emdash 0.36.0 → 0.37.0

package/src/plugins/index.ts

@@ -78,6 +78,9 @@ export {
 	createSandboxRouteErrorEnvelope,
 	getSandboxRouteErrorDetails,
 	getSandboxRouteErrorEnvelope,
+	MAX_SANDBOX_SAVE_REJECTION_REASON_LENGTH,
+	SANDBOX_HOOK_RESULT_VERSION,
+	inspectSandboxHookResult,
 	createNoopSandboxRunner,
 } from "./sandbox/index.js";
 export type {
@@ -93,6 +96,9 @@ export type {
 	SandboxRouteErrorCode,
 	SandboxRouteErrorDetails,
 	SandboxRouteErrorEnvelope,
+	SandboxHookErrorEnvelope,
+	SandboxHookResultInspection,
+	SandboxSaveRejectedError,
 } from "./sandbox/index.js";
 
 // Types

package/src/plugins/manager.ts

@@ -305,12 +305,13 @@ export class PluginManager {
 		content: Record<string, unknown>,
 		collection: string,
 		isNew: boolean,
+		id?: string,
 	): Promise<{
 		content: Record<string, unknown>;
 		results: HookResult<Record<string, unknown>>[];
 	}> {
 		this.ensureInitialized();
-		return this.hookPipeline!.runContentBeforeSave(content, collection, isNew);
+		return this.hookPipeline!.runContentBeforeSave(content, collection, isNew, id);
 	}
 
 	/**

package/src/plugins/manifest-schema.ts

@@ -243,7 +243,7 @@ const pluginAdminConfigSchema = z.object({
 								action_id: z.string(),
 								label: z.string().optional(),
 							})
-							.passthrough(),
+							.loose(),
 					)
 					.optional(),
 			}),

package/src/plugins/routes.ts

@@ -8,6 +8,8 @@
  *
  */
 
+import { z } from "zod";
+
 import { MediaUsageActivationWriteBlockedError } from "../api/media-usage-write-fence.js";
 import { PluginContextFactory, type PluginContextFactoryOptions } from "./context.js";
 import { extractRequestMeta } from "./request-meta.js";
@@ -215,7 +217,7 @@ export class PluginRouteHandler {
 					error: {
 						code: "VALIDATION_ERROR",
 						message: "Invalid request body",
-						details: parseResult.error.format(),
+						details: z.formatError(parseResult.error),
 					},
 					status: 400,
 				};

package/src/plugins/sandbox/hook-result.ts

@@ -0,0 +1,52 @@
+/** Current wire-format version for sandbox hook result envelopes. */
+export const SANDBOX_HOOK_RESULT_VERSION = 1 as const;
+
+/** Maximum editor-facing rejection reason accepted from a sandboxed plugin. */
+export const MAX_SANDBOX_SAVE_REJECTION_REASON_LENGTH = 500;
+
+export interface SandboxSaveRejectedError {
+	code: "SAVE_REJECTED";
+	reason: string;
+}
+
+/**
+ * Returned from a sandboxed `content:beforeSave` hook to reject the save.
+ * The host validates every field before exposing the reason to an editor.
+ */
+export interface SandboxHookErrorEnvelope {
+	__emdashSandboxHookResult: true;
+	version: typeof SANDBOX_HOOK_RESULT_VERSION;
+	error: SandboxSaveRejectedError;
+}
+
+export type SandboxHookResultInspection =
+	| { kind: "value" }
+	| { kind: "malformed" }
+	| { kind: "error"; error: SandboxSaveRejectedError };
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Validate and normalize an untrusted value returned across the sandbox boundary. */
+export function inspectSandboxHookResult(value: unknown): SandboxHookResultInspection {
+	if (!isRecord(value) || !Object.hasOwn(value, "__emdashSandboxHookResult")) {
+		return { kind: "value" };
+	}
+	if (
+		value.__emdashSandboxHookResult !== true ||
+		value.version !== SANDBOX_HOOK_RESULT_VERSION ||
+		!isRecord(value.error) ||
+		value.error.code !== "SAVE_REJECTED" ||
+		typeof value.error.reason !== "string"
+	) {
+		return { kind: "malformed" };
+	}
+
+	const reason = value.error.reason.trim();
+	if (reason.length === 0 || reason.length > MAX_SANDBOX_SAVE_REJECTION_REASON_LENGTH) {
+		return { kind: "malformed" };
+	}
+
+	return { kind: "error", error: { code: "SAVE_REJECTED", reason } };
+}

package/src/plugins/sandbox/index.ts

@@ -11,6 +11,11 @@ export {
 	getSandboxRouteErrorDetails,
 	getSandboxRouteErrorEnvelope,
 } from "./types.js";
+export {
+	MAX_SANDBOX_SAVE_REJECTION_REASON_LENGTH,
+	SANDBOX_HOOK_RESULT_VERSION,
+	inspectSandboxHookResult,
+} from "./hook-result.js";
 
 export type {
 	SandboxRunner,
@@ -26,3 +31,8 @@ export type {
 	SandboxRouteErrorDetails,
 	SandboxRouteErrorEnvelope,
 } from "./types.js";
+export type {
+	SandboxHookErrorEnvelope,
+	SandboxHookResultInspection,
+	SandboxSaveRejectedError,
+} from "./hook-result.js";

package/src/plugins/types.ts

@@ -811,6 +811,12 @@ export interface ContentHookEvent {
 	content: Record<string, unknown>;
 	collection: string;
 	isNew: boolean;
+	/**
+	 * ID of the existing item on `content:beforeSave` for an update. Absent on
+	 * creates, where the ID is assigned when the save completes, and on
+	 * `content:afterSave`, where `content.id` carries it.
+	 */
+	id?: string;
 }
 
 /**

package/src/registry/artifact-checksum.ts

@@ -0,0 +1,15 @@
+import { verifyMultihash } from "@emdash-cms/registry-verification/checksum";
+
+const SHA256_HEX_PATTERN = /^[0-9a-fA-F]{64}$/;
+
+export async function verifyRegistryArtifactChecksum(
+	bytes: Uint8Array,
+	checksum: string,
+): Promise<boolean> {
+	if (SHA256_HEX_PATTERN.test(checksum)) {
+		const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes)));
+		const actual = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+		return actual === checksum.toLowerCase();
+	}
+	return (await verifyMultihash(bytes, checksum)).success;
+}

package/src/registry/artifact-verification.ts

@@ -0,0 +1,85 @@
+import type { VerificationErrorCode } from "@emdash-cms/registry-verification";
+import { validatePluginBundle } from "@emdash-cms/registry-verification/bundle";
+import {
+	computeArtifactDigestCandidates,
+	verifyMultihash,
+} from "@emdash-cms/registry-verification/checksum";
+
+import { pluginManifestSchema, reconcileManifestAccess } from "../plugins/manifest-schema.js";
+import type { PluginBundle } from "../plugins/marketplace.js";
+
+const bundleDecoder = new TextDecoder("utf-8", { fatal: true });
+
+export type RegistryArtifactVerificationCode =
+	| VerificationErrorCode
+	| "BUNDLE_INVALID_CODE_ENCODING"
+	| "BUNDLE_RUNTIME_UNSUPPORTED";
+
+export type RegistryArtifactVerificationResult =
+	| {
+			success: true;
+			value: {
+				bundle: PluginBundle;
+				artifactDigest: Uint8Array;
+				artifactDigests: readonly Uint8Array[];
+			};
+	  }
+	| {
+			success: false;
+			error: { code: RegistryArtifactVerificationCode; message: string };
+	  };
+
+export async function validateRegistryArtifact(
+	bytes: Uint8Array,
+	checksum: string,
+	slug: string,
+	version: string,
+): Promise<RegistryArtifactVerificationResult> {
+	const checksumReport = await verifyMultihash(bytes, checksum);
+	if (!checksumReport.success) return checksumReport;
+	const [artifactDigest, ...artifactDigests] = await computeArtifactDigestCandidates(bytes);
+
+	const bundleReport = await validatePluginBundle(bytes, {
+		expectedSlug: slug,
+		expectedVersion: version,
+	});
+	if (!bundleReport.success) return bundleReport;
+
+	const manifest = pluginManifestSchema.safeParse(bundleReport.value.manifest);
+	if (!manifest.success) {
+		return {
+			success: false,
+			error: {
+				code: "BUNDLE_RUNTIME_UNSUPPORTED",
+				message: "The plugin bundle uses manifest features unsupported by this EmDash version.",
+			},
+		};
+	}
+
+	try {
+		return {
+			success: true,
+			value: {
+				bundle: {
+					manifest: reconcileManifestAccess(manifest.data),
+					backendCode: bundleDecoder.decode(bundleReport.value.backend),
+					adminCode:
+						bundleReport.value.admin === undefined
+							? undefined
+							: bundleDecoder.decode(bundleReport.value.admin),
+					checksum,
+				},
+				artifactDigest,
+				artifactDigests,
+			},
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "BUNDLE_INVALID_CODE_ENCODING",
+				message: "Plugin bundle code must be valid UTF-8.",
+			},
+		};
+	}
+}

package/src/registry/authoritative-records.ts

@@ -0,0 +1,180 @@
+import type {
+	DirectPdsDidDocumentResolver,
+	DirectPdsProfileRecord,
+	DirectPdsReadErrorCode,
+	DirectPdsReleaseRecord,
+} from "@emdash-cms/registry-client/direct-pds";
+import { DirectPdsClient, DirectPdsReadError } from "@emdash-cms/registry-client/direct-pds";
+import {
+	fetchVerifiedResource,
+	inspectPackageReleaseRecords,
+	verifyMultihash,
+	verifyPackageReleaseRecords,
+	type FetchImplementation,
+	type HostnameResolver,
+	type ProvenanceVerifier,
+	type RecordInspectionReport,
+	type RecordVerificationFailure,
+	type RecordVerificationReport,
+	type VerificationErrorCode,
+} from "@emdash-cms/registry-verification";
+
+import { cloudflareDohResolver, ssrfSafeFetch } from "../security/ssrf.js";
+
+const MAX_PROVENANCE_BYTES = 5 * 1024 * 1024;
+
+export type AuthoritativeRecordErrorCode =
+	| DirectPdsReadErrorCode
+	| VerificationErrorCode
+	| "AUTHORITATIVE_RECORD_READ_FAILED";
+
+export interface AuthoritativeRecordReadOptions {
+	fetch?: typeof fetch;
+	didDocumentResolver?: DirectPdsDidDocumentResolver;
+	provenanceFetch?: FetchImplementation;
+	resolveHostname?: HostnameResolver;
+	provenanceVerifier?: ProvenanceVerifier;
+	artifactDigests?: readonly Uint8Array[];
+}
+
+export interface VerifiedAuthoritativeRecords {
+	publisherDid: string;
+	packageSlug: string;
+	version: string;
+	profile: DirectPdsProfileRecord;
+	release: DirectPdsReleaseRecord;
+	inspection: Extract<RecordInspectionReport, { success: true }>;
+}
+
+export type VerifiedAuthoritativeReleaseReport = Extract<
+	RecordVerificationReport,
+	{ success: true }
+>;
+
+export type AuthoritativeRecordReadResult =
+	| { success: true; value: VerifiedAuthoritativeRecords }
+	| {
+			success: false;
+			error: { code: AuthoritativeRecordErrorCode; message: string };
+	  };
+
+export type AuthoritativeRecordReader = (
+	publisherDid: string,
+	packageSlug: string,
+	version: string,
+	options?: AuthoritativeRecordReadOptions,
+) => Promise<AuthoritativeRecordReadResult>;
+
+export async function readAuthoritativePackageRelease(
+	publisherDid: string,
+	packageSlug: string,
+	version: string,
+	options: AuthoritativeRecordReadOptions = {},
+): Promise<AuthoritativeRecordReadResult> {
+	try {
+		const client = new DirectPdsClient({
+			did: publisherDid,
+			fetch: options.fetch ?? guardedFetch,
+			didDocumentResolver: options.didDocumentResolver,
+		});
+		const [profile, release] = await Promise.all([
+			client.getPackageProfile(packageSlug),
+			client.getPackageRelease(packageSlug, version),
+		]);
+		const inspection = await inspectPackageReleaseRecords({
+			publisherDid,
+			package: packageSlug,
+			version,
+			rkey: release.rkey,
+			profile: profile.value,
+			release: release.value,
+		});
+		if (!inspection.success) {
+			return {
+				success: false,
+				error: {
+					code: inspection.code,
+					message: inspection.reasons[0]?.message ?? "The signed package records are invalid.",
+				},
+			};
+		}
+		return {
+			success: true,
+			value: { publisherDid, packageSlug, version, profile, release, inspection },
+		};
+	} catch (error) {
+		if (error instanceof DirectPdsReadError) {
+			return { success: false, error: { code: error.code, message: error.message } };
+		}
+		return {
+			success: false,
+			error: {
+				code: "AUTHORITATIVE_RECORD_READ_FAILED",
+				message: "The publisher's signed package records could not be verified.",
+			},
+		};
+	}
+}
+
+export async function verifyAuthoritativePackageRelease(
+	records: VerifiedAuthoritativeRecords,
+	artifactDigest: Uint8Array,
+	options: AuthoritativeRecordReadOptions = {},
+): Promise<RecordVerificationReport> {
+	const context = records.inspection.value;
+	const provenanceReference = context.releaseExtension.provenance;
+	let document: Uint8Array | undefined;
+	if (provenanceReference) {
+		const fetched = await fetchVerifiedResource(provenanceReference.url, {
+			fetch: options.provenanceFetch ?? defaultProvenanceFetch,
+			resolveHostname: options.resolveHostname ?? cloudflareDohResolver,
+			maxBytes: MAX_PROVENANCE_BYTES,
+		});
+		if (!fetched.success) {
+			return verificationFailure(fetched.error.code, fetched.error.message);
+		}
+		const checksum = await verifyMultihash(fetched.value.bytes, provenanceReference.checksum);
+		if (!checksum.success) {
+			return verificationFailure(checksum.error.code, checksum.error.message);
+		}
+		document = fetched.value.bytes;
+	}
+
+	return verifyPackageReleaseRecords({
+		publisherDid: records.publisherDid,
+		package: records.packageSlug,
+		version: records.version,
+		rkey: records.release.rkey,
+		profile: records.profile.value,
+		release: records.release.value,
+		provenance:
+			document === undefined
+				? undefined
+				: {
+						document,
+						artifactDigest,
+						artifactDigests: options.artifactDigests,
+						verifier: options.provenanceVerifier,
+					},
+	});
+}
+
+function verificationFailure(
+	code: VerificationErrorCode,
+	message: string,
+): RecordVerificationFailure {
+	return {
+		success: false,
+		status: "failed",
+		code,
+		reasons: [{ code, message }],
+		provenance: { status: "failed" },
+	};
+}
+
+const guardedFetch: typeof fetch = async (input, init) => {
+	const url = input instanceof Request ? input.url : String(input);
+	return ssrfSafeFetch(url, init, { httpsOnly: true });
+};
+
+const defaultProvenanceFetch: FetchImplementation = (input, init) => globalThis.fetch(input, init);

package/src/registry/record-labels.ts

@@ -0,0 +1,28 @@
+interface VersionedRecordLabel {
+	val?: string;
+	uri?: string;
+	cid?: string;
+	neg?: boolean;
+	exp?: string;
+}
+
+export function hasCurrentRecordLabel(
+	labels: readonly VersionedRecordLabel[],
+	value: string,
+	record: { uri: string; cid: string },
+	now = Date.now(),
+): boolean {
+	return labels.some((label) => {
+		if (
+			label.val !== value ||
+			label.uri !== record.uri ||
+			label.cid !== record.cid ||
+			label.neg === true
+		) {
+			return false;
+		}
+		if (label.exp === undefined) return true;
+		const expiresAt = Date.parse(label.exp);
+		return Number.isFinite(expiresAt) && expiresAt > now;
+	});
+}

package/src/schema/registry.ts

@@ -9,6 +9,7 @@ import type {
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
+import { refreshDevTypes } from "../astro/dev-typegen.js";
 import { currentTimestamp, listTablesLike, tableExists } from "../database/dialect-helpers.js";
 import { withTransaction } from "../database/transaction.js";
 import type { CollectionTable, Database, FieldTable } from "../database/types.js";
@@ -244,6 +245,13 @@ export class SchemaError extends Error {
 export class SchemaRegistry {
 	constructor(private db: Kysely<Database>) {}
 
+	/**
+	 * Notify the dev typegen hook that the schema has changed.
+	 */
+	private notifyTypegen(): void {
+		refreshDevTypes(this.db);
+	}
+
 	// ============================================
 	// Collection Operations
 	// ============================================
@@ -496,6 +504,7 @@ export class SchemaRegistry {
 			throw new SchemaError("Failed to create collection", "CREATE_FAILED");
 		}
 
+		this.notifyTypegen();
 		return collection;
 	}
 
@@ -671,6 +680,7 @@ export class SchemaRegistry {
 			}
 			throw error;
 		}
+		this.notifyTypegen();
 	}
 
 	private async assertSeedFieldDefinitions(
@@ -719,7 +729,7 @@ export class SchemaRegistry {
 	 * Update a collection
 	 */
 	async updateCollection(slug: string, input: UpdateCollectionInput): Promise<Collection> {
-		return withTransaction(this.db, async (trx) => {
+		const updated = await withTransaction(this.db, async (trx) => {
 			const existingRow = await trx
 				.selectFrom("_emdash_collections")
 				.where("slug", "=", slug)
@@ -798,6 +808,8 @@ export class SchemaRegistry {
 
 			return this.mapCollectionRow(row);
 		});
+		this.notifyTypegen();
+		return updated;
 	}
 
 	/**
@@ -852,6 +864,7 @@ export class SchemaRegistry {
 			}
 			throw error;
 		}
+		this.notifyTypegen();
 	}
 
 	// ============================================
@@ -1005,6 +1018,7 @@ export class SchemaRegistry {
 					"CONTENT_USAGE_STALE",
 				);
 			}
+			this.notifyTypegen();
 			return created;
 		} catch (error) {
 			if (schemaMutated) {
@@ -1185,6 +1199,7 @@ export class SchemaRegistry {
 					);
 				}
 			}
+			this.notifyTypegen();
 			return updatedField;
 		} catch (error) {
 			if (schemaMutated) {
@@ -1326,6 +1341,7 @@ export class SchemaRegistry {
 			}
 			throw error;
 		}
+		this.notifyTypegen();
 	}
 
 	/**
@@ -1380,6 +1396,7 @@ export class SchemaRegistry {
 					.execute();
 			}
 		});
+		this.notifyTypegen();
 	}
 
 	/**
@@ -1400,6 +1417,7 @@ export class SchemaRegistry {
 				.where("slug", "=", fieldSlugs[i])
 				.execute();
 		}
+		this.notifyTypegen();
 	}
 
 	// ============================================
@@ -1463,9 +1481,13 @@ export class SchemaRegistry {
 			ON ${sql.ref(tableName)} (slug)
 		`.execute(conn);
 
+		// Name must stay identical to migration 074. `deleted_at` leads so the
+		// scheduled-publishing sweep can seek it and walk `scheduled_at` for both
+		// its range and its ORDER BY; a `scheduled_at`-only index leaves a
+		// stats-blind planner reading every live row.
 		await sql`
-			${createIndex} ${sql.ref(`idx_${tableName}_scheduled`)}
-			ON ${sql.ref(tableName)} (scheduled_at)
+			${createIndex} ${sql.ref(`idx_${tableName}_del_sched`)}
+			ON ${sql.ref(tableName)} (deleted_at, scheduled_at)
 			WHERE scheduled_at IS NOT NULL
 		`.execute(conn);
 
@@ -1992,6 +2014,7 @@ export class SchemaRegistry {
 				throw new SchemaError("Failed to register orphaned table", "REGISTER_FAILED");
 			}
 			await markContentMediaUsageCollectionStaleSafely(this.db, slug, "CONTENT_USAGE_STALE");
+			this.notifyTypegen();
 
 			return collection;
 		} catch (error) {

package/src/schema/zod-generator.ts

@@ -1,4 +1,4 @@
-import { z, type ZodTypeAny } from "zod";
+import { z, type ZodType } from "zod";
 
 import { hashString } from "../utils/hash.js";
 import type { CollectionWithFields, Field, FieldType, RepeaterSubField } from "./types.js";
@@ -14,8 +14,8 @@ const PASCAL_CASE_SPLIT_PATTERN = /[_\-\s]+/;
  */
 export function generateZodSchema(
 	collection: CollectionWithFields,
-): z.ZodObject<Record<string, ZodTypeAny>> {
-	const shape: Record<string, ZodTypeAny> = {};
+): z.ZodObject<Record<string, ZodType>> {
+	const shape: Record<string, ZodType> = {};
 
 	for (const field of collection.fields) {
 		shape[field.slug] = generateFieldSchema(field);
@@ -27,7 +27,7 @@ export function generateZodSchema(
 /**
  * Generate Zod schema for a single field
  */
-export function generateFieldSchema(field: Field): ZodTypeAny {
+export function generateFieldSchema(field: Field): ZodType {
 	let schema = getBaseSchema(field.type, field);
 
 	// Apply validation rules
@@ -58,10 +58,10 @@ export function generateFieldSchema(field: Field): ZodTypeAny {
 /**
  * Get base Zod schema for a field type
  */
-function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTypeAny {
+function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodType {
 	switch (type) {
 		case "url":
-			return z.string().url();
+			return z.string().check(z.url());
 
 		case "string":
 		case "text":
@@ -94,7 +94,10 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 			// validate or the entry becomes unsavable through its own editor
 			// (#1368; same class as #867). `z.iso.*` retains semantic validation,
 			// so impossible dates are still rejected.
-			return z.iso.datetime({ offset: true, local: true }).or(z.iso.date());
+			return z.iso
+				.datetime({ offset: true, local: true })
+				.or(z.iso.datetime({ offset: true, local: true, precision: -1 }))
+				.or(z.iso.date());
 
 		case "select": {
 			const options = field.validation?.options;
@@ -122,7 +125,7 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 			// renderers dispatch on it, but `_key` is intentionally optional:
 			// it's a UI-layer concern that the editor regenerates on every
 			// change (see `PortableTextEditor`), and the rest of this schema
-			// uses `.passthrough()` for everything below the top level. Making
+			// uses `.loose()` for everything below the top level. Making
 			// `_key` strictly required here was an accidentally tight invariant
 			// that rejected any seed/import data not authored against the
 			// editor (#867 — autosave failures on seeded template content).
@@ -132,7 +135,7 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 						_type: z.string(),
 						_key: z.string().optional(),
 					})
-					.passthrough(),
+					.loose(),
 			);
 
 		case "image": {
@@ -186,8 +189,8 @@ function getBaseSchema(type: FieldType, field: Pick<Field, "validation">): ZodTy
 
 function generateRepeaterRowSchema(
 	subFields: readonly RepeaterSubField[],
-): z.ZodObject<Record<string, ZodTypeAny>> {
-	const shape: Record<string, ZodTypeAny> = {};
+): z.ZodObject<Record<string, ZodType>> {
+	const shape: Record<string, ZodType> = {};
 
 	for (const subField of subFields) {
 		let schema = getBaseSchema(subField.type, {
@@ -204,13 +207,13 @@ function generateRepeaterRowSchema(
 		shape[subField.slug] = schema;
 	}
 
-	return z.object(shape).passthrough();
+	return z.object(shape).loose();
 }
 
 /**
  * Apply validation rules to a schema
  */
-function applyValidation(schema: ZodTypeAny, field: Field): ZodTypeAny {
+function applyValidation(schema: ZodType, field: Field): ZodType {
 	const validation = field.validation;
 	if (!validation) return schema;