* fix(skills): correct the Block Kit examples that break the admin page
Five of the fourteen block examples in the creating-plugins skill describe
a shape that packages/blocks does not accept. Stats puts its cards under
`stats` where StatsBlock declares `items`, and Columns wraps each column in
an object where ColumnsBlock declares an array of blocks — both crash the
admin renderer, which calls .map() on the missing value. Table omits the
required page_action_id, and three button examples use `text` where
ButtonElement declares `label`.
These files ship inside every generated project and are read by coding
agents that cannot check a rendered page before shipping, so an example
that disagrees with the types is copied straight into a broken plugin.
Running every example through validateBlocks() now reports 0 of 14 failing,
down from 5.
* test(blocks): guard the Block Kit reference examples against type drift
The corrected examples were checked once by hand, so nothing stops them
from drifting away from the declared block and element shapes again. Every
JSON example in the reference now runs through validateBlocks; reverting
the reference to its previous state fails six of them.
* feat: add object-cache purge API and cache:purge plugin capability
Admins and sandboxed plugins can clear CMS object-cache namespaces
(KV/memory) via GET/POST /_emdash/api/admin/cache/object and
ctx.cache. Block Kit buttons gain optional disabled and title fields
for clearer troubleshooting UI.
* style: format
* feat: add Workers Cache purge API alongside object cache
Admins and plugins with cache:purge can clear edge-cached pages via
GET/POST /_emdash/api/admin/cache/workers and ctx.cache.purgeWorkersCache()
(Cloudflare purge_everything using CF_ZONE_ID + CF_CACHE_PURGE_TOKEN).
* feat: purge Workers Cache via native cache.purge()
Replace zone REST purge (CF_ZONE_ID + token) with cloudflare:workers
cache.purge({ purgeEverything: true }). Status is configured when the
native API is available — no secrets required.
* fix(core): resolve Workers Cache purge via virtual module
Dynamic import of cloudflare:workers from core failed under Vite.
Expose cache through virtual:emdash/workers-cache (same pattern as env
and waitUntil) so status/purge work on the Cloudflare adapter.
* feat: Workers Cache path-prefix purge
POST /admin/cache/workers and ctx.cache.purgeWorkersCache() accept
optional pathPrefixes (paths or full URLs, normalized). Empty input
still purges everything via cache.purge.
* fix: lint workers-cache handlers and marketplace capability list
Move URL regex to module scope, drop redundant unknown union, rename
shadowed Tooltip render prop, and include cache:purge in
CAPABILITY_LABELS contract test.
---------
Co-authored-by: emdashbot[bot] <emdashbot[bot]@users.noreply.github.com>
Bumps oxlint 1.71.0 to 1.73.0 and oxlint-tsgolint 0.23.0 to 0.24.0.
The stricter no-unnecessary-type-assertion rule flagged 82 redundant
assertions. Removed them via autofix, dropped the now-dangling
no-unsafe-type-assertion disable comments, removed the type-only imports
left unused, and added justified no-base-to-string suppressions at the
few sites where a removed assertion had been narrowing an unknown scalar
for String().
Compile-time only; emitted output is unchanged.
* ci: release
* format
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Kane <m@mk.gg>
* ci: release
* format
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Kane <m@mk.gg>
* chore: bump @cloudflare/kumo to 2.3
Migrates two internal call sites to the Kumo 2 API:
- accordion block: Collapsible refactored to a compound component.
Use Collapsible.Root / .DefaultTrigger / .DefaultPanel instead of
<Collapsible label=...>.
- chart block: ChartPalette.color renamed to ChartPalette.categorical.
Admin tests that asserted on Button's native title attribute now read
aria-label instead, because Kumo 2 wraps <Button title> in a Tooltip
popup rather than setting the DOM title attribute. Updated the
@cloudflare/kumo mock in the blocks renderer tests to match the new
Collapsible compound shape.
No public API changes; consumers see identical behaviour.
* test(e2e): update title selectors for Kumo 2 Button tooltip
Kumo 2.x wraps <Button title> in a Tooltip popup rather than setting a
DOM title attribute. Switch redirect and revision history e2e selectors
from button[title=...] to button[aria-label=...] / [aria-label^=...].
The components already exposed accurate aria-labels (and in the
redirects case, more specific per-row labels via the source path).
* fix(deps): catalog-pin zod so trusted plugins typecheck
Astro bundles its own Zod and re-exports it as 'astro/zod'. Trusted
plugins like @emdash-cms/plugin-forms import their route schemas via
'astro/zod', then pass those schemas to definePlugin() in core. With
emdash's 'zod: ^4.3.5' resolving independently of Astro's caret,
pnpm kept two Zod 4 patches in the tree (e.g. 4.3.6 alongside 4.4.1).
Zod 4 embeds its semver in the type system, so two patches of Zod 4
are not assignable to each other. The forms plugin's route schemas
(ZodObject<..., $strip>) were rejected by PluginRoute<TInput>['input']
(ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>) with
'Type "3" is not assignable to type "4"' on the internal version
field. The native definePlugin overload silently failed, TS fell
through to the StandardPluginDefinition overload, and reported a
misleading 'id does not exist' error -- masking 8 cascading errors.
Catalog-pinning Zod forces a single workspace-wide instance and
restores normal overload resolution. No code changes needed in core
or plugins/forms.
Also adds a pnpm-workspace.yaml comment explaining the gotcha so the
next person doesn't bump emdash's pin past Astro's range.
* feat(registry): experimental decentralized plugin registry
Adds opt-in support for installing sandboxed plugins from the
decentralized plugin registry described in RFC #694. Enabled via
`experimental.registry.aggregatorUrl` in the EmDash integration
options; when set, the admin UI replaces marketplace browse/install
with the registry path.
Server: new install handler (RFC verification chain), endpoint at
POST /_emdash/api/admin/plugins/registry/install, migration 038 adds
`source = 'registry'` plus `registry_publisher_did` /
`registry_slug` columns on `_plugin_state`, runtime sync split into
shared marketplace + registry tiers via a normalized opaque
`r_<hash>` plugin id.
Browser: aggregator XRPC calls go direct from the admin UI via
@emdash-cms/registry-client. Install POST runs through the server.
Includes a minimum-release-age policy with a per-publisher exclude
allowlist, enforced both client-side (UX) and server-side (gate).
Hardening (5 rounds of adversarial review): bundle id rewritten to
the derived pluginId before storage, aggregator identity
cross-checked, artifact and aggregator URLs validated for SSRF
(https-only in prod, IPv6 brackets handled), per-request and total
budgets on every outbound call, decompressed bundle capped at 256
KiB to match the RFC publish-time limit, migration 038 idempotent
on both SQLite and Postgres.
Known gaps tracked for follow-up: full MST signature verification
against the publisher's PDS, multibase multihash decoding (hex SHA-256
is accepted today), registry plugin update + uninstall handlers.
* fix(registry-lexicons): drop codegen from build script
The generated lexicon types are committed to git so consumers don't
need the codegen toolchain. Running lex-cli generate as part of the
default build pipeline broke Cloudflare Pages builds for sites that
pull registry-lexicons in transitively, because lex-cli imports
lex.config.ts directly and Node in the CF Pages build environment
can't load .ts natively.
Codegen moves to a separate `regen` script (`pnpm regen` runs
codegen + full build). Maintainers run it when they edit the
lexicons; consumers just consume the committed output.
* fix(registry): copilot review fixes
- Drift check normalizes capabilities (filter strings, dedupe, sort) on
both browser and server so reorderings or junk entries can't trigger
spurious rejection. Adds a shared normalizeCapabilities helper in
registry/config.ts and a mirror in admin/lib/api/registry.ts.
- RegistryPluginDetail no longer trusts the aggregator-supplied
ext?.capabilities as already-validated string[]; runs it through
normalizeCapabilities before display and before send.
- Fix stale '32 MiB' docstring on extractBundle (cap is actually
MAX_DECOMPRESSED_BUNDLE_BYTES = 256 KiB).
- Fix plugin-id.ts JSDoc: validatePluginIdentifier regex is
/^[a-z][a-z0-9_-]*$/ (allows hyphens); the prior 'cannot collide
with marketplace ids' claim was too strong and is now framed as
'syntactically distinct, plus an explicit pre-existing-row check
in the install handler.'
* fix(registry): address review findings + CI failures
CI fixes:
- Rename normalizeCapabilities -> canonicalCapabilitiesForDriftCheck
to avoid namespace clash with the existing capability normalizer
exported from @emdash-cms/plugin-types via core's index. The old
name shadowed plugin-types' helper at the top level of core's dist,
which made the definePlugin() overload set look ambiguous to TS in
plugins/forms and caused a typecheck cascade there.
- [...seen].toSorted() instead of [...seen].sort() to clear the
e18e/prefer-spread-syntax + unicorn/no-array-sort lint errors.
Review findings (ask-bonk[bot]):
- HIGH: drift check tripped on every install when the release record's
extension was empty. The browser now omits acknowledgedDeclaredAccess
when capabilities is empty, opting out of the server-side drift gate
for the (currently common) case where publishers haven't filled in
the extension block. The bundle's real capabilities are still bound
to the checksum-verified bytes.
- HIGH: DID-only publishers (no resolvable handle) could be linked from
the browse grid but never installed because the server rejects
handles without a '.'. Cards now render as non-interactive with a
'Publisher handle unresolved' badge; the detail page surfaces a
matching warning and disables Install.
- MEDIUM: registry-enabled sites were unconditionally routing existing
marketplace plugin detail URLs to RegistryPluginDetail, breaking deep
links. Detail-route selection now discriminates by param shape
(pluginId.includes('/')) rather than the manifest flag.
- MEDIUM: state-row write failure after storeBundleInR2 left orphan
bundles. Best-effort cleanup in the catch via deleteBundleFromR2.
- LOW: parseDurationSeconds runs on the user-supplied integration
option per install (not the already-normalized manifest shape). Wrap
in try/catch and surface as REGISTRY_POLICY_INVALID rather than
letting it bubble to a generic INSTALL_FAILED.
- LOW: validator-pattern doc drift in plugin-id.ts (already fixed in
the prior commit).
* fix(registry): move registry config types to their own module
The new RegistryConfig + ExperimentalConfig interfaces lived alongside
definePlugin's overloads in astro/integration/runtime.ts. tsdown +
rolldown's chunking decided to inline a bigger subset of plugin-related
types into the entry chunk as a result, which broke definePlugin()
overload resolution for trusted plugins building against core's dist
on CI (plugins/forms failed with 'id does not exist in type
StandardPluginDefinition').
Move both types to packages/core/src/registry/types.ts (still re-exported
from runtime.ts for backwards compatibility) so the chunking matches
main's layout and definePlugin's overloads resolve as before.
* fix(registry): wire up real-world install + display polish
Aggregator (apps/aggregator):
- Add CORS to /xrpc/* so the admin UI can call it from any origin
(preflight 204, response headers on every method). Aggregator is a
public read-only service; * is correct here.
Core (packages/core):
- Implement multibase-multihash checksum verification by re-encoding
our SHA-256 digest in the same 'b<base32>' shape the registry CLI
produces, rather than decoding the publisher's checksum. Same trust
contract, no base32 decoder needed. Bare hex SHA-256 still accepted
as a convenience fallback.
- Switch install handler to take 'did' (not handle) so packages whose
handle the aggregator couldn't resolve are still installable. The
browser resolves handle→DID via the aggregator before posting and
sends DID directly; the server skips resolvePackage and goes
straight to getPackage.
- Coerce 'experimental.registry' bare-string shorthand into the full
RegistryConfig object via 'coerceRegistryConfig'. 'registry:
"..."' is now equivalent to 'registry: { aggregatorUrl: "..." }'.
- Plumb 'experimental' through the integration's serializableConfig
so the manifest endpoint actually sees the user's registry block.
Previously it was being stripped, so the admin UI never branched to
the registry path.
- Split RegistryConfig + ExperimentalConfig types into their own
module (registry/types.ts) so they don't get bundled into the
astro/integration/runtime.ts dist chunk -- the wider inlining was
breaking definePlugin overload resolution for trusted plugins
building against core's dist.
Admin (packages/admin):
- New <PublisherHandle> component + usePublisherHandle hook with
tri-state result ('ok' / 'invalid' / 'missing'). Renders @handle,
'Unverified publisher' (red), or DID respectively. Uses
@atcute/identity-resolver's LocalActorResolver for bidirectional
handle verification, localStorage-cached for 24h.
- Detail page disables install on 'invalid' status (publisher claims
a handle that doesn't round-trip back to its DID -- impersonation
risk). Surfaces 'We couldn't verify this publisher's identity'
alert in plain language.
- Detail page reads installed state from fetchPlugins() and swaps
the Install button to 'Installed' (disabled) when the package
already has a 'source = "registry"' row matching its DID + slug.
React Query's existing ['plugins'] invalidation handles the
post-install UI update.
- Browse cards reuse <PublisherHandle> (variant='card') and link by
handle when available, DID otherwise. Detail page parses either
form from the URL.
- Browser sends 'did' (not handle) in the install POST.
Workspace:
- '@cloudflare/kumo' moved to the pnpm catalog and bumped to ^1.16.0
workspace-wide. Older 1.10.0 was missing Sidebar export and being
hoisted into the admin via packages/blocks's transitive dep.
- Add '@atcute/multibase' to core (for checksum encoding) and
'@atcute/identity-resolver' to admin (for DID->handle resolution).
- Update DEFAULT_AGGREGATOR_URL + DiscoveryClient doc example from
'experimental-registry.emdashcms.com' to 'registry.emdashcms.com'
(the actual production host).
* fix(registry): adversarial review round 6 findings
Addresses 7 findings from the round-6 adversarial review and
documents the eighth.
#1 (high) Capability consent bypass [registry.ts, RegistryPluginDetail.tsx]
The drift check was gated on the client sending acknowledgedDeclaredAccess.
If the publisher's release record had no extension, the admin saw an
empty permission dialog, omitted the acknowledgement, and the server
skipped the check entirely -- letting a bundle whose manifest declares
real capabilities slip through behind an empty consent UI. Server now
extracts capabilities from the bundle manifest after download and
refuses with DECLARED_ACCESS_REQUIRED if the bundle declares any
capabilities and no acknowledgement was sent. Client always sends the
list (empty when no extension) so the new server check is always armed.
#2 (high) Concurrent install bundle deletion [registry.ts]
Two parallel installs of the same (did, slug, version) both passed the
pre-existing-row check, both uploaded to the same deterministic R2
prefix, and one then won the state-row PK race. The loser's catch block
deleted the R2 bundle the winner had just written. On state-write
failure we now re-query the state row: if a winner exists, we lost the
race and must not touch the R2 bundle. Cleanup runs only when the
failure is a real DB error, not a lost concurrent install.
#3 (high) SSRF via DNS-resolving public hostnames [registry.ts, ssrf.ts moved]
Literal-IP blocklist alone left a DNS-rebinding gap: any public DNS
service resolving an attacker-chosen hostname to loopback / RFC1918 /
169.254.169.254 passed the URL check. The import pipeline already
shipped resolveAndValidateExternalUrl which does Cloudflare DoH
resolution and rejects on any forbidden resolved address; reuse it
for artifact downloads. Move src/import/ssrf.ts to src/security/ssrf.ts
to reflect that it's not import-specific. Leave a re-export shim at
the old path so 13 existing callers keep working unchanged. Add
#security/* path alias.
#5 (high) Aggregator-supplied handles treated as verified [PublisherHandle.tsx]
usePublisherHandle returned status: 'ok' with the aggregator-supplied
handle whenever one was present, skipping local DID->handle round-trip.
A compromised aggregator could label an attacker DID as e.g.
'stripe.com' and the UI would render it as verified. Always run
LocalActorResolver via resolveDidToHandle; use the aggregator handle
only for a cross-check. If the aggregator's claim differs from the
verified handle, mark the publisher invalid.
#6 (medium) Postgres migration 038 schema-qualification [038_registry_plugin_state.ts]
The columns probe queried information_schema.columns without filtering
by table_schema. A _plugin_state table in another schema (multi-tenant
Postgres, per-test schemas) could make the migration skip the column
adds. Filter by table_schema = current_schema().
#7 (medium) Install errors leak full artifact URLs [registry.ts]
fetchArtifact recorded each full URL in the joined error message that
bubbled up to the admin client. Artifacts hosted on storage backends
often carry presigned tokens in the query string; failed installs were
leaking those into HTTP responses and logs. Strip query and fragment
when building client-visible errors (origin + path only); log the full
URL server-side for debugging.
#8 (medium) Credentialed aggregator URLs accepted [config.ts]
validateAggregatorUrl accepted https://user:pass@example.com.
The normalized URL ends up in the admin manifest and is shipped to
every admin browser; browser fetch() also rejects credentialed URLs
outright. Reject them at config-validation time.
#4 (high, documented not fixed) Aggregator-trust-root scope [types.ts]
Full MST proof / publisher signature verification is not in this PR;
the server still trusts the aggregator-supplied (did, slug, checksum,
artifact URL). Expand the JSDoc on EmDashConfig.experimental.registry
to spell out exactly what the v1 trust contract is, what EmDash does
verify independently (checksum, manifest id/version/capabilities), and
what it doesn't (release-record signatures, replay). Recommendation:
point aggregatorUrl only at an aggregator you operate or trust at
centralized-source level until signature verification lands.
* fix(registry): adversarial review round 7 followups
Two LOW findings from the round-7 review (PR #1011 comment).
NSID exact-match in RegistryPluginDetail.tsx
Round-6 left a startsWith() match on the release-extension key.
RFC 0001 fixes the NSID for the release extension; accepting prefix
variants (...releaseExtensionV2, ...releaseExtension.deprecated)
would let a publisher render a different capability list than the
canonical key would. Use exact-equality keyed lookup.
Registry plugin uninstall affordance in PluginManager.tsx
Registry-installed plugins appear in PluginManager but the Uninstall
button is gated on isMarketplace. Admins see a permanent-looking
install with no way to remove it short of editing the DB and R2 by
hand. Add an inline note for source === 'registry' rows that says
uninstall isn't available yet and points the admin at the disable
toggle. Full uninstall handler lands in a follow-up PR.
* feat(admin): add media_picker BlockKit element
Adds a `media_picker` Block Kit element: a thumbnail preview with a modal
library picker and mime-type filter. Usable in plugin block forms (inside
`PortableTextEditor`) and as a Block Kit field widget (`BlockKitFieldWidget`).
The stored value is the selected asset's URL string, so it is value-compatible
with a plain `text_input` — existing content continues to work after swapping.
Split from #679 per maintainer request. Image-link landed in #704; repeater
landed in the rescoped #679.
* fix(blocks): handle media_picker in runtime renderElement
Add a `case "media_picker"` arm to keep the Element union exhaustive.
The picker is an admin-authoring construct (thumbnail + modal library
picker) with no runtime render semantics, so returning null matches
the repeater pattern.
* chore: extract locale catalogs [skip ci]
* fix(admin,blocks): address PR #731 media_picker review feedback
- Extract shared BlockKitMediaPickerField; both BlockKitFieldWidget and
PortableTextEditor now render through it, killing two near-identical
copies that risked diverging.
- Fix URL-insert local-rewrite bug: MediaPickerModal returns URL-inserted
items with id:"" and no provider/storageKey. Treating the absence of
provider as "local" rewrote external URLs to a broken
/_emdash/api/media/file/ path. Detect local explicitly via
provider==="local" || !!storageKey and fall through to item.url.
- Validate URLs before previewing: only render <img> for safe http(s)
URLs or relative paths starting with "/" (not "//"); fall back to the
empty-state placeholder otherwise. Add referrerPolicy="no-referrer"
and loading="lazy" on the preview <img>.
- Improve a11y on hover-revealed Change/Remove controls: also reveal on
group-focus-within, and toggle pointer-events with the same group
states so invisible controls don't absorb pointer events.
- Restrict mime_type_filter to image MIME types (image/ or image/<sub>),
rejecting wildcards like image/* (unsupported by the picker's
startsWith filter) and non-image types like video/.
- Add validation tests (3 valid + 6 invalid cases) and component tests
(11 cases covering empty state, picker open, local pick, URL pick,
preview attrs, unsafe-URL fallback, remove).
---------
Co-authored-by: Matt Kane <mkane@cloudflare.com>
* fix(core): REST + CLI audit, 34 bug fixes across security, error handling, data integrity, and client parity
* fix: revert device flow client_id validation, built-in CLI client is not in DB
* fix: remove pointless single-mimetype blocklist from media provider upload
Wraps Kumo Collapsible with the Block Kit pattern: a labeled trigger
hides nested blocks until opened, with an optional `default_open`.
Open/closed state is local — no round-trip to the plugin.
* ci: release
* chore: restore original PR/author attribution in CHANGELOGs
* style: format
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: emdashbot[bot] <emdashbot[bot]@users.noreply.github.com>
* revert: undo accidental 1.0.0 release; prevent recurrence
Reverts 46f3acb (ci: release #759), which bumped all 8 publishable
packages to 1.0.0. Restores 0.7.x versions and pending changesets so
the next release lands at 0.8.0.
Root cause: peer-dep cycle between `emdash` and `@emdash-cms/auth-atproto`,
both using `workspace:*`. Changesets resolves `workspace:*` to the exact
current version for semver checks, so a minor bump on either side falls
outside the range and escalates the cycle's other side to major. Other
plugins use `workspace:>=X.Y.Z` and don't trip this — switching both
ends of the cycle to the same form fixes the escalation.
The existing workflow guard greps `pnpm changeset status` for "bumped
at major", which only runs at PR-creation time. Once the version PR is
merged, no changesets are pending and the grep returns nothing — so
the publish step proceeded with already-bumped 1.0.0 versions.
Replaces it with a package.json scan that fails on any non-private 1.x
version. Wired into both `release.yml` (publish-time) and `ci.yml`
(every PR, including the auto-generated Version Packages PR).
Also adds .claude/* to .gitignore (mirroring the .opencode pattern)
so local agent state doesn't accidentally land in commits.
* style: format
* chore: update lockfile for workspace range changes
---------
Co-authored-by: emdashbot[bot] <emdashbot[bot]@users.noreply.github.com>
emdashbot[bot]