feat(release-service): add delegated release foundations - #2743
Conversation
🦋 Changeset detectedLatest commit: 60c5462 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
review/awaiting-author
Scope checkThis PR changes 17,762 lines across 34 files. Large PRs are harder to review and more likely to be closed without review. If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs. See CONTRIBUTING.md for contribution guidelines. |
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/auth-atproto
@emdash-cms/blocks
@emdash-cms/cloudflare
@emdash-cms/contentful-to-portable-text
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/plugin-cli
@emdash-cms/plugin-types
@emdash-cms/registry-client
@emdash-cms/registry-lexicons
@emdash-cms/registry-moderation
@emdash-cms/registry-verification
@emdash-cms/sandbox-workerd
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-field-kit
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
![emdashbot[bot]](https://avatars.githubusercontent.com/in/3255304?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR lays out a sensible foundation for the delegated release service: a minimal Cloudflare Worker shell, strict create-only OAuth client metadata, a compact context-bound JWE encryption layer, safe error logging, and a CLI-side OAuth registration fix that lets saved sessions refresh/revoke after the loopback callback server closes. It also wires up an exact-scope PDS conformance harness behind a hidden command and links to the approved Discussion. Overall approach fits the architecture and the approved design.
I checked the changed source files and tests, traced the new CLI OAuth registration store, verified the conformance harness against the docs steps, and compared the new Worker app against repo conventions. The code is generally careful (fail-closed configuration, context digests bound to deployment + row identity, no raw config values in error bodies). The most important gap is CI/integration coverage: the new @emdash-cms/release-service package is not included in root workspace scripts or the CI test/build pipeline, so its tests will not run automatically. I also found a few smaller robustness/doc items.
A note on an unverified concern: getStoredSessionMetadata returns tokenSet.expires_at as expiresAt unchanged, and pds-conformance.ts compares it to Date.now(). If atcute stores expires_at as seconds (the common OAuth convention), the refreshDue report field will be misleading. I couldn’t confirm the unit without running the library, so I’m not listing it as a confirmed finding, but it’s worth checking before relying on that field.
Findings
-
[needs fixing]
package.json:13The new
apps/release-servicepackage has its owntypecheckandtestscripts and a sizable new test suite, but roottest:unit(line 13) andtypecheck(line 8) only coverpackages/*plus a few named package filters. The Worker app is therefore not exercised bypnpm test:unitorpnpm typecheck.Add
@emdash-cms/release-serviceto both root scripts so developers and CI exercise the new app the same way as other packages. -
[needs fixing]
.github/workflows/ci.yml:125The CI
testjob’s build step builds the packages it intends to test but does not include@emdash-cms/release-service. Even if the roottest:unitscript is updated, this build command still needs the new app so its workspace links are built before tests run.Current line:
- run: pnpm run --filter emdash... --filter "@emdash-cms/aggregator" --filter "@emdash-cms/labeler" --filter "@emdash-cms/plugin-cli" --filter "@emdash-cms/registry-*" --filter "@emdash-cms/plugin-types" build
- run: pnpm run --filter emdash... --filter "@emdash-cms/aggregator" --filter "@emdash-cms/labeler" --filter "@emdash-cms/plugin-cli" --filter "@emdash-cms/registry-*" --filter "@emdash-cms/plugin-types" --filter "@emdash-cms/release-service" build -
[suggestion]
apps/release-service/src/crypto/encryption.ts:226parseEnvelopevalidates segments 0, 1, 2, and 4 are non-empty, but it does not reject an empty ciphertext segment (segment 3). A compact JWE with an empty ciphertext is malformed and should be rejected explicitly before reachingcompactDecrypt.segments[0]?.length === 0 || segments[1]?.length === 0 || segments[2]?.length === 0 || segments[3]?.length === 0 || segments[4]?.length === 0 -
[suggestion]
docs/technical-specs/delegated-release-service-g0-conformance.md:197The result matrix dates the npmX and Cirrus public-client results as 2026-08-25, but the narrative sections above state the authorization runs completed on 2026-08-24. If the matrix reflects the later refresh/revoke phases, clarify the column meaning; otherwise align the dates so readers don’t think the authorization and matrix dates conflict.
-
[suggestion]
packages/plugin-cli/src/commands/pds-conformance.ts:170refreshDuecomparesmetadataBefore.expiresAtdirectly againstDate.now().getStoredSessionMetadatasurfacestokenSet.expires_atunchanged, and many OAuth libraries store that value as seconds since epoch. If atcute does the same, this comparison is always true on resume and therefreshDuereport field becomes misleading. Confirm the unit and convert to milliseconds before comparing if needed.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
docs | 60c5462 | Aug 28 2026, 11:11 PM |
Overlapping PRsThis PR modifies files that are also changed by other open PRs:
This may cause merge conflicts or duplicated work. A maintainer will coordinate. |
40c24fc to
fbb6990
Compare
github-actions
Bot
added
review/needs-rereview
fbb6990 to
bdebf5d
Compare
🔍 Adversarial review — stack #2766, layer 2 of 8Automated deep review of this layer's diff ( What the PR actually does + verdictPR #2743 adds a new private Cloudflare Worker ( Findings
PR description vs code
Test-coverage gaps
Verification environment: full test runs at ref ~ 🤖 Fable |
bdebf5d to
8b98602
Compare
Lunaria Status Overview🌕 This pull request will trigger status changes. Learn moreBy default, every PR changing files present in the Lunaria configuration's You can change this by adding one of the keywords present in the Tracked Files
Warnings reference
|
4e1c2c1 to
1c65031
Compare
1c65031 to
60c5462
Compare
What does this PR do?
Adds the foundation for the delegated release service: the Worker shell, exact create-only PDS conformance harness, confidential OAuth metadata, compact JWE envelope encryption, safe unexpected-error logging, and CI support for dependent stack PR bases.
This is PR 1 of 7. Its three focused commits are retained for review. The stack merges as one unit and no intermediate branch is a deployable service version.
Discussion: #1590
Type of change
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpasses (or targeted tests for my change)pnpm formathas been runAI-generated code disclosure
Screenshots / test output
The complete stack passes formatting, strict lint, package/application typechecks and tests. The public-client G0 lifecycle passed against the npmX-hosted Bluesky PDS and Cirrus; deployment-only confidential-client checks remain pending.