emdash 0.40.1 → 0.42.0

package/src/plugins/context.ts

@@ -52,6 +52,7 @@ import { markContentMediaUsageCollectionStaleSafely } from "../media/usage/conte
 import { SchemaRegistry } from "../schema/registry.js";
 import { invalidateSiteSettingsCache } from "../settings/index.js";
 import type { Storage } from "../storage/types.js";
+import { createBylineAccess } from "./byline-access.js";
 import { assertStorageKey } from "./conditional-storage.js";
 import { createContentAccess } from "./content-access.js";
 import { CronAccessImpl } from "./cron.js";
@@ -182,7 +183,9 @@ export function createKVAccess(
 			const includesSettings =
 				"settings:".startsWith(requestedPrefix) || requestedPrefix.startsWith("settings:");
 			const fullPrefix = `${prefix}${requestedPrefix}`;
-			const entriesMap = await optionsRepo.getByPrefix(fullPrefix);
+			const entriesMap = requestedPrefix.startsWith("settings:")
+				? new Map<string, unknown>()
+				: await optionsRepo.getByPrefix(fullPrefix);
 			const result: Array<{ key: string; value: unknown }> = [];
 			for (const [fullKey, value] of entriesMap) {
 				if (includesSettings && fullKey.startsWith(`${prefix}settings:`)) continue;
@@ -1761,6 +1764,8 @@ export class PluginContextFactory {
 			taxonomies = createTaxonomyAccess(db);
 		}
 
+		const bylines = capabilities.has("bylines:read") ? createBylineAccess(db) : undefined;
+
 		let redirects: RedirectAccess | RedirectAccessWithWrite | undefined;
 		if (capabilities.has("redirects:write")) {
 			redirects = createRedirectAccess(db, true);
@@ -1857,6 +1862,7 @@ export class PluginContextFactory {
 			content,
 			schema,
 			taxonomies,
+			bylines,
 			redirects,
 			media,
 			http,

package/src/plugins/cron.ts

@@ -21,7 +21,8 @@ const CRON_TIMEZONE = "UTC";
 /** Stale lock threshold in minutes */
 const STALE_LOCK_MINUTES = 10;
 const ISO_DATETIME_PATTERN =
-	/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?$/;
+	/^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?$/;
+const ISO_TIMEZONE_PATTERN = /(?:Z|[+-]\d{2}:?\d{2})$/;
 
 /**
  * Callback to invoke a plugin's cron hook.
@@ -114,7 +115,7 @@ export class CronExecutor {
 					);
 					await sql`
 						UPDATE _emdash_cron_tasks
-						SET status = 'idle', locked_at = NULL
+						SET status = 'idle', locked_at = NULL, enabled = 0
 						WHERE id = ${task.id}
 					`.execute(this.db);
 					continue;
@@ -177,7 +178,22 @@ export class CronExecutor {
 				}
 			} else {
 				// Recurring: compute next run and reset
-				const nextRun = nextCronTime(task.schedule, currentTime);
+				let nextRun: string;
+				try {
+					nextRun = nextCronTime(task.schedule, currentTime);
+				} catch (error) {
+					console.error(
+						`[cron] Disabling unsatisfiable schedule for ${task.plugin_id}:${task.task_name}:`,
+						error,
+					);
+					await sql`
+						UPDATE _emdash_cron_tasks
+						SET status = 'idle', locked_at = NULL, last_run_at = ${now}, enabled = 0
+						WHERE id = ${task.id}
+					`.execute(this.db);
+					processed++;
+					continue;
+				}
 				await sql`
 					UPDATE _emdash_cron_tasks
 					SET status = 'idle',
@@ -248,7 +264,7 @@ export class CronAccessImpl implements CronAccess {
 		validateSchedule(opts.schedule);
 
 		const oneshot = isOneShot(opts.schedule);
-		const nextRun = oneshot ? opts.schedule : nextCronTime(opts.schedule, this.now());
+		const nextRun = oneshot ? oneShotTime(opts.schedule) : nextCronTime(opts.schedule, this.now());
 		const dataJson = opts.data ? JSON.stringify(opts.data) : null;
 		const id = ulid();
 
@@ -370,6 +386,13 @@ export function isOneShot(schedule: string): boolean {
 	return !isNaN(Date.parse(schedule));
 }
 
+function oneShotTime(schedule: string): string {
+	const withoutZone = ISO_DATETIME_PATTERN.test(schedule) && !ISO_TIMEZONE_PATTERN.test(schedule);
+	const normalized = ISO_DATETIME_PATTERN.test(schedule) ? schedule.replace(" ", "T") : schedule;
+	const input = withoutZone ? `${normalized}Z` : normalized;
+	return new Date(input).toISOString();
+}
+
 /** Max length for a task name */
 const MAX_TASK_NAME_LENGTH = 128;
 /** Task name pattern: alphanumeric, dashes, underscores */

package/src/plugins/hooks.ts

@@ -12,6 +12,8 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
 
+import type { BylineSummary } from "../database/repositories/types.js";
+import { toBylineInfo } from "./byline-access.js";
 import { inspectContentPolicyDecision } from "./content-policy.js";
 import { PluginContextFactory, type PluginContextFactoryOptions } from "./context.js";
 import type {
@@ -56,6 +58,8 @@ import type {
 	CommentAfterCreateHandler,
 	CommentAfterModerateEvent,
 	CommentAfterModerateHandler,
+	BylineAfterSaveHandler,
+	BylineAfterDeleteHandler,
 	PageMetadataEvent,
 	PageMetadataHandler,
 	PageMetadataContribution,
@@ -95,6 +99,8 @@ type HookNameV2 =
 	| "comment:moderate"
 	| "comment:afterCreate"
 	| "comment:afterModerate"
+	| "byline:afterSave"
+	| "byline:afterDelete"
 	| "page:metadata"
 	| "page:fragments";
 
@@ -150,6 +156,8 @@ interface HookHandlerMap {
 	"comment:moderate": CommentModerateHandler;
 	"comment:afterCreate": CommentAfterCreateHandler;
 	"comment:afterModerate": CommentAfterModerateHandler;
+	"byline:afterSave": BylineAfterSaveHandler;
+	"byline:afterDelete": BylineAfterDeleteHandler;
 	"page:metadata": PageMetadataHandler;
 	"page:fragments": PageFragmentHandler;
 }
@@ -295,6 +303,8 @@ export class HookPipeline {
 			this.registerPluginHook(plugin, "comment:moderate");
 			this.registerPluginHook(plugin, "comment:afterCreate");
 			this.registerPluginHook(plugin, "comment:afterModerate");
+			this.registerPluginHook(plugin, "byline:afterSave");
+			this.registerPluginHook(plugin, "byline:afterDelete");
 			this.registerPluginHook(plugin, "page:metadata");
 			this.registerPluginHook(plugin, "page:fragments");
 		}
@@ -343,6 +353,8 @@ export class HookPipeline {
 		["comment:moderate", "users:read"],
 		["comment:afterCreate", "users:read"],
 		["comment:afterModerate", "users:read"],
+		["byline:afterSave", "bylines:read"],
+		["byline:afterDelete", "bylines:read"],
 		// Page fragments — can inject arbitrary scripts into every public page
 		["page:fragments", "hooks.page-fragments:register"],
 	]);
@@ -1243,6 +1255,41 @@ export class HookPipeline {
 		}
 	}
 
+	// =========================================================================
+	// Byline Hooks
+	// =========================================================================
+
+	/** Run byline:afterSave hooks. Errors are logged and never propagate. */
+	async runBylineAfterSave(byline: BylineSummary, isNew: boolean): Promise<void> {
+		const event = { byline: toBylineInfo(byline), isNew };
+		for (const hook of this.getTypedHooks("byline:afterSave")) {
+			await this.runLoggedHook("byline:afterSave", hook, (ctx) => hook.handler(event, ctx));
+		}
+	}
+
+	/** Run byline:afterDelete hooks. Errors are logged and never propagate. */
+	async runBylineAfterDelete(byline: BylineSummary): Promise<void> {
+		const event = { byline: toBylineInfo(byline) };
+		for (const hook of this.getTypedHooks("byline:afterDelete")) {
+			await this.runLoggedHook("byline:afterDelete", hook, (ctx) => hook.handler(event, ctx));
+		}
+	}
+
+	private async runLoggedHook(
+		name: HookNameV2,
+		hook: { pluginId: string; timeout: number },
+		run: (ctx: PluginContext) => Promise<void>,
+	): Promise<void> {
+		try {
+			await this.executeWithTimeout(() => run(this.getContext(hook.pluginId)), hook.timeout);
+		} catch (error) {
+			console.error(
+				`[${name}] Plugin "${hook.pluginId}" error:`,
+				error instanceof Error ? error.message : error,
+			);
+		}
+	}
+
 	// =========================================================================
 	// Public Page Hooks
 	// =========================================================================

package/src/plugins/host.ts

@@ -3,6 +3,7 @@ export { OptionsRepository } from "../database/repositories/options.js";
 export { PluginStorageRepository } from "../database/repositories/plugin-storage.js";
 export { resolvePluginEncryptionKeys } from "../config/secrets.js";
 export { resolveContentCreateLocale } from "../i18n/config.js";
+export { createBylineAccess } from "./byline-access.js";
 export { createCommentAccess } from "./context.js";
 export { createContentAccess } from "./content-access.js";
 export { createMediaAccess } from "./context.js";

package/src/plugins/index.ts

@@ -42,6 +42,7 @@ export {
 	createUrlHelper,
 	createSiteInfo,
 } from "./context.js";
+export { createBylineAccess } from "./byline-access.js";
 export { createContentAccess } from "./content-access.js";
 export type { ContentActionCallbacks, PluginContextFactoryOptions } from "./context.js";
 export {
@@ -207,6 +208,11 @@ export type {
 	TaxonomyTermInfo,
 	TaxonomyTermCreateInput,
 	TaxonomyReadOptions,
+	BylineAccess,
+	BylineCreditInfo,
+	BylineInfo,
+	BylineListOptions,
+	EntryBylineCredits,
 	RedirectAccess,
 	RedirectAccessWithWrite,
 	RedirectCreateInput,
@@ -263,7 +269,10 @@ export type {
 	MediaAfterUploadHandler,
 	LifecycleHandler,
 	UninstallHandler,
-
+	BylineAfterSaveEvent,
+	BylineAfterDeleteEvent,
+	BylineAfterSaveHandler,
+	BylineAfterDeleteHandler,
 	// Comment types
 	CommentBeforeCreateEvent,
 	CommentModerateEvent,

package/src/plugins/manifest-schema.ts

@@ -4,7 +4,7 @@
  * Used to validate manifest.json from plugin bundles at every parse site:
  * - Client-side download (marketplace.ts extractBundle)
  * - R2 load (api/handlers/marketplace.ts loadBundleFromR2)
- * - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)
+ * - marketplace and registry bundle validation
  * - Marketplace ingest extends this with publishing-specific fields
  */
 
@@ -43,6 +43,7 @@ export const CURRENT_PLUGIN_CAPABILITIES = [
 	"hooks.content-policy:register",
 	"taxonomies:read",
 	"taxonomies:write",
+	"bylines:read",
 	"redirects:read",
 	"redirects:write",
 	"media:read",
@@ -134,6 +135,8 @@ export const HOOK_NAMES = [
 	"comment:moderate",
 	"comment:afterCreate",
 	"comment:afterModerate",
+	"byline:afterSave",
+	"byline:afterDelete",
 	"page:metadata",
 	"page:fragments",
 ] as const;
@@ -401,6 +404,7 @@ const declaredAccessSchema = z.object({
 	taxonomies: z
 		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
 		.optional(),
+	bylines: z.object({ read: accessConstraints.optional() }).optional(),
 	redirects: z
 		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
 		.optional(),

package/src/plugins/marketplace.ts

@@ -200,6 +200,50 @@ export class MarketplaceUnavailableError extends MarketplaceError {
 	}
 }
 
+const MAX_REDIRECTS = 5;
+
+/**
+ * Fetches a marketplace URL, following redirects only while they stay on
+ * that URL's origin. Throws a `MarketplaceError` coded
+ * `${codePrefix}_REDIRECT_UNTRUSTED` or `${codePrefix}_TOO_MANY_REDIRECTS`.
+ */
+export async function fetchWithinOrigin(
+	url: string,
+	label: string,
+	codePrefix: string,
+): Promise<Response> {
+	const origin = new URL(url).origin;
+	let currentUrl = url;
+	let response = await fetch(currentUrl, { redirect: "manual" });
+
+	for (let i = 0; i < MAX_REDIRECTS; i++) {
+		if (response.status < 300 || response.status >= 400) break;
+
+		const location = response.headers.get("location");
+		if (!location) break;
+
+		const target = new URL(location, currentUrl);
+		if (target.origin !== origin) {
+			throw new MarketplaceError(
+				`${label} redirected to untrusted host: ${target.origin}`,
+				response.status,
+				`${codePrefix}_REDIRECT_UNTRUSTED`,
+			);
+		}
+		currentUrl = target.href;
+		response = await fetch(currentUrl, { redirect: "manual" });
+	}
+
+	if (response.status >= 300 && response.status < 400) {
+		throw new MarketplaceError(
+			`${label} exceeded maximum redirects (${MAX_REDIRECTS})`,
+			response.status,
+			`${codePrefix}_TOO_MANY_REDIRECTS`,
+		);
+	}
+	return response;
+}
+
 // ── Implementation ─────────────────────────────────────────────────
 
 class MarketplaceClientImpl implements MarketplaceClient {
@@ -241,40 +285,9 @@ class MarketplaceClientImpl implements MarketplaceClient {
 	async downloadBundle(id: string, version: string): Promise<PluginBundle> {
 		const bundleUrl = `${this.baseUrl}/api/v1/plugins/${encodeURIComponent(id)}/versions/${encodeURIComponent(version)}/bundle`;
 
-		const marketplaceOrigin = new URL(this.baseUrl).origin;
-		const MAX_REDIRECTS = 5;
 		let response: Response;
 		try {
-			let currentUrl = bundleUrl;
-			response = await fetch(currentUrl, { redirect: "manual" });
-
-			// Follow redirects manually, validating each target stays on the marketplace host
-			for (let i = 0; i < MAX_REDIRECTS; i++) {
-				if (response.status < 300 || response.status >= 400) break;
-
-				const location = response.headers.get("location");
-				if (!location) break;
-
-				const target = new URL(location, currentUrl);
-				if (target.origin !== marketplaceOrigin) {
-					throw new MarketplaceError(
-						`Bundle download redirected to untrusted host: ${target.origin}`,
-						response.status,
-						"BUNDLE_REDIRECT_UNTRUSTED",
-					);
-				}
-				currentUrl = target.href;
-				response = await fetch(currentUrl, { redirect: "manual" });
-			}
-
-			// If still a redirect after MAX_REDIRECTS, fail explicitly
-			if (response.status >= 300 && response.status < 400) {
-				throw new MarketplaceError(
-					`Bundle download exceeded maximum redirects (${MAX_REDIRECTS})`,
-					response.status,
-					"BUNDLE_TOO_MANY_REDIRECTS",
-				);
-			}
+			response = await fetchWithinOrigin(bundleUrl, "Bundle download", "BUNDLE");
 		} catch (err) {
 			if (err instanceof MarketplaceError) throw err;
 			throw new MarketplaceUnavailableError(err);
@@ -383,10 +396,9 @@ class MarketplaceClientImpl implements MarketplaceClient {
  * over plugin bundle tarballs regardless of distribution channel.
  */
 // Aligns with RFC 0001 §"Bundle size limits" (256 KiB decompressed,
-// 20 files). Matches `MAX_BUNDLE_SIZE` in cli/commands/bundle-utils.ts
-// (the publish-side cap). We don't import that constant to keep this
-// runtime module independent of the CLI; the two values are
-// load-bearing identical and must stay in sync.
+// 20 files). Matches `MAX_BUNDLE_SIZE` in @emdash-cms/plugin-cli. We
+// don't import that constant to keep this runtime module independent
+// of the authoring CLI; the two values must stay in sync.
 //
 // Tar adds per-file headers (~512 bytes each) plus directory entries,
 // so the entry count cap is set comfortably above RFC's 20-file limit.

package/src/plugins/sandbox/proxy.ts

@@ -124,6 +124,7 @@ export function createSandboxedPluginProxy(
 			settingsSchema: manifest.admin.settingsSchema,
 			portableTextBlocks: manifest.admin.portableTextBlocks,
 			fieldWidgets: manifest.admin.fieldWidgets,
+			mcp: manifest.mcp,
 		},
 	);
 }

package/src/plugins/types.ts

@@ -674,6 +674,66 @@ export interface TaxonomyAccessWithWrite extends TaxonomyAccess {
 	): Promise<TaxonomyTermInfo[]>;
 }
 
+/**
+ * Public byline profile returned from the byline API. Omits the linked user
+ * account, guest flag, and custom field values.
+ */
+export interface BylineInfo {
+	id: string;
+	slug: string;
+	displayName: string;
+	bio: string | null;
+	websiteUrl: string | null;
+	/** Media ID of the avatar image. Resolve it with `ctx.media.get()`. */
+	avatarMediaId: string | null;
+	locale: string;
+	/** Locale-agnostic identity shared by every translation of the byline. */
+	translationGroup: string;
+}
+
+/** A byline credited on a content entry. */
+export interface BylineCreditInfo {
+	byline: BylineInfo;
+	sortOrder: number;
+	roleLabel: string | null;
+	/**
+	 * `explicit` for a credit assigned in the editor; `inferred` when the entry
+	 * has no credits and the byline linked to the entry's author is used.
+	 */
+	source: "explicit" | "inferred";
+}
+
+export interface BylineListOptions {
+	/** Match one locale. Omit to list every locale. */
+	locale?: string;
+	/** Page size, clamped to 1–100. Defaults to 50. */
+	limit?: number;
+	cursor?: string;
+}
+
+/** Byline credits for one entry in a batched lookup. */
+export interface EntryBylineCredits {
+	entryId: string;
+	bylines: BylineCreditInfo[];
+}
+
+/**
+ * Byline access interface — capability-gated on `bylines:read`.
+ */
+export interface BylineAccess {
+	/** Get a byline by its row ID. */
+	get(id: string): Promise<BylineInfo | null>;
+	/** List bylines, newest first. */
+	list(options?: BylineListOptions): Promise<PaginatedResult<BylineInfo>>;
+	/**
+	 * Bylines credited on up to 100 entries of one collection, in the order the
+	 * IDs were given. Duplicate IDs are returned once. Credits resolve at each
+	 * entry's own locale, matching what the site renders. Trashed and missing
+	 * entries have no credits.
+	 */
+	getEntriesBylines(collection: string, entryIds: string[]): Promise<EntryBylineCredits[]>;
+}
+
 export type RedirectStatus = 301 | 302 | 307 | 308 | 410 | 451;
 
 export interface RedirectInfo {
@@ -988,6 +1048,9 @@ export interface PluginContext<TStorage extends PluginStorageConfig = PluginStor
 	/** Taxonomy access - only if a taxonomy capability is declared. */
 	taxonomies?: TaxonomyAccess | TaxonomyAccessWithWrite;
 
+	/** Byline access - only if bylines:read capability */
+	bylines?: BylineAccess;
+
 	/** Redirect access - only if redirects:read or redirects:write capability */
 	redirects?: RedirectAccess | RedirectAccessWithWrite;
 
@@ -1463,6 +1526,34 @@ export type ContentAfterUnscheduleHandler = (
 	ctx: PluginContext,
 ) => Promise<void>;
 
+/**
+ * Event for `byline:afterSave`, fired after a byline profile or one of its
+ * locale translations is created or updated.
+ */
+export interface BylineAfterSaveEvent {
+	byline: BylineInfo;
+	isNew: boolean;
+}
+
+/**
+ * Event for `byline:afterDelete`, fired after a byline row is deleted. When it
+ * was the last locale of its translation group, its credits have already been
+ * removed from every entry.
+ */
+export interface BylineAfterDeleteEvent {
+	byline: BylineInfo;
+}
+
+export type BylineAfterSaveHandler = (
+	event: BylineAfterSaveEvent,
+	ctx: PluginContext,
+) => Promise<void>;
+
+export type BylineAfterDeleteHandler = (
+	event: BylineAfterDeleteEvent,
+	ctx: PluginContext,
+) => Promise<void>;
+
 export type MediaBeforeUploadHandler = (
 	event: MediaUploadEvent,
 	ctx: PluginContext,
@@ -1678,6 +1769,8 @@ export interface PluginHooks {
 	"comment:moderate"?: HookConfig<CommentModerateHandler> | CommentModerateHandler;
 	"comment:afterCreate"?: HookConfig<CommentAfterCreateHandler> | CommentAfterCreateHandler;
 	"comment:afterModerate"?: HookConfig<CommentAfterModerateHandler> | CommentAfterModerateHandler;
+	"byline:afterSave"?: HookConfig<BylineAfterSaveHandler> | BylineAfterSaveHandler;
+	"byline:afterDelete"?: HookConfig<BylineAfterDeleteHandler> | BylineAfterDeleteHandler;
 
 	// Public page hooks
 	"page:metadata"?: HookConfig<PageMetadataHandler> | PageMetadataHandler;
@@ -2077,6 +2170,8 @@ export interface ResolvedPluginHooks {
 	"comment:moderate"?: ResolvedHook<CommentModerateHandler>;
 	"comment:afterCreate"?: ResolvedHook<CommentAfterCreateHandler>;
 	"comment:afterModerate"?: ResolvedHook<CommentAfterModerateHandler>;
+	"byline:afterSave"?: ResolvedHook<BylineAfterSaveHandler>;
+	"byline:afterDelete"?: ResolvedHook<BylineAfterDeleteHandler>;
 	"page:metadata"?: ResolvedHook<PageMetadataHandler>;
 	"page:fragments"?: ResolvedHook<PageFragmentHandler>;
 }