feat(registry): host release artifacts as publisher blobs - #2765
feat(registry): host release artifacts as publisher blobs#2765ascorbic wants to merge 13 commits into
Conversation
🦋 Changeset detectedLatest commit: 01d1f98 The changes in this PR will be included in the next version bump. This PR includes changesets to release 21 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| 🔵 In progress View logs |
docs | f0715ab | Aug 28 2026, 09:16 PM |
Scope checkThis PR changes 3,250 lines across 65 files. Large PRs are harder to review and more likely to be closed without review. If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs. See CONTRIBUTING.md for contribution guidelines. |
![emdashbot[bot]](https://avatars.githubusercontent.com/in/3255304?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is the right architectural change: it moves sandboxed plugin artifacts from publisher-hosted tarballs and PUT-uploaded images to atproto PDS blobs and record-scoped caches, which matches the RFC direction and keeps checksum verification end-to-end. The diff is large but the critical paths (CLI publish, server install/update, artifact proxy, labeler canonical input, aggregator view mappers) are consistent with the new lexicon and most edge cases are handled.
I checked the core and CLI handlers, the new registry-verification artifact fetcher, the aggregator view mappers, the admin proxy route, labeler assessment, the lexicon/generated types, the changeset, and the updated docs. Tests cover the new blob path, CID/checksum mismatch rejection, OAuth scope gating, and the proxy routes.
Two things stand out:
emdash-plugin infonow callsclient.getLatestRelease()to print hosting metadata, but it doesn't guard against a missing/withdrawn release or a network failure. Because this command previously worked without that round-trip, a transient XRPC error or an inconsistentlatestVersionpointer can now crash the CLI.- The labeler hardcodes
https://cdn.em-da.shfor media URLs even though the aggregator now advertises typedartifactCaches. For now the constant matches the canonical deployment, but any staging/alternative cache origin will produce stale URLs without warning.
Fixing the first one is the only blocking concern; the second is architectural debt to address before the cache origin is allowed to vary.
github-actions
Bot
added
the
review/awaiting-author
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/auth-atproto
@emdash-cms/blocks
@emdash-cms/cloudflare
@emdash-cms/contentful-to-portable-text
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/plugin-cli
@emdash-cms/plugin-types
@emdash-cms/registry-client
@emdash-cms/registry-lexicons
@emdash-cms/registry-moderation
@emdash-cms/registry-verification
@emdash-cms/sandbox-workerd
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-field-kit
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
github-actions
Bot
added
review/needs-rereview
🔍 Adversarial review — stack #2766, layer 1 of 8Automated deep review of this layer's diff ( What the PR actually does + verdictThe PR moves plugin release artifacts from publisher-hosted URLs to atproto blobs on the publisher's PDS. Verified against code: Findings
PR description vs code
Test-coverage gaps
~ 🤖 Fable |
Overlapping PRsThis PR modifies files that are also changed by other open PRs:
This may cause merge conflicts or duplicated work. A maintainer will coordinate. |
cb0de84 to
f0715ab
Compare
1 participant
What does this PR do?
Makes the publisher's PDS the default host for sandboxed plugin release artifacts.
emdash-plugin publishnow builds and validates the bundle, uploads the gzip package and declared PNG/JPEG/WebP listing images throughcom.atproto.repo.uploadBlob, and writes CID-bound checksums into the release record.--urlremains available for externally hosted package bundles; the HTTP PUT--artifact-base-urlflow is removed.The release Lexicon accepts blob or URL artifact sources, applies slot-specific MIME and size constraints, and changes
authto an open union. Shared verification rejects source-less artifacts, blob/checksum mismatches, gated artifacts without a supported auth method, unsafe fetch targets, and corrupt bytes. Resolution tries typed record-scoped artifact caches, the publisher PDS, then the explicit URL.Aggregator release envelopes now expose typed
artifactCachesinstead ofmirrors. Raw and image cache routes bind both the exact release-record CID and blob CID. The admin image proxy uses Cumulus image presets, while package installation and labeler assessment use checksum-verifiable raw bytes.Related work:
Type of change
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpasses (or targeted tests for my change)pnpm formathas been runAI-generated code disclosure
Screenshots / test output
No visual UI changes.
Verified locally:
pnpm typecheckpnpm lint:json | jq '.diagnostics | length'→0pnpm --dir docs build