emdash 0.37.0 → 0.39.0

package/src/api/handlers/registry.ts

@@ -13,6 +13,7 @@ import { canonicalizeDeclaredAccess } from "@emdash-cms/plugin-types";
 import type { CanonicalDeclaredAccess } from "@emdash-cms/plugin-types";
 import { checkEnvCompatibility, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
 import type { HostEnv } from "@emdash-cms/registry-client/env";
+import { isProvenFirstRelease } from "@emdash-cms/registry-client/listing-policy";
 import { evaluateRegistryReleaseWithdrawal } from "@emdash-cms/registry-client/withdrawal";
 import { NSID } from "@emdash-cms/registry-lexicons";
 import {
@@ -22,6 +23,7 @@ import {
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
+import { withUnavailableReason } from "../../plugins/sandbox/types.js";
 import type { SandboxRunner } from "../../plugins/sandbox/types.js";
 import { PluginStateRepository } from "../../plugins/state.js";
 import {
@@ -120,6 +122,7 @@ export interface RegistryInstallInput {
 	 */
 	acknowledgedDeclaredAccess?: unknown;
 	acknowledgedMcpTools?: unknown;
+	acknowledgedPublicRoutes?: unknown;
 	acknowledgedProfileCid?: string;
 	acknowledgedReleaseCid?: string;
 }
@@ -137,6 +140,7 @@ export interface RegistryInstallResult {
 	capabilities: string[];
 	declaredAccess: DeclaredAccess;
 	mcpTools: RegistryMcpConsentTool[];
+	publicRoutes: string[];
 	verification: RegistryRecordVerificationSummary;
 }
 
@@ -468,7 +472,10 @@ export async function handleRegistryInstall(
 			success: false,
 			error: {
 				code: "SANDBOX_NOT_AVAILABLE",
-				message: "Sandbox runner is required for registry plugins",
+				message: withUnavailableReason(
+					"Sandbox runner is required for registry plugins",
+					sandboxRunner,
+				),
 			},
 		};
 	}
@@ -728,7 +735,9 @@ export async function handleRegistryInstall(
 			const exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) =>
 				e.trim().toLowerCase(),
 			);
-			const exempt = releaseExemptFromMinimumAge(exclude, publisherDid, slug);
+			const exempt =
+				releaseExemptFromMinimumAge(exclude, publisherDid, slug) ||
+				isProvenFirstRelease(packageView);
 			if (!exempt) {
 				const indexedAt = Date.parse(releaseView.indexedAt);
 				if (!Number.isFinite(indexedAt)) {
@@ -947,6 +956,28 @@ export async function handleRegistryInstall(
 		const actualMcpTools = (bundle.manifest.mcp?.tools ?? []).map(
 			({ inputSchema: _, outputSchema: __, ...tool }) => tool,
 		);
+		const publicRoutes = diffRouteVisibility(undefined, bundle.manifest).newlyPublic.toSorted();
+		if (!opts?.verifyOnly && publicRoutes.length > 0) {
+			const acknowledgedPublicRoutes = Array.isArray(input.acknowledgedPublicRoutes)
+				? input.acknowledgedPublicRoutes
+						.filter((route): route is string => typeof route === "string")
+						.toSorted()
+				: [];
+			if (JSON.stringify(acknowledgedPublicRoutes) !== JSON.stringify(publicRoutes)) {
+				return {
+					success: false,
+					error: {
+						code: "ROUTE_VISIBILITY_ESCALATION",
+						message: "Plugin install exposes public (unauthenticated) routes",
+						details: {
+							routeVisibilityChanges: { newlyPublic: publicRoutes },
+							mcpTools: actualMcpTools,
+							verification,
+						},
+					},
+				};
+			}
+		}
 		if (!opts?.verifyOnly && actualMcpTools.length > 0) {
 			if (JSON.stringify(input.acknowledgedMcpTools) !== JSON.stringify(actualMcpTools)) {
 				return {
@@ -954,7 +985,12 @@ export async function handleRegistryInstall(
 					error: {
 						code: "MCP_TOOL_CONSENT_REQUIRED",
 						message: "Plugin MCP tools require explicit consent",
-						details: { mcpTools: actualMcpTools, verification },
+						details: {
+							mcpTools: actualMcpTools,
+							routeVisibilityChanges:
+								publicRoutes.length > 0 ? { newlyPublic: publicRoutes } : undefined,
+							verification,
+						},
 					},
 				};
 			}
@@ -968,6 +1004,7 @@ export async function handleRegistryInstall(
 			capabilities: bundle.manifest.capabilities,
 			declaredAccess: recordReport.value.releaseExtension.declaredAccess,
 			mcpTools: actualMcpTools,
+			publicRoutes,
 			verification,
 		};
 		if (opts?.verifyOnly) return { success: true, data: result };
@@ -1113,7 +1150,7 @@ export async function handleRegistryUninstall(
 	db: Kysely<Database>,
 	storage: Storage | null,
 	pluginId: string,
-	opts?: { deleteData?: boolean },
+	opts?: { deleteData?: boolean; beforeDelete?: () => Promise<void> },
 ): Promise<ApiResult<RegistryUninstallResult>> {
 	try {
 		const stateRepo = new PluginStateRepository(db);
@@ -1132,22 +1169,18 @@ export async function handleRegistryUninstall(
 		// registry-source rows (there's no shadow column like marketplace's
 		// `marketplaceVersion`). Use it verbatim for the R2 prefix.
 		const version = existing.version;
+		await opts?.beforeDelete?.();
 
-		// Order: optional storage cleanup → bundle delete → state row delete.
-		// The most failure-prone step runs first so a transient DB error
-		// (deadlock, contention) cascades to the outer catch with the state
-		// row and bundle intact — admin retries safely. Bundle delete is
-		// idempotent on misses.
+		// Lifecycle cleanup runs before every destructive step so the plugin can
+		// inspect its stored state. The database cleanup then runs before the
+		// idempotent bundle delete, leaving the state row and bundle intact if a
+		// transient database error makes the uninstall retryable.
 		let dataDeleted = false;
 		if (opts?.deleteData) {
 			await db.deleteFrom("_plugin_storage").where("plugin_id", "=", pluginId).execute();
 			dataDeleted = true;
 		}
 
-		if (storage) {
-			await deleteBundleFromR2(storage, pluginId, version, "registry");
-		}
-
 		try {
 			await removeAllPluginIndexes(db, pluginId);
 		} catch {
@@ -1156,6 +1189,10 @@ export async function handleRegistryUninstall(
 
 		await stateRepo.delete(pluginId);
 
+		if (storage) {
+			await deleteBundleFromR2(storage, pluginId, version, "registry");
+		}
+
 		return { success: true, data: { pluginId, dataDeleted } };
 	} catch (err) {
 		console.error("[registry-uninstall] Failed:", err);
@@ -1186,8 +1223,8 @@ export interface RegistryUpdateResult {
  * `handleMarketplaceUpdate`: resolves the target version via the aggregator,
  * re-runs the artifact fetch / checksum / extract pipeline, diffs capabilities
  * and route visibility against the currently installed bundle, and gates
- * escalations behind `confirmCapabilityChanges` / `confirmRouteVisibilityChanges`
- * so the admin re-consents to widened permissions.
+ * escalations behind `confirmCapabilityChanges` and an exact
+ * `acknowledgedPublicRoutes` match so the admin re-consents to widened permissions.
  *
  * Refuses non-registry sources. Refuses when the stored state row is missing
  * the `(publisherDid, slug)` it needs to resolve against the aggregator.
@@ -1201,7 +1238,7 @@ export async function handleRegistryUpdate(
 	opts?: {
 		version?: string;
 		confirmCapabilityChanges?: boolean;
-		confirmRouteVisibilityChanges?: boolean;
+		acknowledgedPublicRoutes?: string[];
 		confirmMcpTools?: boolean;
 		acknowledgedProfileCid?: string;
 		acknowledgedReleaseCid?: string;
@@ -1229,7 +1266,10 @@ export async function handleRegistryUpdate(
 	if (!sandboxRunner || !sandboxRunner.isAvailable()) {
 		return {
 			success: false,
-			error: { code: "SANDBOX_NOT_AVAILABLE", message: "Sandbox runner is required" },
+			error: {
+				code: "SANDBOX_NOT_AVAILABLE",
+				message: withUnavailableReason("Sandbox runner is required", sandboxRunner),
+			},
 		};
 	}
 	try {
@@ -1397,13 +1437,13 @@ export async function handleRegistryUpdate(
 		}
 		if (
 			opts?.confirmCapabilityChanges ||
-			opts?.confirmRouteVisibilityChanges ||
+			(opts?.acknowledgedPublicRoutes?.length ?? 0) > 0 ||
 			opts?.confirmMcpTools
 		) {
 			const consentError = recordConsentError(
 				{
-					profileCid: opts.acknowledgedProfileCid,
-					releaseCid: opts.acknowledgedReleaseCid,
+					profileCid: opts?.acknowledgedProfileCid,
+					releaseCid: opts?.acknowledgedReleaseCid,
 				},
 				records,
 			);
@@ -1517,14 +1557,24 @@ export async function handleRegistryUpdate(
 		}
 
 		const routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);
-		const hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;
-		if (hasNewPublicRoutes && !opts?.confirmRouteVisibilityChanges) {
+		const newlyPublicRoutes = routeVisibilityChanges.newlyPublic.toSorted();
+		const acknowledgedPublicRoutes = (opts?.acknowledgedPublicRoutes ?? [])
+			.filter((route): route is string => typeof route === "string")
+			.toSorted();
+		if (
+			newlyPublicRoutes.length > 0 &&
+			JSON.stringify(acknowledgedPublicRoutes) !== JSON.stringify(newlyPublicRoutes)
+		) {
 			return {
 				success: false,
 				error: {
 					code: "ROUTE_VISIBILITY_ESCALATION",
 					message: "Plugin update exposes new public (unauthenticated) routes",
-					details: { routeVisibilityChanges, capabilityChanges, verification },
+					details: {
+						routeVisibilityChanges: { newlyPublic: newlyPublicRoutes },
+						capabilityChanges,
+						verification,
+					},
 				},
 			};
 		}
@@ -1567,11 +1617,6 @@ export async function handleRegistryUpdate(
 
 		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
 
-		// Best-effort cleanup of the old bundle. Failures here don't roll
-		// back the upgrade (the new bundle is already stored and committed
-		// in the state row); the orphan is just storage we'll pay for.
-		deleteBundleFromR2(storage, pluginId, oldVersion, "registry").catch(() => {});
-
 		return {
 			success: true,
 			data: {
@@ -1579,7 +1624,8 @@ export async function handleRegistryUpdate(
 				oldVersion,
 				newVersion,
 				capabilityChanges,
-				routeVisibilityChanges: hasNewPublicRoutes ? routeVisibilityChanges : undefined,
+				routeVisibilityChanges:
+					newlyPublicRoutes.length > 0 ? { newlyPublic: newlyPublicRoutes } : undefined,
 				verification,
 			},
 		};

package/src/api/handlers/revision.ts

@@ -7,8 +7,9 @@ import type { Kysely } from "kysely";
 import { after } from "../../after.js";
 import { ContentRepository } from "../../database/repositories/content.js";
 import { RevisionRepository, type Revision } from "../../database/repositories/revision.js";
-import { withTransaction } from "../../database/transaction.js";
+import { ContentMutationConflictError } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
+import { encodeRev } from "../rev.js";
 import type { ApiResult, ContentResponse } from "../types.js";
 
 export interface RevisionListResponse {
@@ -110,30 +111,12 @@ export async function handleRevisionRestore(
 			};
 		}
 
-		// Extract _slug from revision data (stored as metadata, not a real column)
-		const { _slug, ...fieldData } = revision.data;
-
-		// Atomically update content and create a new revision to record the restore.
-		// If either operation fails, neither is committed (on engines that support
-		// transactions; on D1, withTransaction falls back to sequential execution).
-		const { item, queuedRevisionId } = await withTransaction(db, async (trx) => {
-			const trxContentRepo = new ContentRepository(trx);
-			const trxRevisionRepo = new RevisionRepository(trx);
-
-			const updated = await trxContentRepo.update(revision.collection, revision.entryId, {
-				data: fieldData,
-				slug: typeof _slug === "string" ? _slug : undefined,
-			});
-
-			const queuedRevision = await trxRevisionRepo.create({
-				collection: revision.collection,
-				entryId: revision.entryId,
-				data: revision.data,
-				authorId: callerUserId,
-			});
-
-			return { item: updated, queuedRevisionId: queuedRevision.id };
-		});
+		const { item, revisionId: queuedRevisionId } = await new ContentRepository(db).restoreRevision(
+			revision.collection,
+			revision.entryId,
+			revision.data,
+			callerUserId,
+		);
 
 		const pruneRepo = new RevisionRepository(db);
 		after(async () => {
@@ -154,9 +137,15 @@ export async function handleRevisionRestore(
 
 		return {
 			success: true,
-			data: { item },
+			data: { item, _rev: encodeRev(item) },
 		};
-	} catch {
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) {
+			return {
+				success: false,
+				error: { code: "CONFLICT", message: error.message },
+			};
+		}
 		return {
 			success: false,
 			error: {

package/src/api/handlers/seo.ts

@@ -18,6 +18,13 @@ export interface SitemapContentEntry {
 	slug: string | null;
 	/** ISO date of last modification */
 	updatedAt: string;
+	/**
+	 * ISO publish date, or null when never published. Used to resolve
+	 * date tokens (`{year}`/`{month}`/`{day}`) in the collection's
+	 * `url_pattern` — the published date keeps permalinks stable across
+	 * later edits (unlike `updatedAt`).
+	 */
+	publishedAt: string | null;
 	/**
 	 * Locale of this row (e.g. `"en"`, `"fr"`). Always present — rows in
 	 * pre-i18n databases are backfilled to the configured `defaultLocale`.
@@ -139,11 +146,12 @@ export async function handleSitemapData(
 					slug: string | null;
 					id: string;
 					updated_at: string;
+					published_at: string | null;
 					locale: string;
 					translation_group: string | null;
 					seo_image: string | null;
 				}>`
-					SELECT c.slug, c.id, c.updated_at, c.locale, c.translation_group, s.seo_image
+					SELECT c.slug, c.id, c.updated_at, c.published_at, c.locale, c.translation_group, s.seo_image
 					FROM ${sql.ref(tableName)} c
 					LEFT JOIN _emdash_seo s
 						ON s.collection = ${col.slug}
@@ -165,6 +173,7 @@ export async function handleSitemapData(
 						id: row.id,
 						slug: row.slug,
 						updatedAt: toW3CDate(row.updated_at),
+						publishedAt: row.published_at ?? null,
 						locale: row.locale,
 						translationGroup: row.translation_group,
 						image: row.seo_image ?? null,

package/src/api/handlers/snapshot.ts

@@ -12,6 +12,7 @@
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { listTableColumns, listTablesLike } from "../../database/dialect-helpers.js";
 import type { Database } from "../../database/types.js";
 
 // ─�� Preview signature verification ──────────────────────────────
@@ -211,10 +212,44 @@ function isExcluded(tableName: string): boolean {
 	return EXCLUDED_PREFIXES.some((prefix) => tableName.startsWith(prefix));
 }
 
-/** Column info from PRAGMA table_info */
-interface ColumnInfo {
-	name: string;
-	type: string;
+type SnapshotColumnType = "TEXT" | "INTEGER" | "REAL" | "BLOB" | "JSON";
+
+function normalizeColumnType(type: string): SnapshotColumnType {
+	switch (type.toLowerCase()) {
+		case "smallint":
+		case "integer":
+		case "bigint":
+		case "boolean":
+			return "INTEGER";
+		case "real":
+		case "double precision":
+		case "numeric":
+		case "decimal":
+			return "REAL";
+		case "blob":
+		case "bytea":
+			return "BLOB";
+		case "json":
+		case "jsonb":
+			return "JSON";
+		default:
+			return "TEXT";
+	}
+}
+
+function normalizeRows(
+	rows: Record<string, unknown>[],
+	types: Record<string, SnapshotColumnType>,
+): Record<string, unknown>[] {
+	for (const row of rows) {
+		for (const [column, type] of Object.entries(types)) {
+			const value = row[column];
+			if (type === "JSON" && value !== null && value !== undefined && typeof value !== "string") {
+				row[column] = JSON.stringify(value);
+			}
+		}
+	}
+	return rows;
 }
 
 export interface GenerateSnapshotOptions {
@@ -231,6 +266,8 @@ export interface GenerateSnapshotOptions {
 	 * `emdash:passkey_pending:`) — the output may be user-downloadable.
 	 */
 	optionPrefixes?: string[];
+	/** Exact options-table keys to include in addition to `optionPrefixes`. */
+	optionKeys?: string[];
 }
 
 /**
@@ -246,16 +283,9 @@ export async function generateSnapshot(
 	const includeDrafts = options?.includeDrafts ?? false;
 	const includeTrashed = options?.includeTrashed ?? false;
 	const optionPrefixes = options?.optionPrefixes ?? SAFE_OPTIONS_PREFIXES;
+	const optionKeys = new Set(options?.optionKeys);
 
-	// Discover all ec_* content tables
-	const tableResult = await sql<{ name: string }>`
-		SELECT name FROM sqlite_master
-		WHERE type = 'table'
-		AND name LIKE 'ec_%'
-		ORDER BY name
-	`.execute(db);
-
-	const contentTables = tableResult.rows.map((r) => r.name);
+	const contentTables = await listTablesLike(db, "ec_%");
 
 	// Build list of all tables to export
 	const allTables = [...contentTables, ...SYSTEM_TABLES];
@@ -266,80 +296,65 @@ export async function generateSnapshot(
 	for (const tableName of allTables) {
 		if (isExcluded(tableName)) continue;
 
-		// Validate identifier before interpolating into sql.raw().
-		// SYSTEM_TABLES are hardcoded and safe, but ec_* names come from
-		// sqlite_master and must be validated.
+		// Content table names come from the database catalog. Validate them
+		// before passing them to sql.ref().
 		if (!SAFE_TABLE_NAME.test(tableName)) continue;
 
-		try {
-			// Get column info via PRAGMA
-			const pragmaResult = await sql<ColumnInfo>`
-				PRAGMA table_info(${sql.raw(`"${tableName}"`)})
-			`.execute(db);
-
-			if (pragmaResult.rows.length === 0) continue;
+		const columnInfo = await listTableColumns(db, tableName);
+		if (columnInfo.length === 0) continue;
 
-			const columns = pragmaResult.rows.map((r) => r.name);
-			const types: Record<string, string> = {};
-			for (const row of pragmaResult.rows) {
-				types[row.name] = row.type || "TEXT";
-			}
+		const columns = columnInfo.map((column) => column.name);
+		const types: Record<string, SnapshotColumnType> = {};
+		for (const column of columnInfo) {
+			types[column.name] = normalizeColumnType(column.type);
+		}
 
-			schema[tableName] = { columns, types };
+		schema[tableName] = { columns, types };
 
-			// Fetch rows
-			let rows: Record<string, unknown>[];
+		let rows: Record<string, unknown>[];
 
-			if (tableName.startsWith("ec_")) {
-				if (includeTrashed) {
-					// Everything, including trash — full-fidelity backup export
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-					`.execute(db)
-					).rows;
-				} else if (includeDrafts) {
-					// Include all non-deleted content (published, draft, scheduled)
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-						WHERE deleted_at IS NULL
-					`.execute(db)
-					).rows;
-				} else {
-					// Only export published content
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-						WHERE deleted_at IS NULL
-						AND status = 'published'
+		if (tableName.startsWith("ec_")) {
+			if (includeTrashed) {
+				rows = (
+					await sql<Record<string, unknown>>`
+						SELECT * FROM ${sql.ref(tableName)}
 					`.execute(db)
-					).rows;
-				}
-			} else if (tableName === "options") {
-				// Filter options to safe rendering-only prefixes.
-				// Excludes plugin secrets, passkey challenges, and setup state.
+				).rows;
+			} else if (includeDrafts) {
 				rows = (
 					await sql<Record<string, unknown>>`
-					SELECT * FROM ${sql.raw(`"${tableName}"`)}
-				`.execute(db)
-				).rows.filter((row) => {
-					const name = typeof row.name === "string" ? row.name : "";
-					return optionPrefixes.some((prefix) => name.startsWith(prefix));
-				});
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+					`.execute(db)
+				).rows;
 			} else {
 				rows = (
 					await sql<Record<string, unknown>>`
-					SELECT * FROM ${sql.raw(`"${tableName}"`)}
-				`.execute(db)
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+						AND status = 'published'
+					`.execute(db)
 				).rows;
 			}
+		} else if (tableName === "options") {
+			rows = (
+				await sql<Record<string, unknown>>`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)
+			).rows.filter((row) => {
+				const name = typeof row.name === "string" ? row.name : "";
+				return optionKeys.has(name) || optionPrefixes.some((prefix) => name.startsWith(prefix));
+			});
+		} else {
+			rows = (
+				await sql<Record<string, unknown>>`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)
+			).rows;
+		}
 
-			if (rows.length > 0) {
-				tables[tableName] = rows;
-			}
-		} catch {
-			// Table might not exist yet (e.g. pre-migration) — skip silently
+		if (rows.length > 0) {
+			tables[tableName] = normalizeRows(rows, types);
 		}
 	}