fix(registry): move registry config types to their own module

ascorbic · ascorbic · commit d6c4dc59ba1a · 2026-05-13T15:52:36.000+01:00
The new RegistryConfig + ExperimentalConfig interfaces lived alongside
definePlugin's overloads in astro/integration/runtime.ts. tsdown +
rolldown's chunking decided to inline a bigger subset of plugin-related
types into the entry chunk as a result, which broke definePlugin()
overload resolution for trusted plugins building against core's dist
on CI (plugins/forms failed with 'id does not exist in type
StandardPluginDefinition').

Move both types to packages/core/src/registry/types.ts (still re-exported
from runtime.ts for backwards compatibility) so the chunking matches
main's layout and definePlugin's overloads resolve as before.
diff --git a/packages/core/src/api/handlers/registry.ts b/packages/core/src/api/handlers/registry.ts
@@ -41,7 +41,6 @@
 import type { Handle } from "@atcute/lexicons";
 import type { Kysely } from "kysely";
 
-import type { RegistryConfig } from "../../astro/integration/runtime.js";
 import type { Database } from "../../database/types.js";
 import { extractBundle } from "../../plugins/marketplace.js";
 import type { PluginBundle } from "../../plugins/marketplace.js";
@@ -54,6 +53,7 @@ import {
 	validateAggregatorUrl,
 } from "../../registry/config.js";
 import { makeRegistryPluginId } from "../../registry/plugin-id.js";
+import type { RegistryConfig } from "../../registry/types.js";
 import { EmDashStorageError } from "../../storage/types.js";
 import type { Storage } from "../../storage/types.js";
 import type { ApiResult } from "../types.js";
diff --git a/packages/core/src/astro/integration/runtime.ts b/packages/core/src/astro/integration/runtime.ts
@@ -11,8 +11,11 @@ import type { AuthDescriptor, AuthProviderDescriptor } from "../../auth/types.js
 import type { DatabaseDescriptor } from "../../db/adapters.js";
 import type { MediaProviderDescriptor } from "../../media/types.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
+import type { ExperimentalConfig } from "../../registry/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
 
+export type { ExperimentalConfig, RegistryConfig } from "../../registry/types.js";
+
 export type { ResolvedPlugin };
 export type { MediaProviderDescriptor };
 
@@ -125,133 +128,6 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
 export type SandboxedPluginDescriptor<TOptions = Record<string, unknown>> =
 	PluginDescriptor<TOptions>;
 
-/**
- * Experimental plugin registry configuration.
- *
- * See {@link ExperimentalConfig.registry}.
- */
-export interface RegistryConfig {
-	/**
-	 * Base URL of the registry aggregator (an atproto AppView that indexes
-	 * the firehose for `pm.fair.package.*` and `com.emdashcms.*` records).
-	 *
-	 * Must be the origin where the aggregator's XRPC endpoints are mounted,
-	 * such that `${aggregatorUrl}/xrpc/<nsid>` resolves to a valid endpoint.
-	 *
-	 * Must be HTTPS in production; `http://localhost` or `http://127.0.0.1`
-	 * are accepted in dev.
-	 */
-	aggregatorUrl: string;
-
-	/**
-	 * Optional comma-separated list of labeller DIDs forwarded as the
-	 * `atproto-accept-labelers` header on every aggregator request.
-	 *
-	 * Format follows the atproto convention:
-	 * `did:plc:abc;redact, did:plc:def`
-	 *
-	 * When unset, the aggregator applies its operator-default labeller set
-	 * (typically the EmDash publisher-verification labeller and any
-	 * additional trusted labellers the aggregator operator configured).
-	 */
-	acceptLabelers?: string;
-
-	/**
-	 * Site-level policy applied to the latest-release selection filter.
-	 *
-	 * These filters operate over the signed records the aggregator returns;
-	 * they are not protocol-level constraints. See the RFC's
-	 * "Update Discovery and Takedowns" section for the integration point.
-	 */
-	policy?: {
-		/**
-		 * Hold back releases newer than this when computing the recommended
-		 * install or update version. Mitigates "compromised publisher
-		 * account pushes a malicious release of an established plugin" by
-		 * giving the takedown labeller a detection window.
-		 *
-		 * Accepts a duration string (`"24h"`, `"48h"`, `"72h"`, `"7d"`) or a
-		 * number of seconds.
-		 *
-		 * Currently applies uniformly to all releases. A future addition
-		 * may exempt brand-new packages (those with no prior release
-		 * history) so the holdback doesn't block first-time publishing,
-		 * but that exemption is not implemented yet; use
-		 * {@link minimumReleaseAgeExclude} to allowlist trusted publishers
-		 * whose packages should install immediately.
-		 *
-		 * Defaults to `undefined` (no holdback). A future trust/moderation
-		 * RFC will specify the recommended default.
-		 */
-		minimumReleaseAge?: string | number;
-
-		/**
-		 * Packages exempt from the {@link minimumReleaseAge} holdback. Use
-		 * for publishers whose release tempo you've explicitly accepted --
-		 * your own first-party plugins, a trusted partner, etc.
-		 *
-		 * Each entry is either:
-		 *   - A bare publisher DID (e.g. `"did:plc:abc123"`) -- every
-		 *     package from that publisher is exempt.
-		 *   - A `<did>/<slug>` pair (e.g.
-		 *     `"did:plc:abc123/hotfix-plugin"`) -- only that specific
-		 *     package is exempt.
-		 *
-		 * Whole-publisher exemptions are the common case: trust is
-		 * naturally a property of the publisher, not of each individual
-		 * package. Per-package exemptions exist for cases where a publisher
-		 * has one plugin you want fast-track installs for and others you'd
-		 * rather hold back.
-		 *
-		 * Only DIDs are accepted -- not handles. Handles are mutable
-		 * aggregator-supplied envelope data, and accepting them as a
-		 * trust input would let a compromised aggregator bypass the
-		 * holdback by claiming any handle for any package. DIDs are
-		 * tied to the AT URI of the package record itself, so even a
-		 * compromised aggregator cannot lie about which DID published
-		 * a release.
-		 *
-		 * Mirrors pnpm's `minimumReleaseAgeExclude`.
-		 *
-		 * @example
-		 * ```ts
-		 * minimumReleaseAgeExclude: [
-		 *   "did:plc:emdashfirstparty",     // every package from this publisher
-		 *   "did:plc:abc123/hotfix-plugin", // just this one package
-		 * ]
-		 * ```
-		 */
-		minimumReleaseAgeExclude?: readonly string[];
-	};
-}
-
-/**
- * Experimental EmDash features. See {@link EmDashConfig.experimental}.
- *
- * Each field is independently opt-in. Fields may be promoted out of
- * `experimental` (becoming top-level `EmDashConfig` options) or removed
- * in minor releases; check the changelog when upgrading.
- */
-export interface ExperimentalConfig {
-	/**
-	 * Decentralized plugin registry.
-	 *
-	 * When set, replaces the centralized `marketplace` for the admin UI's
-	 * browse and install flows. The registry is an atproto-backed
-	 * federation: package metadata lives in each publisher's PDS, an
-	 * aggregator (the `aggregatorUrl`) indexes the firehose and exposes
-	 * read-only XRPC endpoints for discovery, and EmDash verifies each
-	 * release against the publisher's signed records before installing.
-	 *
-	 * See [RFC 0001](https://github.com/emdash-cms/emdash/pull/694) for
-	 * the protocol design and threat model.
-	 *
-	 * Requires `sandboxRunner` to be configured -- registry plugins always
-	 * run sandboxed.
-	 */
-	registry?: RegistryConfig;
-}
-
 export interface EmDashConfig {
 	/**
 	 * Database configuration
diff --git a/packages/core/src/registry/config.ts b/packages/core/src/registry/config.ts
@@ -8,7 +8,7 @@
  * seconds so the browser doesn't need a duration parser.
  */
 
-import type { RegistryConfig } from "../astro/integration/runtime.js";
+import type { RegistryConfig } from "./types.js";
 
 /**
  * Shape returned in the admin manifest's `registry` field. The browser
diff --git a/packages/core/src/registry/types.ts b/packages/core/src/registry/types.ts
@@ -0,0 +1,138 @@
+/**
+ * Public types for the experimental plugin registry.
+ *
+ * Kept in their own module so they don't get re-bundled into the
+ * `astro/integration/runtime.ts` chunk's dist output. tsdown / rolldown
+ * are sensitive to which top-level types live alongside `definePlugin`'s
+ * overloads, and pulling these types into the integration module
+ * affected downstream `definePlugin()` overload resolution for trusted
+ * plugins built against core's dist (see commit history for the
+ * detailed write-up).
+ */
+
+/**
+ * Experimental plugin registry configuration.
+ *
+ * See {@link ExperimentalConfig.registry}.
+ */
+export interface RegistryConfig {
+	/**
+	 * Base URL of the registry aggregator (an atproto AppView that indexes
+	 * the firehose for `pm.fair.package.*` and `com.emdashcms.*` records).
+	 *
+	 * Must be the origin where the aggregator's XRPC endpoints are mounted,
+	 * such that `${aggregatorUrl}/xrpc/<nsid>` resolves to a valid endpoint.
+	 *
+	 * Must be HTTPS in production; `http://localhost` or `http://127.0.0.1`
+	 * are accepted in dev.
+	 */
+	aggregatorUrl: string;
+
+	/**
+	 * Optional comma-separated list of labeller DIDs forwarded as the
+	 * `atproto-accept-labelers` header on every aggregator request.
+	 *
+	 * Format follows the atproto convention:
+	 * `did:plc:abc;redact, did:plc:def`
+	 *
+	 * When unset, the aggregator applies its operator-default labeller set
+	 * (typically the EmDash publisher-verification labeller and any
+	 * additional trusted labellers the aggregator operator configured).
+	 */
+	acceptLabelers?: string;
+
+	/**
+	 * Site-level policy applied to the latest-release selection filter.
+	 *
+	 * These filters operate over the signed records the aggregator returns;
+	 * they are not protocol-level constraints. See the RFC's
+	 * "Update Discovery and Takedowns" section for the integration point.
+	 */
+	policy?: {
+		/**
+		 * Hold back releases newer than this when computing the recommended
+		 * install or update version. Mitigates "compromised publisher
+		 * account pushes a malicious release of an established plugin" by
+		 * giving the takedown labeller a detection window.
+		 *
+		 * Accepts a duration string (`"24h"`, `"48h"`, `"72h"`, `"7d"`) or a
+		 * number of seconds.
+		 *
+		 * Currently applies uniformly to all releases. A future addition
+		 * may exempt brand-new packages (those with no prior release
+		 * history) so the holdback doesn't block first-time publishing,
+		 * but that exemption is not implemented yet; use
+		 * {@link minimumReleaseAgeExclude} to allowlist trusted publishers
+		 * whose packages should install immediately.
+		 *
+		 * Defaults to `undefined` (no holdback). A future trust/moderation
+		 * RFC will specify the recommended default.
+		 */
+		minimumReleaseAge?: string | number;
+
+		/**
+		 * Packages exempt from the {@link minimumReleaseAge} holdback. Use
+		 * for publishers whose release tempo you've explicitly accepted --
+		 * your own first-party plugins, a trusted partner, etc.
+		 *
+		 * Each entry is either:
+		 *   - A bare publisher DID (e.g. `"did:plc:abc123"`) -- every
+		 *     package from that publisher is exempt.
+		 *   - A `<did>/<slug>` pair (e.g.
+		 *     `"did:plc:abc123/hotfix-plugin"`) -- only that specific
+		 *     package is exempt.
+		 *
+		 * Whole-publisher exemptions are the common case: trust is
+		 * naturally a property of the publisher, not of each individual
+		 * package. Per-package exemptions exist for cases where a publisher
+		 * has one plugin you want fast-track installs for and others you'd
+		 * rather hold back.
+		 *
+		 * Only DIDs are accepted -- not handles. Handles are mutable
+		 * aggregator-supplied envelope data, and accepting them as a
+		 * trust input would let a compromised aggregator bypass the
+		 * holdback by claiming any handle for any package. DIDs are
+		 * tied to the AT URI of the package record itself, so even a
+		 * compromised aggregator cannot lie about which DID published
+		 * a release.
+		 *
+		 * Mirrors pnpm's `minimumReleaseAgeExclude`.
+		 *
+		 * @example
+		 * ```ts
+		 * minimumReleaseAgeExclude: [
+		 *   "did:plc:emdashfirstparty",     // every package from this publisher
+		 *   "did:plc:abc123/hotfix-plugin", // just this one package
+		 * ]
+		 * ```
+		 */
+		minimumReleaseAgeExclude?: readonly string[];
+	};
+}
+
+/**
+ * Experimental EmDash features. See `EmDashConfig.experimental`.
+ *
+ * Each field is independently opt-in. Fields may be promoted out of
+ * `experimental` (becoming top-level `EmDashConfig` options) or removed
+ * in minor releases; check the changelog when upgrading.
+ */
+export interface ExperimentalConfig {
+	/**
+	 * Decentralized plugin registry.
+	 *
+	 * When set, replaces the centralized `marketplace` for the admin UI's
+	 * browse and install flows. The registry is an atproto-backed
+	 * federation: package metadata lives in each publisher's PDS, an
+	 * aggregator (the `aggregatorUrl`) indexes the firehose and exposes
+	 * read-only XRPC endpoints for discovery, and EmDash verifies each
+	 * release against the publisher's signed records before installing.
+	 *
+	 * See [RFC 0001](https://github.com/emdash-cms/emdash/pull/694) for
+	 * the protocol design and threat model.
+	 *
+	 * Requires `sandboxRunner` to be configured -- registry plugins always
+	 * run sandboxed.
+	 */
+	registry?: RegistryConfig;
+}
