emdash 0.36.0 → 0.37.0

package/src/database/repositories/plugin-storage.ts

@@ -16,6 +16,7 @@ import {
 	validateOrderByClause,
 	getIndexedFields,
 	jsonOrderExtract,
+	StorageQueryError,
 } from "../../plugins/storage-query.js";
 import type {
 	StorageCollection,
@@ -52,6 +53,19 @@ function rawWhereExpr(sqlText: string, params: unknown[]): RawBuilder<boolean> {
  *
  * Implements the StorageCollection interface for a specific plugin and collection.
  */
+/**
+ * Rank a sort expression so NULLs get a deterministic position.
+ *
+ * A missing key in a schemaless document extracts as NULL, which sorts
+ * differently per dialect (SQLite first, Postgres last) and makes every
+ * comparison against it UNKNOWN. Sorting on this rank ahead of the value puts
+ * NULLs in the same place on both dialects and keeps the seek operands
+ * non-NULL.
+ */
+function nullRank(expr: RawBuilder<unknown>): RawBuilder<number> {
+	return sql`(case when ${expr} is null then 1 else 0 end)`;
+}
+
 export class PluginStorageRepository<T = unknown> implements StorageCollection<T> {
 	private indexedFields: Set<string>;
 
@@ -234,24 +248,75 @@ export class PluginStorageRepository<T = unknown> implements StorageCollection<T
 			query = query.where(rawWhereExpr(whereResult.sql, whereResult.params));
 		}
 
+		const orderEntries = Object.entries(orderBy);
+		const orderDirections = new Set(orderEntries.map(([, direction]) => direction));
+		const descending = orderEntries.length > 0 && orderEntries[0][1] === "desc";
+
+		// A missing key in a schemaless document extracts as NULL, and NULL sorts
+		// differently per dialect (SQLite first, Postgres last) and makes any
+		// comparison against it UNKNOWN. Rank nulls explicitly so both the sort and
+		// the seek agree on where they sit, on either dialect, and so no comparison
+		// operand is ever NULL.
+		const sortExpr = (field: string): RawBuilder<unknown> =>
+			sql`${sql.raw(jsonOrderExtract(this.db, field))}`;
+
 		// Handle cursor-based pagination — throws on invalid cursor.
 		if (cursor) {
 			const decoded = decodeCursor(cursor);
-			query = query.where(({ eb }) =>
-				eb(sql`(created_at, id)`, ">", sql`(${decoded.orderValue}, ${decoded.id})`),
-			);
+			if (orderEntries.length === 0) {
+				query = query.where(({ eb }) =>
+					eb(sql`(created_at, id)`, ">", sql`(${decoded.orderValue}, ${decoded.id})`),
+				);
+			} else {
+				if (orderDirections.size > 1) {
+					throw new StorageQueryError(
+						"Cursor pagination requires every orderBy field to share one direction.",
+						Object.keys(orderBy).join(", "),
+						"Sort every field the same way, or page without a cursor.",
+					);
+				}
+				const op = descending ? sql`<` : sql`>`;
+				// The cursor row's sort values, recomputed with the same expression
+				// rather than carried in the cursor, so nothing is bound as a literal
+				// and neither dialect has to coerce a JSON value to compare it.
+				const cursorExpr = (field: string): RawBuilder<unknown> =>
+					sql`(select ${sql.raw(jsonOrderExtract(this.db, field))} from _plugin_storage where plugin_id = ${this.pluginId} and collection = ${this.collection} and id = ${decoded.id})`;
+
+				const fields = orderEntries.map(([field]) => {
+					const own = sortExpr(field);
+					const theirs = cursorExpr(field);
+					return {
+						equal: sql`(${nullRank(own)} = ${nullRank(theirs)} and (${nullRank(own)} = 1 or ${own} = ${theirs}))`,
+						after: sql`(${nullRank(own)} ${op} ${nullRank(theirs)} or (${nullRank(own)} = ${nullRank(theirs)} and ${nullRank(own)} = 0 and ${own} ${op} ${theirs}))`,
+					};
+				});
+
+				// Lexicographic seek: ties on every earlier field, then strictly after
+				// on this one; finally all fields tied and strictly after on id.
+				const terms = fields.map(
+					(_, k) =>
+						sql`(${sql.join([...fields.slice(0, k).map((f) => f.equal), fields[k].after], sql` and `)})`,
+				);
+				terms.push(
+					sql`(${sql.join([...fields.map((f) => f.equal), sql`id ${op} ${decoded.id}`], sql` and `)})`,
+				);
+				query = query.where(sql<boolean>`(${sql.join(terms, sql` or `)})`);
+			}
 		}
 
 		// Build ORDER BY using sql template
-		if (Object.keys(orderBy).length > 0) {
-			for (const [field, direction] of Object.entries(orderBy)) {
+		if (orderEntries.length > 0) {
+			for (const [field, direction] of orderEntries) {
+				const dir = direction === "desc" ? sql`desc` : sql`asc`;
+				const expr = sortExpr(field);
+				// Null rank first so NULL placement is identical on both dialects.
+				query = query.orderBy(sql`${nullRank(expr)} ${dir}`);
 				// Order over the jsonb-native value on Postgres so numeric fields sort
 				// numerically, not lexically. See pluginDataOrderExpr.
-				const extract = jsonOrderExtract(this.db, field);
-				const orderExpr =
-					direction === "desc" ? sql`${sql.raw(extract)} desc` : sql`${sql.raw(extract)} asc`;
-				query = query.orderBy(orderExpr);
+				query = query.orderBy(sql`${expr} ${dir}`);
 			}
+			// Total order, so a page boundary can never fall inside a group of ties.
+			query = query.orderBy("id", descending ? "desc" : "asc");
 		} else {
 			// Default ordering for consistent pagination
 			query = query.orderBy("created_at", "asc").orderBy("id", "asc");

package/src/database/repositories/types.ts

@@ -64,13 +64,14 @@ export interface BylineSummary {
 	avatarMediaId: string | null;
 	/**
 	 * The avatar media's storage key, folded in by a LEFT JOIN on the
-	 * `media` table during content byline hydration. Non-null only when the
-	 * byline has an avatar AND was loaded through the content-credit hydration
-	 * path (`getContentBylines` / `getContentBylinesMany`, i.e. the
-	 * `entry.data.bylines` populated by `getEmDashCollection` / `getEmDashEntry`).
-	 * The plain byline finders (`findById`, `findBySlug`, …) leave it null.
+	 * `media` table. Populated by the content-credit hydration path
+	 * (`getContentBylines` / `getContentBylinesMany`, i.e. the
+	 * `entry.data.bylines` populated by `getEmDashCollection` /
+	 * `getEmDashEntry`) and by the single-row finders (`findById`,
+	 * `findBySlug`, `findByUserId`, `findByUserIds`). `findMany` doesn't
+	 * join media, so it leaves this null.
 	 *
-	 * Lets list pages build a direct storage URL for an author avatar without a
+	 * Lets a page build a direct storage URL for an author avatar without a
 	 * per-byline `MediaRepository.findById`, avoiding an N+1 when many distinct
 	 * authors appear on one page.
 	 *
@@ -86,7 +87,7 @@ export interface BylineSummary {
 	 * same media join as `avatarStorageKey`. Lets a renderer paint a blurred
 	 * placeholder while the full avatar loads, with no extra media lookup.
 	 * Null when the byline has no avatar, the media row has no blurhash, or the
-	 * byline was loaded through a finder that doesn't join media.
+	 * byline came from `findMany`, which doesn't join media.
 	 */
 	avatarBlurhash?: string | null;
 	/**

package/src/db/adapters.ts

@@ -199,7 +199,14 @@ export interface PostgresConfig {
 	user?: string;
 	password?: string;
 	ssl?: boolean;
-	pool?: { min?: number; max?: number };
+	pool?: {
+		min?: number;
+		max?: number;
+		/** Maximum time to wait for a connection, in milliseconds. Uses the pg default when omitted. */
+		connectionTimeoutMillis?: number;
+		/** Time before an idle client is closed, in milliseconds. Uses the pg default when omitted. */
+		idleTimeoutMillis?: number;
+	};
 	migrationConnectionStringEnv?: string;
 }
 

package/src/db/postgres.ts

@@ -11,6 +11,26 @@ import { Pool } from "pg";
 import { FailFastPostgresDialect } from "../database/pg-migration-lock.js";
 import type { PostgresConfig } from "./adapters.js";
 
+const URL_PATTERN = /[A-Za-z][A-Za-z0-9+.-]*:\/\/\S+/g;
+const CREDENTIAL_PATTERN = /\b(auth|credential|key|password|secret|signature|token)\s*[=:]\s*\S+/gi;
+const ERROR_CODE_PATTERN = /^[A-Za-z0-9_-]{1,32}$/;
+
+function redactPoolErrorMessage(message: string): string {
+	return message
+		.replace(URL_PATTERN, "[REDACTED_URL]")
+		.replace(CREDENTIAL_PATTERN, "$1=[REDACTED]")
+		.replaceAll(/[\r\n\t]/g, " ")
+		.slice(0, 1_000);
+}
+
+function logPoolError(error: Error): void {
+	// pg attaches the failed client to this error, which can contain connection credentials.
+	const code = "code" in error && typeof error.code === "string" ? error.code : undefined;
+	const safeCode = code && ERROR_CODE_PATTERN.test(code) ? ` (${code})` : "";
+	const message = redactPoolErrorMessage(error.message) || "Unknown error";
+	console.error(`[emdash] PostgreSQL idle client error${safeCode}: ${message}`);
+}
+
 /**
  * Create a PostgreSQL dialect from config
  */
@@ -25,7 +45,10 @@ export function createDialect(config: PostgresConfig): PostgresDialect {
 		ssl: config.ssl,
 		min: config.pool?.min ?? 0,
 		max: config.pool?.max ?? 10,
+		connectionTimeoutMillis: config.pool?.connectionTimeoutMillis,
+		idleTimeoutMillis: config.pool?.idleTimeoutMillis,
 	});
+	pool.on("error", logPoolError);
 
 	// Fail-fast migration locking instead of Kysely's blocking advisory
 	// lock — see pg-migration-lock.ts (#1744).

package/src/emdash-runtime.ts

@@ -14,6 +14,7 @@ import virtualConfig from "virtual:emdash/config";
 import { z } from "zod";
 
 import { ErrorCode } from "./api/errors.js";
+import { buildManifestCollections } from "./api/handlers/manifest.js";
 import { assertMediaUsageActivationWriteAllowed } from "./api/media-usage-write-fence.js";
 import { validateRev } from "./api/rev.js";
 import type {
@@ -21,7 +22,7 @@ import type {
 	PluginAdminPage,
 	PluginDashboardWidget,
 } from "./astro/integration/runtime.js";
-import type { EmDashManifest, ManifestCollection } from "./astro/types.js";
+import type { EmDashManifest } from "./astro/types.js";
 import { getAuthMode } from "./auth/mode.js";
 import { getTrustedProxyHeaders } from "./auth/trusted-proxy.js";
 import type { ContentFieldFilters } from "./content-list-query.js";
@@ -58,6 +59,7 @@ import {
 	refreshContentMediaUsageAfterWrite,
 } from "./media/usage/content-refresh.js";
 import { processMediaUsageWorkAfterWrite } from "./media/usage/work-processor.js";
+import { inspectSandboxHookResult } from "./plugins/sandbox/hook-result.js";
 import { createSandboxRunnerOptions } from "./plugins/sandbox/runner-options.js";
 import { getSandboxRouteErrorDetails } from "./plugins/sandbox/types.js";
 import type {
@@ -66,6 +68,7 @@ import type {
 	SandboxRunnerFactory,
 } from "./plugins/sandbox/types.js";
 import type {
+	ContentHookEvent,
 	ResolvedPlugin,
 	MediaItem,
 	PluginManifest,
@@ -81,7 +84,6 @@ import type {
 	UserInfo,
 } from "./plugins/types.js";
 import { recordSchedulerHeartbeatSafely } from "./scheduler-health.js";
-import { MAX_COLLECTION_LIST_COLUMNS, type FieldType } from "./schema/types.js";
 import { isMissingTableError } from "./utils/db-errors.js";
 import { hashString } from "./utils/hash.js";
 import { createInitLock, type InitLock, initWithLock } from "./utils/init-lock.js";
@@ -189,6 +191,7 @@ import {
 	handleMediaGet,
 	handleMediaCreate,
 	handleMediaUpdate,
+	handleMediaReplaceMetadata,
 	handleMediaDelete,
 	handleRevisionList,
 	handleRevisionGet,
@@ -229,41 +232,9 @@ import { publishDueContent, type PublishedRef } from "./scheduled-publish.js";
 import { FTSManager } from "./search/fts-manager.js";
 import { invalidateSiteSettingsCache } from "./settings/index.js";
 
-/**
- * Map schema field types to editor field kinds
- */
-const FIELD_TYPE_TO_KIND: Record<FieldType, string> = {
-	string: "string",
-	slug: "string",
-	url: "url",
-	text: "richText",
-	number: "number",
-	integer: "number",
-	boolean: "boolean",
-	datetime: "datetime",
-	select: "select",
-	multiSelect: "multiSelect",
-	portableText: "portableText",
-	image: "image",
-	file: "file",
-	reference: "reference",
-	json: "json",
-	repeater: "repeater",
-};
-
 const DRAFT_ONLY_UPDATE_KEYS = new Set(["data", "slug", "locale", "skipRevision"]);
 const MAX_DRAFT_STAGE_ATTEMPTS = 32;
 
-const LIST_COLUMN_FIELD_TYPES: ReadonlySet<FieldType> = new Set([
-	"string",
-	"number",
-	"integer",
-	"boolean",
-	"datetime",
-	"select",
-	"multiSelect",
-]);
-
 /**
  * Sandboxed plugin entry from virtual module
  */
@@ -2452,103 +2423,10 @@ export class EmDashRuntime {
 	 * is two queries in practice; never N+1.
 	 */
 	private async _buildManifest(): Promise<EmDashManifest> {
-		// Build collections from database.
+		// Build collections from the live database.
 		// Use this.db (ALS-aware getter) so playground mode picks up the
 		// per-session DO database instead of the hardcoded singleton.
-		const manifestCollections: Record<string, ManifestCollection> = {};
-		try {
-			const registry = new SchemaRegistry(this.db);
-			const dbCollections = await registry.listCollectionsWithFields();
-			for (const collection of dbCollections) {
-				const fields: Record<
-					string,
-					{
-						kind: string;
-						label?: string;
-						required?: boolean;
-						widget?: string;
-						// Two shapes: legacy enum-style `[{ value, label }]` for select widgets,
-						// or arbitrary `Record<string, unknown>` for plugin field widgets that
-						// need per-field config (e.g. a checkbox grid receiving its column defs).
-						options?: Array<{ value: string; label: string }> | Record<string, unknown>;
-						id?: string;
-						validation?: Record<string, unknown>;
-					}
-				> = {};
-
-				for (const field of collection.fields) {
-					const entry: (typeof fields)[string] = {
-						kind: FIELD_TYPE_TO_KIND[field.type] ?? "string",
-						label: field.label,
-						required: field.required,
-					};
-					// Always include the field's database ID so the admin can forward it
-					// to upload/media-list API calls for MIME allowlist widening.
-					entry.id = field.id;
-					if (field.widget) entry.widget = field.widget;
-					// Plugin field widgets read their per-field config from `field.options`,
-					// which the seed schema types as `Record<string, unknown>`. Pass it
-					// through to the manifest so plugin widgets in the admin SPA receive it.
-					if (field.options) {
-						entry.options = field.options;
-					}
-					// Legacy: select/multiSelect enum options live on `field.validation.options`.
-					// Wins over `field.options` to preserve existing behavior for enum widgets.
-					if (field.validation?.options) {
-						entry.options = field.validation.options.map((v) => ({
-							value: v,
-							label: v.charAt(0).toUpperCase() + v.slice(1),
-						}));
-					}
-					// Include full validation for repeater fields (subFields, minItems, maxItems)
-					// and for file/image fields (allowedMimeTypes).
-					if (
-						(field.type === "repeater" || field.type === "file" || field.type === "image") &&
-						field.validation
-					) {
-						entry.validation = { ...field.validation };
-					}
-					fields[field.slug] = entry;
-				}
-
-				const configuredListColumns = collection.admin?.listColumns ?? [];
-				const fieldTypes = new Map(collection.fields.map((field) => [field.slug, field.type]));
-				const listColumns: string[] = [];
-				for (const slug of configuredListColumns) {
-					if (listColumns.includes(slug)) continue;
-					const fieldType = fieldTypes.get(slug);
-					if (!fieldType || !LIST_COLUMN_FIELD_TYPES.has(fieldType)) {
-						console.warn(
-							`EmDash: Ignoring unsupported or unknown list column "${slug}" in collection "${collection.slug}".`,
-						);
-						continue;
-					}
-					if (listColumns.length >= MAX_COLLECTION_LIST_COLUMNS) {
-						console.warn(
-							`EmDash: Collection "${collection.slug}" declares more than ${MAX_COLLECTION_LIST_COLUMNS} list columns; extra columns are ignored.`,
-						);
-						break;
-					}
-					listColumns.push(slug);
-				}
-
-				manifestCollections[collection.slug] = {
-					label: collection.label,
-					labelSingular: collection.labelSingular || collection.label,
-					supports: collection.supports || [],
-					hasSeo: collection.hasSeo,
-					urlPattern: collection.urlPattern,
-					routable: collection.routable !== false,
-					titleField: collection.titleField,
-					dateField: collection.dateField,
-					...(collection.hidden ? { hidden: true } : {}),
-					listColumns: listColumns.length > 0 ? listColumns : undefined,
-					fields,
-				};
-			}
-		} catch (error) {
-			console.debug("EmDash: Could not load database collections:", error);
-		}
+		const manifestCollections = await buildManifestCollections({}, this.db);
 
 		// Build plugins manifest
 		const manifestPlugins: Record<
@@ -2714,7 +2592,11 @@ export class EmDashRuntime {
 		const i18nConfig = virtualConfig?.i18n ?? getI18nConfig();
 		const i18n =
 			i18nConfig && i18nConfig.locales && i18nConfig.locales.length > 1
-				? { defaultLocale: i18nConfig.defaultLocale, locales: i18nConfig.locales }
+				? {
+						defaultLocale: i18nConfig.defaultLocale,
+						locales: i18nConfig.locales,
+						prefixDefaultLocale: i18nConfig.prefixDefaultLocale,
+					}
 				: undefined;
 
 		// Normalize the experimental registry config for browser consumption.
@@ -2924,7 +2806,9 @@ export class EmDashRuntime {
 		}
 
 		// Run beforeSave hooks (sandboxed plugins)
-		processedData = await this.runSandboxedBeforeSave(processedData, collection, true);
+		const sandboxResult = await this.runSandboxedBeforeSave(processedData, collection, true);
+		if (!sandboxResult.success) return sandboxResult;
+		processedData = sandboxResult.data;
 
 		// Normalize media fields (fill dimensions, storageKey, etc.)
 		processedData = await this.normalizeMediaFields(collection, processedData);
@@ -3020,6 +2904,7 @@ export class EmDashRuntime {
 						bodyWithoutRev.data,
 						collection,
 						false,
+						resolvedItem?.id,
 					);
 					processedData = hookResult.content;
 				} catch (error) {
@@ -3028,7 +2913,14 @@ export class EmDashRuntime {
 			}
 
 			// Run sandboxed beforeSave hooks
-			processedData = await this.runSandboxedBeforeSave(processedData!, collection, false);
+			const sandboxResult = await this.runSandboxedBeforeSave(
+				processedData!,
+				collection,
+				false,
+				resolvedItem?.id,
+			);
+			if (!sandboxResult.success) return sandboxResult;
+			processedData = sandboxResult.data;
 
 			// Normalize media fields (fill dimensions, storageKey, etc.)
 			processedData = await this.normalizeMediaFields(collection, processedData);
@@ -3271,7 +3163,7 @@ export class EmDashRuntime {
 
 	async handleContentListTrashed(
 		collection: string,
-		params: { cursor?: string; limit?: number } = {},
+		params: { cursor?: string; limit?: number; locale?: string } = {},
 	) {
 		return handleContentListTrashed(this.db, collection, params);
 	}
@@ -3304,8 +3196,8 @@ export class EmDashRuntime {
 		return result;
 	}
 
-	async handleContentCountTrashed(collection: string) {
-		return handleContentCountTrashed(this.db, collection);
+	async handleContentCountTrashed(collection: string, params: { locale?: string } = {}) {
+		return handleContentCountTrashed(this.db, collection, params);
 	}
 
 	async handleContentDuplicate(collection: string, id: string, authorId?: string) {
@@ -3327,6 +3219,7 @@ export class EmDashRuntime {
 			publishedAt?: string;
 			requireScheduledDue?: boolean;
 			expectedScheduledAt?: string;
+			_rev?: string;
 		} = {},
 	) {
 		const result = await handleContentPublish(this.db, collection, id, options);
@@ -3342,8 +3235,8 @@ export class EmDashRuntime {
 		return result;
 	}
 
-	async handleContentUnpublish(collection: string, id: string) {
-		const result = await handleContentUnpublish(this.db, collection, id);
+	async handleContentUnpublish(collection: string, id: string, options: { _rev?: string } = {}) {
+		const result = await handleContentUnpublish(this.db, collection, id, options);
 		if (result.success && result.data) {
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
 		}
@@ -3388,8 +3281,8 @@ export class EmDashRuntime {
 		return handleContentCountScheduled(this.db, collection);
 	}
 
-	async handleContentDiscardDraft(collection: string, id: string) {
-		const result = await handleContentDiscardDraft(this.db, collection, id);
+	async handleContentDiscardDraft(collection: string, id: string, options: { _rev?: string } = {}) {
+		const result = await handleContentDiscardDraft(this.db, collection, id, options);
 		if (result.success && result.data) {
 			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
 		}
@@ -3434,6 +3327,7 @@ export class EmDashRuntime {
 		blurhash?: string;
 		dominantColor?: string;
 		authorId?: string;
+		folderId?: string | null;
 	}) {
 		// Run beforeUpload hooks
 		let processedInput = input;
@@ -3498,6 +3392,18 @@ export class EmDashRuntime {
 		return result;
 	}
 
+	async handleMediaReplaceMetadata(
+		id: string,
+		expectedStorageKey: string,
+		input: { size: number; width: number; height: number; contentHash: string },
+	) {
+		const result = await handleMediaReplaceMetadata(this.db, id, expectedStorageKey, input);
+		if (result.success) {
+			invalidateSiteSettingsCache();
+		}
+		return result;
+	}
+
 	async handleMediaDelete(id: string) {
 		const result = await handleMediaDelete(this.db, id);
 		// Same reasoning as `handleMediaUpdate`: if the deleted media row
@@ -4071,7 +3977,8 @@ export class EmDashRuntime {
 		content: Record<string, unknown>,
 		collection: string,
 		isNew: boolean,
-	): Promise<Record<string, unknown>> {
+		contentId?: string,
+	) {
 		let result = content;
 
 		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
@@ -4079,11 +3986,30 @@ export class EmDashRuntime {
 			if (!id || !this.isPluginEnabled(id)) continue;
 
 			try {
-				const hookResult = await plugin.invokeHook("content:beforeSave", {
-					content: result,
-					collection,
-					isNew,
-				});
+				const event: ContentHookEvent = { content: result, collection, isNew };
+				if (contentId !== undefined) event.id = contentId;
+				const hookResult = await plugin.invokeHook("content:beforeSave", event);
+				const inspection = inspectSandboxHookResult(hookResult);
+				if (inspection.kind === "error") {
+					return {
+						success: false as const,
+						error: {
+							code: ErrorCode.SAVE_REJECTED,
+							message: "Save rejected by a sandboxed plugin",
+							details: { pluginId: id, reason: inspection.error.reason },
+						},
+					};
+				}
+				if (inspection.kind === "malformed") {
+					console.error(`EmDash: Sandboxed plugin ${id} returned an invalid hook result`);
+					return {
+						success: false as const,
+						error: {
+							code: ErrorCode.CONTENT_HOOK_ERROR,
+							message: "A plugin hook failed while saving content",
+						},
+					};
+				}
 				if (hookResult && typeof hookResult === "object" && !Array.isArray(hookResult)) {
 					// Sandbox returns unknown; convert to record by iterating own properties
 					const record: Record<string, unknown> = {};
@@ -4093,14 +4019,18 @@ export class EmDashRuntime {
 					result = record;
 				}
 			} catch (error) {
-				console.error(
-					`EmDash: Sandboxed plugin ${id} beforeSave hook threw; a sandboxed plugin cannot cancel a save, so the save continues:`,
-					error,
-				);
+				console.error(`EmDash: Sandboxed plugin ${id} beforeSave hook failed:`, error);
+				return {
+					success: false as const,
+					error: {
+						code: ErrorCode.CONTENT_HOOK_ERROR,
+						message: "A plugin hook failed while saving content",
+					},
+				};
 			}
 		}
 
-		return result;
+		return { success: true as const, data: result };
 	}
 
 	private async runSandboxedBeforeDelete(id: string, collection: string): Promise<boolean> {

package/src/fields/boolean.ts

@@ -15,7 +15,7 @@ export function boolean(options: BooleanOptions = {}): FieldDefinition<boolean>
 	const boolSchema = z.boolean();
 
 	// Apply default
-	const schema: z.ZodTypeAny =
+	const schema: z.ZodType =
 		options.default !== undefined ? boolSchema.default(options.default) : boolSchema;
 
 	const ui: FieldUIHints = {

package/src/fields/datetime.ts

@@ -25,7 +25,7 @@ export function datetime(options: DatetimeOptions = {}): FieldDefinition<Date> {
 	}
 
 	// Optional vs required
-	const schema: z.ZodTypeAny = options.required ? dateSchema : dateSchema.optional();
+	const schema: z.ZodType = options.required ? dateSchema : dateSchema.optional();
 
 	const ui: FieldUIHints = {
 		widget: "datetime",

package/src/fields/file.ts

@@ -21,7 +21,7 @@ export function file(options: FileOptions = {}): FieldDefinition<FileValue> {
 		meta: z.record(z.string(), z.unknown()).optional(),
 	});
 
-	const schema: z.ZodTypeAny = options.required ? fileObjSchema : fileObjSchema.optional();
+	const schema: z.ZodType = options.required ? fileObjSchema : fileObjSchema.optional();
 
 	const ui: FieldUIHints = {
 		widget: "file",

package/src/fields/integer.ts

@@ -29,7 +29,7 @@ export function integer(options: IntegerOptions = {}): FieldDefinition<number> {
 	}
 
 	// Optional vs required
-	const schema: z.ZodTypeAny = options.required ? intSchema : intSchema.optional();
+	const schema: z.ZodType = options.required ? intSchema : intSchema.optional();
 
 	const ui: FieldUIHints = {
 		widget: "number",

package/src/fields/json.ts

@@ -15,7 +15,7 @@ export function json<T = unknown>(options: JsonOptions<T> = {}): FieldDefinition
 	// When T = unknown (default), z.unknown() is already z.ZodType<unknown>.
 	// When a custom schema is provided, it carries the correct generic.
 	// The generic constraint ensures type safety for callers.
-	let schema: z.ZodTypeAny = options.schema ?? z.unknown();
+	let schema: z.ZodType = options.schema ?? z.unknown();
 
 	// Optional vs required
 	if (!options.required && !options.schema) {

package/src/fields/multiselect.ts

@@ -28,7 +28,7 @@ export function multiSelect<T extends readonly [string, ...string[]]>(
 	}
 
 	// Optional vs required
-	const schema: z.ZodTypeAny = msOptions.required ? arraySchema : arraySchema.optional();
+	const schema: z.ZodType = msOptions.required ? arraySchema : arraySchema.optional();
 
 	const ui: FieldUIHints = {
 		widget: "multiSelect",

package/src/fields/number.ts

@@ -32,7 +32,7 @@ export function number(options: NumberOptions = {}): FieldDefinition<number> {
 	}
 
 	// Optional vs required
-	const schema: z.ZodTypeAny = options.required ? numberSchema : numberSchema.optional();
+	const schema: z.ZodType = options.required ? numberSchema : numberSchema.optional();
 
 	const ui: FieldUIHints = {
 		widget: "number",

package/src/fields/portable-text.ts

@@ -10,7 +10,7 @@ const portableTextBlockSchema: z.ZodType<PortableTextBlock> = z
 		_type: z.string(),
 		_key: z.string(),
 	})
-	.passthrough();
+	.loose();
 
 /**
  * Portable Text field

package/src/fields/richtext.ts

@@ -14,7 +14,7 @@ export function richText(options: RichTextOptions = {}): FieldDefinition<string>
 	const stringSchema = z.string();
 
 	// Optional vs required
-	const schema: z.ZodTypeAny = options.required ? stringSchema : stringSchema.optional();
+	const schema: z.ZodType = options.required ? stringSchema : stringSchema.optional();
 
 	const ui: FieldUIHints = {
 		widget: "richText",