@emdash-cms/admin 0.14.0 → 0.16.0

package/dist/index.js

@@ -1,7 +1,7 @@
-import { c as fetchAuthMode, d as throwResponseError, i as fetchPlugins, l as fetchManifest, n as enablePlugin, o as API_BASE, r as fetchPlugin, s as apiFetch, t as disablePlugin, u as parseApiResponse } from "./plugins-qrjvPK4g.js";
-import { a as SUPPORTED_LOCALES, i as DEFAULT_LOCALE, l as resolveLocale, n as useLocale, o as SUPPORTED_LOCALE_CODES, t as LocaleDirectionProvider } from "./LocaleDirectionProvider-D32XwRVp.js";
+import { c as fetchAuthMode, d as throwResponseError, i as fetchPlugins, l as fetchManifest, n as enablePlugin, o as API_BASE, r as fetchPlugin, s as apiFetch, t as disablePlugin, u as parseApiResponse } from "./plugins-BZzztFdK.js";
+import { a as SUPPORTED_LOCALES, i as DEFAULT_LOCALE, l as resolveLocale, n as useLocale, o as SUPPORTED_LOCALE_CODES, t as LocaleDirectionProvider } from "./LocaleDirectionProvider-BNEVyvgW.js";
 import "./locales/index.js";
-import { Badge, Button, Checkbox, CommandPalette, Dialog, Input, InputArea, Label, LinkButton, Loader, Popover, Select, Sidebar as KumoSidebar, Switch, Tabs, Toast, Toasty, Tooltip, buttonVariants, useSidebar } from "@cloudflare/kumo";
+import { Autocomplete, Badge, Button, Checkbox, CommandPalette, Dialog, Input, InputArea, Label, LinkButton, Loader, Popover, Select, Sidebar as KumoSidebar, Switch, Tabs, Toast, Toasty, Tooltip, buttonVariants, useSidebar } from "@cloudflare/kumo";
 import { i18n } from "@lingui/core";
 import { I18nProvider, Trans, useLingui } from "@lingui/react";
 import { QueryClient, QueryClientProvider, useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
@@ -27,17 +27,19 @@ import { TableHeader } from "@tiptap/extension-table-header";
 import { TableRow } from "@tiptap/extension-table-row";
 import TextAlign from "@tiptap/extension-text-align";
 import Typography from "@tiptap/extension-typography";
-import { EditorContent, Node as Node$2, NodeViewWrapper, ReactNodeViewRenderer, mergeAttributes as mergeAttributes$1, useEditor, useEditorState } from "@tiptap/react";
+import { EditorContent, Node as Node$2, NodeViewContent, NodeViewWrapper, ReactNodeViewRenderer, mergeAttributes as mergeAttributes$1, useEditor, useEditorState } from "@tiptap/react";
 import { BubbleMenu } from "@tiptap/react/menus";
 import StarterKit from "@tiptap/starter-kit";
 import { Plugin, PluginKey } from "@tiptap/pm/state";
 import { Decoration, DecorationSet } from "@tiptap/pm/view";
 import { createPortal } from "react-dom";
+import CodeBlock$1 from "@tiptap/extension-code-block";
 import { DragHandle } from "@tiptap/extension-drag-handle-react";
 import { isAllowedUri } from "@tiptap/extension-link";
 import { BlockRenderer } from "@emdash-cms/blocks";
 import DOMPurify from "dompurify";
 import { Marked, Renderer } from "marked";
+import { checkEnvCompatibility, hostEnvFromVersions } from "@emdash-cms/registry-client/env";
 import { useHotkeys } from "react-hotkeys-hook";
 
 //#region src/components/ThemeProvider.tsx
@@ -1956,6 +1958,7 @@ async function fetchBylines(options) {
 	if (options?.search) params.set("search", options.search);
 	if (options?.isGuest !== void 0) params.set("isGuest", String(options.isGuest));
 	if (options?.userId) params.set("userId", options.userId);
+	if (options?.locale) params.set("locale", options.locale);
 	if (options?.cursor) params.set("cursor", options.cursor);
 	if (options?.limit) params.set("limit", String(options.limit));
 	return parseApiResponse(await apiFetch(`${API_BASE}/admin/bylines${params.toString() ? `?${params}` : ""}`), "Failed to fetch bylines");
@@ -1984,6 +1987,26 @@ async function deleteByline(id) {
 		message: "Failed to delete byline"
 	}));
 }
+/**
+* Fetch every translation of a byline (siblings sharing the same
+* translation_group).
+*/
+async function fetchBylineTranslations(id) {
+	return parseApiResponse(await apiFetch(`${API_BASE}/admin/bylines/${id}/translations`), "Failed to fetch byline translations");
+}
+/**
+* Create a new locale variant of a byline. The new row joins the source's
+* `translation_group`. Body defaults — slug, display name, avatar, website —
+* inherit from the source when omitted, so editors only have to fill in the
+* localized bio (and optionally a localized display name).
+*/
+async function createBylineTranslation(id, input) {
+	return parseApiResponse(await apiFetch(`${API_BASE}/admin/bylines/${id}/translations`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(input)
+	}), "Failed to create byline translation");
+}
 
 //#endregion
 //#region src/lib/api/menus.ts
@@ -5525,6 +5548,392 @@ function Suggestion({ pluginKey = SuggestionPluginKey, editor, char = "@", allow
 }
 var index_default = Suggestion;
 
+//#endregion
+//#region src/components/editor/codeBlockLanguages.ts
+const CODE_BLOCK_LANGUAGES = [
+	{
+		id: "plaintext",
+		label: "Plain text",
+		aliases: [
+			"text",
+			"plain",
+			"txt"
+		]
+	},
+	{
+		id: "astro",
+		label: "Astro"
+	},
+	{
+		id: "bash",
+		label: "Bash",
+		aliases: [
+			"sh",
+			"shell",
+			"zsh"
+		]
+	},
+	{
+		id: "c",
+		label: "C"
+	},
+	{
+		id: "cpp",
+		label: "C++",
+		aliases: ["c++"]
+	},
+	{
+		id: "csharp",
+		label: "C#",
+		aliases: ["cs", "c#"]
+	},
+	{
+		id: "css",
+		label: "CSS"
+	},
+	{
+		id: "diff",
+		label: "Diff",
+		aliases: ["patch"]
+	},
+	{
+		id: "dockerfile",
+		label: "Dockerfile",
+		aliases: ["docker"]
+	},
+	{
+		id: "go",
+		label: "Go",
+		aliases: ["golang"]
+	},
+	{
+		id: "graphql",
+		label: "GraphQL",
+		aliases: ["gql"]
+	},
+	{
+		id: "html",
+		label: "HTML"
+	},
+	{
+		id: "java",
+		label: "Java"
+	},
+	{
+		id: "javascript",
+		label: "JavaScript",
+		aliases: ["js"]
+	},
+	{
+		id: "json",
+		label: "JSON"
+	},
+	{
+		id: "jsx",
+		label: "JSX"
+	},
+	{
+		id: "kotlin",
+		label: "Kotlin",
+		aliases: ["kt"]
+	},
+	{
+		id: "markdown",
+		label: "Markdown",
+		aliases: ["md"]
+	},
+	{
+		id: "mdx",
+		label: "MDX"
+	},
+	{
+		id: "php",
+		label: "PHP"
+	},
+	{
+		id: "python",
+		label: "Python",
+		aliases: ["py"]
+	},
+	{
+		id: "ruby",
+		label: "Ruby",
+		aliases: ["rb"]
+	},
+	{
+		id: "rust",
+		label: "Rust",
+		aliases: ["rs"]
+	},
+	{
+		id: "scss",
+		label: "SCSS",
+		aliases: ["sass"]
+	},
+	{
+		id: "sql",
+		label: "SQL"
+	},
+	{
+		id: "svelte",
+		label: "Svelte"
+	},
+	{
+		id: "swift",
+		label: "Swift"
+	},
+	{
+		id: "toml",
+		label: "TOML"
+	},
+	{
+		id: "tsx",
+		label: "TSX"
+	},
+	{
+		id: "typescript",
+		label: "TypeScript",
+		aliases: ["ts"]
+	},
+	{
+		id: "vue",
+		label: "Vue"
+	},
+	{
+		id: "xml",
+		label: "XML"
+	},
+	{
+		id: "yaml",
+		label: "YAML",
+		aliases: ["yml"]
+	}
+];
+/**
+* Look up a language by id or alias. Case-insensitive.
+* Returns the canonical entry, or `null` if not found in the curated list.
+*/
+function findLanguage(value) {
+	if (!value) return null;
+	const needle = value.trim().toLowerCase();
+	if (!needle) return null;
+	for (const lang of CODE_BLOCK_LANGUAGES) {
+		if (lang.id === needle) return lang;
+		if (lang.aliases?.includes(needle)) return lang;
+	}
+	return null;
+}
+/**
+* Normalize a user-entered language string to a canonical id where possible.
+* Unknown inputs are sanitized to a single safe class token: lowercased,
+* trimmed, with any character outside `[a-z0-9_-]` (including whitespace,
+* dots, slashes, etc.) collapsed to `-`. This keeps the stored value safe
+* to interpolate into a `language-{id}` CSS class without splitting on
+* whitespace.
+*
+* Examples:
+*   normalizeLanguage("TypeScript")   -> "typescript" (canonical id)
+*   normalizeLanguage("ts")           -> "typescript" (alias)
+*   normalizeLanguage("Objective C")  -> "objective-c" (sanitized)
+*   normalizeLanguage("F#")           -> "f-" (sanitized)
+*   normalizeLanguage("")             -> undefined
+*/
+const DISALLOWED_CHARS_RE = /[^a-z0-9_-]+/g;
+const LEADING_TRAILING_HYPHENS_RE = /^-+|-+$/g;
+function normalizeLanguage(value) {
+	if (!value) return void 0;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	const match = findLanguage(trimmed);
+	if (match) return match.id;
+	return trimmed.toLowerCase().replace(DISALLOWED_CHARS_RE, "-").replace(LEADING_TRAILING_HYPHENS_RE, "") || void 0;
+}
+/**
+* Human-readable label for a stored language id. Falls back to the id itself
+* for unknown values so the editor never shows "undefined".
+*/
+function languageLabel(value) {
+	if (!value) return "Plain text";
+	const match = findLanguage(value);
+	if (match) return match.label;
+	return value;
+}
+
+//#endregion
+//#region src/components/editor/CodeBlockNode.tsx
+/**
+* Code block node with language picker.
+*
+* Wraps the base `@tiptap/extension-code-block` with a React node view that
+* overlays a small language chip in the top-right corner. Clicking the chip
+* opens a popover with a Kumo Autocomplete: a free-form text input plus a
+* filtered list of curated language suggestions. The value is persisted on
+* the node's `language` attribute and round-trips through Portable Text as
+* `block.language`.
+*
+* The picker accepts arbitrary strings (not restricted to the curated list)
+* so that less common languages can still be used. Free-form input is
+* sanitized to a single safe CSS class token via `normalizeLanguage` so the
+* frontend's `language-{id}` class stays well-formed.
+*/
+const LANGUAGE_ITEMS = CODE_BLOCK_LANGUAGES.map((l) => l.label);
+function filterLanguages(item, query) {
+	if (!query) return true;
+	const needle = query.toLowerCase();
+	const lang = CODE_BLOCK_LANGUAGES.find((l) => l.label === item);
+	if (!lang) return false;
+	if (lang.label.toLowerCase().includes(needle)) return true;
+	if (lang.id.toLowerCase().includes(needle)) return true;
+	return lang.aliases?.some((alias) => alias.toLowerCase().includes(needle)) ?? false;
+}
+function CodeBlockNodeView({ node, updateAttributes, selected }) {
+	const { _: _t } = useLingui();
+	const [isEditing, setIsEditing] = React$1.useState(false);
+	const storedLanguage = typeof node.attrs.language === "string" ? node.attrs.language : "";
+	const [draft, setDraft] = React$1.useState(() => languageLabel(storedLanguage));
+	const popoverRef = React$1.useRef(null);
+	React$1.useEffect(() => {
+		if (!isEditing) setDraft(languageLabel(storedLanguage));
+	}, [storedLanguage, isEditing]);
+	const openPicker = React$1.useCallback(() => {
+		setDraft(storedLanguage ? languageLabel(storedLanguage) : "");
+		setIsEditing(true);
+	}, [storedLanguage]);
+	const closePicker = React$1.useCallback(() => {
+		setIsEditing(false);
+		setDraft(languageLabel(storedLanguage));
+	}, [storedLanguage]);
+	const commit = React$1.useCallback((value) => {
+		updateAttributes({ language: normalizeLanguage(value ?? draft) ?? null });
+		setIsEditing(false);
+	}, [draft, updateAttributes]);
+	const handleKeyDown = (e) => {
+		if (e.key === "Enter") {
+			e.preventDefault();
+			commit();
+		} else if (e.key === "Escape") {
+			e.preventDefault();
+			closePicker();
+		}
+	};
+	React$1.useEffect(() => {
+		if (!isEditing) return void 0;
+		const onMouseDown = (event) => {
+			const target = event.target instanceof Node ? event.target : null;
+			if (popoverRef.current && target && !popoverRef.current.contains(target)) closePicker();
+		};
+		document.addEventListener("mousedown", onMouseDown);
+		return () => document.removeEventListener("mousedown", onMouseDown);
+	}, [isEditing, closePicker]);
+	const label = languageLabel(storedLanguage);
+	const chipPersistent = isEditing || Boolean(storedLanguage) || selected;
+	return /* @__PURE__ */ jsxs(NodeViewWrapper, {
+		className: "group relative my-4",
+		"data-language": storedLanguage || void 0,
+		children: [/* @__PURE__ */ jsx("pre", {
+			className: "emdash-code-block",
+			children: /* @__PURE__ */ jsx(NodeViewContent, { as: "code" })
+		}), /* @__PURE__ */ jsx("div", {
+			className: "absolute end-2 top-2 select-none",
+			contentEditable: false,
+			children: isEditing ? /* @__PURE__ */ jsxs("div", {
+				ref: popoverRef,
+				className: "flex items-center gap-1 rounded-md border bg-kumo-overlay p-1 shadow-lg",
+				onKeyDown: handleKeyDown,
+				children: [
+					/* @__PURE__ */ jsxs(Autocomplete, {
+						items: LANGUAGE_ITEMS,
+						value: draft,
+						onValueChange: (next) => setDraft(next),
+						filter: filterLanguages,
+						children: [/* @__PURE__ */ jsx(Autocomplete.InputGroup, {
+							size: "sm",
+							placeholder: _t({
+								id: "vXIe7J",
+								message: "Language"
+							})
+						}), /* @__PURE__ */ jsxs(Autocomplete.Content, {
+							sideOffset: 4,
+							children: [/* @__PURE__ */ jsx(Autocomplete.List, { children: (item) => /* @__PURE__ */ jsx(Autocomplete.Item, {
+								value: item,
+								children: item
+							}, item) }), /* @__PURE__ */ jsx(Autocomplete.Empty, { children: _t({
+								id: "4TVVsS",
+								message: "No matches"
+							}) })]
+						})]
+					}),
+					/* @__PURE__ */ jsx(Button, {
+						type: "button",
+						variant: "ghost",
+						shape: "square",
+						className: "h-7 w-7",
+						onMouseDown: (e) => e.preventDefault(),
+						onClick: () => commit(),
+						title: _t({
+							id: "Ek42QX",
+							message: "Apply language"
+						}),
+						"aria-label": _t({
+							id: "Ek42QX",
+							message: "Apply language"
+						}),
+						children: /* @__PURE__ */ jsx(Check, { className: "h-4 w-4" })
+					}),
+					/* @__PURE__ */ jsx(Button, {
+						type: "button",
+						variant: "ghost",
+						shape: "square",
+						className: "h-7 w-7",
+						onMouseDown: (e) => e.preventDefault(),
+						onClick: closePicker,
+						title: _t({
+							id: "dEgA5A",
+							message: "Cancel"
+						}),
+						"aria-label": _t({
+							id: "dEgA5A",
+							message: "Cancel"
+						}),
+						children: /* @__PURE__ */ jsx(X, { className: "h-4 w-4" })
+					})
+				]
+			}) : /* @__PURE__ */ jsx("button", {
+				type: "button",
+				tabIndex: chipPersistent ? 0 : -1,
+				onMouseDown: (e) => e.preventDefault(),
+				onClick: openPicker,
+				className: "rounded-md border bg-kumo-overlay/90 px-2 py-1 text-xs text-kumo-subtle opacity-0 transition-opacity hover:text-kumo-strong focus:opacity-100 focus:outline-none focus:ring-2 focus:ring-kumo-brand group-hover:opacity-100 data-[persistent=true]:opacity-100",
+				"data-persistent": chipPersistent ? "true" : "false",
+				title: _t({
+					id: "9cbOH7",
+					message: "Set language"
+				}),
+				"aria-label": _t({
+					id: "q/A3pF",
+					message: "Set language (current: {label})",
+					values: { label }
+				}),
+				"aria-hidden": chipPersistent ? void 0 : true,
+				children: storedLanguage ? label : _t({
+					id: "9cbOH7",
+					message: "Set language"
+				})
+			})
+		})]
+	});
+}
+/**
+* TipTap extension: code block with an inline language picker node view.
+*
+* Drop-in replacement for StarterKit's default `codeBlock`. Configure
+* `StarterKit.configure({ codeBlock: false })` and add this extension to
+* the editor's extensions array.
+*/
+const CodeBlockExtension = CodeBlock$1.extend({ addNodeView() {
+	return ReactNodeViewRenderer(CodeBlockNodeView);
+} });
+
 //#endregion
 //#region src/components/editor/BlockMenu.tsx
 const blockTransforms = [
@@ -7549,19 +7958,17 @@ function PluginBlockModal({ block, initialValues, onClose, onInsert }) {
 			size: dialogSize,
 			children: [/* @__PURE__ */ jsxs("div", {
 				className: "flex items-start justify-between gap-4 mb-4",
-				children: [/* @__PURE__ */ jsxs(Dialog.Title, {
+				children: [/* @__PURE__ */ jsx(Dialog.Title, {
 					className: "text-lg font-semibold leading-none tracking-tight",
-					children: [
-						isEditing ? _t2({
-							id: "ePK91l",
-							message: "Edit"
-						}) : _t2({
-							id: "S8Yqbl",
-							message: "Insert"
-						}),
-						" ",
-						block?.label || ""
-					]
+					children: isEditing ? _t2({
+						id: "N6j2JH",
+						message: "Edit {0}",
+						values: { 0: block?.label || "" }
+					}) : _t2({
+						id: "yQNfsE",
+						message: "Insert {0}",
+						values: { 0: block?.label || "" }
+					})
 				}), /* @__PURE__ */ jsx(Dialog.Close, {
 					"aria-label": _t2({
 						id: "yz7wBu",
@@ -8153,6 +8560,7 @@ function PortableTextEditor({ value, onChange, placeholder = "Start writing...",
 					color: "#3b82f6",
 					width: 2
 				},
+				codeBlock: false,
 				link: {
 					openOnClick: false,
 					enableClickSelection: true,
@@ -8160,6 +8568,7 @@ function PortableTextEditor({ value, onChange, placeholder = "Start writing...",
 				},
 				underline: {}
 			}),
+			CodeBlockExtension,
 			ImageExtension,
 			MarkdownLinkExtension,
 			PluginBlockExtension,
@@ -8262,8 +8671,7 @@ function PortableTextEditor({ value, onChange, placeholder = "Start writing...",
 		if (!editor || !pluginBlockModal) return;
 		const { id, ...data } = values;
 		const editPos = editingBlockPosRef.current;
-		if (editPos !== null) {
-			const { tr } = editor.state;
+		if (editPos !== null) editor.chain().command(({ tr }) => {
 			const node = tr.doc.nodeAt(editPos);
 			if (node?.type.name === "pluginBlock") {
 				tr.setNodeMarkup(editPos, void 0, {
@@ -8271,9 +8679,11 @@ function PortableTextEditor({ value, onChange, placeholder = "Start writing...",
 					id: typeof id === "string" ? id : node.attrs.id,
 					data
 				});
-				editor.view.dispatch(tr);
+				return true;
 			}
-		} else editor.chain().focus().insertContent({
+			return false;
+		}).run();
+		else editor.chain().focus().insertContent({
 			type: "pluginBlock",
 			attrs: {
 				blockType: pluginBlockModal.type,
@@ -9908,6 +10318,7 @@ function termExactMatches(term, input) {
 * - Checkbox tree for hierarchical taxonomies (categories)
 * - Tag input for flat taxonomies (tags)
 */
+const EMPTY_TERMS = [];
 /**
 * Fetch taxonomy definitions
 */
@@ -9975,11 +10386,13 @@ function CategoryCheckboxTree({ term, level = 0, selectedIds, onToggle }) {
 function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, label }) {
 	const { _: _t } = useLingui();
 	const [input, setInput] = React$1.useState("");
+	const [isOpen, setIsOpen] = React$1.useState(false);
 	const selectedTerms = terms.filter((term) => selectedIds.has(term.id));
 	const trimmedInput = input.trim();
 	const suggestions = React$1.useMemo(() => {
-		if (!trimmedInput) return [];
-		return terms.filter((term) => !selectedIds.has(term.id) && termMatches(term, trimmedInput)).slice(0, 5);
+		const availableTerms = terms.filter((term) => !selectedIds.has(term.id));
+		if (!trimmedInput) return availableTerms.slice(0, 5);
+		return availableTerms.filter((term) => termMatches(term, trimmedInput)).slice(0, 5);
 	}, [
 		trimmedInput,
 		terms,
@@ -9993,11 +10406,18 @@ function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, l
 	const handleSelect = (term) => {
 		onAdd(term.id);
 		setInput("");
+		setIsOpen(false);
 	};
 	const handleCreate = () => {
 		if (!trimmedInput || isCreating) return;
 		onCreate(trimmedInput);
 		setInput("");
+		setIsOpen(false);
+	};
+	const handleBlur = (e) => {
+		const nextFocused = e.relatedTarget;
+		if (nextFocused instanceof Node && e.currentTarget.contains(nextFocused)) return;
+		setIsOpen(false);
 	};
 	const handleKeyDown = (e) => {
 		if (e.key === "Enter") {
@@ -10026,9 +10446,14 @@ function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, l
 			}, term.id))
 		}), /* @__PURE__ */ jsxs("div", {
 			className: "relative",
+			onBlur: handleBlur,
 			children: [/* @__PURE__ */ jsx(Input, {
 				value: input,
-				onChange: (e) => setInput(e.target.value),
+				onChange: (e) => {
+					setInput(e.target.value);
+					setIsOpen(true);
+				},
+				onFocus: () => setIsOpen(true),
 				onKeyDown: handleKeyDown,
 				placeholder: _t({
 					id: "SnJVrE",
@@ -10040,15 +10465,17 @@ function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, l
 					values: { label }
 				}),
 				className: "text-sm"
-			}), (suggestions.length > 0 || showCreateOption) && /* @__PURE__ */ jsxs("div", {
+			}), isOpen && (suggestions.length > 0 || showCreateOption) && /* @__PURE__ */ jsxs("div", {
 				className: "absolute top-full start-0 end-0 mt-1 bg-kumo-overlay border rounded-md shadow-lg z-10",
 				children: [suggestions.map((term) => /* @__PURE__ */ jsx("button", {
 					type: "button",
+					onMouseDown: (e) => e.preventDefault(),
 					onClick: () => handleSelect(term),
 					className: "w-full text-start px-3 py-2 text-sm hover:bg-kumo-tint",
 					children: term.label
 				}, term.id)), showCreateOption && /* @__PURE__ */ jsxs("button", {
 					type: "button",
+					onMouseDown: (e) => e.preventDefault(),
 					onClick: handleCreate,
 					disabled: isCreating,
 					className: "w-full text-start px-3 py-2 text-sm hover:bg-kumo-tint text-kumo-accent flex items-center gap-1 border-t",
@@ -10074,11 +10501,11 @@ function TaxonomySection({ taxonomy, collection, entryId, onChange }) {
 	const toastManager = Toast.useToastManager();
 	const [newCategoryLabel, setNewCategoryLabel] = React$1.useState("");
 	const [showCategoryInput, setShowCategoryInput] = React$1.useState(false);
-	const { data: terms = [] } = useQuery({
+	const { data: terms = EMPTY_TERMS } = useQuery({
 		queryKey: ["taxonomy-terms", taxonomy.name],
 		queryFn: () => fetchTerms$1(taxonomy.name)
 	});
-	const { data: entryTerms = [] } = useQuery({
+	const { data: entryTerms = EMPTY_TERMS } = useQuery({
 		queryKey: [
 			"entry-terms",
 			collection,
@@ -10373,7 +10800,7 @@ function formatScheduledDate(dateStr) {
 /**
 * Content editor with dynamic field rendering
 */
-function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSaving, onSave, onAutosave, isAutosaving, lastAutosaveAt, onPublish, onUnpublish, onDiscardDraft, onSchedule, onUnschedule, isScheduling, supportsDrafts = false, supportsRevisions = false, supportsPreview = false, currentUser, users, onAuthorChange, availableBylines, selectedBylines, onBylinesChange, onQuickCreateByline, onQuickEditByline, onDelete, isDeleting, i18n, translations, onTranslate, pluginBlocks, hasSeo = false, onSeoChange, manifest }) {
+function ContentEditor({ collection, collectionLabel, item, fields, isNew, entryLocale, isSaving, onSave, onAutosave, isAutosaving, lastAutosaveAt, onPublish, onUnpublish, onDiscardDraft, onSchedule, onUnschedule, isScheduling, supportsDrafts = false, supportsRevisions = false, supportsPreview = false, currentUser, users, onAuthorChange, availableBylines, availableBylinesLoaded, selectedBylines, onBylinesChange, onQuickCreateByline, onQuickEditByline, onDelete, isDeleting, i18n, translations, onTranslate, pluginBlocks, hasSeo = false, onSeoChange, manifest }) {
 	const { _: _t } = useLingui();
 	const navigate = useNavigate$1();
 	const [formData, setFormData] = React$1.useState(item?.data || {});
@@ -10384,6 +10811,7 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 		bylineId: entry.byline.id,
 		roleLabel: entry.roleLabel
 	})) ?? []);
+	const [bylinesTouched, setBylinesTouched] = React$1.useState(false);
 	const [portableTextEditor, setPortableTextEditor] = React$1.useState(null);
 	const [blockSidebarPanel, setBlockSidebarPanel] = React$1.useState(null);
 	const handleBlockSidebarOpen = React$1.useCallback((panel) => {
@@ -10425,6 +10853,7 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 			bylines: nextBylines
 		}));
 		pendingAutosaveStateRef.current = null;
+		setBylinesTouched(false);
 	}
 	const itemDataString = React$1.useMemo(() => item ? JSON.stringify(item.data) : "", [item?.data]);
 	React$1.useEffect(() => {
@@ -10446,6 +10875,7 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 				})) ?? []
 			}));
 			pendingAutosaveStateRef.current = null;
+			setBylinesTouched(false);
 		}
 	}, [
 		item?.updatedAt,
@@ -10455,6 +10885,7 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 	]);
 	const activeBylines = isNew ? selectedBylines ?? [] : internalBylines;
 	const handleBylinesChange = React$1.useCallback((next) => {
+		setBylinesTouched(true);
 		if (isNew) {
 			onBylinesChange?.(next);
 			return;
@@ -10497,13 +10928,13 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 			if (hasInvalidUrls(formDataRef.current)) return;
 			const payload = {
 				data: formDataRef.current,
-				slug: slugRef.current || void 0,
-				bylines: activeBylines
+				slug: slugRef.current || void 0
 			};
+			if (bylinesTouched) payload.bylines = activeBylines;
 			pendingAutosaveStateRef.current = serializeEditorState({
 				data: payload.data,
 				slug: payload.slug || "",
-				bylines: payload.bylines
+				bylines: activeBylines
 			});
 			onAutosave(payload);
 		}, AUTOSAVE_DELAY);
@@ -10519,6 +10950,7 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 		isSaving,
 		isAutosaving,
 		activeBylines,
+		bylinesTouched,
 		hasInvalidUrls
 	]);
 	const handleSubmit = (e) => {
@@ -10528,11 +10960,12 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 			clearTimeout(autosaveTimeoutRef.current);
 			autosaveTimeoutRef.current = null;
 		}
-		onSave?.({
+		const payload = {
 			data: formData,
-			slug: slug || void 0,
-			bylines: activeBylines
-		});
+			slug: slug || void 0
+		};
+		if (isNew || bylinesTouched) payload.bylines = activeBylines;
+		onSave?.(payload);
 	};
 	const [isLoadingPreview, setIsLoadingPreview] = React$1.useState(false);
 	const urlPattern = manifest?.collections[collection]?.urlPattern;
@@ -11066,9 +11499,12 @@ function ContentEditor({ collection, collectionLabel, item, fields, isNew, isSav
 							}), /* @__PURE__ */ jsx(BylineCreditsEditor, {
 								credits: activeBylines,
 								bylines: availableBylines ?? [],
+								bylinesLoaded: availableBylinesLoaded,
 								onChange: handleBylinesChange,
 								onQuickCreate: onQuickCreateByline,
-								onQuickEdit: onQuickEditByline
+								onQuickEdit: onQuickEditByline,
+								entryLocale: item?.locale ?? entryLocale,
+								i18n
 							})]
 						}),
 						i18n && item && !isNew && /* @__PURE__ */ jsx("div", {
@@ -11725,7 +12161,7 @@ function FileFieldRenderer({ id, label, value, onChange, required, allowedMimeTy
 		]
 	});
 }
-function BylineCreditsEditor({ credits, bylines, onChange, onQuickCreate, onQuickEdit }) {
+function BylineCreditsEditor({ credits, bylines, onChange, onQuickCreate, onQuickEdit, entryLocale, i18n, bylinesLoaded = true }) {
 	const { _: _t7 } = useLingui();
 	const [selectedBylineId, setSelectedBylineId] = React$1.useState("");
 	const [quickName, setQuickName] = React$1.useState("");
@@ -11768,6 +12204,27 @@ function BylineCreditsEditor({ credits, bylines, onChange, onQuickCreate, onQuic
 	return /* @__PURE__ */ jsxs("div", {
 		className: "space-y-3",
 		children: [
+			!!i18n && i18n.locales.length > 1 && bylinesLoaded && bylines.length === 0 && !!entryLocale && /* @__PURE__ */ jsxs("div", {
+				className: "rounded border border-dashed p-3 text-sm space-y-2",
+				children: [/* @__PURE__ */ jsx("p", {
+					className: "text-kumo-subtle",
+					children: _t7({
+						id: "Tmb8Fw",
+						message: "No bylines available in {entryLocale}. Create a variant from the Bylines page before crediting one on this entry.",
+						values: { entryLocale }
+					})
+				}), /* @__PURE__ */ jsx(RouterLinkButton, {
+					to: "/bylines",
+					search: { locale: entryLocale ?? void 0 },
+					variant: "secondary",
+					size: "sm",
+					children: _t7({
+						id: "yXD9HA",
+						message: "Manage bylines in {entryLocale}",
+						values: { entryLocale }
+					})
+				})]
+			}),
 			/* @__PURE__ */ jsxs("div", {
 				className: "flex gap-2",
 				children: [/* @__PURE__ */ jsx(Select, {
@@ -17591,6 +18048,85 @@ function formatInstallCount(count) {
 	return String(count);
 }
 
+//#endregion
+//#region src/lib/markdown.ts
+const HTML_ESCAPE_MAP = {
+	"&": "&",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+};
+const HTML_ESCAPE_RE = /[&<>"']/g;
+function escapeHtml(str) {
+	return str.replace(HTML_ESCAPE_RE, (ch) => HTML_ESCAPE_MAP[ch]);
+}
+const renderer = new Renderer();
+renderer.link = function({ href, tokens }) {
+	const inner = this.parser.parseInline(tokens);
+	if (!SAFE_URL_RE.test(href)) return inner;
+	return `<a href="${escapeHtml(href)}" target="_blank" rel="noopener noreferrer">${inner}</a>`;
+};
+renderer.image = ({ text }) => escapeHtml(text);
+renderer.html = () => "";
+const md = new Marked({
+	renderer,
+	async: false
+});
+/** Allowed tags and attributes for DOMPurify — only standard markdown output. */
+const SANITIZE_CONFIG = {
+	ALLOWED_TAGS: [
+		"h1",
+		"h2",
+		"h3",
+		"h4",
+		"h5",
+		"h6",
+		"p",
+		"a",
+		"ul",
+		"ol",
+		"li",
+		"blockquote",
+		"pre",
+		"code",
+		"em",
+		"strong",
+		"del",
+		"br",
+		"hr",
+		"table",
+		"thead",
+		"tbody",
+		"tr",
+		"th",
+		"td",
+		"details",
+		"summary",
+		"sup",
+		"sub"
+	],
+	ALLOWED_ATTR: [
+		"href",
+		"target",
+		"rel"
+	]
+};
+/**
+* Render untrusted Markdown to a sanitized HTML string safe for
+* `dangerouslySetInnerHTML`.
+*
+* Defense in depth: the `marked` renderer drops raw HTML, drops images, and
+* emits only `https?:` links (escaped, with `rel="noopener noreferrer"`);
+* DOMPurify then re-sanitizes the output against a tag/attribute allowlist
+* (no `script`/`style`/`img`/`iframe`, no inline styles or event handlers).
+*/
+function renderMarkdown(markdown) {
+	const result = md.parse(markdown);
+	const html = typeof result === "string" ? result : "";
+	return DOMPurify.sanitize(html, SANITIZE_CONFIG);
+}
+
 //#endregion
 //#region src/components/CapabilityConsentDialog.tsx
 /**
@@ -17600,10 +18136,10 @@ function formatInstallCount(count) {
 * Lists each requested capability with a human-readable explanation.
 * User must explicitly confirm before the action proceeds.
 */
-function CapabilityConsentDialog({ mode, pluginName, capabilities, allowedHosts, newCapabilities = [], auditVerdict, isPending = false, error, onConfirm, onCancel }) {
+function CapabilityConsentDialog({ mode, pluginName, capabilities, allowedHosts, newCapabilities = [], newlyPublicRoutes = [], auditVerdict, isPending = false, error, onConfirm, onCancel }) {
 	const { _: _t } = useLingui();
 	const newSet = new Set(newCapabilities);
-	const isUpdate = mode === "update" || newCapabilities.length > 0;
+	const isUpdate = mode === "update" || newCapabilities.length > 0 || newlyPublicRoutes.length > 0;
 	return /* @__PURE__ */ jsxs("div", {
 		className: "fixed inset-0 z-50 flex items-center justify-center",
 		role: "dialog",
@@ -17644,31 +18180,60 @@ function CapabilityConsentDialog({ mode, pluginName, capabilities, allowedHosts,
 				}),
 				/* @__PURE__ */ jsxs("div", {
 					className: "px-6 py-4 space-y-3",
-					children: [capabilities.map((cap) => {
-						const isNew = newSet.has(cap);
-						return /* @__PURE__ */ jsxs("div", {
-							className: cn("flex items-start gap-3 rounded-md p-2 text-sm", isNew ? "bg-warning/10 border border-warning/30" : "bg-kumo-tint/50"),
-							children: [/* @__PURE__ */ jsx(ShieldCheck, { className: cn("mt-0.5 h-4 w-4 shrink-0", isNew ? "text-warning" : "text-kumo-subtle") }), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("span", {
-								className: cn(isNew && "font-medium"),
-								children: describeCapability(cap, allowedHosts)
-							}), isNew && /* @__PURE__ */ jsx("span", {
-								className: "ms-2 text-xs text-warning font-medium",
-								children: _t({
-									id: "p6NueD",
-									message: "NEW"
+					children: [
+						capabilities.map((cap) => {
+							const isNew = newSet.has(cap);
+							return /* @__PURE__ */ jsxs("div", {
+								className: cn("flex items-start gap-3 rounded-md p-2 text-sm", isNew ? "bg-warning/10 border border-warning/30" : "bg-kumo-tint/50"),
+								children: [/* @__PURE__ */ jsx(ShieldCheck, { className: cn("mt-0.5 h-4 w-4 shrink-0", isNew ? "text-warning" : "text-kumo-subtle") }), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("span", {
+									className: cn(isNew && "font-medium"),
+									children: describeCapability(cap, allowedHosts)
+								}), isNew && /* @__PURE__ */ jsx("span", {
+									className: "ms-2 text-xs text-warning font-medium",
+									children: _t({
+										id: "p6NueD",
+										message: "NEW"
+									})
+								})] })]
+							}, cap);
+						}),
+						newlyPublicRoutes.length > 0 && /* @__PURE__ */ jsxs("div", {
+							className: "rounded-md border border-warning/30 bg-warning/10 p-3 text-sm",
+							children: [
+								/* @__PURE__ */ jsxs("div", {
+									className: "flex items-center gap-2 font-medium text-warning",
+									children: [/* @__PURE__ */ jsx(Warning, { className: "h-4 w-4 shrink-0" }), _t({
+										id: "NXruDe",
+										message: "New public routes"
+									})]
+								}),
+								/* @__PURE__ */ jsx("p", {
+									className: "mt-1 text-xs text-kumo-subtle",
+									children: _t({
+										id: "qCUL4n",
+										message: "This update exposes the following routes without authentication:"
+									})
+								}),
+								/* @__PURE__ */ jsx("ul", {
+									className: "mt-2 space-y-1 ps-5 text-xs",
+									children: newlyPublicRoutes.map((route) => /* @__PURE__ */ jsx("li", {
+										className: "list-disc font-mono",
+										children: route
+									}, route))
 								})
-							})] })]
-						}, cap);
-					}), auditVerdict && auditVerdict !== "pass" && /* @__PURE__ */ jsxs("div", {
-						className: cn("flex items-center gap-2 rounded-md p-3 text-sm mt-2", auditVerdict === "warn" ? "bg-warning/10 text-warning" : "bg-kumo-danger/10 text-kumo-danger"),
-						children: [auditVerdict === "warn" ? /* @__PURE__ */ jsx(Warning, { className: "h-4 w-4 shrink-0" }) : /* @__PURE__ */ jsx(ShieldWarning, { className: "h-4 w-4 shrink-0" }), /* @__PURE__ */ jsx("span", { children: auditVerdict === "warn" ? _t({
-							id: "zPUuMZ",
-							message: "Security audit flagged potential concerns with this plugin."
-						}) : _t({
-							id: "nvVzbM",
-							message: "Security audit flagged this plugin as potentially unsafe."
-						}) })]
-					})]
+							]
+						}),
+						auditVerdict && auditVerdict !== "pass" && /* @__PURE__ */ jsxs("div", {
+							className: cn("flex items-center gap-2 rounded-md p-3 text-sm mt-2", auditVerdict === "warn" ? "bg-warning/10 text-warning" : "bg-kumo-danger/10 text-kumo-danger"),
+							children: [auditVerdict === "warn" ? /* @__PURE__ */ jsx(Warning, { className: "h-4 w-4 shrink-0" }) : /* @__PURE__ */ jsx(ShieldWarning, { className: "h-4 w-4 shrink-0" }), /* @__PURE__ */ jsx("span", { children: auditVerdict === "warn" ? _t({
+								id: "zPUuMZ",
+								message: "Security audit flagged potential concerns with this plugin."
+							}) : _t({
+								id: "nvVzbM",
+								message: "Security audit flagged this plugin as potentially unsafe."
+							}) })]
+						})
+					]
 				}),
 				/* @__PURE__ */ jsx(DialogError, {
 					message: error,
@@ -17707,6 +18272,474 @@ function CapabilityConsentDialog({ mode, pluginName, capabilities, allowedHosts,
 	});
 }
 
+//#endregion
+//#region src/lib/api/registry.ts
+let cachedDiscovery = null;
+async function getDiscoveryClient(config) {
+	if (cachedDiscovery && cachedDiscovery.config.aggregatorUrl === config.aggregatorUrl && cachedDiscovery.config.acceptLabelers === config.acceptLabelers) return cachedDiscovery.client;
+	const DiscoveryClient = (await import("@emdash-cms/registry-client/discovery")).DiscoveryClient;
+	const discovery = new DiscoveryClient({
+		aggregatorUrl: config.aggregatorUrl,
+		acceptLabelers: config.acceptLabelers
+	});
+	const wrapped = {
+		async searchPackages(opts) {
+			return discovery.searchPackages({
+				q: opts.q,
+				cursor: opts.cursor,
+				limit: opts.limit
+			});
+		},
+		async resolvePackage(handle, slug) {
+			return discovery.resolvePackage({
+				handle,
+				slug
+			});
+		},
+		async getPackage(did, slug) {
+			return discovery.getPackage({
+				did,
+				slug
+			});
+		},
+		async getLatestRelease(did, slug) {
+			return discovery.getLatestRelease({
+				did,
+				package: slug
+			});
+		},
+		async listReleases(did, slug, opts) {
+			return discovery.listReleases({
+				did,
+				package: slug,
+				cursor: opts?.cursor,
+				limit: opts?.limit
+			});
+		}
+	};
+	cachedDiscovery = {
+		config,
+		client: wrapped
+	};
+	return wrapped;
+}
+/**
+* Returns whether a release should be considered installable given the
+* configured policy. Currently implements the minimum-release-age check
+* described in RFC 0001's "Pre-label gap and launch tempo" section,
+* plus the `minimumReleaseAgeExclude` allowlist.
+*
+* Returns `false` (release blocked) when the policy is configured but
+* the release is missing a valid `indexedAt` -- we fail closed rather
+* than silently letting unbounded-age releases through.
+*/
+function releasePassesPolicy(release, pkg, policy, now = Date.now()) {
+	if (!policy?.minimumReleaseAgeSeconds) return true;
+	if (releaseExemptFromMinimumAge(policy.minimumReleaseAgeExclude, pkg.did, pkg.slug)) return true;
+	const indexedAt = Date.parse(release.indexedAt);
+	if (!Number.isFinite(indexedAt)) return false;
+	return (now - indexedAt) / 1e3 >= policy.minimumReleaseAgeSeconds;
+}
+/**
+* Canonicalize a capabilities list for set-style comparison. Mirrors
+* the server-side helper `canonicalCapabilitiesForDriftCheck` in
+* `packages/core/src/registry/config.ts` -- both sides must produce
+* the same canonical shape so the install handler's drift check is
+* stable across reorderings, duplicates, and junk entries.
+*
+* Filters non-strings, deduplicates, and sorts lexically.
+*/
+function canonicalCapabilitiesForDriftCheck(value) {
+	if (!Array.isArray(value)) return [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) if (typeof entry === "string" && entry.length > 0) seen.add(entry);
+	return [...seen].toSorted();
+}
+/**
+* Matches a `(publisher_did, slug)` against the
+* `minimumReleaseAgeExclude` allowlist. Mirrors the server-side helper
+* of the same name in `packages/core/src/registry/config.ts`.
+*
+* DID-only on purpose: handles are aggregator-supplied envelope data
+* and accepting them as a trust input would let a compromised
+* aggregator bypass the holdback by claiming any handle for any
+* package. DIDs are tied to the AT URI of the record itself.
+*
+* Entries from the config list have already been lowercased at
+* manifest build time, so this only needs to lowercase the runtime
+* values for comparison.
+*/
+function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
+	if (!exclude || exclude.length === 0) return false;
+	const didLower = publisherDid.toLowerCase();
+	const fullDid = `${didLower}/${slug.toLowerCase()}`;
+	for (const entry of exclude) {
+		if (entry === didLower) return true;
+		if (entry === fullDid) return true;
+	}
+	return false;
+}
+/**
+* The FAIR-recognised long-form section keys, in display order. Publishers may
+* also ship unrecognised keys (the lexicon's `sections` map is open), but the
+* admin renders only this known set so an aggregator can't inject a section
+* with an attacker-chosen heading; everything else is ignored.
+*/
+const SECTION_ORDER = [
+	"description",
+	"installation",
+	"faq",
+	"changelog",
+	"security"
+];
+/**
+* Select the non-empty long-form sections off a package profile, in
+* `SECTION_ORDER`. `profile.sections` is a lexicon-validated map of Markdown
+* strings (or `null` when the aggregator returned a non-conforming record), so
+* each value is narrowed to a non-whitespace string before inclusion. Empty,
+* missing, whitespace-only, and non-string entries are dropped, so callers can
+* suppress the whole sections UI when the result is empty.
+*/
+function presentSections(profile) {
+	const sections = profile?.sections;
+	if (!sections || typeof sections !== "object") return [];
+	const map = sections;
+	const out = [];
+	for (const key of SECTION_ORDER) {
+		const value = map[key];
+		if (typeof value === "string" && value.trim().length > 0) out.push({
+			key,
+			markdown: value
+		});
+	}
+	return out;
+}
+/**
+* Narrow a release record's `sbom` field to the fields the admin renders.
+* Returns `null` unless the value is an object carrying at least one usable
+* field (`format` or `url`); every field is independently optional per the
+* lexicon. `sbom` is lexicon-validated at the DiscoveryClient boundary, but the
+* record is a publisher pass-through, so its inner shape still needs narrowing.
+*/
+function extractSbom(value) {
+	if (!value || typeof value !== "object") return null;
+	const v = value;
+	const sbom = {};
+	if (typeof v.format === "string" && v.format.length > 0) sbom.format = v.format;
+	if (typeof v.url === "string" && v.url.length > 0) sbom.url = v.url;
+	if (typeof v.checksum === "string") sbom.checksum = v.checksum;
+	if (!sbom.format && !sbom.url) return null;
+	return sbom;
+}
+/**
+* Validate an SBOM document URL for use in a download `href`. Returns the
+* normalised URL only when it is an absolute `http(s)` URL; everything else
+* (relative, `javascript:`, `data:`, non-string) returns `null`. The release
+* record is a remote pass-through, so an unsanitised SBOM `href` would be
+* stored XSS in the authenticated admin origin. The browser fetches the SBOM
+* client-side on click — no server proxy, so SSRF isn't a concern here.
+*/
+function sbomDownloadHref(value) {
+	if (typeof value !== "string" || value.length === 0) return null;
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+	return parsed.href;
+}
+async function searchRegistryPackages(config, opts) {
+	return (await getDiscoveryClient(config)).searchPackages(opts);
+}
+async function resolveRegistryPackage(config, handle, slug) {
+	return (await getDiscoveryClient(config)).resolvePackage(handle, slug);
+}
+async function getRegistryPackage(config, did, slug) {
+	return (await getDiscoveryClient(config)).getPackage(did, slug);
+}
+async function listRegistryReleases(config, did, slug, opts) {
+	return (await getDiscoveryClient(config)).listReleases(did, slug, opts);
+}
+/**
+* Derive the host environment versions (`env:emdash`, `env:astro`) the running
+* EmDash install advertises, so a release's `requires` constraints can be
+* evaluated client-side before offering install. Reads the already-fetched
+* admin manifest (`version`, `astroVersion`) rather than issuing a second
+* request. The dev-skip / astro-omit rule is shared with the server gate via
+* `hostEnvFromVersions`.
+*/
+function hostEnvFromManifest(manifest) {
+	return hostEnvFromVersions(manifest?.version, manifest?.astroVersion);
+}
+/**
+* Resolve a publisher DID to its claimed handle using the same
+* `LocalActorResolver` pattern as `@emdash-cms/plugin-cli` and
+* `@emdash-cms/auth-atproto`. Bidirectional verification (handle's
+* domain points back to the same DID) is part of the resolver --
+* `LocalActorResolver` returns the sentinel `"handle.invalid"` when
+* the `alsoKnownAs` handle is present but doesn't round-trip.
+*
+* Three distinct outcomes the UI can render:
+*
+*   - `{ status: "ok", handle }` — verified handle, round-trip OK.
+*   - `{ status: "invalid" }` — DID claims a handle but it doesn't
+*     resolve back. The publisher's handle setup is broken; the admin
+*     should see a clear "Invalid handle" indicator rather than the
+*     raw DID.
+*   - `{ status: "missing" }` — no handle claimed at all (no
+*     `alsoKnownAs`), or the DID document couldn't be fetched (network
+*     error, unsupported DID method).
+*/
+let actorResolver = null;
+async function getActorResolver() {
+	if (actorResolver) return actorResolver;
+	const { CompositeDidDocumentResolver, CompositeHandleResolver, DohJsonHandleResolver, LocalActorResolver, PlcDidDocumentResolver, WebDidDocumentResolver, WellKnownHandleResolver } = await import("@atcute/identity-resolver");
+	actorResolver = new LocalActorResolver({
+		handleResolver: new CompositeHandleResolver({ methods: {
+			dns: new DohJsonHandleResolver({ dohUrl: "https://cloudflare-dns.com/dns-query" }),
+			http: new WellKnownHandleResolver()
+		} }),
+		didDocumentResolver: new CompositeDidDocumentResolver({ methods: {
+			plc: new PlcDidDocumentResolver(),
+			web: new WebDidDocumentResolver()
+		} })
+	});
+	return actorResolver;
+}
+/**
+* localStorage-backed cache for DID→handle resolutions. Handles are
+* stable for hours-to-days in practice, but bound the cache so a
+* compromised handle eventually flips back to "invalid" without a
+* forced refresh. 24h matches the typical atproto handle TTL.
+*
+* Failures (network errors, unsupported DID method) are *not* cached --
+* those should retry on the next render.
+*/
+const HANDLE_CACHE_TTL_MS = 1440 * 60 * 1e3;
+const HANDLE_CACHE_KEY_PREFIX = "emdash:did-handle:";
+function isCachedResolution(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.expiresAt === "number" && typeof candidate.resolution === "object" && candidate.resolution !== null;
+}
+function readHandleCache(did) {
+	if (typeof localStorage === "undefined") return null;
+	try {
+		const raw = localStorage.getItem(`${HANDLE_CACHE_KEY_PREFIX}${did}`);
+		if (!raw) return null;
+		const parsed = JSON.parse(raw);
+		if (!isCachedResolution(parsed) || parsed.expiresAt < Date.now()) return null;
+		return parsed.resolution;
+	} catch {
+		return null;
+	}
+}
+function writeHandleCache(did, resolution) {
+	if (typeof localStorage === "undefined") return;
+	try {
+		const entry = {
+			resolution,
+			expiresAt: Date.now() + HANDLE_CACHE_TTL_MS
+		};
+		localStorage.setItem(`${HANDLE_CACHE_KEY_PREFIX}${did}`, JSON.stringify(entry));
+	} catch {}
+}
+async function resolveDidToHandle(did) {
+	const cached = readHandleCache(did);
+	if (cached) return cached;
+	let result;
+	try {
+		const resolved = await (await getActorResolver()).resolve(did);
+		if (resolved.handle === "handle.invalid") result = { status: "invalid" };
+		else if (resolved.handle) result = {
+			status: "ok",
+			handle: resolved.handle
+		};
+		else result = { status: "missing" };
+	} catch (err) {
+		console.warn(`[registry] DID->handle resolution failed for ${did}:`, err);
+		return { status: "missing" };
+	}
+	writeHandleCache(did, result);
+	return result;
+}
+const ARTIFACT_PROXY_ENDPOINT = `${API_BASE}/admin/plugins/registry/artifact`;
+/**
+* Build the URL of the server-side artifact proxy for an artifact addressed by
+* its `(did, slug, version, kind, index)` coordinates. The browser never sends
+* the publisher's URL — the proxy resolves the *declared* URL from the release
+* record, applies SSRF defences, enforces an image content-type allowlist, and
+* serves the bytes back same-origin.
+*
+* Empty `version` (latest) and `index` (non-screenshot kinds) are omitted.
+*/
+function artifactProxyUrl(coords) {
+	const params = new URLSearchParams();
+	params.set("did", coords.did);
+	params.set("slug", coords.slug);
+	params.set("kind", coords.kind);
+	if (coords.version) params.set("version", coords.version);
+	if (coords.kind === "screenshot" && coords.index !== void 0) params.set("index", String(coords.index));
+	return `${ARTIFACT_PROXY_ENDPOINT}?${params.toString()}`;
+}
+/**
+* Narrow one entry of a release's `artifacts` map to the fields we render.
+* Returns `null` when the value isn't an object carrying a usable `url`
+* (presence gate), keeping only the dimensions for layout.
+*
+* Records are lexicon-validated at the DiscoveryClient boundary, but
+* `artifacts` is an aggregator pass-through, so each entry still needs
+* shape-narrowing.
+*/
+function asMediaArtifact(value) {
+	if (!value || typeof value !== "object") return null;
+	const v = value;
+	if (typeof v.url !== "string" || v.url.length === 0) return null;
+	const artifact = {};
+	if (typeof v.width === "number") artifact.width = v.width;
+	if (typeof v.height === "number") artifact.height = v.height;
+	return artifact;
+}
+/**
+* Pull icon, banner, and the screenshot gallery out of a release's `artifacts`
+* map, keeping presence and dimensions only. The lexicon types `screenshots`
+* as an array of artifacts; entries without a usable `url` are dropped, and
+* gallery order is preserved so screenshot indices line up with the proxy's.
+*/
+function extractMediaArtifacts(artifacts) {
+	const result = { screenshots: [] };
+	if (!artifacts || typeof artifacts !== "object") return result;
+	const map = artifacts;
+	const icon = asMediaArtifact(map.icon);
+	if (icon) result.icon = icon;
+	const banner = asMediaArtifact(map.banner);
+	if (banner) result.banner = banner;
+	if (Array.isArray(map.screenshots)) map.screenshots.forEach((entry, index) => {
+		const artifact = asMediaArtifact(entry);
+		if (artifact) result.screenshots.push({
+			...artifact,
+			index
+		});
+	});
+	return result;
+}
+const INSTALL_ENDPOINT = `${API_BASE}/admin/plugins/registry/install`;
+/**
+* Install a plugin from the registry.
+*
+* Posts to the EmDash server, which re-resolves the same `(handle,
+* slug)` against the aggregator, re-verifies the bundle's checksum
+* against the signed release record, and writes the install. Surfaces
+* structured error codes (`RELEASE_YANKED`, `CHECKSUM_MISMATCH`,
+* `DECLARED_ACCESS_DRIFT`, etc.) that callers map to localized
+* messages.
+*/
+async function installRegistryPlugin(body) {
+	return parseApiResponse(await apiFetch(INSTALL_ENDPOINT, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	}), i18n._({
+		id: "/LWKyx",
+		message: "Failed to install plugin"
+	}));
+}
+/**
+* Server-side escalation gate raised by the update endpoint when the
+* target version widens the trust contract. Carries the diff the user
+* needs to see in the consent dialog before the call is retried with the
+* matching `confirm*` flag.
+*/
+var RegistryUpdateEscalationError = class extends Error {
+	code;
+	capabilityChanges;
+	routeVisibilityChanges;
+	constructor(code, message, capabilityChanges, routeVisibilityChanges) {
+		super(message);
+		this.name = "RegistryUpdateEscalationError";
+		this.code = code;
+		this.capabilityChanges = capabilityChanges;
+		this.routeVisibilityChanges = routeVisibilityChanges;
+	}
+};
+/**
+* Update a registry-source plugin to a newer version.
+* `POST /_emdash/api/admin/plugins/registry/:id/update`
+*
+* Called without `confirm*` flags first, this throws
+* `RegistryUpdateEscalationError` when the target version widens
+* permissions; the caller renders a consent dialog populated from the
+* error's diff, then re-calls with the matching `confirm*` flag once
+* the user agrees.
+*/
+async function updateRegistryPlugin(pluginId, opts = {}) {
+	const response = await apiFetch(`${API_BASE}/admin/plugins/registry/${encodeURIComponent(pluginId)}/update`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(opts)
+	});
+	if (response.ok) return;
+	const escalation = parseEscalation(await response.clone().json().catch(() => void 0));
+	if (escalation) throw escalation;
+	await throwResponseError(response, i18n._({
+		id: "8m84rO",
+		message: "Failed to update plugin"
+	}));
+}
+function parseEscalation(body) {
+	if (!body || typeof body !== "object" || !("error" in body)) return null;
+	const error = body.error;
+	if (!error || typeof error !== "object" || !("code" in error)) return null;
+	const code = error.code;
+	if (code !== "CAPABILITY_ESCALATION" && code !== "ROUTE_VISIBILITY_ESCALATION") return null;
+	const details = "details" in error && error.details && typeof error.details === "object" ? error.details : {};
+	const capabilityChanges = normaliseCapabilityChanges("capabilityChanges" in details ? details.capabilityChanges : void 0);
+	const routeVisibilityChanges = normaliseRouteVisibilityChanges("routeVisibilityChanges" in details ? details.routeVisibilityChanges : void 0);
+	return new RegistryUpdateEscalationError(code, "message" in error && typeof error.message === "string" ? error.message : i18n._({
+		id: "dgD7yY",
+		message: "Plugin update requires re-consent"
+	}), capabilityChanges, routeVisibilityChanges);
+}
+function normaliseCapabilityChanges(value) {
+	if (!value || typeof value !== "object") return {
+		added: [],
+		removed: []
+	};
+	const v = value;
+	return {
+		added: Array.isArray(v.added) ? v.added.filter((s) => typeof s === "string") : [],
+		removed: Array.isArray(v.removed) ? v.removed.filter((s) => typeof s === "string") : []
+	};
+}
+function normaliseRouteVisibilityChanges(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const v = value;
+	if (!Array.isArray(v.newlyPublic)) return void 0;
+	const newlyPublic = v.newlyPublic.filter((s) => typeof s === "string");
+	return newlyPublic.length > 0 ? { newlyPublic } : void 0;
+}
+/**
+* Uninstall a registry-source plugin.
+* `POST /_emdash/api/admin/plugins/registry/:id/uninstall`
+*
+* The server refuses to uninstall non-registry sources, so calling this
+* with a marketplace or config plugin id is a no-op error rather than a
+* destructive cross-source action.
+*/
+async function uninstallRegistryPlugin(pluginId, opts = {}) {
+	const response = await apiFetch(`${API_BASE}/admin/plugins/registry/${encodeURIComponent(pluginId)}/uninstall`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(opts)
+	});
+	if (!response.ok) await throwResponseError(response, i18n._({
+		id: "IDxl65",
+		message: "Failed to uninstall plugin"
+	}));
+}
+
 //#endregion
 //#region src/components/PluginManager.tsx
 /**
@@ -17796,7 +18829,7 @@ function PluginManager({ manifest }) {
 		if (!updates) return /* @__PURE__ */ new Map();
 		return new Map(updates.map((u) => [u.pluginId, u]));
 	}, [updates]);
-	const hasMarketplacePlugins = plugins?.some((p) => p.source === "marketplace");
+	const hasUpdatableSources = plugins?.some((p) => p.source === "marketplace" || p.source === "registry");
 	if (isLoading) return /* @__PURE__ */ jsxs("div", {
 		className: "space-y-6",
 		children: [/* @__PURE__ */ jsx("h1", {
@@ -17844,7 +18877,7 @@ function PluginManager({ manifest }) {
 				}), /* @__PURE__ */ jsxs("div", {
 					className: "flex items-center gap-3",
 					children: [
-						hasMarketplacePlugins && /* @__PURE__ */ jsx(Button, {
+						hasUpdatableSources && /* @__PURE__ */ jsx(Button, {
 							variant: "ghost",
 							onClick: () => void refetchUpdates(),
 							disabled: isCheckingUpdates,
@@ -17939,15 +18972,17 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 	const [expanded, setExpanded] = React$1.useState(false);
 	const [showUpdateConsent, setShowUpdateConsent] = React$1.useState(false);
 	const [showUninstallConfirm, setShowUninstallConfirm] = React$1.useState(false);
+	const [registryEscalation, setRegistryEscalation] = React$1.useState(null);
 	const queryClient = useQueryClient();
 	const toastManager = Toast.useToastManager();
 	const isMarketplace = plugin.source === "marketplace";
 	const isRegistry = plugin.source === "registry";
 	const hasUpdate = !!updateInfo && updateInfo.installed !== updateInfo.latest;
 	const updateMutation = useMutation({
-		mutationFn: () => updateMarketplacePlugin(plugin.id, { confirmCapabilities: true }),
+		mutationFn: (opts) => isRegistry ? updateRegistryPlugin(plugin.id, opts) : updateMarketplacePlugin(plugin.id, { confirmCapabilities: true }),
 		onSuccess: () => {
 			setShowUpdateConsent(false);
+			setRegistryEscalation(null);
 			queryClient.invalidateQueries({ queryKey: ["plugins"] });
 			queryClient.invalidateQueries({ queryKey: ["plugin-updates"] });
 			queryClient.invalidateQueries({ queryKey: ["manifest"] });
@@ -17965,10 +19000,29 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 					}
 				})
 			});
+		},
+		onError: (err) => {
+			if (err instanceof RegistryUpdateEscalationError) {
+				setRegistryEscalation(err);
+				setShowUpdateConsent(true);
+			}
 		}
 	});
+	const handleUpdateClick = () => {
+		if (isRegistry) {
+			setRegistryEscalation(null);
+			updateMutation.mutate({});
+		} else setShowUpdateConsent(true);
+	};
+	const handleUpdateConfirm = () => {
+		if (isRegistry) {
+			const opts = { confirmCapabilityChanges: true };
+			if (registryEscalation?.code === "ROUTE_VISIBILITY_ESCALATION") opts.confirmRouteVisibilityChanges = true;
+			updateMutation.mutate(opts);
+		} else updateMutation.mutate({});
+	};
 	const uninstallMutation = useMutation({
-		mutationFn: (deleteData) => uninstallMarketplacePlugin(plugin.id, { deleteData }),
+		mutationFn: (deleteData) => isRegistry ? uninstallRegistryPlugin(plugin.id, { deleteData }) : uninstallMarketplacePlugin(plugin.id, { deleteData }),
 		onSuccess: () => {
 			setShowUninstallConfirm(false);
 			queryClient.invalidateQueries({ queryKey: ["plugins"] });
@@ -18078,13 +19132,10 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 											const label = CAPABILITY_LABELS[c];
 											return label ? _t2(label) : c;
 										}).join(", "),
-										children: [/* @__PURE__ */ jsx(ShieldCheck, { className: "h-3 w-3" }), _t2({
-											id: "gMTYze",
-											message: "{0} permission{1}",
-											values: {
-												0: plugin.capabilities.length,
-												1: plugin.capabilities.length !== 1 ? "s" : ""
-											}
+										children: [/* @__PURE__ */ jsx(ShieldCheck, { className: "h-3 w-3" }), i18n._({
+											id: "dB/Iw4",
+											message: "{0, plural, one {# permission} other {# permissions}}",
+											values: { 0: plugin.capabilities.length }
 										})]
 									})
 								]
@@ -18097,7 +19148,7 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 							hasUpdate && /* @__PURE__ */ jsx(Button, {
 								variant: "outline",
 								size: "sm",
-								onClick: () => setShowUpdateConsent(true),
+								onClick: handleUpdateClick,
 								disabled: updateMutation.isPending,
 								children: updateMutation.isPending ? _t2({
 									id: "RXbEvi",
@@ -18261,7 +19312,7 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 							] })
 						]
 					}),
-					isMarketplace && /* @__PURE__ */ jsx("div", {
+					(isMarketplace || isRegistry) && /* @__PURE__ */ jsx("div", {
 						className: "pt-2 border-t",
 						children: /* @__PURE__ */ jsx(Button, {
 							variant: "ghost",
@@ -18274,13 +19325,6 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 								message: "Uninstall"
 							})
 						})
-					}),
-					isRegistry && /* @__PURE__ */ jsx("div", {
-						className: "pt-2 border-t text-xs text-kumo-subtle",
-						children: _t2({
-							id: "YvXVtr",
-							message: "Uninstall is not yet available for registry plugins. Disable the plugin to stop it from running; full uninstall will land in a follow-up."
-						})
 					})
 				]
 			})]
@@ -18289,12 +19333,14 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 			mode: "update",
 			pluginName: plugin.name,
 			capabilities: plugin.capabilities,
-			newCapabilities: [],
+			newCapabilities: registryEscalation?.capabilityChanges.added ?? [],
+			newlyPublicRoutes: registryEscalation?.routeVisibilityChanges?.newlyPublic ?? [],
 			isPending: updateMutation.isPending,
-			error: getMutationError(updateMutation.error),
-			onConfirm: () => updateMutation.mutate(),
+			error: updateMutation.error instanceof RegistryUpdateEscalationError ? null : getMutationError(updateMutation.error),
+			onConfirm: handleUpdateConfirm,
 			onCancel: () => {
 				setShowUpdateConsent(false);
+				setRegistryEscalation(null);
 				updateMutation.reset();
 			}
 		}),
@@ -18850,72 +19896,6 @@ function ScreenshotLightbox({ screenshots, index, isBlurred = false, onClose, on
 		]
 	});
 }
-const HTML_ESCAPE_MAP = {
-	"&": "&amp;",
-	"<": "&lt;",
-	">": "&gt;",
-	"\"": "&quot;",
-	"'": "&#39;"
-};
-const HTML_ESCAPE_RE = /[&<>"']/g;
-function escapeHtml(str) {
-	return str.replace(HTML_ESCAPE_RE, (ch) => HTML_ESCAPE_MAP[ch]);
-}
-const renderer = new Renderer();
-renderer.link = ({ href, text }) => {
-	if (!SAFE_URL_RE.test(href)) return escapeHtml(text);
-	return `<a href="${escapeHtml(href)}" target="_blank" rel="noopener noreferrer">${escapeHtml(text)}</a>`;
-};
-renderer.image = ({ text }) => escapeHtml(text);
-renderer.html = () => "";
-const md = new Marked({
-	renderer,
-	async: false
-});
-/** Allowed tags and attributes for DOMPurify — only standard markdown output. */
-const SANITIZE_CONFIG = {
-	ALLOWED_TAGS: [
-		"h1",
-		"h2",
-		"h3",
-		"h4",
-		"h5",
-		"h6",
-		"p",
-		"a",
-		"ul",
-		"ol",
-		"li",
-		"blockquote",
-		"pre",
-		"code",
-		"em",
-		"strong",
-		"del",
-		"br",
-		"hr",
-		"table",
-		"thead",
-		"tbody",
-		"tr",
-		"th",
-		"td",
-		"details",
-		"summary",
-		"sup",
-		"sub"
-	],
-	ALLOWED_ATTR: [
-		"href",
-		"target",
-		"rel"
-	]
-};
-function renderMarkdown(markdown) {
-	const result = md.parse(markdown);
-	const html = typeof result === "string" ? result : "";
-	return DOMPurify.sanitize(html, SANITIZE_CONFIG);
-}
 function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
 	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -21951,235 +22931,6 @@ function Redirects() {
 	});
 }
 
-//#endregion
-//#region src/lib/api/registry.ts
-let cachedDiscovery = null;
-async function getDiscoveryClient(config) {
-	if (cachedDiscovery && cachedDiscovery.config.aggregatorUrl === config.aggregatorUrl && cachedDiscovery.config.acceptLabelers === config.acceptLabelers) return cachedDiscovery.client;
-	const DiscoveryClient = (await import("@emdash-cms/registry-client/discovery")).DiscoveryClient;
-	const discovery = new DiscoveryClient({
-		aggregatorUrl: config.aggregatorUrl,
-		acceptLabelers: config.acceptLabelers
-	});
-	const wrapped = {
-		async searchPackages(opts) {
-			return discovery.searchPackages({
-				q: opts.q,
-				cursor: opts.cursor,
-				limit: opts.limit
-			});
-		},
-		async resolvePackage(handle, slug) {
-			return discovery.resolvePackage({
-				handle,
-				slug
-			});
-		},
-		async getPackage(did, slug) {
-			return discovery.getPackage({
-				did,
-				slug
-			});
-		},
-		async getLatestRelease(did, slug) {
-			return discovery.getLatestRelease({
-				did,
-				package: slug
-			});
-		},
-		async listReleases(did, slug, cursor) {
-			return discovery.listReleases({
-				did,
-				package: slug,
-				cursor
-			});
-		}
-	};
-	cachedDiscovery = {
-		config,
-		client: wrapped
-	};
-	return wrapped;
-}
-/**
-* Returns whether a release should be considered installable given the
-* configured policy. Currently implements the minimum-release-age check
-* described in RFC 0001's "Pre-label gap and launch tempo" section,
-* plus the `minimumReleaseAgeExclude` allowlist.
-*
-* Returns `false` (release blocked) when the policy is configured but
-* the release is missing a valid `indexedAt` -- we fail closed rather
-* than silently letting unbounded-age releases through.
-*/
-function releasePassesPolicy(release, pkg, policy, now = Date.now()) {
-	if (!policy?.minimumReleaseAgeSeconds) return true;
-	if (releaseExemptFromMinimumAge(policy.minimumReleaseAgeExclude, pkg.did, pkg.slug)) return true;
-	const indexedAt = Date.parse(release.indexedAt);
-	if (!Number.isFinite(indexedAt)) return false;
-	return (now - indexedAt) / 1e3 >= policy.minimumReleaseAgeSeconds;
-}
-/**
-* Canonicalize a capabilities list for set-style comparison. Mirrors
-* the server-side helper `canonicalCapabilitiesForDriftCheck` in
-* `packages/core/src/registry/config.ts` -- both sides must produce
-* the same canonical shape so the install handler's drift check is
-* stable across reorderings, duplicates, and junk entries.
-*
-* Filters non-strings, deduplicates, and sorts lexically.
-*/
-function canonicalCapabilitiesForDriftCheck(value) {
-	if (!Array.isArray(value)) return [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of value) if (typeof entry === "string" && entry.length > 0) seen.add(entry);
-	return [...seen].toSorted();
-}
-/**
-* Matches a `(publisher_did, slug)` against the
-* `minimumReleaseAgeExclude` allowlist. Mirrors the server-side helper
-* of the same name in `packages/core/src/registry/config.ts`.
-*
-* DID-only on purpose: handles are aggregator-supplied envelope data
-* and accepting them as a trust input would let a compromised
-* aggregator bypass the holdback by claiming any handle for any
-* package. DIDs are tied to the AT URI of the record itself.
-*
-* Entries from the config list have already been lowercased at
-* manifest build time, so this only needs to lowercase the runtime
-* values for comparison.
-*/
-function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
-	if (!exclude || exclude.length === 0) return false;
-	const didLower = publisherDid.toLowerCase();
-	const fullDid = `${didLower}/${slug.toLowerCase()}`;
-	for (const entry of exclude) {
-		if (entry === didLower) return true;
-		if (entry === fullDid) return true;
-	}
-	return false;
-}
-async function searchRegistryPackages(config, opts) {
-	return (await getDiscoveryClient(config)).searchPackages(opts);
-}
-async function resolveRegistryPackage(config, handle, slug) {
-	return (await getDiscoveryClient(config)).resolvePackage(handle, slug);
-}
-async function getRegistryPackage(config, did, slug) {
-	return (await getDiscoveryClient(config)).getPackage(did, slug);
-}
-async function getLatestRegistryRelease(config, did, slug) {
-	return (await getDiscoveryClient(config)).getLatestRelease(did, slug);
-}
-/**
-* Resolve a publisher DID to its claimed handle using the same
-* `LocalActorResolver` pattern as `@emdash-cms/plugin-cli` and
-* `@emdash-cms/auth-atproto`. Bidirectional verification (handle's
-* domain points back to the same DID) is part of the resolver --
-* `LocalActorResolver` returns the sentinel `"handle.invalid"` when
-* the `alsoKnownAs` handle is present but doesn't round-trip.
-*
-* Three distinct outcomes the UI can render:
-*
-*   - `{ status: "ok", handle }` — verified handle, round-trip OK.
-*   - `{ status: "invalid" }` — DID claims a handle but it doesn't
-*     resolve back. The publisher's handle setup is broken; the admin
-*     should see a clear "Invalid handle" indicator rather than the
-*     raw DID.
-*   - `{ status: "missing" }` — no handle claimed at all (no
-*     `alsoKnownAs`), or the DID document couldn't be fetched (network
-*     error, unsupported DID method).
-*/
-let actorResolver = null;
-async function getActorResolver() {
-	if (actorResolver) return actorResolver;
-	const { CompositeDidDocumentResolver, CompositeHandleResolver, DohJsonHandleResolver, LocalActorResolver, PlcDidDocumentResolver, WebDidDocumentResolver, WellKnownHandleResolver } = await import("@atcute/identity-resolver");
-	actorResolver = new LocalActorResolver({
-		handleResolver: new CompositeHandleResolver({ methods: {
-			dns: new DohJsonHandleResolver({ dohUrl: "https://cloudflare-dns.com/dns-query" }),
-			http: new WellKnownHandleResolver()
-		} }),
-		didDocumentResolver: new CompositeDidDocumentResolver({ methods: {
-			plc: new PlcDidDocumentResolver(),
-			web: new WebDidDocumentResolver()
-		} })
-	});
-	return actorResolver;
-}
-/**
-* localStorage-backed cache for DID→handle resolutions. Handles are
-* stable for hours-to-days in practice, but bound the cache so a
-* compromised handle eventually flips back to "invalid" without a
-* forced refresh. 24h matches the typical atproto handle TTL.
-*
-* Failures (network errors, unsupported DID method) are *not* cached --
-* those should retry on the next render.
-*/
-const HANDLE_CACHE_TTL_MS = 1440 * 60 * 1e3;
-const HANDLE_CACHE_KEY_PREFIX = "emdash:did-handle:";
-function readHandleCache(did) {
-	if (typeof localStorage === "undefined") return null;
-	try {
-		const raw = localStorage.getItem(`${HANDLE_CACHE_KEY_PREFIX}${did}`);
-		if (!raw) return null;
-		const parsed = JSON.parse(raw);
-		if (!parsed || typeof parsed.expiresAt !== "number" || parsed.expiresAt < Date.now()) return null;
-		return parsed.resolution;
-	} catch {
-		return null;
-	}
-}
-function writeHandleCache(did, resolution) {
-	if (typeof localStorage === "undefined") return;
-	try {
-		const entry = {
-			resolution,
-			expiresAt: Date.now() + HANDLE_CACHE_TTL_MS
-		};
-		localStorage.setItem(`${HANDLE_CACHE_KEY_PREFIX}${did}`, JSON.stringify(entry));
-	} catch {}
-}
-async function resolveDidToHandle(did) {
-	const cached = readHandleCache(did);
-	if (cached) return cached;
-	let result;
-	try {
-		const resolved = await (await getActorResolver()).resolve(did);
-		if (resolved.handle === "handle.invalid") result = { status: "invalid" };
-		else if (resolved.handle) result = {
-			status: "ok",
-			handle: resolved.handle
-		};
-		else result = { status: "missing" };
-	} catch (err) {
-		console.warn(`[registry] DID->handle resolution failed for ${did}:`, err);
-		return { status: "missing" };
-	}
-	writeHandleCache(did, result);
-	return result;
-}
-const INSTALL_ENDPOINT = `${API_BASE}/admin/plugins/registry/install`;
-/**
-* Install a plugin from the registry.
-*
-* Posts to the EmDash server, which re-resolves the same `(handle,
-* slug)` against the aggregator, re-verifies the bundle's checksum
-* against the signed release record, and writes the install. Surfaces
-* structured error codes (`RELEASE_YANKED`, `CHECKSUM_MISMATCH`,
-* `DECLARED_ACCESS_DRIFT`, etc.) that callers map to localized
-* messages.
-*/
-async function installRegistryPlugin(body) {
-	const response = await apiFetch(INSTALL_ENDPOINT, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body)
-	});
-	if (!response.ok) await throwResponseError(response, i18n._({
-		id: "/LWKyx",
-		message: "Failed to install plugin"
-	}));
-	return (await response.json()).data;
-}
-
 //#endregion
 //#region src/components/PublisherHandle.tsx
 /**
@@ -22473,10 +23224,15 @@ function RegistryPluginDetail({ pluginId, config }) {
 	const { data: installedPlugins } = useQuery({
 		queryKey: ["plugins"],
 		queryFn: async () => {
-			const { fetchPlugins } = await import("./plugins-qrjvPK4g.js").then((n) => n.a);
+			const { fetchPlugins } = await import("./plugins-BZzztFdK.js").then((n) => n.a);
 			return fetchPlugins();
 		}
 	});
+	const { data: manifest } = useQuery({
+		queryKey: ["manifest"],
+		queryFn: fetchManifest
+	});
+	const hostEnv = React$1.useMemo(() => hostEnvFromManifest(manifest), [manifest]);
 	const slashIdx = pluginId.lastIndexOf("/");
 	const publisher = slashIdx > 0 ? pluginId.slice(0, slashIdx) : "";
 	const slug = slashIdx > 0 ? pluginId.slice(slashIdx + 1) : "";
@@ -22494,17 +23250,42 @@ function RegistryPluginDetail({ pluginId, config }) {
 		enabled: Boolean(publisher && slug)
 	});
 	const handleResult = usePublisherHandle(pkg?.did ?? "", pkg?.handle);
-	const { data: release } = useQuery({
+	const { data: releasesData } = useQuery({
 		queryKey: [
 			"registry",
-			"latest-release",
+			"releases",
 			config.aggregatorUrl,
+			config.acceptLabelers,
 			pkg?.did,
 			slug
 		],
-		queryFn: () => getLatestRegistryRelease(config, pkg.did, slug),
+		queryFn: () => listRegistryReleases(config, pkg.did, slug, { limit: 100 }),
 		enabled: Boolean(pkg?.did && slug)
 	});
+	const releases = React$1.useMemo(() => (releasesData?.releases ?? []).filter((r) => r.release !== null && !isYanked(r)), [releasesData]);
+	const hasFilteredAllReleases = (releasesData?.releases.length ?? 0) > 0 && releases.length === 0;
+	const defaultVersion = React$1.useMemo(() => {
+		if (!pkg || releases.length === 0) return void 0;
+		return (releases.find((r) => releasePassesPolicy(r, {
+			did: pkg.did,
+			slug
+		}, config.policy)) ?? releases[0])?.version;
+	}, [
+		pkg,
+		releases,
+		slug,
+		config.policy
+	]);
+	const [selectedVersion, setSelectedVersion] = React$1.useState(void 0);
+	const [prevPluginId, setPrevPluginId] = React$1.useState(pluginId);
+	if (prevPluginId !== pluginId) {
+		setPrevPluginId(pluginId);
+		setSelectedVersion(void 0);
+	}
+	if (selectedVersion !== void 0 && releases.length > 0 && !releases.some((r) => r.version === selectedVersion)) setSelectedVersion(void 0);
+	const effectiveVersion = selectedVersion ?? defaultVersion;
+	const release = React$1.useMemo(() => releases.find((r) => r.version === effectiveVersion), [releases, effectiveVersion]);
+	const isPreRelease = release ? isPreReleaseVersion(release.version) : false;
 	const ext = (release?.release?.extensions)?.["com.emdashcms.experimental.package.releaseExtension"];
 	const capabilities = Array.isArray(ext?.capabilities) ? canonicalCapabilitiesForDriftCheck(ext?.capabilities) : canonicalCapabilitiesForDriftCheck(declaredAccessToCapabilityList(ext?.declaredAccess));
 	const pkgProfile = pkg?.profile ?? null;
@@ -22526,11 +23307,51 @@ function RegistryPluginDetail({ pluginId, config }) {
 		}] : [];
 	});
 	const repoHref = safeExternalHref(release?.release?.repo);
-	const verified = (pkg?.labels ?? []).some((l) => l.val === "verified");
+	const verifiedLabel = (pkg?.labels ?? []).find((l) => l.val === "verified");
+	const verified = Boolean(verifiedLabel);
+	const verifiedLabeller = typeof verifiedLabel?.src === "string" ? verifiedLabel.src : null;
+	const sections = presentSections(pkgProfile);
+	const [selectedSection, setSelectedSection] = React$1.useState(void 0);
+	const defaultSection = sections[0]?.key;
+	const activeSection = selectedSection && sections.some((s) => s.key === selectedSection) ? selectedSection : defaultSection;
+	const activePane = sections.find((s) => s.key === activeSection);
+	const sbom = extractSbom(release?.release?.sbom);
+	const sbomHref = sbom ? sbomDownloadHref(sbom.url) : null;
+	const lastUpdated = typeof pkgProfile?.lastUpdated === "string" ? pkgProfile.lastUpdated : null;
+	const mediaArtifacts = extractMediaArtifacts(release?.release?.artifacts);
+	const artifactDid = pkg?.did;
+	const artifactVersion = release?.version;
+	const iconSrc = mediaArtifacts.icon && artifactDid ? artifactProxyUrl({
+		did: artifactDid,
+		slug,
+		version: artifactVersion,
+		kind: "icon"
+	}) : null;
+	const bannerSrc = mediaArtifacts.banner && artifactDid ? artifactProxyUrl({
+		did: artifactDid,
+		slug,
+		version: artifactVersion,
+		kind: "banner"
+	}) : null;
+	const screenshots = artifactDid ? mediaArtifacts.screenshots.map((shot) => ({
+		...shot,
+		src: artifactProxyUrl({
+			did: artifactDid,
+			slug,
+			version: artifactVersion,
+			kind: "screenshot",
+			index: shot.index
+		})
+	})) : [];
 	const policyOk = release && pkg ? releasePassesPolicy(release, {
 		did: pkg.did,
 		slug
 	}, config.policy) : true;
+	const envMismatches = React$1.useMemo(() => {
+		if (!release) return [];
+		return checkEnvCompatibility(release.release?.requires, hostEnv);
+	}, [release, hostEnv]);
+	const envOk = envMismatches.length === 0;
 	const installedEntry = React$1.useMemo(() => {
 		if (!pkg || !installedPlugins) return void 0;
 		return installedPlugins.find((p) => p.source === "registry" && p.registryPublisherDid === pkg.did && p.registrySlug === slug);
@@ -22589,14 +23410,33 @@ function RegistryPluginDetail({ pluginId, config }) {
 		className: "space-y-6",
 		children: [
 			/* @__PURE__ */ jsx(BackLink, {}),
+			bannerSrc ? /* @__PURE__ */ jsx("img", {
+				src: bannerSrc,
+				alt: _t({
+					id: "aOmjNp",
+					message: "{0} banner",
+					values: { 0: displayName ?? slug }
+				}),
+				className: "h-40 w-full rounded-xl object-cover",
+				loading: "lazy"
+			}) : null,
 			/* @__PURE__ */ jsxs("div", {
-				className: "flex items-start gap-4",
+				className: "flex flex-wrap items-start gap-4",
 				children: [
 					/* @__PURE__ */ jsx("div", {
-						className: "rounded-xl bg-kumo-subtle p-3 text-kumo-subtle",
-						children: /* @__PURE__ */ jsx("span", {
+						className: "overflow-hidden rounded-xl bg-kumo-subtle text-kumo-subtle",
+						children: iconSrc ? /* @__PURE__ */ jsx("img", {
+							src: iconSrc,
+							alt: _t({
+								id: "dVaAiX",
+								message: "{0} icon",
+								values: { 0: displayName ?? slug }
+							}),
+							className: "block h-16 w-16 object-cover",
+							loading: "lazy"
+						}) : /* @__PURE__ */ jsx("span", {
 							"aria-hidden": true,
-							className: "block h-10 w-10"
+							className: "block h-16 w-16"
 						})
 					}),
 					/* @__PURE__ */ jsxs("div", {
@@ -22607,11 +23447,30 @@ function RegistryPluginDetail({ pluginId, config }) {
 								children: [/* @__PURE__ */ jsx("h1", {
 									className: "truncate text-3xl font-bold",
 									children: displayName ?? slug
-								}), verified ? /* @__PURE__ */ jsx(ShieldCheck, {
-									className: "h-5 w-5 shrink-0 text-kumo-brand",
-									"aria-label": _t({
-										id: "70QfpA",
-										message: "Verified publisher"
+								}), verified ? /* @__PURE__ */ jsx(Tooltip, {
+									content: verifiedLabeller ? _t({
+										id: "/rITsG",
+										message: "Verified publisher. A labeller ({verifiedLabeller}) has confirmed this publisher's identity.",
+										values: { verifiedLabeller }
+									}) : _t({
+										id: "PCUvJ4",
+										message: "Verified publisher. A labeller has confirmed this publisher's identity."
+									}),
+									render: /* @__PURE__ */ jsx("button", {
+										type: "button",
+										className: "inline-flex shrink-0 cursor-help rounded-full focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-kumo-brand",
+										"aria-label": verifiedLabeller ? _t({
+											id: "s7Woxs",
+											message: "Verified publisher, confirmed by labeller {verifiedLabeller}",
+											values: { verifiedLabeller }
+										}) : _t({
+											id: "70QfpA",
+											message: "Verified publisher"
+										}),
+										children: /* @__PURE__ */ jsx(ShieldCheck, {
+											className: "h-5 w-5 text-kumo-brand",
+											"aria-hidden": true
+										})
 									})
 								}) : null]
 							}),
@@ -22630,40 +23489,124 @@ function RegistryPluginDetail({ pluginId, config }) {
 									})
 								]
 							}),
-							release ? /* @__PURE__ */ jsxs("p", {
-								className: "text-xs text-kumo-subtle",
+							release ? /* @__PURE__ */ jsxs("div", {
+								className: "mt-1 flex flex-wrap items-center gap-2",
 								children: [
-									_t({
-										id: "YYdC3A",
-										message: "Version {0}",
-										values: { 0: release.version }
+									/* @__PURE__ */ jsx("p", {
+										className: "text-xs text-kumo-subtle",
+										children: _t({
+											id: "YYdC3A",
+											message: "Version {0}",
+											values: { 0: release.version }
+										})
 									}),
-									" · ",
-									_t({
-										id: "294VT5",
-										message: "indexed {0}",
-										values: { 0: formatDate(release.indexedAt) }
-									})
+									isPreRelease ? /* @__PURE__ */ jsx(Badge, { children: _t({
+										id: "omrja/",
+										message: "Pre-release"
+									}) }) : null,
+									sbom?.format ? /* @__PURE__ */ jsx(Badge, { children: _t({
+										id: "mQmHhZ",
+										message: "SBOM · {0}",
+										values: { 0: sbom.format }
+									}) }) : sbom ? /* @__PURE__ */ jsx(Badge, { children: _t({
+										id: "SBWpbn",
+										message: "SBOM"
+									}) }) : null,
+									sbomHref ? /* @__PURE__ */ jsx("a", {
+										href: sbomHref,
+										target: "_blank",
+										rel: "noopener noreferrer",
+										download: true,
+										className: "text-xs text-kumo-brand hover:underline",
+										children: _t({
+											id: "gm9IDy",
+											message: "Download SBOM"
+										})
+									}) : null
 								]
+							}) : null,
+							release ? /* @__PURE__ */ jsxs("dl", {
+								className: "mt-1 flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-kumo-subtle",
+								children: [lastUpdated ? /* @__PURE__ */ jsxs("div", {
+									className: "flex items-center gap-1",
+									children: [/* @__PURE__ */ jsx("dt", {
+										className: "font-medium",
+										children: _t({
+											id: "+b7T3G",
+											message: "Updated"
+										})
+									}), /* @__PURE__ */ jsx("dd", { children: formatDate(lastUpdated) })]
+								}) : null, /* @__PURE__ */ jsxs("div", {
+									className: "flex items-center gap-1",
+									children: [/* @__PURE__ */ jsx("dt", {
+										className: "font-medium",
+										children: _t({
+											id: "I3/r1f",
+											message: "Indexed"
+										})
+									}), /* @__PURE__ */ jsx("dd", { children: formatDate(release.indexedAt) })]
+								})]
 							}) : null
 						]
 					}),
-					/* @__PURE__ */ jsx("div", { children: isInstalled ? /* @__PURE__ */ jsx(Button, {
-						variant: "secondary",
-						disabled: true,
-						children: _t({
-							id: "eQkgKV",
-							message: "Installed"
-						})
-					}) : /* @__PURE__ */ jsx(Button, {
-						variant: "primary",
-						disabled: !release || !policyOk || handleResult.status === "invalid",
-						onClick: () => setShowConsent(true),
-						children: _t({
-							id: "TKQ7K+",
-							message: "Install"
-						})
-					}) })
+					/* @__PURE__ */ jsxs("div", {
+						className: "flex min-w-0 flex-wrap items-center gap-2",
+						children: [releases.length > 1 ? /* @__PURE__ */ jsx(Select, {
+							"aria-label": _t({
+								id: "eE0JZ4",
+								message: "Version"
+							}),
+							className: "w-full max-w-[220px]",
+							value: effectiveVersion ?? "",
+							onValueChange: (v) => setSelectedVersion(v ?? void 0),
+							renderValue: (v) => typeof v === "string" ? v : "",
+							children: releases.map((r) => {
+								const preRelease = isPreReleaseVersion(r.version);
+								const policyBlocked = !releasePassesPolicy(r, {
+									did: pkg.did,
+									slug
+								}, config.policy);
+								return /* @__PURE__ */ jsx(Select.Option, {
+									value: r.version,
+									children: /* @__PURE__ */ jsxs("span", {
+										className: "flex items-center gap-2",
+										children: [
+											/* @__PURE__ */ jsx("span", { children: r.version }),
+											preRelease ? /* @__PURE__ */ jsx("span", {
+												className: "text-xs text-kumo-subtle",
+												children: _t({
+													id: "D2C1D+",
+													message: "(pre-release)"
+												})
+											}) : null,
+											policyBlocked ? /* @__PURE__ */ jsx("span", {
+												className: "text-xs text-kumo-subtle",
+												children: _t({
+													id: "W3SUIF",
+													message: "(too new)"
+												})
+											}) : null
+										]
+									})
+								}, r.version);
+							})
+						}) : null, isInstalled ? /* @__PURE__ */ jsx(Button, {
+							variant: "secondary",
+							disabled: true,
+							children: _t({
+								id: "eQkgKV",
+								message: "Installed"
+							})
+						}) : /* @__PURE__ */ jsx(Button, {
+							variant: "primary",
+							disabled: !release || !policyOk || !envOk || handleResult.status === "invalid",
+							onClick: () => setShowConsent(true),
+							children: _t({
+								id: "TKQ7K+",
+								message: "Install"
+							})
+						})]
+					})
 				]
 			}),
 			handleResult.status === "invalid" ? /* @__PURE__ */ jsxs("div", {
@@ -22683,6 +23626,23 @@ function RegistryPluginDetail({ pluginId, config }) {
 					})
 				})] })]
 			}) : null,
+			hasFilteredAllReleases ? /* @__PURE__ */ jsxs("div", {
+				className: "flex items-start gap-3 rounded-md border border-kumo-warning bg-kumo-warning/10 p-4 text-kumo-warning",
+				role: "status",
+				children: [/* @__PURE__ */ jsx(Warning, { className: "mt-0.5 h-5 w-5 shrink-0" }), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("p", {
+					className: "font-medium",
+					children: _t({
+						id: "rqsq95",
+						message: "No installable releases"
+					})
+				}), /* @__PURE__ */ jsx("p", {
+					className: "mt-1 text-sm text-kumo-default",
+					children: _t({
+						id: "o+La9d",
+						message: "Every published release of this plugin has been withdrawn or could not be verified. Check back later, or contact the publisher."
+					})
+				})] })]
+			}) : null,
 			release && !policyOk ? /* @__PURE__ */ jsxs("div", {
 				className: "flex items-start gap-3 rounded-md border border-kumo-warning bg-kumo-warning/10 p-4 text-kumo-warning",
 				role: "status",
@@ -22701,10 +23661,66 @@ function RegistryPluginDetail({ pluginId, config }) {
 					})
 				})] })]
 			}) : null,
+			release && !envOk ? /* @__PURE__ */ jsxs("div", {
+				className: "flex items-start gap-3 rounded-md border border-kumo-warning bg-kumo-warning/10 p-4 text-kumo-warning",
+				role: "status",
+				children: [/* @__PURE__ */ jsx(Warning, { className: "mt-0.5 h-5 w-5 shrink-0" }), /* @__PURE__ */ jsxs("div", { children: [
+					/* @__PURE__ */ jsx("p", {
+						className: "font-medium",
+						children: _t({
+							id: "25SzC8",
+							message: "Not compatible with this environment"
+						})
+					}),
+					/* @__PURE__ */ jsx("p", {
+						className: "mt-1 text-sm text-kumo-default",
+						children: _t({
+							id: "RwFsM0",
+							message: "This release requires a newer environment than your site currently runs. Upgrade before installing."
+						})
+					}),
+					/* @__PURE__ */ jsx("ul", {
+						className: "mt-2 space-y-1 text-sm text-kumo-default",
+						children: envMismatches.map((m) => /* @__PURE__ */ jsx("li", { children: _t({
+							id: "XMcEUU",
+							message: "{0} {1} required — you have {2}.",
+							values: {
+								0: envLabel(m.key),
+								1: m.required,
+								2: m.host
+							}
+						}) }, m.key))
+					})
+				] })]
+			}) : null,
 			description ? /* @__PURE__ */ jsx("p", {
 				className: "text-base text-kumo-default",
 				children: description
 			}) : null,
+			screenshots.length > 0 ? /* @__PURE__ */ jsx("section", {
+				"aria-label": _t({
+					id: "lqROaa",
+					message: "Screenshots"
+				}),
+				children: /* @__PURE__ */ jsx("ul", {
+					className: "flex snap-x gap-3 overflow-x-auto pb-2",
+					children: screenshots.map((shot, i) => /* @__PURE__ */ jsx("li", {
+						className: "shrink-0 snap-start",
+						children: /* @__PURE__ */ jsx("img", {
+							src: shot.src,
+							alt: _t({
+								id: "3rcds3",
+								message: "Screenshot {0}",
+								values: { 0: i + 1 }
+							}),
+							width: shot.width,
+							height: shot.height,
+							className: "h-48 w-auto rounded-lg border border-kumo-default object-cover",
+							loading: "lazy"
+						})
+					}, shot.index))
+				})
+			}) : null,
 			licenseText || repoHref || keywordList.length > 0 ? /* @__PURE__ */ jsxs("section", {
 				className: "flex flex-wrap items-center gap-2",
 				children: [
@@ -22787,6 +23803,27 @@ function RegistryPluginDetail({ pluginId, config }) {
 				className: "mt-2 flex flex-wrap gap-2",
 				children: capabilities.map((c) => /* @__PURE__ */ jsx(Badge, { children: c }, c))
 			})] }) : null,
+			sections.length > 0 && activePane ? /* @__PURE__ */ jsxs("section", {
+				"aria-label": _t({
+					id: "TYxt+3",
+					message: "Plugin details"
+				}),
+				children: [sections.length > 1 ? /* @__PURE__ */ jsx(Tabs, {
+					variant: "underline",
+					value: activeSection,
+					onValueChange: (v) => setSelectedSection(v),
+					tabs: sections.map((s) => ({
+						value: s.key,
+						label: _t(SECTION_LABELS[s.key])
+					}))
+				}) : /* @__PURE__ */ jsx("h2", {
+					className: "text-sm font-semibold text-kumo-subtle",
+					children: _t(SECTION_LABELS[activePane.key])
+				}), /* @__PURE__ */ jsx("div", {
+					className: "prose prose-sm mt-4 max-w-none rounded-lg border bg-kumo-base p-6",
+					children: /* @__PURE__ */ jsx("div", { dangerouslySetInnerHTML: { __html: renderMarkdown(activePane.markdown) } })
+				})]
+			}) : null,
 			showConsent && release ? /* @__PURE__ */ jsx(CapabilityConsentDialog, {
 				mode: "install",
 				pluginName: displayName ?? slug,
@@ -22802,6 +23839,28 @@ function RegistryPluginDetail({ pluginId, config }) {
 		]
 	});
 }
+const SECTION_LABELS = {
+	description: {
+		id: "Nu4oKW",
+		message: "Description"
+	},
+	installation: {
+		id: "Xry+oU",
+		message: "Installation"
+	},
+	faq: {
+		id: "/lDBHm",
+		message: "FAQ"
+	},
+	changelog: {
+		id: "CWe7wB",
+		message: "Changelog"
+	},
+	security: {
+		id: "a3LDKx",
+		message: "Security"
+	}
+};
 function BackLink() {
 	const { _: _t2 } = useLingui();
 	return /* @__PURE__ */ jsxs(Link$1, {
@@ -22833,6 +23892,43 @@ function declaredAccessToCapabilityList(declaredAccess) {
 	}
 	return out;
 }
+const PRE_RELEASE_VERSION_RE = /^\d+\.\d+\.\d+-/;
+/**
+* Detects semver pre-release identifiers (`1.0.0-alpha.1`, `2.0.0-rc.2`). The
+* release lexicon does not enforce semver shape, so a permissive `includes("-")`
+* check would light up the badge for malformed values like `-1.0.0` or
+* `abc-def`. Require a `MAJOR.MINOR.PATCH-` prefix instead.
+*/
+function isPreReleaseVersion(version) {
+	return PRE_RELEASE_VERSION_RE.test(version);
+}
+/**
+* Human-readable name for a `requires` env key. The known EmDash environments
+* get their proper product names; anything else falls back to the key with the
+* `env:` prefix stripped (product names, not localised strings).
+*/
+function envLabel(key) {
+	if (key === "env:emdash") return "EmDash";
+	if (key === "env:astro") return "Astro";
+	return key.startsWith("env:") ? key.slice(4) : key;
+}
+const YANKED_LABEL_VALUE = "security:yanked";
+/**
+* Aggregators forward labels applied by their configured labellers. `security:yanked`
+* is a hard-enforcement label that publishers can self-apply (or that a labeller
+* applies on their behalf) to retract a release after publication. Sites whose
+* `acceptLabelers` config includes the labeller never see yanked releases at all
+* (server filtering), but sites without it receive yanked releases interleaved
+* with installable ones — filter them out so they never reach the picker.
+*
+* `neg` (negated labels) is intentionally ignored to match the server install
+* handler, which only checks `l.val === "security:yanked"`. Diverging here would
+* let the UI surface an install affordance the server will reject with
+* `RELEASE_YANKED`. Honoring `neg` on both sides is a separate follow-up.
+*/
+function isYanked(release) {
+	return (release.labels ?? []).some((l) => l.val === YANKED_LABEL_VALUE);
+}
 function formatDate(iso) {
 	try {
 		return new Date(iso).toLocaleDateString();
@@ -28147,15 +29243,6 @@ function SidebarNav({ manifest }) {
 				border-top: 1px solid rgba(255,255,255,0.08);
 			}
 
-			/* Keep all nav icons visible when sidebar collapses to icon mode */
-			.emdash-sidebar[data-state="collapsed"] [data-sidebar="group-content"] {
-				grid-template-rows: 1fr !important;
-			}
-			/* Mobile drawer: kumo's Sheet has no data-state attribute, so group-content
-			   stays at grid-rows-[0fr] (hidden). Force it open in the mobile sidebar. */
-			.emdash-sidebar[data-mobile="true"] [data-sidebar="group-content"] {
-				grid-template-rows: 1fr !important;
-			}
 			/* Collapsed separators — thin centered line */
 			.emdash-sidebar[data-state="collapsed"] [data-sidebar="separator"] {
 				margin: 0.375rem 0.625rem;
@@ -28239,52 +29326,36 @@ function SidebarNav({ manifest }) {
 					isActive: isItemActive("/", currentPath)
 				}) }) }),
 				/* @__PURE__ */ jsx(KumoSidebar.Separator, {}),
-				visibleContent.length > 1 && /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "4b3oEV",
-							message: "Content"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleContent.filter((i) => i.to !== "/")) }) })]
-				}),
+				visibleContent.length > 1 && /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "4b3oEV",
+						message: "Content"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleContent.filter((i) => i.to !== "/")) })] }),
 				/* @__PURE__ */ jsx(KumoSidebar.Separator, {}),
-				visibleManage.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "wckWOP",
-							message: "Manage"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleManage) }) })]
-				}),
+				visibleManage.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "wckWOP",
+						message: "Manage"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleManage) })] }),
 				/* @__PURE__ */ jsx(KumoSidebar.Separator, {}),
-				visibleAdmin.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "U3pytU",
-							message: "Admin"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleAdmin) }) })]
-				}),
-				visiblePlugins.length > 0 && /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(KumoSidebar.Separator, {}), /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "ohUJJM",
-							message: "Plugins"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visiblePlugins) }) })]
-				})] })
+				visibleAdmin.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "U3pytU",
+						message: "Admin"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleAdmin) })] }),
+				visiblePlugins.length > 0 && /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(KumoSidebar.Separator, {}), /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "ohUJJM",
+						message: "Plugins"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visiblePlugins) })] })] })
 			] }),
 			/* @__PURE__ */ jsx(KumoSidebar.Footer, { children: /* @__PURE__ */ jsxs("p", {
 				className: "emdash-nav-label px-3 py-2 text-[11px] text-white/30",
@@ -29522,22 +30593,23 @@ function TermFormDialog({ open, onClose, taxonomyName, taxonomyDef, term, allTer
 						className: "flex items-start justify-between gap-4 mb-4",
 						children: [/* @__PURE__ */ jsxs("div", {
 							className: "flex flex-col space-y-1.5",
-							children: [/* @__PURE__ */ jsxs(Dialog.Title, {
+							children: [/* @__PURE__ */ jsx(Dialog.Title, {
 								className: "text-lg font-semibold leading-none tracking-tight",
-								children: [
-									term ? _t3({
-										id: "ePK91l",
-										message: "Edit"
-									}) : _t3({
-										id: "m16xKo",
-										message: "Add"
-									}),
-									" ",
-									taxonomyDef.labelSingular || _t3({
+								children: term ? _t3({
+									id: "N6j2JH",
+									message: "Edit {0}",
+									values: { 0: taxonomyDef.labelSingular || _t3({
 										id: "k3xOSk",
 										message: "Term"
-									})
-								]
+									}) }
+								}) : _t3({
+									id: "3nLdaX",
+									message: "Add {0}",
+									values: { 0: taxonomyDef.labelSingular || _t3({
+										id: "k3xOSk",
+										message: "Term"
+									}) }
+								})
 							}), /* @__PURE__ */ jsx(Dialog.Description, {
 								className: "text-sm text-kumo-subtle",
 								children: term ? _t3({
@@ -30062,20 +31134,17 @@ function TaxonomyManager({ taxonomyName }) {
 								message: "New Taxonomy"
 							})
 						}),
-						/* @__PURE__ */ jsxs(Button, {
+						/* @__PURE__ */ jsx(Button, {
 							icon: /* @__PURE__ */ jsx(Plus, {}),
 							onClick: () => setFormOpen(true),
-							children: [
-								_t5({
-									id: "m16xKo",
-									message: "Add"
-								}),
-								" ",
-								taxonomyDef.labelSingular || _t5({
+							children: _t5({
+								id: "3nLdaX",
+								message: "Add {0}",
+								values: { 0: taxonomyDef.labelSingular || _t5({
 									id: "k3xOSk",
 									message: "Term"
-								})
-							]
+								}) }
+							})
 						})
 					]
 				})]
@@ -34218,6 +35287,13 @@ function AuthorMappingStep({ authorMappings, emdashUsers, onMappingChange, onCon
 
 //#endregion
 //#region src/routes/bylines.tsx
+/**
+* True when the load-more snapshot still matches the current filter state.
+* Used to discard appends from requests whose filters have changed mid-flight.
+*/
+function loadMoreSnapshotMatches(snapshot, current) {
+	return snapshot.search === current.search && snapshot.guestFilter === current.guestFilter && snapshot.locale === current.locale;
+}
 function toFormState(byline) {
 	if (!byline) return {
 		slug: "",
@@ -34243,21 +35319,39 @@ function getUserLabel(user) {
 function BylinesPage() {
 	const { _: _t } = useLingui();
 	const queryClient = useQueryClient();
+	const navigate = useNavigate$1();
+	const { locale: routeLocale } = useSearch({ from: "/_admin/bylines" });
 	const [search, setSearch] = React$1.useState("");
 	const [guestFilter, setGuestFilter] = React$1.useState("all");
 	const [selectedId, setSelectedId] = React$1.useState(null);
 	const [showDeleteConfirm, setShowDeleteConfirm] = React$1.useState(false);
 	const [allItems, setAllItems] = React$1.useState([]);
 	const [nextCursor, setNextCursor] = React$1.useState(void 0);
+	const { data: manifest } = useQuery({
+		queryKey: ["manifest"],
+		queryFn: fetchManifest
+	});
+	const i18n = useI18nConfig(manifest);
+	const isMultiLocale = !!i18n && i18n.locales.length > 1;
+	const activeLocale = routeLocale ?? i18n?.defaultLocale ?? void 0;
+	const handleLocaleChange = (locale) => {
+		navigate({
+			to: "/bylines",
+			search: { locale: locale || void 0 }
+		});
+		setSelectedId(null);
+	};
 	const { data, isLoading, error } = useQuery({
 		queryKey: [
 			"bylines",
 			search,
-			guestFilter
+			guestFilter,
+			activeLocale ?? null
 		],
 		queryFn: () => fetchBylines({
 			search: search || void 0,
 			isGuest: guestFilter === "all" ? void 0 : guestFilter === "guest",
+			locale: activeLocale,
 			limit: 50
 		})
 	});
@@ -34273,28 +35367,44 @@ function BylinesPage() {
 	});
 	const users = usersData?.items ?? [];
 	const loadMoreMutation = useMutation({
-		mutationFn: async () => {
-			if (!nextCursor) return null;
-			return fetchBylines({
-				search: search || void 0,
-				isGuest: guestFilter === "all" ? void 0 : guestFilter === "guest",
-				limit: 50,
-				cursor: nextCursor
-			});
+		mutationFn: async (snapshot) => {
+			return {
+				result: await fetchBylines({
+					search: snapshot.search || void 0,
+					isGuest: snapshot.guestFilter === "all" ? void 0 : snapshot.guestFilter === "guest",
+					locale: snapshot.locale,
+					limit: 50,
+					cursor: snapshot.cursor
+				}),
+				snapshot
+			};
 		},
-		onSuccess: (result) => {
-			if (result) {
-				setAllItems((prev) => [...prev, ...result.items]);
-				setNextCursor(result.nextCursor);
-			}
+		onSuccess: ({ result, snapshot }) => {
+			if (!loadMoreSnapshotMatches(snapshot, {
+				search,
+				guestFilter,
+				locale: activeLocale
+			})) return;
+			setAllItems((prev) => [...prev, ...result.items]);
+			setNextCursor(result.nextCursor);
 		}
 	});
 	const items = allItems;
-	const selected = items.find((item) => item.id === selectedId) ?? null;
+	const { data: selectedRemote } = useQuery({
+		queryKey: ["byline", selectedId],
+		queryFn: () => selectedId ? fetchByline(selectedId) : Promise.resolve(null),
+		enabled: !!selectedId
+	});
+	const selected = selectedRemote ?? items.find((item) => item.id === selectedId) ?? null;
 	const [form, setForm] = React$1.useState(() => toFormState(null));
 	React$1.useEffect(() => {
 		setForm(toFormState(selected));
-	}, [selectedId, selected]);
+	}, [selected]);
+	const { data: translationsData } = useQuery({
+		queryKey: ["byline-translations", selectedId],
+		queryFn: () => selectedId ? fetchBylineTranslations(selectedId) : Promise.resolve({ items: [] }),
+		enabled: !!selectedId && isMultiLocale
+	});
 	const createMutation = useMutation({
 		mutationFn: () => createByline({
 			slug: form.slug,
@@ -34302,7 +35412,8 @@ function BylinesPage() {
 			bio: form.bio || null,
 			websiteUrl: form.websiteUrl || null,
 			userId: form.userId,
-			isGuest: form.isGuest
+			isGuest: form.isGuest,
+			locale: activeLocale
 		}),
 		onSuccess: (created) => {
 			queryClient.invalidateQueries({ queryKey: ["bylines"] });
@@ -34323,6 +35434,7 @@ function BylinesPage() {
 		},
 		onSuccess: () => {
 			queryClient.invalidateQueries({ queryKey: ["bylines"] });
+			if (selectedId) queryClient.invalidateQueries({ queryKey: ["byline", selectedId] });
 		}
 	});
 	const deleteMutation = useMutation({
@@ -34336,6 +35448,26 @@ function BylinesPage() {
 			setShowDeleteConfirm(false);
 		}
 	});
+	const [pendingTranslationLocale, setPendingTranslationLocale] = React$1.useState(null);
+	const translateMutation = useMutation({
+		mutationFn: (targetLocale) => {
+			if (!selectedId) throw new Error("No byline selected");
+			setPendingTranslationLocale(targetLocale);
+			return createBylineTranslation(selectedId, { locale: targetLocale });
+		},
+		onSettled: () => {
+			setPendingTranslationLocale(null);
+		},
+		onSuccess: (created) => {
+			queryClient.invalidateQueries({ queryKey: ["bylines"] });
+			if (selectedId) queryClient.invalidateQueries({ queryKey: ["byline-translations", selectedId] });
+			navigate({
+				to: "/bylines",
+				search: { locale: created.locale }
+			});
+			setSelectedId(created.id);
+		}
+	});
 	if (isLoading) return /* @__PURE__ */ jsx("div", {
 		className: "flex items-center justify-center min-h-[30vh]",
 		children: /* @__PURE__ */ jsx(Loader, {})
@@ -34349,230 +35481,273 @@ function BylinesPage() {
 		})
 	});
 	const isSaving = createMutation.isPending || updateMutation.isPending;
-	const mutationError = createMutation.error || updateMutation.error || deleteMutation.error;
+	const mutationError = createMutation.error || updateMutation.error || deleteMutation.error || translateMutation.error;
 	return /* @__PURE__ */ jsxs("div", {
-		className: "grid grid-cols-1 gap-6 lg:grid-cols-[320px_1fr]",
+		className: "space-y-4",
 		children: [
+			isMultiLocale && i18n && activeLocale ? /* @__PURE__ */ jsxs("div", {
+				className: "flex items-center justify-between",
+				children: [/* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx("h1", {
+					className: "text-2xl font-semibold",
+					children: _t({
+						id: "xLGa7J",
+						message: "Bylines"
+					})
+				}) }), /* @__PURE__ */ jsx(LocaleSwitcher, {
+					locales: i18n.locales,
+					defaultLocale: i18n.defaultLocale,
+					value: activeLocale,
+					onChange: handleLocaleChange
+				})]
+			}) : null,
 			/* @__PURE__ */ jsxs("div", {
-				className: "rounded-lg border p-4",
+				className: "grid grid-cols-1 gap-6 lg:grid-cols-[320px_1fr]",
 				children: [/* @__PURE__ */ jsxs("div", {
-					className: "mb-4 space-y-2",
-					children: [/* @__PURE__ */ jsx(Input, {
-						placeholder: _t({
-							id: "4L2LjM",
-							message: "Search bylines"
-						}),
-						value: search,
-						onChange: (e) => setSearch(e.target.value)
-					}), /* @__PURE__ */ jsxs("div", {
-						className: "flex items-center gap-2",
-						children: [/* @__PURE__ */ jsx("div", {
-							className: "flex-1",
-							children: /* @__PURE__ */ jsx(Select, {
-								"aria-label": _t({
-									id: "kYxs0a",
-									message: "Filter byline type"
-								}),
-								value: guestFilter,
-								onValueChange: (v) => setGuestFilter(v ?? "all"),
-								items: {
-									all: _t({
-										id: "VK3dVJ",
-										message: "All bylines"
-									}),
-									guest: _t({
-										id: "+0jFzA",
-										message: "Guest only"
+					className: "rounded-lg border p-4",
+					children: [/* @__PURE__ */ jsxs("div", {
+						className: "mb-4 space-y-2",
+						children: [/* @__PURE__ */ jsx(Input, {
+							placeholder: _t({
+								id: "4L2LjM",
+								message: "Search bylines"
+							}),
+							value: search,
+							onChange: (e) => setSearch(e.target.value)
+						}), /* @__PURE__ */ jsxs("div", {
+							className: "flex items-center gap-2",
+							children: [/* @__PURE__ */ jsx("div", {
+								className: "flex-1",
+								children: /* @__PURE__ */ jsx(Select, {
+									"aria-label": _t({
+										id: "kYxs0a",
+										message: "Filter byline type"
 									}),
-									linked: _t({
-										id: "RZ5T1J",
-										message: "Linked only"
-									})
+									value: guestFilter,
+									onValueChange: (v) => setGuestFilter(v ?? "all"),
+									items: {
+										all: _t({
+											id: "VK3dVJ",
+											message: "All bylines"
+										}),
+										guest: _t({
+											id: "+0jFzA",
+											message: "Guest only"
+										}),
+										linked: _t({
+											id: "RZ5T1J",
+											message: "Linked only"
+										})
+									},
+									className: "w-full"
+								})
+							}), /* @__PURE__ */ jsx(Button, {
+								variant: "secondary",
+								onClick: () => {
+									setSelectedId(null);
+									setForm(toFormState(null));
 								},
-								className: "w-full"
-							})
-						}), /* @__PURE__ */ jsx(Button, {
-							variant: "secondary",
-							onClick: () => {
-								setSelectedId(null);
-								setForm(toFormState(null));
-							},
-							children: _t({
-								id: "isRobC",
-								message: "New"
-							})
+								children: _t({
+									id: "isRobC",
+									message: "New"
+								})
+							})]
 						})]
+					}), /* @__PURE__ */ jsxs("div", {
+						className: "space-y-2 max-h-[70vh] overflow-auto",
+						children: [
+							items.map((item) => {
+								return /* @__PURE__ */ jsxs("button", {
+									type: "button",
+									onClick: () => setSelectedId(item.id),
+									className: `w-full rounded border p-3 text-start ${item.id === selectedId ? "border-kumo-brand bg-kumo-brand/10" : "border-kumo-line"}`,
+									children: [/* @__PURE__ */ jsx("p", {
+										className: "font-medium",
+										children: item.displayName
+									}), /* @__PURE__ */ jsxs("p", {
+										className: "text-xs text-kumo-subtle",
+										children: [item.slug, item.isGuest ? _t({
+											id: "89z9Fh",
+											message: " - Guest"
+										}) : item.userId ? _t({
+											id: "X4uMa1",
+											message: " - Linked"
+										}) : ""]
+									})]
+								}, item.id);
+							}),
+							items.length === 0 && /* @__PURE__ */ jsx("p", {
+								className: "text-sm text-kumo-subtle",
+								children: _t({
+									id: "Qc/a/A",
+									message: "No bylines found"
+								})
+							}),
+							nextCursor && /* @__PURE__ */ jsx(Button, {
+								variant: "secondary",
+								className: "w-full mt-2",
+								onClick: () => loadMoreMutation.mutate({
+									search,
+									guestFilter,
+									locale: activeLocale,
+									cursor: nextCursor
+								}),
+								disabled: loadMoreMutation.isPending,
+								children: loadMoreMutation.isPending ? _t({
+									id: "Z3FXyt",
+									message: "Loading..."
+								}) : _t({
+									id: "yQ2kGp",
+									message: "Load more"
+								})
+							})
+						]
 					})]
 				}), /* @__PURE__ */ jsxs("div", {
-					className: "space-y-2 max-h-[70vh] overflow-auto",
+					className: "rounded-lg border p-6 space-y-6",
 					children: [
-						items.map((item) => {
-							return /* @__PURE__ */ jsxs("button", {
-								type: "button",
-								onClick: () => setSelectedId(item.id),
-								className: `w-full rounded border p-3 text-start ${item.id === selectedId ? "border-kumo-brand bg-kumo-brand/10" : "border-kumo-line"}`,
-								children: [/* @__PURE__ */ jsx("p", {
-									className: "font-medium",
-									children: item.displayName
-								}), /* @__PURE__ */ jsxs("p", {
-									className: "text-xs text-kumo-subtle",
-									children: [item.slug, item.isGuest ? _t({
-										id: "89z9Fh",
-										message: " - Guest"
-									}) : item.userId ? _t({
-										id: "X4uMa1",
-										message: " - Linked"
-									}) : ""]
-								})]
-							}, item.id);
-						}),
-						items.length === 0 && /* @__PURE__ */ jsx("p", {
-							className: "text-sm text-kumo-subtle",
-							children: _t({
-								id: "Qc/a/A",
-								message: "No bylines found"
-							})
-						}),
-						nextCursor && /* @__PURE__ */ jsx(Button, {
-							variant: "secondary",
-							className: "w-full mt-2",
-							onClick: () => loadMoreMutation.mutate(),
-							disabled: loadMoreMutation.isPending,
-							children: loadMoreMutation.isPending ? _t({
-								id: "Z3FXyt",
-								message: "Loading..."
+						/* @__PURE__ */ jsx("h2", {
+							className: "text-lg font-semibold",
+							children: selected ? _t({
+								id: "N6j2JH",
+								message: "Edit {0}",
+								values: { 0: selected.displayName }
 							}) : _t({
-								id: "yQ2kGp",
-								message: "Load more"
+								id: "d6HWlw",
+								message: "Create byline"
 							})
-						})
-					]
-				})]
-			}),
-			/* @__PURE__ */ jsxs("div", {
-				className: "rounded-lg border p-6",
-				children: [/* @__PURE__ */ jsx("h2", {
-					className: "text-lg font-semibold mb-4",
-					children: selected ? _t({
-						id: "N6j2JH",
-						message: "Edit {0}",
-						values: { 0: selected.displayName }
-					}) : _t({
-						id: "d6HWlw",
-						message: "Create byline"
-					})
-				}), /* @__PURE__ */ jsxs("div", {
-					className: "space-y-4",
-					children: [
-						/* @__PURE__ */ jsx(Input, {
-							label: _t({
-								id: "pfa8F0",
-								message: "Display name"
-							}),
-							value: form.displayName,
-							onChange: (e) => setForm((prev) => ({
-								...prev,
-								displayName: e.target.value
-							}))
 						}),
-						/* @__PURE__ */ jsx(Input, {
-							label: _t({
-								id: "L85WcV",
-								message: "Slug"
-							}),
-							value: form.slug,
-							onChange: (e) => setForm((prev) => ({
-								...prev,
-								slug: e.target.value
-							}))
-						}),
-						/* @__PURE__ */ jsx(Input, {
-							label: _t({
-								id: "XYcw7G",
-								message: "Website URL"
-							}),
-							value: form.websiteUrl,
-							onChange: (e) => setForm((prev) => ({
-								...prev,
-								websiteUrl: e.target.value
-							}))
-						}),
-						/* @__PURE__ */ jsx(InputArea, {
-							label: _t({
-								id: "E+oKCO",
-								message: "Bio"
-							}),
-							value: form.bio,
-							onChange: (e) => setForm((prev) => ({
-								...prev,
-								bio: e.target.value
-							})),
-							rows: 5
-						}),
-						/* @__PURE__ */ jsx(Select, {
-							label: _t({
-								id: "nti0N3",
-								message: "Linked user"
-							}),
-							value: form.userId ?? "",
-							onValueChange: (v) => {
-								const val = v || null;
-								setForm((prev) => ({
-									...prev,
-									userId: val,
-									isGuest: val ? false : prev.isGuest
-								}));
-							},
-							items: {
-								"": _t({
-									id: "n9o2+L",
-									message: "No linked user"
+						/* @__PURE__ */ jsxs("div", {
+							className: "space-y-4",
+							children: [
+								/* @__PURE__ */ jsx(Input, {
+									label: _t({
+										id: "pfa8F0",
+										message: "Display name"
+									}),
+									value: form.displayName,
+									onChange: (e) => setForm((prev) => ({
+										...prev,
+										displayName: e.target.value
+									}))
 								}),
-								...Object.fromEntries(users.map((u) => [u.id, getUserLabel(u)]))
-							},
-							className: "w-full"
-						}),
-						/* @__PURE__ */ jsx(Switch, {
-							label: _t({
-								id: "6CRaxp",
-								message: "Guest byline"
-							}),
-							checked: form.isGuest,
-							onCheckedChange: (checked) => setForm((prev) => ({
-								...prev,
-								isGuest: checked,
-								userId: checked ? null : prev.userId
-							}))
+								/* @__PURE__ */ jsx(Input, {
+									label: _t({
+										id: "L85WcV",
+										message: "Slug"
+									}),
+									value: form.slug,
+									onChange: (e) => setForm((prev) => ({
+										...prev,
+										slug: e.target.value
+									}))
+								}),
+								/* @__PURE__ */ jsx(Input, {
+									label: _t({
+										id: "XYcw7G",
+										message: "Website URL"
+									}),
+									value: form.websiteUrl,
+									onChange: (e) => setForm((prev) => ({
+										...prev,
+										websiteUrl: e.target.value
+									}))
+								}),
+								/* @__PURE__ */ jsx(InputArea, {
+									label: _t({
+										id: "E+oKCO",
+										message: "Bio"
+									}),
+									value: form.bio,
+									onChange: (e) => setForm((prev) => ({
+										...prev,
+										bio: e.target.value
+									})),
+									rows: 5
+								}),
+								/* @__PURE__ */ jsx(Select, {
+									label: _t({
+										id: "nti0N3",
+										message: "Linked user"
+									}),
+									value: form.userId ?? "",
+									onValueChange: (v) => {
+										const val = v || null;
+										setForm((prev) => ({
+											...prev,
+											userId: val,
+											isGuest: val ? false : prev.isGuest
+										}));
+									},
+									items: {
+										"": _t({
+											id: "n9o2+L",
+											message: "No linked user"
+										}),
+										...Object.fromEntries(users.map((u) => [u.id, getUserLabel(u)]))
+									},
+									className: "w-full"
+								}),
+								/* @__PURE__ */ jsx(Switch, {
+									label: _t({
+										id: "6CRaxp",
+										message: "Guest byline"
+									}),
+									checked: form.isGuest,
+									onCheckedChange: (checked) => setForm((prev) => ({
+										...prev,
+										isGuest: checked,
+										userId: checked ? null : prev.userId
+									}))
+								}),
+								/* @__PURE__ */ jsx(DialogError, { message: getMutationError(mutationError) }),
+								/* @__PURE__ */ jsxs("div", {
+									className: "flex gap-2 pt-2",
+									children: [/* @__PURE__ */ jsx(Button, {
+										onClick: () => {
+											if (selected) updateMutation.mutate();
+											else createMutation.mutate();
+										},
+										disabled: !form.displayName || !form.slug || isSaving,
+										children: isSaving ? _t({
+											id: "XvjC4F",
+											message: "Saving..."
+										}) : selected ? _t({
+											id: "tfDRzk",
+											message: "Save"
+										}) : _t({
+											id: "hYgDIe",
+											message: "Create"
+										})
+									}), selected && /* @__PURE__ */ jsx(Button, {
+										variant: "destructive",
+										onClick: () => setShowDeleteConfirm(true),
+										disabled: deleteMutation.isPending,
+										children: _t({
+											id: "cnGeoo",
+											message: "Delete"
+										})
+									})]
+								})
+							]
 						}),
-						/* @__PURE__ */ jsx(DialogError, { message: getMutationError(mutationError) }),
-						/* @__PURE__ */ jsxs("div", {
-							className: "flex gap-2 pt-2",
-							children: [/* @__PURE__ */ jsx(Button, {
-								onClick: () => {
-									if (selected) updateMutation.mutate();
-									else createMutation.mutate();
+						selected && isMultiLocale && i18n ? /* @__PURE__ */ jsx("div", {
+							className: "border-t pt-6",
+							children: /* @__PURE__ */ jsx(TranslationsPanel, {
+								locales: i18n.locales,
+								defaultLocale: i18n.defaultLocale,
+								currentLocale: selected.locale,
+								translations: translationsData?.items ?? [],
+								onOpen: (summary) => {
+									navigate({
+										to: "/bylines",
+										search: { locale: summary.locale }
+									});
+									setSelectedId(summary.id);
 								},
-								disabled: !form.displayName || !form.slug || isSaving,
-								children: isSaving ? _t({
-									id: "XvjC4F",
-									message: "Saving..."
-								}) : selected ? _t({
-									id: "tfDRzk",
-									message: "Save"
-								}) : _t({
-									id: "hYgDIe",
-									message: "Create"
-								})
-							}), selected && /* @__PURE__ */ jsx(Button, {
-								variant: "destructive",
-								onClick: () => setShowDeleteConfirm(true),
-								disabled: deleteMutation.isPending,
-								children: _t({
-									id: "cnGeoo",
-									message: "Delete"
-								})
-							})]
-						})
+								onCreate: (locale) => translateMutation.mutate(locale),
+								pendingLocale: pendingTranslationLocale
+							})
+						}) : null
 					]
 				})]
 			}),
@@ -36140,10 +37315,11 @@ function ContentNewPage() {
 		queryKey: ["manifest"],
 		queryFn: fetchManifest
 	});
+	const pickerLocale = locale ?? manifest?.i18n?.defaultLocale;
 	const createMutation = useMutation({
 		mutationFn: (data) => createContent(collection, {
 			...data,
-			locale
+			locale: pickerLocale
 		}),
 		onSuccess: (result) => {
 			queryClient.invalidateQueries({ queryKey: ["content", collection] });
@@ -36157,14 +37333,23 @@ function ContentNewPage() {
 		}
 	});
 	const pluginBlocks = React$1.useMemo(() => manifest ? getPluginBlocks(manifest) : [], [manifest]);
-	const { data: bylinesData } = useQuery({
-		queryKey: ["bylines"],
-		queryFn: () => fetchBylines({ limit: 100 })
+	const { data: bylinesData, isSuccess: bylinesLoaded } = useQuery({
+		queryKey: [
+			"bylines",
+			"picker",
+			pickerLocale ?? null
+		],
+		queryFn: () => fetchBylines({
+			locale: pickerLocale,
+			limit: 100
+		}),
+		enabled: !!manifest
 	});
 	const createBylineMutation = useMutation({
 		mutationFn: (input) => createByline({
 			...input,
-			isGuest: true
+			isGuest: true,
+			locale: pickerLocale
 		}),
 		onSuccess: () => {
 			queryClient.invalidateQueries({ queryKey: ["bylines"] });
@@ -36190,10 +37375,13 @@ function ContentNewPage() {
 		collectionLabel: collectionConfig.labelSingular || collectionConfig.label,
 		fields: collectionConfig.fields,
 		isNew: true,
+		entryLocale: pickerLocale,
+		i18n: manifest?.i18n,
 		isSaving: createMutation.isPending,
 		onSave: handleSave,
 		pluginBlocks,
 		availableBylines: bylinesData?.items,
+		availableBylinesLoaded: bylinesLoaded,
 		selectedBylines,
 		onBylinesChange: setSelectedBylines,
 		onQuickCreateByline: async (input) => {
@@ -36303,14 +37491,24 @@ function ContentEditPage() {
 		enabled: !!currentUser && currentUser.role >= ROLE_EDITOR,
 		staleTime: 300 * 1e3
 	});
-	const { data: bylinesData } = useQuery({
-		queryKey: ["bylines"],
-		queryFn: () => fetchBylines({ limit: 100 })
+	const itemLocale = rawItem?.locale ?? void 0;
+	const { data: bylinesData, isSuccess: bylinesLoaded } = useQuery({
+		queryKey: [
+			"bylines",
+			"picker",
+			itemLocale ?? null
+		],
+		queryFn: () => fetchBylines({
+			locale: itemLocale,
+			limit: 100
+		}),
+		enabled: !!itemLocale
 	});
 	const createBylineMutation = useMutation({
 		mutationFn: (input) => createByline({
 			...input,
-			isGuest: true
+			isGuest: true,
+			locale: itemLocale
 		}),
 		onSuccess: () => {
 			queryClient.invalidateQueries({ queryKey: ["bylines"] });
@@ -36693,6 +37891,7 @@ function ContentEditPage() {
 		hasSeo: collectionConfig.hasSeo,
 		onSeoChange: handleSeoChange,
 		availableBylines: bylinesData?.items,
+		availableBylinesLoaded: bylinesLoaded,
 		onQuickCreateByline: async (input) => {
 			return await createBylineMutation.mutateAsync(input);
 		},
@@ -36985,7 +38184,7 @@ function MarketplaceBrowsePage() {
 	const { data: plugins } = useQuery({
 		queryKey: ["plugins"],
 		queryFn: async () => {
-			const { fetchPlugins } = await import("./plugins-qrjvPK4g.js").then((n) => n.a);
+			const { fetchPlugins } = await import("./plugins-BZzztFdK.js").then((n) => n.a);
 			return fetchPlugins();
 		}
 	});
@@ -37016,7 +38215,7 @@ function MarketplaceDetailPage() {
 	const { data: plugins } = useQuery({
 		queryKey: ["plugins"],
 		queryFn: async () => {
-			const { fetchPlugins } = await import("./plugins-qrjvPK4g.js").then((n) => n.a);
+			const { fetchPlugins } = await import("./plugins-BZzztFdK.js").then((n) => n.a);
 			return fetchPlugins();
 		}
 	});
@@ -37100,10 +38299,15 @@ const usersRoute = createRoute({
 	path: "/users",
 	component: UsersPage
 });
+function parseBylinesLocaleSearch(search) {
+	if (typeof search.locale === "string" && search.locale.length > 0) return { locale: search.locale };
+	return { locale: void 0 };
+}
 const bylinesRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
 	path: "/bylines",
-	component: BylinesPage
+	component: BylinesPage,
+	validateSearch: parseBylinesLocaleSearch
 });
 const contentTypesListRoute = createRoute({
 	getParentRoute: () => adminLayoutRoute,
@@ -37488,5 +38692,5 @@ function AdminApp({ pluginAdmins = EMPTY_PLUGINS, authProviders = EMPTY_AUTH_PRO
 }
 
 //#endregion
-export { API_BASE, API_TOKEN_SCOPES, AdminApp, AdminApp as App, AuthProviderProvider, CAPABILITY_LABELS, ContentEditor, ContentList, DEFAULT_LOCALE, Dashboard, EditorHeader, Header, Link, LoginPage, MediaLibrary, MediaPickerModal, PasskeyLogin, PasskeyRegistration, PluginAdminProvider, PortableTextEditor, SUPPORTED_LOCALES, SUPPORTED_LOCALE_CODES, SaveButton, Settings, SetupWizard, Shell, KumoSidebar as Sidebar, SidebarNav, analyzeWpPluginSite, analyzeWxr, apiFetch, bulkCommentAction, checkPluginUpdates, cn, compareRevisions, completeSignup, createAdminRouter, createAllowedDomain, createApiToken, createByline, createCollection, createContent, createField, createMenu, createMenuItem, createMenuTranslation, createRedirect, createSection, createTaxonomy, createTerm, createTermTranslation, createWidget, createWidgetArea, deleteAllowedDomain, deleteByline, deleteCollection, deleteComment, deleteContent, deleteField, deleteFromProvider, deleteMedia, deleteMenu, deleteMenuItem, deletePasskey, deleteRedirect, deleteSection, deleteTerm, deleteWidget, deleteWidgetArea, describeCapability, disablePlugin, disableUser, discardDraft, duplicateContent, enablePlugin, enableUser, executeWpPluginImport, executeWxrImport, fetch404Summary, fetchAllowedDomains, fetchApiTokens, fetchAuthMode, fetchByline, fetchBylines, fetchCollection, fetchCollections, fetchComment, fetchCommentCounts, fetchComments, fetchContent, fetchContentList, fetchDashboardStats, fetchEmailSettings, fetchFields, fetchManifest, fetchMarketplacePlugin, fetchMediaList, fetchMediaProviders, fetchMenu, fetchMenuTranslations, fetchMenus, fetchOrphanedTables, fetchPasskeys, fetchPlugin, fetchPlugins, fetchProviderMedia, fetchRedirects, fetchRevision, fetchRevisions, fetchSection, fetchSections, fetchSettings, fetchTaxonomyDef, fetchTaxonomyDefs, fetchTermTranslations, fetchTerms, fetchTheme, fetchTranslations, fetchTrashedContent, fetchUser, fetchUsers, fetchWidgetArea, fetchWidgetAreas, fetchWidgetComponents, generatePreviewUrl, getDraftStatus, getPreviewUrl, hasAllowedDomains, importWxrMedia, installMarketplacePlugin, inviteUser, parseApiResponse, permanentDeleteContent, prepareWxrImport, probeImportUrl, publishContent, registerOrphanedTable, renamePasskey, reorderFields, reorderMenuItems, reorderWidgets, requestSignup, resolveLocale, restoreContent, restoreRevision, revokeApiToken, rewriteContentUrls, scheduleContent, searchMarketplace, searchThemes, sendRecoveryLink, sendTestEmail, setSearchEnabled, throwResponseError, uninstallMarketplacePlugin, unpublishContent, unscheduleContent, updateAllowedDomain, updateByline, updateCollection, updateCommentStatus, updateContent, updateField, updateMarketplacePlugin, updateMedia, updateMenu, updateMenuItem, updateRedirect, updateSection, updateSettings, updateTerm, updateUser, updateWidget, uploadMedia, uploadToProvider, useAuthProviderList, useAuthProviders, useCurrentUser, useLocale, useNavigate, useParams, usePluginAdmins, usePluginField, usePluginHasPages, usePluginHasWidgets, usePluginPage, usePluginWidget, validateInviteToken, verifySignupToken };
+export { API_BASE, API_TOKEN_SCOPES, AdminApp, AdminApp as App, AuthProviderProvider, CAPABILITY_LABELS, ContentEditor, ContentList, DEFAULT_LOCALE, Dashboard, EditorHeader, Header, Link, LoginPage, MediaLibrary, MediaPickerModal, PasskeyLogin, PasskeyRegistration, PluginAdminProvider, PortableTextEditor, SUPPORTED_LOCALES, SUPPORTED_LOCALE_CODES, SaveButton, Settings, SetupWizard, Shell, KumoSidebar as Sidebar, SidebarNav, analyzeWpPluginSite, analyzeWxr, apiFetch, bulkCommentAction, checkPluginUpdates, cn, compareRevisions, completeSignup, createAdminRouter, createAllowedDomain, createApiToken, createByline, createBylineTranslation, createCollection, createContent, createField, createMenu, createMenuItem, createMenuTranslation, createRedirect, createSection, createTaxonomy, createTerm, createTermTranslation, createWidget, createWidgetArea, deleteAllowedDomain, deleteByline, deleteCollection, deleteComment, deleteContent, deleteField, deleteFromProvider, deleteMedia, deleteMenu, deleteMenuItem, deletePasskey, deleteRedirect, deleteSection, deleteTerm, deleteWidget, deleteWidgetArea, describeCapability, disablePlugin, disableUser, discardDraft, duplicateContent, enablePlugin, enableUser, executeWpPluginImport, executeWxrImport, fetch404Summary, fetchAllowedDomains, fetchApiTokens, fetchAuthMode, fetchByline, fetchBylineTranslations, fetchBylines, fetchCollection, fetchCollections, fetchComment, fetchCommentCounts, fetchComments, fetchContent, fetchContentList, fetchDashboardStats, fetchEmailSettings, fetchFields, fetchManifest, fetchMarketplacePlugin, fetchMediaList, fetchMediaProviders, fetchMenu, fetchMenuTranslations, fetchMenus, fetchOrphanedTables, fetchPasskeys, fetchPlugin, fetchPlugins, fetchProviderMedia, fetchRedirects, fetchRevision, fetchRevisions, fetchSection, fetchSections, fetchSettings, fetchTaxonomyDef, fetchTaxonomyDefs, fetchTermTranslations, fetchTerms, fetchTheme, fetchTranslations, fetchTrashedContent, fetchUser, fetchUsers, fetchWidgetArea, fetchWidgetAreas, fetchWidgetComponents, generatePreviewUrl, getDraftStatus, getPreviewUrl, hasAllowedDomains, importWxrMedia, installMarketplacePlugin, inviteUser, parseApiResponse, permanentDeleteContent, prepareWxrImport, probeImportUrl, publishContent, registerOrphanedTable, renamePasskey, reorderFields, reorderMenuItems, reorderWidgets, requestSignup, resolveLocale, restoreContent, restoreRevision, revokeApiToken, rewriteContentUrls, scheduleContent, searchMarketplace, searchThemes, sendRecoveryLink, sendTestEmail, setSearchEnabled, throwResponseError, uninstallMarketplacePlugin, unpublishContent, unscheduleContent, updateAllowedDomain, updateByline, updateCollection, updateCommentStatus, updateContent, updateField, updateMarketplacePlugin, updateMedia, updateMenu, updateMenuItem, updateRedirect, updateSection, updateSettings, updateTerm, updateUser, updateWidget, uploadMedia, uploadToProvider, useAuthProviderList, useAuthProviders, useCurrentUser, useLocale, useNavigate, useParams, usePluginAdmins, usePluginField, usePluginHasPages, usePluginHasWidgets, usePluginPage, usePluginWidget, validateInviteToken, verifySignupToken };
 //# sourceMappingURL=index.js.map