emdash 0.38.0 → 0.39.0

package/src/query.ts

@@ -32,11 +32,13 @@ import {
 	FOLDED_BYLINES,
 	FOLDED_BYLINES_EXIST,
 	FOLDED_TERMS,
+	loadPublishedDates,
 	type WhereRange,
 	type WhereValue,
 } from "./loader.js";
 import {
 	cachedQuery,
+	contentCacheNamespaces,
 	contentNamespaces,
 	invalidateSchemaObjectCache,
 } from "./object-cache/index.js";
@@ -46,7 +48,7 @@ import { getRequestContext } from "./request-context.js";
 import { resetRegisteredCollectionsCache } from "./schema/collection-slugs-cache.js";
 import { compileUrlPattern } from "./schema/url-pattern.js";
 import type { TaxonomyTerm } from "./taxonomies/types.js";
-import { isMissingTableError } from "./utils/db-errors.js";
+import { isMissingColumnError, isMissingTableError } from "./utils/db-errors.js";
 import {
 	createEditable,
 	createNoop,
@@ -210,6 +212,58 @@ export interface CacheHint {
 	lastModified?: Date;
 }
 
+interface PublishedDatesResult {
+	dates: Date[];
+	cacheHint: CacheHint;
+	error?: Error;
+}
+
+/** @internal Publication dates for the Archives widget. */
+export async function getPublishedDates(
+	type: string,
+	options?: { locale?: string },
+): Promise<PublishedDatesResult> {
+	const locale = effectiveLocaleKey(options) || undefined;
+	const key = `publishedDates:${JSON.stringify([type, locale])}`;
+	try {
+		return await requestCached(key, () =>
+			cachedQuery<PublishedDatesResult>({
+				namespace: contentCacheNamespaces(type),
+				key,
+				load: async () => {
+					const rows = await loadPublishedDates(type, locale);
+					const dates: Date[] = [];
+					let lastModified: Date | undefined;
+					for (const row of rows) {
+						if (row.published_at) {
+							const date = new Date(row.published_at);
+							if (!Number.isNaN(date.getTime())) dates.push(date);
+						}
+						if (row.updated_at) {
+							const modified = new Date(row.updated_at);
+							if (!Number.isNaN(modified.getTime()) && (!lastModified || modified > lastModified)) {
+								lastModified = modified;
+							}
+						}
+					}
+					return { dates, cacheHint: { tags: [type], lastModified } };
+				},
+			}),
+		);
+	} catch (error) {
+		return {
+			dates: [],
+			cacheHint: {},
+			error:
+				isMissingTableError(error) || isMissingColumnError(error)
+					? undefined
+					: error instanceof Error
+						? error
+						: new Error("Failed to load publication dates"),
+		};
+	}
+}
+
 /**
  * Result from getEmDashCollection
  */

package/src/registry/authoritative-records.ts

@@ -65,12 +65,30 @@ export type AuthoritativeRecordReader = (
 	options?: AuthoritativeRecordReadOptions,
 ) => Promise<AuthoritativeRecordReadResult>;
 
+const AUTHORITATIVE_READER_OVERRIDE = Symbol.for("emdash.registry.authoritativeRecordReader");
+interface AuthoritativeReaderGlobal {
+	[AUTHORITATIVE_READER_OVERRIDE]?: AuthoritativeRecordReader;
+}
+
+export function setDefaultAuthoritativeRecordReaderForTesting(
+	reader: AuthoritativeRecordReader | undefined,
+): AuthoritativeRecordReader | undefined {
+	// oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Symbol.for state must survive duplicated SSR module chunks.
+	const state = globalThis as AuthoritativeReaderGlobal;
+	const previous = state[AUTHORITATIVE_READER_OVERRIDE];
+	state[AUTHORITATIVE_READER_OVERRIDE] = reader;
+	return previous;
+}
+
 export async function readAuthoritativePackageRelease(
 	publisherDid: string,
 	packageSlug: string,
 	version: string,
 	options: AuthoritativeRecordReadOptions = {},
 ): Promise<AuthoritativeRecordReadResult> {
+	// oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Symbol.for state must survive duplicated SSR module chunks.
+	const override = (globalThis as AuthoritativeReaderGlobal)[AUTHORITATIVE_READER_OVERRIDE];
+	if (override) return override(publisherDid, packageSlug, version, options);
 	try {
 		const client = new DirectPdsClient({
 			did: publisherDid,
@@ -86,6 +104,7 @@ export async function readAuthoritativePackageRelease(
 			package: packageSlug,
 			version,
 			rkey: release.rkey,
+			profileCid: profile.cid,
 			profile: profile.value,
 			release: release.value,
 		});
@@ -123,6 +142,12 @@ export async function verifyAuthoritativePackageRelease(
 ): Promise<RecordVerificationReport> {
 	const context = records.inspection.value;
 	const provenanceReference = context.releaseExtension.provenance;
+	if (provenanceReference && context.repository === null) {
+		return verificationFailure(
+			"PROVENANCE_UNVERIFIABLE",
+			"The release supplies provenance, but its signed profile has no repository anchor.",
+		);
+	}
 	let document: Uint8Array | undefined;
 	if (provenanceReference) {
 		const fetched = await fetchVerifiedResource(provenanceReference.url, {
@@ -145,6 +170,7 @@ export async function verifyAuthoritativePackageRelease(
 		package: records.packageSlug,
 		version: records.version,
 		rkey: records.release.rkey,
+		profileCid: records.profile.cid,
 		profile: records.profile.value,
 		release: records.release.value,
 		provenance:

package/src/registry/config.ts

@@ -1,6 +1,5 @@
 /**
- * Helpers for normalizing the experimental registry integration option
- * (`config.experimental.registry` in `astro.config.mjs`) into the shape
+ * Helpers for normalizing the registry integration option into the shape
  * exposed on the admin manifest.
  *
  * The integration option accepts a human-friendly duration string for
@@ -10,7 +9,40 @@
 
 import { isDid } from "@atcute/lexicons/syntax";
 
-import type { RegistryConfig, RegistryConfigInput } from "./types.js";
+import type { RegistryConfig, RegistryConfigInput, RegistryConfigOption } from "./types.js";
+
+export const DEFAULT_REGISTRY_AGGREGATOR_URL = "https://registry.emdashcms.com";
+
+export interface ResolvedRegistryConfigInput {
+	input?: RegistryConfigInput;
+	fieldPrefix: RegistryConfigurationPrefix;
+}
+
+export function resolveRegistryConfigForSandbox(options: {
+	registry?: RegistryConfigOption;
+	experimentalRegistry?: RegistryConfigInput;
+	sandboxRunner?: string;
+	sandboxEnabled?: boolean;
+}): ResolvedRegistryConfigInput {
+	if (options.registry === false) return { fieldPrefix: "registry" };
+	if (options.registry !== undefined) {
+		return { input: options.registry, fieldPrefix: "registry" };
+	}
+	if (options.experimentalRegistry !== undefined) {
+		return { input: options.experimentalRegistry, fieldPrefix: "experimental.registry" };
+	}
+	if (options.sandboxRunner && options.sandboxEnabled !== false) {
+		return { input: DEFAULT_REGISTRY_AGGREGATOR_URL, fieldPrefix: "registry" };
+	}
+	return { fieldPrefix: "registry" };
+}
+
+export function getRegistryConfigInput(
+	registry: RegistryConfigOption | undefined,
+	experimentalRegistry: RegistryConfigInput | undefined,
+): RegistryConfigInput | undefined {
+	return resolveRegistryConfigForSandbox({ registry, experimentalRegistry }).input;
+}
 
 /**
  * Shape returned in the admin manifest's `registry` field. The browser
@@ -48,10 +80,15 @@ export type RegistryConfigurationErrorCode =
 	| "REGISTRY_MINIMUM_RELEASE_AGE_INVALID"
 	| "REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID";
 
+export type RegistryConfigurationPrefix = "registry" | "experimental.registry";
+
+type RegistryConfigurationFieldSuffix =
+	| "aggregatorUrl"
+	| "policy.minimumReleaseAge"
+	| "policy.minimumReleaseAgeExclude";
+
 export type RegistryConfigurationField =
-	| "experimental.registry.aggregatorUrl"
-	| "experimental.registry.policy.minimumReleaseAge"
-	| "experimental.registry.policy.minimumReleaseAgeExclude";
+	`${RegistryConfigurationPrefix}.${RegistryConfigurationFieldSuffix}`;
 
 export interface ManifestRegistryConfigurationError {
 	code: RegistryConfigurationErrorCode;
@@ -70,8 +107,16 @@ class RegistryConfigurationError extends Error {
 	}
 }
 
-interface RegistryConfigurationValidationOptions {
+export interface RegistryConfigurationValidationOptions {
 	allowLocalhost?: boolean;
+	fieldPrefix?: RegistryConfigurationPrefix;
+}
+
+function registryField(
+	options: RegistryConfigurationValidationOptions,
+	suffix: RegistryConfigurationFieldSuffix,
+): RegistryConfigurationField {
+	return `${options.fieldPrefix ?? "experimental.registry"}.${suffix}`;
 }
 
 /**
@@ -212,7 +257,7 @@ export function validateAggregatorUrl(
 	} catch (cause) {
 		throw new RegistryConfigurationError(
 			"REGISTRY_AGGREGATOR_URL_INVALID",
-			"experimental.registry.aggregatorUrl",
+			registryField(options, "aggregatorUrl"),
 			"must be a valid URL",
 			{ cause },
 		);
@@ -220,7 +265,7 @@ export function validateAggregatorUrl(
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
 		throw new RegistryConfigurationError(
 			"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
-			"experimental.registry.aggregatorUrl",
+			registryField(options, "aggregatorUrl"),
 			"must use HTTP or HTTPS",
 		);
 	}
@@ -232,7 +277,7 @@ export function validateAggregatorUrl(
 	if (parsed.username || parsed.password) {
 		throw new RegistryConfigurationError(
 			"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
-			"experimental.registry.aggregatorUrl",
+			registryField(options, "aggregatorUrl"),
 			"must not contain embedded credentials",
 		);
 	}
@@ -259,21 +304,21 @@ export function validateAggregatorUrl(
 		if (parsed.protocol === "http:") {
 			throw new RegistryConfigurationError(
 				"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
-				"experimental.registry.aggregatorUrl",
+				registryField(options, "aggregatorUrl"),
 				"must use HTTPS outside development",
 			);
 		}
 		if (isLocalhost) {
 			throw new RegistryConfigurationError(
 				"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
-				"experimental.registry.aggregatorUrl",
+				registryField(options, "aggregatorUrl"),
 				"must not point at localhost outside development",
 			);
 		}
 	} else if (parsed.protocol === "http:" && !isLocalhost) {
 		throw new RegistryConfigurationError(
 			"REGISTRY_AGGREGATOR_URL_FORBIDDEN",
-			"experimental.registry.aggregatorUrl",
+			registryField(options, "aggregatorUrl"),
 			"must use HTTPS unless it points at localhost in development",
 		);
 	}
@@ -286,7 +331,7 @@ export function validateAggregatorUrl(
  * `RegistryConfig` object shape.
  *
  * Users can pass a bare aggregator URL string for the common case
- * (`experimental.registry: "https://registry.emdashcms.com"`); the
+ * (`registry: "https://registry.emdashcms.com"`); the
  * normalizer handles either form transparently.
  *
  * Returns `undefined` for `undefined` input so callers can chain with
@@ -327,7 +372,7 @@ export function normalizeRegistryConfig(
 	if (!aggregatorUrl) {
 		throw new RegistryConfigurationError(
 			"REGISTRY_AGGREGATOR_URL_REQUIRED",
-			"experimental.registry.aggregatorUrl",
+			registryField(options, "aggregatorUrl"),
 			"is required when the registry is configured",
 		);
 	}
@@ -353,7 +398,7 @@ export function normalizeRegistryConfig(
 		} catch (cause) {
 			throw new RegistryConfigurationError(
 				"REGISTRY_MINIMUM_RELEASE_AGE_INVALID",
-				"experimental.registry.policy.minimumReleaseAge",
+				registryField(options, "policy.minimumReleaseAge"),
 				'must be a duration such as "48h", "7d", or a non-negative number of seconds',
 				{ cause },
 			);
@@ -365,7 +410,7 @@ export function normalizeRegistryConfig(
 		if (!Array.isArray(config.policy.minimumReleaseAgeExclude)) {
 			throw new RegistryConfigurationError(
 				"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
-				"experimental.registry.policy.minimumReleaseAgeExclude",
+				registryField(options, "policy.minimumReleaseAgeExclude"),
 				"must be an array of DIDs or <did>/<slug> entries",
 			);
 		}
@@ -376,7 +421,7 @@ export function normalizeRegistryConfig(
 			if (typeof entry !== "string") {
 				throw new RegistryConfigurationError(
 					"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
-					"experimental.registry.policy.minimumReleaseAgeExclude",
+					registryField(options, "policy.minimumReleaseAgeExclude"),
 					"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>",
 				);
 			}
@@ -384,7 +429,7 @@ export function normalizeRegistryConfig(
 			if (!trimmed) {
 				throw new RegistryConfigurationError(
 					"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
-					"experimental.registry.policy.minimumReleaseAgeExclude",
+					registryField(options, "policy.minimumReleaseAgeExclude"),
 					"entries cannot be empty",
 				);
 			}
@@ -398,7 +443,7 @@ export function normalizeRegistryConfig(
 			) {
 				throw new RegistryConfigurationError(
 					"REGISTRY_MINIMUM_RELEASE_AGE_EXCLUDE_INVALID",
-					"experimental.registry.policy.minimumReleaseAgeExclude",
+					registryField(options, "policy.minimumReleaseAgeExclude"),
 					"minimumReleaseAgeExclude entry must be a DID or <did>/<slug>",
 				);
 			}
@@ -418,12 +463,15 @@ export function normalizeRegistryConfig(
 }
 
 /** Normalize registry config without allowing a known config error to hide the admin. */
-export function resolveManifestRegistryConfig(input: RegistryConfigInput | undefined): {
+export function resolveManifestRegistryConfig(
+	input: RegistryConfigInput | undefined,
+	options: RegistryConfigurationValidationOptions = {},
+): {
 	registry?: ManifestRegistryConfig;
 	error?: ManifestRegistryConfigurationError;
 } {
 	try {
-		const registry = normalizeRegistryConfig(input);
+		const registry = normalizeRegistryConfig(input, options);
 		return registry ? { registry } : {};
 	} catch (error) {
 		if (!(error instanceof RegistryConfigurationError)) throw error;

package/src/registry/testing.ts

@@ -0,0 +1,100 @@
+import { inspectPackageReleaseRecords } from "@emdash-cms/registry-verification/records";
+
+import {
+	setDefaultAuthoritativeRecordReaderForTesting,
+	type AuthoritativeRecordReader,
+} from "./authoritative-records.js";
+
+export interface RegistryAuthoritativeFixture {
+	publisherDid: string;
+	packageSlug: string;
+	version: string;
+	profileCid: string;
+	releaseCid: string;
+	profile: unknown;
+	release: unknown;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function installRegistryAuthoritativeFixture(input: unknown): void {
+	if (
+		!isRecord(input) ||
+		typeof input.publisherDid !== "string" ||
+		typeof input.packageSlug !== "string" ||
+		typeof input.version !== "string" ||
+		typeof input.profileCid !== "string" ||
+		typeof input.releaseCid !== "string" ||
+		!("profile" in input) ||
+		!("release" in input)
+	) {
+		throw new TypeError("Registry authoritative fixture is invalid");
+	}
+	const fixture: RegistryAuthoritativeFixture = {
+		publisherDid: input.publisherDid,
+		packageSlug: input.packageSlug,
+		version: input.version,
+		profileCid: input.profileCid,
+		releaseCid: input.releaseCid,
+		profile: input.profile,
+		release: input.release,
+	};
+	const reader: AuthoritativeRecordReader = async (publisherDid, packageSlug, version) => {
+		if (
+			publisherDid !== fixture.publisherDid ||
+			packageSlug !== fixture.packageSlug ||
+			version !== fixture.version
+		) {
+			return {
+				success: false,
+				error: {
+					code: "RECORD_NOT_FOUND",
+					message: "The registry test fixture does not contain this package release.",
+				},
+			};
+		}
+		const rkey = `${packageSlug}:${version}`;
+		const inspection = await inspectPackageReleaseRecords({
+			publisherDid,
+			package: packageSlug,
+			version,
+			rkey,
+			profileCid: fixture.profileCid,
+			profile: fixture.profile,
+			release: fixture.release,
+		});
+		if (!inspection.success) {
+			return {
+				success: false,
+				error: {
+					code: inspection.code,
+					message: inspection.reasons[0]?.message ?? "The registry test fixture is invalid.",
+				},
+			};
+		}
+		return {
+			success: true,
+			value: {
+				publisherDid,
+				packageSlug,
+				version,
+				profile: {
+					uri: `at://${publisherDid}/com.emdashcms.experimental.package.profile/${packageSlug}`,
+					cid: fixture.profileCid,
+					rkey: packageSlug,
+					value: inspection.value.profile,
+				},
+				release: {
+					uri: `at://${publisherDid}/com.emdashcms.experimental.package.release/${rkey}`,
+					cid: fixture.releaseCid,
+					rkey,
+					value: inspection.value.release,
+				},
+				inspection,
+			},
+		};
+	};
+	setDefaultAuthoritativeRecordReaderForTesting(reader);
+}

package/src/registry/types.ts

@@ -115,20 +115,18 @@ export interface RegistryConfig {
  *
  * @example
  * ```ts
- * experimental: {
- *   registry: "https://registry.emdashcms.com",
- * }
+ * registry: "https://registry.emdashcms.com"
  * ```
  *
  * Equivalent to:
  * ```ts
- * experimental: {
- *   registry: { aggregatorUrl: "https://registry.emdashcms.com" },
- * }
+ * registry: { aggregatorUrl: "https://registry.emdashcms.com" }
  * ```
  */
 export type RegistryConfigInput = string | RegistryConfig;
 
+export type RegistryConfigOption = RegistryConfigInput | false;
+
 /**
  * Experimental EmDash features. See `EmDashConfig.experimental`.
  *
@@ -138,65 +136,10 @@ export type RegistryConfigInput = string | RegistryConfig;
  */
 export interface ExperimentalConfig {
 	/**
-	 * Decentralized plugin registry.
-	 *
-	 * When set, replaces the centralized `marketplace` for the admin UI's
-	 * browse and install flows. The registry is an atproto-backed
-	 * federation: package metadata lives in each publisher's PDS and
-	 * an aggregator (the `aggregatorUrl`) indexes the firehose and
-	 * exposes read-only XRPC endpoints for discovery.
-	 *
-	 * See [RFC 0001](https://github.com/emdash-cms/emdash/pull/694) for
-	 * the protocol design.
-	 *
-	 * **Trust model (v1, experimental).** Today EmDash trusts the
-	 * configured aggregator with these claims, per package and per
-	 * release:
-	 *
-	 *   - The publisher DID associated with a `(did, slug)` pair.
-	 *   - The artifact source fields, checksum, and cache services returned for
-	 *     a release.
-	 *   - The published handle for a DID (used for display only;
-	 *     EmDash separately verifies the DID->handle round-trip in the
-	 *     admin UI before treating a handle as confirmed).
-	 *
-	 * What EmDash verifies independently before activating an
-	 * installed plugin:
-	 *
-	 *   - The artifact bytes hash to the checksum the aggregator
-	 *     returned (so a malicious cache or in-transit tamper can't
-	 *     swap the bundle).
-	 *   - The bundle's `manifest.id` matches the requested slug, and
-	 *     its `manifest.version` matches the release version (so an
-	 *     attacker who controls the aggregator can't trick the
-	 *     sandbox into addressing the wrong plugin id).
-	 *   - The bundle's `manifest.capabilities` matches what the admin
-	 *     acknowledged in the consent dialog (so a publisher can't
-	 *     ship a bundle that requests more permissions than the
-	 *     dialog displayed).
-	 *
-	 * What's NOT yet verified:
-	 *
-	 *   - Full MST proof / publisher signature on the release record.
-	 *     A compromised aggregator can forge a release for any DID
-	 *     and slug, and the install will succeed as long as the
-	 *     bundle matches the (forged) checksum.
-	 *   - Per-release replay / rollback: the aggregator chooses which
-	 *     release version is "latest".
-	 *
-	 * **Recommendation.** Until full signature verification lands,
-	 * point `aggregatorUrl` only at an aggregator you operate
-	 * yourself or one you trust with the same level of authority as
-	 * a centralized plugin source. `policy.minimumReleaseAge` widens
-	 * the detection window for takedowns. `acceptLabelers` declares a
-	 * request and cache identity; it does not change aggregator policy.
-	 *
-	 * Requires `sandboxRunner` to be configured -- registry plugins
-	 * always run sandboxed.
+	 * Deprecated location for registry configuration. Use the top-level
+	 * `registry` option instead. A top-level value takes precedence.
 	 *
-	 * Accepts a bare URL string as shorthand for
-	 * `{ aggregatorUrl: "..." }`. Use the full object form when you
-	 * need `acceptLabelers` or `policy`.
+	 * @deprecated Use `EmDashConfig.registry`.
 	 */
 	registry?: RegistryConfigInput;
 }

package/src/scheduled-publish.ts

@@ -14,6 +14,7 @@ import type { Kysely } from "kysely";
 
 import { handleContentPublish } from "./api/handlers/content.js";
 import { ContentRepository } from "./database/repositories/content.js";
+import { OptionsRepository } from "./database/repositories/options.js";
 import type { Database } from "./database/types.js";
 import { SchemaRegistry } from "./schema/registry.js";
 
@@ -29,6 +30,27 @@ export interface PublishedRef {
  * invocation's CPU/subrequest budget; the remainder drains on later ticks.
  */
 export const SCHEDULED_PUBLISH_BATCH_LIMIT = 100;
+const SCHEDULED_PUBLISH_CURSOR_PREFIX = "emdash:scheduled-publish-cursor:";
+
+interface ScheduledPublishCursor {
+	scheduledAt: string;
+	id: string;
+}
+
+function scheduledPublishCursorKey(collection: string): string {
+	return `${SCHEDULED_PUBLISH_CURSOR_PREFIX}${collection}`;
+}
+
+function isScheduledPublishCursor(value: unknown): value is ScheduledPublishCursor {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		"scheduledAt" in value &&
+		typeof value.scheduledAt === "string" &&
+		"id" in value &&
+		typeof value.id === "string"
+	);
+}
 
 /**
  * Publishes a single content item. Mirrors the relevant subset of
@@ -44,6 +66,7 @@ export type ScheduledPublishFn = (
 		publishedAt?: string;
 		requireScheduledDue?: boolean;
 		expectedScheduledAt?: string;
+		currentTime?: Date;
 	},
 ) => Promise<{ success: boolean; error?: { code?: string } }>;
 
@@ -67,6 +90,8 @@ export interface PublishDueContentOptions {
 	 * `SCHEDULED_PUBLISH_BATCH_LIMIT`. Pass `0` (or a negative) for unbounded.
 	 */
 	limit?: number;
+	/** Clock value shared by due selection and the final publication fence. */
+	currentTime?: Date;
 }
 
 /**
@@ -89,7 +114,12 @@ export async function publishDueContent(
 	db: Kysely<Database>,
 	options: PublishDueContentOptions = {},
 ): Promise<PublishedRef[]> {
-	const { publish, onPublished, limit = SCHEDULED_PUBLISH_BATCH_LIMIT } = options;
+	const {
+		publish,
+		onPublished,
+		limit = SCHEDULED_PUBLISH_BATCH_LIMIT,
+		currentTime = new Date(),
+	} = options;
 	const published: PublishedRef[] = [];
 
 	let collections;
@@ -101,6 +131,7 @@ export async function publishDueContent(
 	}
 
 	const repo = new ContentRepository(db);
+	const optionsRepo = new OptionsRepository(db);
 	const doPublish: ScheduledPublishFn =
 		publish ?? ((collection, id, opts) => handleContentPublish(db, collection, id, opts));
 	// 0 / negative means unbounded; findReadyToPublish treats that as "no LIMIT".
@@ -108,7 +139,24 @@ export async function publishDueContent(
 
 	for (const collection of collections) {
 		try {
-			const due = await repo.findReadyToPublish(collection.slug, batchLimit);
+			let cursor: ScheduledPublishCursor | undefined;
+			let cursorRevision: string | null = null;
+			if (batchLimit !== undefined) {
+				try {
+					const stored = await optionsRepo.getVersioned(scheduledPublishCursorKey(collection.slug));
+					cursorRevision = stored?.revision ?? null;
+					if (isScheduledPublishCursor(stored?.value)) cursor = stored.value;
+				} catch (error) {
+					console.error(
+						`[scheduled-publish] Failed to read cursor for "${collection.slug}":`,
+						error,
+					);
+				}
+			}
+			let due = await repo.findReadyToPublish(collection.slug, batchLimit, currentTime, cursor);
+			if (cursor && due.length === 0) {
+				due = await repo.findReadyToPublish(collection.slug, batchLimit, currentTime);
+			}
 			const batch: PublishedRef[] = [];
 			for (const item of due) {
 				// First publication of a scheduled draft should record the intended
@@ -119,10 +167,11 @@ export async function publishDueContent(
 					publishedAt,
 					requireScheduledDue: true,
 					expectedScheduledAt: item.scheduledAt ?? undefined,
+					currentTime,
 				});
 				if (result.success) {
 					batch.push({ collection: collection.slug, id: item.id });
-				} else if (result.error?.code === "NOT_DUE") {
+				} else if (result.error?.code === "NOT_DUE" || result.error?.code === "PUBLISH_REJECTED") {
 					// Unscheduled or rescheduled between selection and publish — the
 					// editor changed their mind; skip quietly, not a failure.
 				} else {
@@ -132,6 +181,24 @@ export async function publishDueContent(
 					);
 				}
 			}
+			const lastAttempted = due.at(-1);
+			if (batchLimit !== undefined && lastAttempted?.scheduledAt) {
+				try {
+					await optionsRepo.compareAndSet(
+						scheduledPublishCursorKey(collection.slug),
+						cursorRevision,
+						{
+							scheduledAt: lastAttempted.scheduledAt,
+							id: lastAttempted.id,
+						},
+					);
+				} catch (error) {
+					console.error(
+						`[scheduled-publish] Failed to save cursor for "${collection.slug}":`,
+						error,
+					);
+				}
+			}
 
 			if (batch.length > 0) {
 				published.push(...batch);

package/src/schema/index.ts

@@ -6,6 +6,7 @@ export type {
 	CollectionSource,
 	FieldValidation,
 	FieldWidgetOptions,
+	UnsupportedFieldType,
 	Collection,
 	Field,
 	CreateCollectionInput,