emdash 0.36.0 → 0.38.0

package/src/registry/authoritative-records.ts

@@ -0,0 +1,180 @@
+import type {
+	DirectPdsDidDocumentResolver,
+	DirectPdsProfileRecord,
+	DirectPdsReadErrorCode,
+	DirectPdsReleaseRecord,
+} from "@emdash-cms/registry-client/direct-pds";
+import { DirectPdsClient, DirectPdsReadError } from "@emdash-cms/registry-client/direct-pds";
+import {
+	fetchVerifiedResource,
+	inspectPackageReleaseRecords,
+	verifyMultihash,
+	verifyPackageReleaseRecords,
+	type FetchImplementation,
+	type HostnameResolver,
+	type ProvenanceVerifier,
+	type RecordInspectionReport,
+	type RecordVerificationFailure,
+	type RecordVerificationReport,
+	type VerificationErrorCode,
+} from "@emdash-cms/registry-verification";
+
+import { cloudflareDohResolver, ssrfSafeFetch } from "../security/ssrf.js";
+
+const MAX_PROVENANCE_BYTES = 5 * 1024 * 1024;
+
+export type AuthoritativeRecordErrorCode =
+	| DirectPdsReadErrorCode
+	| VerificationErrorCode
+	| "AUTHORITATIVE_RECORD_READ_FAILED";
+
+export interface AuthoritativeRecordReadOptions {
+	fetch?: typeof fetch;
+	didDocumentResolver?: DirectPdsDidDocumentResolver;
+	provenanceFetch?: FetchImplementation;
+	resolveHostname?: HostnameResolver;
+	provenanceVerifier?: ProvenanceVerifier;
+	artifactDigests?: readonly Uint8Array[];
+}
+
+export interface VerifiedAuthoritativeRecords {
+	publisherDid: string;
+	packageSlug: string;
+	version: string;
+	profile: DirectPdsProfileRecord;
+	release: DirectPdsReleaseRecord;
+	inspection: Extract<RecordInspectionReport, { success: true }>;
+}
+
+export type VerifiedAuthoritativeReleaseReport = Extract<
+	RecordVerificationReport,
+	{ success: true }
+>;
+
+export type AuthoritativeRecordReadResult =
+	| { success: true; value: VerifiedAuthoritativeRecords }
+	| {
+			success: false;
+			error: { code: AuthoritativeRecordErrorCode; message: string };
+	  };
+
+export type AuthoritativeRecordReader = (
+	publisherDid: string,
+	packageSlug: string,
+	version: string,
+	options?: AuthoritativeRecordReadOptions,
+) => Promise<AuthoritativeRecordReadResult>;
+
+export async function readAuthoritativePackageRelease(
+	publisherDid: string,
+	packageSlug: string,
+	version: string,
+	options: AuthoritativeRecordReadOptions = {},
+): Promise<AuthoritativeRecordReadResult> {
+	try {
+		const client = new DirectPdsClient({
+			did: publisherDid,
+			fetch: options.fetch ?? guardedFetch,
+			didDocumentResolver: options.didDocumentResolver,
+		});
+		const [profile, release] = await Promise.all([
+			client.getPackageProfile(packageSlug),
+			client.getPackageRelease(packageSlug, version),
+		]);
+		const inspection = await inspectPackageReleaseRecords({
+			publisherDid,
+			package: packageSlug,
+			version,
+			rkey: release.rkey,
+			profile: profile.value,
+			release: release.value,
+		});
+		if (!inspection.success) {
+			return {
+				success: false,
+				error: {
+					code: inspection.code,
+					message: inspection.reasons[0]?.message ?? "The signed package records are invalid.",
+				},
+			};
+		}
+		return {
+			success: true,
+			value: { publisherDid, packageSlug, version, profile, release, inspection },
+		};
+	} catch (error) {
+		if (error instanceof DirectPdsReadError) {
+			return { success: false, error: { code: error.code, message: error.message } };
+		}
+		return {
+			success: false,
+			error: {
+				code: "AUTHORITATIVE_RECORD_READ_FAILED",
+				message: "The publisher's signed package records could not be verified.",
+			},
+		};
+	}
+}
+
+export async function verifyAuthoritativePackageRelease(
+	records: VerifiedAuthoritativeRecords,
+	artifactDigest: Uint8Array,
+	options: AuthoritativeRecordReadOptions = {},
+): Promise<RecordVerificationReport> {
+	const context = records.inspection.value;
+	const provenanceReference = context.releaseExtension.provenance;
+	let document: Uint8Array | undefined;
+	if (provenanceReference) {
+		const fetched = await fetchVerifiedResource(provenanceReference.url, {
+			fetch: options.provenanceFetch ?? defaultProvenanceFetch,
+			resolveHostname: options.resolveHostname ?? cloudflareDohResolver,
+			maxBytes: MAX_PROVENANCE_BYTES,
+		});
+		if (!fetched.success) {
+			return verificationFailure(fetched.error.code, fetched.error.message);
+		}
+		const checksum = await verifyMultihash(fetched.value.bytes, provenanceReference.checksum);
+		if (!checksum.success) {
+			return verificationFailure(checksum.error.code, checksum.error.message);
+		}
+		document = fetched.value.bytes;
+	}
+
+	return verifyPackageReleaseRecords({
+		publisherDid: records.publisherDid,
+		package: records.packageSlug,
+		version: records.version,
+		rkey: records.release.rkey,
+		profile: records.profile.value,
+		release: records.release.value,
+		provenance:
+			document === undefined
+				? undefined
+				: {
+						document,
+						artifactDigest,
+						artifactDigests: options.artifactDigests,
+						verifier: options.provenanceVerifier,
+					},
+	});
+}
+
+function verificationFailure(
+	code: VerificationErrorCode,
+	message: string,
+): RecordVerificationFailure {
+	return {
+		success: false,
+		status: "failed",
+		code,
+		reasons: [{ code, message }],
+		provenance: { status: "failed" },
+	};
+}
+
+const guardedFetch: typeof fetch = async (input, init) => {
+	const url = input instanceof Request ? input.url : String(input);
+	return ssrfSafeFetch(url, init, { httpsOnly: true });
+};
+
+const defaultProvenanceFetch: FetchImplementation = (input, init) => globalThis.fetch(input, init);

package/src/registry/config.ts

@@ -41,6 +41,39 @@ export interface ManifestRegistryConfig {
 	};
 }
 
+export type RegistryConfigurationErrorCode =
+	| "REGISTRY_AGGREGATOR_URL_REQUIRED"
+	| "REGISTRY_AGGREGATOR_URL_INVALID"
+	| "REGISTRY_AGGREGATOR_URL_FORBIDDEN"
+	| "REGISTRY_MINIMUM_RELEASE_AGE_INVALID"
+	| "REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID";
+
+export type RegistryConfigurationField =
+	| "experimental.registry.aggregatorUrl"
+	| "experimental.registry.policy.minimumReleaseAge"
+	| "experimental.registry.policy.minimumReleaseAgeExclude";
+
+export interface ManifestRegistryConfigurationError {
+	code: RegistryConfigurationErrorCode;
+	field: RegistryConfigurationField;
+}
+
+class RegistryConfigurationError extends Error {
+	constructor(
+		public readonly code: RegistryConfigurationErrorCode,
+		public readonly field: RegistryConfigurationField,
+		message: string,
+		options?: ErrorOptions,
+	) {
+		super(`EmDash registry configuration error in ${field}: ${message}`, options);
+		this.name = "RegistryConfigurationError";
+	}
+}
+
+interface RegistryConfigurationValidationOptions {
+	allowLocalhost?: boolean;
+}
+
 /**
  * Canonicalize a capabilities list for set-style comparison.
  *
@@ -169,15 +202,27 @@ export function parseDurationSeconds(duration: string | number): number {
  * own HTTPS bundle, defeating the checksum trust chain because the
  * attacker controls the unsigned transport that supplied the checksum.
  */
-export function validateAggregatorUrl(aggregatorUrl: string): URL {
+export function validateAggregatorUrl(
+	aggregatorUrl: string,
+	options: RegistryConfigurationValidationOptions = {},
+): URL {
 	let parsed: URL;
 	try {
 		parsed = new URL(aggregatorUrl);
-	} catch {
-		throw new Error(`registry.aggregatorUrl is not a valid URL: ${aggregatorUrl}`);
+	} catch (cause) {
+		throw new RegistryConfigurationError(
+			"REGISTRY_AGGREGATOR_URL_INVALID",
+			"experimental.registry.aggregatorUrl",
+			"must be a valid URL",
+			{ cause },
+		);
 	}
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-		throw new Error(`registry.aggregatorUrl must use http or https: ${aggregatorUrl}`);
+		throw new RegistryConfigurationError(
+			"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
+			"experimental.registry.aggregatorUrl",
+			"must use HTTP or HTTPS",
+		);
 	}
 	// Reject embedded credentials. The normalized aggregator URL ends
 	// up in the admin manifest and is shipped to every admin browser;
@@ -185,7 +230,11 @@ export function validateAggregatorUrl(aggregatorUrl: string): URL {
 	// so leaving them in would both leak the credentials and break the
 	// registry UI at runtime.
 	if (parsed.username || parsed.password) {
-		throw new Error("registry.aggregatorUrl must not contain embedded credentials (user:pass@)");
+		throw new RegistryConfigurationError(
+			"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
+			"experimental.registry.aggregatorUrl",
+			"must not contain embedded credentials",
+		);
 	}
 
 	// WHATWG URL preserves the brackets on IPv6 hostnames -- strip them
@@ -205,18 +254,27 @@ export function validateAggregatorUrl(aggregatorUrl: string): URL {
 		hostname.startsWith("::ffff:127.") ||
 		hostname.startsWith("::ffff:7f00:");
 
-	if (!import.meta.env.DEV) {
+	const allowLocalhost = options.allowLocalhost ?? import.meta.env.DEV;
+	if (!allowLocalhost) {
 		if (parsed.protocol === "http:") {
-			throw new Error(`registry.aggregatorUrl must use https in production: ${aggregatorUrl}`);
+			throw new RegistryConfigurationError(
+				"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
+				"experimental.registry.aggregatorUrl",
+				"must use HTTPS outside development",
+			);
 		}
 		if (isLocalhost) {
-			throw new Error(
-				`registry.aggregatorUrl points at localhost; allowed only in dev: ${aggregatorUrl}`,
+			throw new RegistryConfigurationError(
+				"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
+				"experimental.registry.aggregatorUrl",
+				"must not point at localhost outside development",
 			);
 		}
 	} else if (parsed.protocol === "http:" && !isLocalhost) {
-		throw new Error(
-			`registry.aggregatorUrl must use https (http allowed only for localhost in dev): ${aggregatorUrl}`,
+		throw new RegistryConfigurationError(
+			"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
+			"experimental.registry.aggregatorUrl",
+			"must use HTTPS unless it points at localhost in development",
 		);
 	}
 
@@ -251,28 +309,30 @@ export function coerceRegistryConfig(
  * object. Returns `null` when `input` is undefined so callers can
  * spread the result directly into the manifest object.
  *
- * Throws if the aggregator URL is malformed, points at a forbidden host,
- * or `policy.minimumReleaseAge` is unparseable. These surface at
- * runtime startup as 500s from the manifest endpoint -- intended,
- * because the alternative is silently disabling the registry on
- * misconfigured sites.
- *
- * TODO: switch to a Zod schema for richer per-field error messages and
- * to surface misconfigurations to the admin UI as a banner instead of
- * a manifest 500.
+ * Throws a field-specific configuration error if the aggregator URL is
+ * malformed or forbidden, or a registry policy value cannot be normalized.
+ * The Astro integration uses this to fail during config loading. Runtime
+ * manifest generation uses {@link resolveManifestRegistryConfig} to expose
+ * recognized failures without exposing the configured value.
  */
 export function normalizeRegistryConfig(
 	input: RegistryConfigInput | undefined,
+	options: RegistryConfigurationValidationOptions = {},
 ): ManifestRegistryConfig | null {
 	const config = coerceRegistryConfig(input);
 	if (!config) return null;
 
-	const aggregatorUrl = config.aggregatorUrl?.trim();
+	const aggregatorUrl =
+		typeof config.aggregatorUrl === "string" ? config.aggregatorUrl.trim() : undefined;
 	if (!aggregatorUrl) {
-		throw new Error("registry.aggregatorUrl is required when registry is configured");
+		throw new RegistryConfigurationError(
+			"REGISTRY_AGGREGATOR_URL_REQUIRED",
+			"experimental.registry.aggregatorUrl",
+			"is required when the registry is configured",
+		);
 	}
 
-	validateAggregatorUrl(aggregatorUrl);
+	validateAggregatorUrl(aggregatorUrl, options);
 
 	const out: ManifestRegistryConfig = {
 		// Strip any trailing slash so `${aggregatorUrl}/xrpc/...` works
@@ -288,18 +348,45 @@ export function normalizeRegistryConfig(
 	let hasPolicy = false;
 
 	if (config.policy?.minimumReleaseAge !== undefined) {
-		policy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);
+		try {
+			policy.minimumReleaseAgeSeconds = parseDurationSeconds(config.policy.minimumReleaseAge);
+		} catch (cause) {
+			throw new RegistryConfigurationError(
+				"REGISTRY_MINIMUM_RELEASE_AGE_INVALID",
+				"experimental.registry.policy.minimumReleaseAge",
+				'must be a duration such as "48h", "7d", or a non-negative number of seconds',
+				{ cause },
+			);
+		}
 		hasPolicy = true;
 	}
 
 	if (config.policy?.minimumReleaseAgeExclude !== undefined) {
+		if (!Array.isArray(config.policy.minimumReleaseAgeExclude)) {
+			throw new RegistryConfigurationError(
+				"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
+				"experimental.registry.policy.minimumReleaseAgeExclude",
+				"must be an array of DIDs or <did>/<slug> entries",
+			);
+		}
 		// Normalize at load time so callers (browser and server) can do
 		// plain string compares without each one re-implementing the
 		// case-folding rule.
 		const list = config.policy.minimumReleaseAgeExclude.map((entry) => {
+			if (typeof entry !== "string") {
+				throw new RegistryConfigurationError(
+					"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
+					"experimental.registry.policy.minimumReleaseAgeExclude",
+					"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>",
+				);
+			}
 			const trimmed = entry.trim();
 			if (!trimmed) {
-				throw new Error("registry.policy.minimumReleaseAgeExclude entries cannot be empty");
+				throw new RegistryConfigurationError(
+					"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
+					"experimental.registry.policy.minimumReleaseAgeExclude",
+					"entries cannot be empty",
+				);
 			}
 			const lower = trimmed.toLowerCase();
 			const [did, slug, ...extra] = lower.split("/");
@@ -309,8 +396,10 @@ export function normalizeRegistryConfig(
 				extra.length > 0 ||
 				(slug !== undefined && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug))
 			) {
-				throw new Error(
-					`registry.policy.minimumReleaseAgeExclude entry must be a DID or <did>/<slug>: ${trimmed}`,
+				throw new RegistryConfigurationError(
+					"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
+					"experimental.registry.policy.minimumReleaseAgeExclude",
+					"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>",
 				);
 			}
 			return lower;
@@ -327,3 +416,17 @@ export function normalizeRegistryConfig(
 
 	return out;
 }
+
+/** Normalize registry config without allowing a known config error to hide the admin. */
+export function resolveManifestRegistryConfig(input: RegistryConfigInput | undefined): {
+	registry?: ManifestRegistryConfig;
+	error?: ManifestRegistryConfigurationError;
+} {
+	try {
+		const registry = normalizeRegistryConfig(input);
+		return registry ? { registry } : {};
+	} catch (error) {
+		if (!(error instanceof RegistryConfigurationError)) throw error;
+		return { error: { code: error.code, field: error.field } };
+	}
+}

package/src/registry/record-labels.ts

@@ -0,0 +1,28 @@
+interface VersionedRecordLabel {
+	val?: string;
+	uri?: string;
+	cid?: string;
+	neg?: boolean;
+	exp?: string;
+}
+
+export function hasCurrentRecordLabel(
+	labels: readonly VersionedRecordLabel[],
+	value: string,
+	record: { uri: string; cid: string },
+	now = Date.now(),
+): boolean {
+	return labels.some((label) => {
+		if (
+			label.val !== value ||
+			label.uri !== record.uri ||
+			label.cid !== record.cid ||
+			label.neg === true
+		) {
+			return false;
+		}
+		if (label.exp === undefined) return true;
+		const expiresAt = Date.parse(label.exp);
+		return Number.isFinite(expiresAt) && expiresAt > now;
+	});
+}

package/src/registry/types.ts

@@ -56,12 +56,11 @@ export interface RegistryConfig {
 		 * Accepts a duration string (`"24h"`, `"48h"`, `"72h"`, `"7d"`) or a
 		 * number of seconds.
 		 *
-		 * Currently applies uniformly to all releases. A future addition
-		 * may exempt brand-new packages (those with no prior release
-		 * history) so the holdback doesn't block first-time publishing,
-		 * but that exemption is not implemented yet; use
-		 * {@link minimumReleaseAgeExclude} to allowlist trusted publishers
-		 * whose packages should install immediately.
+		 * A package's first release is exempt only when the aggregator
+		 * reports one release and confirms that its retained history is
+		 * complete. Missing or incomplete history keeps the holdback in
+		 * force. Use {@link minimumReleaseAgeExclude} to allowlist trusted
+		 * publishers whose packages should always install immediately.
 		 *
 		 * Defaults to `undefined` (no holdback). A future trust/moderation
 		 * RFC will specify the recommended default.

package/src/schema/collection-slugs-cache.ts

@@ -0,0 +1,157 @@
+/**
+ * Per-isolate cache of registered collection slugs (`_emdash_collections`).
+ *
+ * Term counting scopes its per-collection UNION to a taxonomy's declared
+ * collections, but a declared collection is not necessarily a created one:
+ * the migration-seeded defaults declare `posts` whether or not that
+ * collection ever exists. Querying optimistically and catching the
+ * missing-table error keeps results correct, yet the failed statement itself
+ * is logged by the database — on D1 it surfaces as a `no such table` error
+ * span per taxonomy per uncached render. Filtering declared collections
+ * against the registry up front means the failing statement is never sent.
+ *
+ * Stored on globalThis behind a Symbol key (same pattern as the taxonomy-defs
+ * cache in `taxonomies/index.ts`) so bundler chunk duplication cannot produce
+ * two independent caches. The promise is cached, so concurrent cold readers
+ * share one in-flight query; a rejection evicts the entry.
+ *
+ * Freshness:
+ * - Primed for free at isolate boot: runtime init's auto-seed gate already
+ *   reads `_emdash_collections` and hands the slugs to
+ *   `primeRegisteredCollections`, so cold isolates pay no extra query.
+ * - Every schema-mutation path resets it: `invalidateUrlPatternCache()`
+ *   (admin API, MCP, WordPress import, seed application) and
+ *   `SchemaRegistry.createCollection`/`deleteCollection` for direct callers.
+ * - Creations on *other* isolates surface through bounded revalidation: the
+ *   set is re-fetched only when the filter would actually drop a declared
+ *   collection and the cached copy is older than the revalidation window.
+ *   Sites whose declared collections all exist — the steady state — never
+ *   revalidate; a site with a genuinely absent collection pays one slug read
+ *   per window instead of one failing statement per render, and a collection
+ *   created elsewhere starts counting within the window.
+ *
+ * Isolated databases bypass the cache (playground / DO preview requests set
+ * `requestContext.dbIsIsolated`): they point at a divergent schema, so the
+ * slug set is fetched per request instead, deduped by the request cache.
+ */
+
+import type { Kysely } from "kysely";
+
+import type { Database } from "../database/types.js";
+import { requestCached } from "../request-cache.js";
+import { getRequestContext } from "../request-context.js";
+
+interface SlugsHolder {
+	promise: Promise<Set<string>> | null;
+	/** When the cached promise was created; gates bounded revalidation. */
+	fetchedAt: number;
+}
+
+const HOLDER_KEY = Symbol.for("emdash:collection-slugs");
+const g = globalThis as Record<symbol, unknown>;
+const holder: SlugsHolder =
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-cache.ts)
+	(g[HOLDER_KEY] as SlugsHolder | undefined) ??
+	(() => {
+		const h: SlugsHolder = { promise: null, fetchedAt: 0 };
+		g[HOLDER_KEY] = h;
+		return h;
+	})();
+
+const REVALIDATE_WINDOW_MS = 60_000;
+let revalidateWindowMs = REVALIDATE_WINDOW_MS;
+
+async function fetchSlugs(db: Kysely<Database>): Promise<Set<string>> {
+	const rows = await db.selectFrom("_emdash_collections").select("slug").execute();
+	return new Set(rows.map((row) => row.slug));
+}
+
+function loadSlugs(db: Kysely<Database>): Promise<Set<string>> {
+	if (holder.promise) return holder.promise;
+	const promise = fetchSlugs(db).catch((error: unknown) => {
+		if (holder.promise === promise) holder.promise = null;
+		throw error;
+	});
+	holder.promise = promise;
+	holder.fetchedAt = Date.now();
+	return promise;
+}
+
+/**
+ * Keep only the collections that have a `_emdash_collections` row, i.e. whose
+ * `ec_*` table the registry has created. When the filter would drop a
+ * collection and the cached set is older than the revalidation window, the
+ * set is re-fetched once so a collection created by another isolate becomes
+ * visible without waiting for an isolate recycle.
+ */
+export async function filterToRegisteredCollections(
+	db: Kysely<Database>,
+	collections: readonly string[],
+): Promise<string[]> {
+	if (collections.length === 0) return [];
+	if (getRequestContext()?.dbIsIsolated === true) {
+		const slugs = await requestCached("collection-slugs", () => fetchSlugs(db));
+		return collections.filter((slug) => slugs.has(slug));
+	}
+	let slugs = await loadSlugs(db);
+	let present = collections.filter((slug) => slugs.has(slug));
+	if (present.length < collections.length && Date.now() - holder.fetchedAt > revalidateWindowMs) {
+		holder.promise = null;
+		slugs = await loadSlugs(db);
+		present = collections.filter((slug) => slugs.has(slug));
+	}
+	return present;
+}
+
+/**
+ * Seed the cache with slugs an init-time read already fetched, so the first
+ * render on a cold isolate pays no extra query. Called by the runtime's
+ * auto-seed gate.
+ */
+export function primeRegisteredCollections(slugs: readonly string[]): void {
+	holder.promise = Promise.resolve(new Set(slugs));
+	holder.fetchedAt = Date.now();
+}
+
+/**
+ * Drop the cached slug set so the next reader re-fetches. Called from every
+ * schema-mutation path (`invalidateUrlPatternCache`, `SchemaRegistry`
+ * create/delete). Other isolates converge through bounded revalidation.
+ */
+export function resetRegisteredCollectionsCache(): void {
+	holder.promise = null;
+	holder.fetchedAt = 0;
+}
+
+/**
+ * Note that a query hit a missing `ec_*` table despite the slug filter: the
+ * cached set is stale (the collection was deleted on another isolate) or the
+ * registry has drifted from the physical schema. Drops the cached set at most
+ * once per revalidation window, so the delete case converges like the create
+ * case while genuine drift costs one slug re-fetch per window instead of one
+ * per render.
+ */
+export function noteStaleRegisteredCollections(): void {
+	if (Date.now() - holder.fetchedAt > revalidateWindowMs) {
+		resetRegisteredCollectionsCache();
+	}
+}
+
+/**
+ * Test/internal helper: reset the cache and restore the production
+ * revalidation window.
+ */
+export function resetRegisteredCollectionsCacheForTests(): void {
+	resetRegisteredCollectionsCache();
+	revalidateWindowMs = REVALIDATE_WINDOW_MS;
+}
+
+/**
+ * Test-only: shorten the revalidation window so the cross-isolate refresh
+ * path can be exercised without waiting out the production window.
+ *
+ * @internal
+ */
+export function setRegisteredCollectionsRevalidateWindowForTests(ms: number): void {
+	revalidateWindowMs = ms;
+}