
  *
  * This plugin renders the editing bar and is the only reader of `bar.actions`,
  * so it declares the key (and its types) itself instead of core's contract
- * carrying it. A plugin that adds a button imports the types from
- * `@dune/plugin-inline-edit`; importing them also makes the key known to
- * TypeScript:
+ * carrying it. A plugin that adds a button imports the key and the types from
+ * `@dune/plugin-inline-edit` (or recreates the key from the name `bar.actions`):
  *
  * ```ts
- * api.capabilities.contribute("bar.actions", ({ page }) =>
+ * import { BAR_ACTIONS } from "@dune/plugin-inline-edit";
+ * api.capabilities.contribute(BAR_ACTIONS, ({ page }) =>
  *   page ? [{ id: "pdf:download", label: "PDF", href: `/pdf${page.route}` }] : []);
  * ```
  *
  * @module
  */
 
+import { type CapabilityKey, capabilityKey } from "@dune/core/plugin-api";
+
 /**
  * Context passed to a `bar.actions` contribution: what belongs on the bar for
  * this response. A plugin that links to its own pages builds the URLs itself
@@ -59,9 +61,8 @@ export interface BarAction {
   onClick?: string;
 }
 
-declare module "@dune/core/plugin-api" {
-  interface Contributions {
-    /** Buttons for the editing bar. Consumer: `@dune/plugin-inline-edit`. */
-    "bar.actions": (ctx: BarActionContext) => BarAction[];
-  }
-}
+/**
+ * The bar's contribution point: each contributing plugin adds one function that
+ * returns its buttons for a response. Consumer: this plugin.
+ */
+export const BAR_ACTIONS: CapabilityKey<(ctx: BarActionContext) => BarAction[]> = capabilityKey("bar.actions");
diff --git a/src/mod.ts b/src/mod.ts
index e831846..958e39a 100644
--- a/src/mod.ts
+++ b/src/mod.ts
@@ -38,7 +38,7 @@
 import type { DunePlugin } from "@dune/core/plugins";
 import { createInlineEditManager } from "./manager.ts";
 import { injectAdminBar } from "./bar.ts";
-import "./bar-actions.ts";
+import { BAR_ACTIONS } from "./bar-actions.ts";
 
 const plugin: DunePlugin = {
   name: "inline-edit",
@@ -89,7 +89,7 @@ const plugin: DunePlugin = {
 
     // Buttons any plugin contributed to the `bar.actions` point. This bar
     // renders them without knowing what they do.
-    const actions = capabilities.list("bar.actions").flatMap((contribute) => contribute({ page }));
+    const actions = capabilities.list(BAR_ACTIONS).flatMap((contribute) => contribute({ page }));
 
     return injectAdminBar(response, {
       sourcePath: page.sourcePath,
@@ -104,6 +104,7 @@ const plugin: DunePlugin = {
 export default plugin;
 
 export { createInlineEditManager } from "./manager.ts";
+export { BAR_ACTIONS } from "./bar-actions.ts";
 export type { BarAction, BarActionContext } from "./bar-actions.ts";
 export type {
   InlineEditClient,
diff --git a/tests/capabilities_test.ts b/tests/capabilities_test.ts
index 6428007..3bd21b7 100644
--- a/tests/capabilities_test.ts
+++ b/tests/capabilities_test.ts
@@ -45,7 +45,7 @@ Deno.test("setup() provides the inline-edit slot, built from the capability cont
 function reader(barActions: unknown[], prefix: string | null = "/admin") {
   return {
     get: (name: string) => (name === "admin.prefix" && prefix ? { prefix } : undefined),
-    list: (point: string) => (point === "bar.actions" ? barActions : []),
+    list: (key: { name: string }) => (key.name === "bar.actions" ? barActions : []),
     providers: () => [],
   };
 }