emdash 0.35.0 → 0.37.0

package/src/registry/authoritative-records.ts

@@ -0,0 +1,180 @@
+import type {
+	DirectPdsDidDocumentResolver,
+	DirectPdsProfileRecord,
+	DirectPdsReadErrorCode,
+	DirectPdsReleaseRecord,
+} from "@emdash-cms/registry-client/direct-pds";
+import { DirectPdsClient, DirectPdsReadError } from "@emdash-cms/registry-client/direct-pds";
+import {
+	fetchVerifiedResource,
+	inspectPackageReleaseRecords,
+	verifyMultihash,
+	verifyPackageReleaseRecords,
+	type FetchImplementation,
+	type HostnameResolver,
+	type ProvenanceVerifier,
+	type RecordInspectionReport,
+	type RecordVerificationFailure,
+	type RecordVerificationReport,
+	type VerificationErrorCode,
+} from "@emdash-cms/registry-verification";
+
+import { cloudflareDohResolver, ssrfSafeFetch } from "../security/ssrf.js";
+
+const MAX_PROVENANCE_BYTES = 5 * 1024 * 1024;
+
+export type AuthoritativeRecordErrorCode =
+	| DirectPdsReadErrorCode
+	| VerificationErrorCode
+	| "AUTHORITATIVE_RECORD_READ_FAILED";
+
+export interface AuthoritativeRecordReadOptions {
+	fetch?: typeof fetch;
+	didDocumentResolver?: DirectPdsDidDocumentResolver;
+	provenanceFetch?: FetchImplementation;
+	resolveHostname?: HostnameResolver;
+	provenanceVerifier?: ProvenanceVerifier;
+	artifactDigests?: readonly Uint8Array[];
+}
+
+export interface VerifiedAuthoritativeRecords {
+	publisherDid: string;
+	packageSlug: string;
+	version: string;
+	profile: DirectPdsProfileRecord;
+	release: DirectPdsReleaseRecord;
+	inspection: Extract<RecordInspectionReport, { success: true }>;
+}
+
+export type VerifiedAuthoritativeReleaseReport = Extract<
+	RecordVerificationReport,
+	{ success: true }
+>;
+
+export type AuthoritativeRecordReadResult =
+	| { success: true; value: VerifiedAuthoritativeRecords }
+	| {
+			success: false;
+			error: { code: AuthoritativeRecordErrorCode; message: string };
+	  };
+
+export type AuthoritativeRecordReader = (
+	publisherDid: string,
+	packageSlug: string,
+	version: string,
+	options?: AuthoritativeRecordReadOptions,
+) => Promise<AuthoritativeRecordReadResult>;
+
+export async function readAuthoritativePackageRelease(
+	publisherDid: string,
+	packageSlug: string,
+	version: string,
+	options: AuthoritativeRecordReadOptions = {},
+): Promise<AuthoritativeRecordReadResult> {
+	try {
+		const client = new DirectPdsClient({
+			did: publisherDid,
+			fetch: options.fetch ?? guardedFetch,
+			didDocumentResolver: options.didDocumentResolver,
+		});
+		const [profile, release] = await Promise.all([
+			client.getPackageProfile(packageSlug),
+			client.getPackageRelease(packageSlug, version),
+		]);
+		const inspection = await inspectPackageReleaseRecords({
+			publisherDid,
+			package: packageSlug,
+			version,
+			rkey: release.rkey,
+			profile: profile.value,
+			release: release.value,
+		});
+		if (!inspection.success) {
+			return {
+				success: false,
+				error: {
+					code: inspection.code,
+					message: inspection.reasons[0]?.message ?? "The signed package records are invalid.",
+				},
+			};
+		}
+		return {
+			success: true,
+			value: { publisherDid, packageSlug, version, profile, release, inspection },
+		};
+	} catch (error) {
+		if (error instanceof DirectPdsReadError) {
+			return { success: false, error: { code: error.code, message: error.message } };
+		}
+		return {
+			success: false,
+			error: {
+				code: "AUTHORITATIVE_RECORD_READ_FAILED",
+				message: "The publisher's signed package records could not be verified.",
+			},
+		};
+	}
+}
+
+export async function verifyAuthoritativePackageRelease(
+	records: VerifiedAuthoritativeRecords,
+	artifactDigest: Uint8Array,
+	options: AuthoritativeRecordReadOptions = {},
+): Promise<RecordVerificationReport> {
+	const context = records.inspection.value;
+	const provenanceReference = context.releaseExtension.provenance;
+	let document: Uint8Array | undefined;
+	if (provenanceReference) {
+		const fetched = await fetchVerifiedResource(provenanceReference.url, {
+			fetch: options.provenanceFetch ?? defaultProvenanceFetch,
+			resolveHostname: options.resolveHostname ?? cloudflareDohResolver,
+			maxBytes: MAX_PROVENANCE_BYTES,
+		});
+		if (!fetched.success) {
+			return verificationFailure(fetched.error.code, fetched.error.message);
+		}
+		const checksum = await verifyMultihash(fetched.value.bytes, provenanceReference.checksum);
+		if (!checksum.success) {
+			return verificationFailure(checksum.error.code, checksum.error.message);
+		}
+		document = fetched.value.bytes;
+	}
+
+	return verifyPackageReleaseRecords({
+		publisherDid: records.publisherDid,
+		package: records.packageSlug,
+		version: records.version,
+		rkey: records.release.rkey,
+		profile: records.profile.value,
+		release: records.release.value,
+		provenance:
+			document === undefined
+				? undefined
+				: {
+						document,
+						artifactDigest,
+						artifactDigests: options.artifactDigests,
+						verifier: options.provenanceVerifier,
+					},
+	});
+}
+
+function verificationFailure(
+	code: VerificationErrorCode,
+	message: string,
+): RecordVerificationFailure {
+	return {
+		success: false,
+		status: "failed",
+		code,
+		reasons: [{ code, message }],
+		provenance: { status: "failed" },
+	};
+}
+
+const guardedFetch: typeof fetch = async (input, init) => {
+	const url = input instanceof Request ? input.url : String(input);
+	return ssrfSafeFetch(url, init, { httpsOnly: true });
+};
+
+const defaultProvenanceFetch: FetchImplementation = (input, init) => globalThis.fetch(input, init);

package/src/registry/config.ts

@@ -8,6 +8,8 @@
  * seconds so the browser doesn't need a duration parser.
  */
 
+import { isDid } from "@atcute/lexicons/syntax";
+
 import type { RegistryConfig, RegistryConfigInput } from "./types.js";
 
 /**
@@ -24,10 +26,12 @@ export interface ManifestRegistryConfig {
 		 * Allowlist of publishers / packages exempt from the
 		 * {@link minimumReleaseAgeSeconds} holdback. Each entry is either:
 		 *
-		 *   - A bare publisher identifier: `"did:plc:abc123"` or a handle
-		 *     like `"example.dev"`. Every package from that publisher is
-		 *     exempt.
-		 *   - A `publisher/slug` pair: only that specific package is exempt.
+		 *   - A bare publisher DID: `"did:plc:abc123"`. Every package from
+		 *     that publisher is exempt.
+		 *   - A `<did>/<slug>` pair: only that specific package is exempt.
+		 *
+		 * Handles are not accepted because they are mutable
+		 * aggregator-supplied envelope data.
 		 *
 		 * Normalized to lowercase strings at config load time so the
 		 * browser does case-insensitive comparison. See
@@ -110,6 +114,8 @@ const TRAILING_SLASHES = /\/+$/;
 /** Trailing dot on a hostname, stripped before URL host comparisons. */
 const TRAILING_DOT = /\.$/;
 
+const REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+
 /**
  * Parse a duration string or raw second count into a non-negative
  * integer count of seconds. Throws on unrecognised input so config
@@ -157,7 +163,7 @@ export function parseDurationSeconds(duration: string | number): number {
  * required in production; `http://localhost` allowed only in dev.
  *
  * The aggregator's responses are the trust source for release records,
- * checksums, labels, mirrors, and `indexedAt` (until full MST
+ * checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST
  * verification lands). Allowing plain HTTP here would let a network
  * attacker swap a release record and point the artifact URL at their
  * own HTTPS bundle, defeating the checksum trust chain because the
@@ -295,7 +301,19 @@ export function normalizeRegistryConfig(
 			if (!trimmed) {
 				throw new Error("registry.policy.minimumReleaseAgeExclude entries cannot be empty");
 			}
-			return trimmed.toLowerCase();
+			const lower = trimmed.toLowerCase();
+			const [did, slug, ...extra] = lower.split("/");
+			if (
+				!did ||
+				!isDid(did) ||
+				extra.length > 0 ||
+				(slug !== undefined && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug))
+			) {
+				throw new Error(
+					`registry.policy.minimumReleaseAgeExclude entry must be a DID or <did>/<slug>: ${trimmed}`,
+				);
+			}
+			return lower;
 		});
 		if (list.length > 0) {
 			policy.minimumReleaseAgeExclude = list;

package/src/registry/record-labels.ts

@@ -0,0 +1,28 @@
+interface VersionedRecordLabel {
+	val?: string;
+	uri?: string;
+	cid?: string;
+	neg?: boolean;
+	exp?: string;
+}
+
+export function hasCurrentRecordLabel(
+	labels: readonly VersionedRecordLabel[],
+	value: string,
+	record: { uri: string; cid: string },
+	now = Date.now(),
+): boolean {
+	return labels.some((label) => {
+		if (
+			label.val !== value ||
+			label.uri !== record.uri ||
+			label.cid !== record.cid ||
+			label.neg === true
+		) {
+			return false;
+		}
+		if (label.exp === undefined) return true;
+		const expiresAt = Date.parse(label.exp);
+		return Number.isFinite(expiresAt) && expiresAt > now;
+	});
+}

package/src/registry/types.ts

@@ -29,15 +29,13 @@ export interface RegistryConfig {
 	aggregatorUrl: string;
 
 	/**
-	 * Optional comma-separated list of labeller DIDs forwarded as the
-	 * `atproto-accept-labelers` header on every aggregator request.
+	 * Optional comma-separated list of bare labeller DIDs forwarded as the
+	 * `atproto-accept-labelers` header on every aggregator request. The
+	 * declaration contributes to the client's cache identity.
 	 *
-	 * Format follows the atproto convention:
-	 * `did:plc:abc;redact, did:plc:def`
-	 *
-	 * When unset, the aggregator applies its operator-default labeller set
-	 * (typically the EmDash publisher-verification labeller and any
-	 * additional trusted labellers the aggregator operator configured).
+	 * The aggregator validates the declaration and rejects unknown sources or
+	 * a list that omits a required source. It does not let the declaration
+	 * override its configured approval, block, takedown, or withdrawal policy.
 	 */
 	acceptLabelers?: string;
 
@@ -157,8 +155,8 @@ export interface ExperimentalConfig {
 	 * release:
 	 *
 	 *   - The publisher DID associated with a `(did, slug)` pair.
-	 *   - The artifact `url`, the artifact `checksum`, and any mirror
-	 *     URLs returned for a release.
+	 *   - The artifact source fields, checksum, and cache services returned for
+	 *     a release.
 	 *   - The published handle for a DID (used for display only;
 	 *     EmDash separately verifies the DID->handle round-trip in the
 	 *     admin UI before treating a handle as confirmed).
@@ -167,7 +165,7 @@ export interface ExperimentalConfig {
 	 * installed plugin:
 	 *
 	 *   - The artifact bytes hash to the checksum the aggregator
-	 *     returned (so a malicious mirror or in-transit tamper can't
+	 *     returned (so a malicious cache or in-transit tamper can't
 	 *     swap the bundle).
 	 *   - The bundle's `manifest.id` matches the requested slug, and
 	 *     its `manifest.version` matches the release version (so an
@@ -190,10 +188,9 @@ export interface ExperimentalConfig {
 	 * **Recommendation.** Until full signature verification lands,
 	 * point `aggregatorUrl` only at an aggregator you operate
 	 * yourself or one you trust with the same level of authority as
-	 * a centralized plugin source. The `policy.minimumReleaseAge` and
-	 * `acceptLabelers` knobs partially mitigate by widening the
-	 * detection window for takedowns, but they assume the labeller
-	 * system is operating.
+	 * a centralized plugin source. `policy.minimumReleaseAge` widens
+	 * the detection window for takedowns. `acceptLabelers` declares a
+	 * request and cache identity; it does not change aggregator policy.
 	 *
 	 * Requires `sandboxRunner` to be configured -- registry plugins
 	 * always run sandboxed.

package/src/schema/registry.ts

@@ -9,6 +9,7 @@ import type {
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
+import { refreshDevTypes } from "../astro/dev-typegen.js";
 import { currentTimestamp, listTablesLike, tableExists } from "../database/dialect-helpers.js";
 import { withTransaction } from "../database/transaction.js";
 import type { CollectionTable, Database, FieldTable } from "../database/types.js";
@@ -244,6 +245,13 @@ export class SchemaError extends Error {
 export class SchemaRegistry {
 	constructor(private db: Kysely<Database>) {}
 
+	/**
+	 * Notify the dev typegen hook that the schema has changed.
+	 */
+	private notifyTypegen(): void {
+		refreshDevTypes(this.db);
+	}
+
 	// ============================================
 	// Collection Operations
 	// ============================================
@@ -496,6 +504,7 @@ export class SchemaRegistry {
 			throw new SchemaError("Failed to create collection", "CREATE_FAILED");
 		}
 
+		this.notifyTypegen();
 		return collection;
 	}
 
@@ -671,6 +680,7 @@ export class SchemaRegistry {
 			}
 			throw error;
 		}
+		this.notifyTypegen();
 	}
 
 	private async assertSeedFieldDefinitions(
@@ -719,7 +729,7 @@ export class SchemaRegistry {
 	 * Update a collection
 	 */
 	async updateCollection(slug: string, input: UpdateCollectionInput): Promise<Collection> {
-		return withTransaction(this.db, async (trx) => {
+		const updated = await withTransaction(this.db, async (trx) => {
 			const existingRow = await trx
 				.selectFrom("_emdash_collections")
 				.where("slug", "=", slug)
@@ -798,6 +808,8 @@ export class SchemaRegistry {
 
 			return this.mapCollectionRow(row);
 		});
+		this.notifyTypegen();
+		return updated;
 	}
 
 	/**
@@ -852,6 +864,7 @@ export class SchemaRegistry {
 			}
 			throw error;
 		}
+		this.notifyTypegen();
 	}
 
 	// ============================================
@@ -1005,6 +1018,7 @@ export class SchemaRegistry {
 					"CONTENT_USAGE_STALE",
 				);
 			}
+			this.notifyTypegen();
 			return created;
 		} catch (error) {
 			if (schemaMutated) {
@@ -1185,6 +1199,7 @@ export class SchemaRegistry {
 					);
 				}
 			}
+			this.notifyTypegen();
 			return updatedField;
 		} catch (error) {
 			if (schemaMutated) {
@@ -1326,6 +1341,7 @@ export class SchemaRegistry {
 			}
 			throw error;
 		}
+		this.notifyTypegen();
 	}
 
 	/**
@@ -1380,6 +1396,7 @@ export class SchemaRegistry {
 					.execute();
 			}
 		});
+		this.notifyTypegen();
 	}
 
 	/**
@@ -1400,6 +1417,7 @@ export class SchemaRegistry {
 				.where("slug", "=", fieldSlugs[i])
 				.execute();
 		}
+		this.notifyTypegen();
 	}
 
 	// ============================================
@@ -1463,9 +1481,13 @@ export class SchemaRegistry {
 			ON ${sql.ref(tableName)} (slug)
 		`.execute(conn);
 
+		// Name must stay identical to migration 074. `deleted_at` leads so the
+		// scheduled-publishing sweep can seek it and walk `scheduled_at` for both
+		// its range and its ORDER BY; a `scheduled_at`-only index leaves a
+		// stats-blind planner reading every live row.
 		await sql`
-			${createIndex} ${sql.ref(`idx_${tableName}_scheduled`)}
-			ON ${sql.ref(tableName)} (scheduled_at)
+			${createIndex} ${sql.ref(`idx_${tableName}_del_sched`)}
+			ON ${sql.ref(tableName)} (deleted_at, scheduled_at)
 			WHERE scheduled_at IS NOT NULL
 		`.execute(conn);
 
@@ -1992,6 +2014,7 @@ export class SchemaRegistry {
 				throw new SchemaError("Failed to register orphaned table", "REGISTER_FAILED");
 			}
 			await markContentMediaUsageCollectionStaleSafely(this.db, slug, "CONTENT_USAGE_STALE");
+			this.notifyTypegen();
 
 			return collection;
 		} catch (error) {

package/src/schema/types.ts

@@ -167,6 +167,7 @@ export interface FieldValidation {
 export interface FieldWidgetOptions {
 	rows?: number; // For textarea
 	showPreview?: boolean; // For image/file
+	darkVariant?: boolean; // For image: offer a second slot for a dark-color-scheme counterpart
 	collection?: string; // For reference - which collection to reference
 	allowMultiple?: boolean; // For reference
 	[key: string]: unknown;

package/src/schema/zod-generator.ts

@@ -1,4 +1,4 @@
-import { z, type ZodTypeAny } from "zod";
+import { z, type ZodType } from "zod";
 
 import { hashString } from "../utils/hash.js";
 import type { CollectionWithFields, Field, FieldType, RepeaterSubField } from "./types.js";
@@ -14,8 +14,8 @@ const PASCAL_CASE_SPLIT_PATTERN = /[_\-\s]+/;
  */
 export function generateZodSchema(
 	collection: CollectionWithFields,
-): z.ZodObject<Record<string, ZodTypeAny>> {
-	const shape: Record<string, ZodTypeAny> = {};
+): z.ZodObject<Record<string, ZodType>> {
+	const shape: Record<string, ZodType> = {};
 
 	for (const field of collection.fields) {
 		shape[field.slug] = generateFieldSchema(field);
@@ -27,7 +27,7 @@ export function generateZodSchema(
 /**
  * Generate Zod schema for a single field
  */
-export function generateFieldSchema(field: Field): ZodTypeAny {
+export function generateFieldSchema(field: Field): ZodType {
 	let schema = getBaseSchema(field.type, field);
 
 	// Apply validation rules
@@ -58,10 +58,10 @@ export function generateFieldSchema(field: Field): ZodTypeAny {
 /**
  * Get base Zod schema for a field type
  */
-function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTypeAny {
+function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodType {
 	switch (type) {
 		case "url":
-			return z.string().url();
+			return z.string().check(z.url());
 
 		case "string":
 		case "text":
@@ -94,7 +94,10 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 			// validate or the entry becomes unsavable through its own editor
 			// (#1368; same class as #867). `z.iso.*` retains semantic validation,
 			// so impossible dates are still rejected.
-			return z.iso.datetime({ offset: true, local: true }).or(z.iso.date());
+			return z.iso
+				.datetime({ offset: true, local: true })
+				.or(z.iso.datetime({ offset: true, local: true, precision: -1 }))
+				.or(z.iso.date());
 
 		case "select": {
 			const options = field.validation?.options;
@@ -122,7 +125,7 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 			// renderers dispatch on it, but `_key` is intentionally optional:
 			// it's a UI-layer concern that the editor regenerates on every
 			// change (see `PortableTextEditor`), and the rest of this schema
-			// uses `.passthrough()` for everything below the top level. Making
+			// uses `.loose()` for everything below the top level. Making
 			// `_key` strictly required here was an accidentally tight invariant
 			// that rejected any seed/import data not authored against the
 			// editor (#867 — autosave failures on seeded template content).
@@ -132,11 +135,11 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 						_type: z.string(),
 						_key: z.string().optional(),
 					})
-					.passthrough(),
+					.loose(),
 			);
 
-		case "image":
-			return z.object({
+		case "image": {
+			const mediaSchema = z.object({
 				id: z.string(),
 				src: z.string().optional(),
 				alt: z.string().optional(),
@@ -153,6 +156,11 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 				/** Provider-specific metadata; for local media this carries storageKey */
 				meta: z.record(z.string(), z.unknown()).optional(),
 			});
+			return mediaSchema.extend({
+				/** Counterpart shown when the page renders in a dark color scheme */
+				darkVariant: mediaSchema.optional(),
+			});
+		}
 
 		case "file":
 			return z.object({
@@ -181,8 +189,8 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 
 function generateRepeaterRowSchema(
 	subFields: readonly RepeaterSubField[],
-): z.ZodObject<Record<string, ZodTypeAny>> {
-	const shape: Record<string, ZodTypeAny> = {};
+): z.ZodObject<Record<string, ZodType>> {
+	const shape: Record<string, ZodType> = {};
 
 	for (const subField of subFields) {
 		let schema = getBaseSchema(subField.type, {
@@ -199,13 +207,13 @@ function generateRepeaterRowSchema(
 		shape[subField.slug] = schema;
 	}
 
-	return z.object(shape).passthrough();
+	return z.object(shape).loose();
 }
 
 /**
  * Apply validation rules to a schema
  */
-function applyValidation(schema: ZodTypeAny, field: Field): ZodTypeAny {
+function applyValidation(schema: ZodType, field: Field): ZodType {
 	const validation = field.validation;
 	if (!validation) return schema;
 
@@ -483,8 +491,11 @@ function fieldTypeToTypeScript(field: {
 		case "portableText":
 			return "PortableTextBlock[]";
 
-		case "image":
-			return "{ id: string; src?: string; alt?: string; width?: number; height?: number; filename?: string; mimeType?: string; blurhash?: string; dominantColor?: string; provider?: string; previewUrl?: string; meta?: Record<string, unknown> }";
+		case "image": {
+			const media =
+				"{ id: string; src?: string; alt?: string; width?: number; height?: number; filename?: string; mimeType?: string; blurhash?: string; dominantColor?: string; provider?: string; previewUrl?: string; meta?: Record<string, unknown> }";
+			return `${media.slice(0, -2)}; darkVariant?: ${media} }`;
+		}
 
 		case "file":
 			return "{ id: string; url?: string; src?: string; filename?: string; mimeType?: string; size?: number; provider?: string; meta?: Record<string, unknown> }";

package/src/security/ssrf.ts

@@ -389,6 +389,22 @@ export async function resolveAndValidateExternalUrl(
 	url: string,
 	options?: { resolver?: DnsResolver },
 ): Promise<URL> {
+	return (await resolveAndValidateExternalUrlTarget(url, options)).url;
+}
+
+export interface ResolvedExternalUrlTarget {
+	url: URL;
+	addresses: readonly string[];
+}
+
+/**
+ * Validate a URL and return the exact public addresses approved for the
+ * subsequent connection.
+ */
+export async function resolveAndValidateExternalUrlTarget(
+	url: string,
+	options?: { resolver?: DnsResolver },
+): Promise<ResolvedExternalUrlTarget> {
 	const parsed = validateExternalUrl(url);
 
 	// Strip brackets from IPv6 hostnames
@@ -397,7 +413,7 @@ export async function resolveAndValidateExternalUrl(
 	// If the hostname is already an IP literal, validateExternalUrl has
 	// already checked it against the private-range list. Skip DNS.
 	if (isIpLiteral(hostname)) {
-		return parsed;
+		return { url: parsed, addresses: [hostname] };
 	}
 
 	const resolver = options?.resolver ?? defaultResolver ?? cloudflareDohResolver;
@@ -416,12 +432,15 @@ export async function resolveAndValidateExternalUrl(
 	}
 
 	for (const ip of addresses) {
+		if (!isIpLiteral(ip)) {
+			throw new SsrfError("Hostname resolver returned a non-IP address");
+		}
 		if (isPrivateIp(ip)) {
 			throw new SsrfError("Hostname resolves to a private IP address");
 		}
 	}
 
-	return parsed;
+	return { url: parsed, addresses };
 }
 
 /** True when a string looks like an IPv4 or IPv6 literal. */
@@ -448,13 +467,16 @@ const CREDENTIAL_HEADERS = ["authorization", "cookie", "proxy-authorization"];
 export async function ssrfSafeFetch(
 	url: string,
 	init?: RequestInit,
-	options?: { resolver?: DnsResolver },
+	options?: { resolver?: DnsResolver; httpsOnly?: boolean },
 ): Promise<Response> {
 	let currentUrl = url;
 	let currentInit = init;
 
 	for (let i = 0; i <= MAX_REDIRECTS; i++) {
-		await resolveAndValidateExternalUrl(currentUrl, options);
+		const validated = await resolveAndValidateExternalUrl(currentUrl, options);
+		if (options?.httpsOnly === true && validated.protocol !== "https:") {
+			throw new SsrfError("Only HTTPS URLs are allowed");
+		}
 
 		const response = await globalThis.fetch(currentUrl, {
 			...currentInit,

package/src/seed/apply.ts

@@ -1419,9 +1419,9 @@ async function resolveMedia(
 		const ext = getExtensionFromContentType(contentType) || getExtensionFromUrl(url) || ".bin";
 
 		// Generate filename and storage key
-		const id = ulid();
+		const storageId = ulid();
 		const finalFilename = filename || generateFilename(url, ext);
-		const storageKey = `${id}${ext}`;
+		const storageKey = `${storageId}${ext}`;
 
 		// Get the body as buffer
 		const arrayBuffer = await response.arrayBuffer();
@@ -1445,7 +1445,7 @@ async function resolveMedia(
 
 		// Create media record
 		const mediaRepo = new MediaRepository(ctx.db);
-		await mediaRepo.create({
+		const media = await mediaRepo.create({
 			filename: finalFilename,
 			mimeType: contentType,
 			size: body.length,
@@ -1460,7 +1460,7 @@ async function resolveMedia(
 		// Create the MediaValue - only store id, URL is built at runtime by EmDashMedia
 		const mediaValue: MediaValue = {
 			provider: "local",
-			id,
+			id: media.id,
 			alt: alt ?? undefined,
 			width,
 			height,