@emdash-cms/admin 0.15.0 → 0.16.0

package/dist/index.js

@@ -1,5 +1,5 @@
 import { c as fetchAuthMode, d as throwResponseError, i as fetchPlugins, l as fetchManifest, n as enablePlugin, o as API_BASE, r as fetchPlugin, s as apiFetch, t as disablePlugin, u as parseApiResponse } from "./plugins-BZzztFdK.js";
-import { a as SUPPORTED_LOCALES, i as DEFAULT_LOCALE, l as resolveLocale, n as useLocale, o as SUPPORTED_LOCALE_CODES, t as LocaleDirectionProvider } from "./LocaleDirectionProvider-C-w4lOU2.js";
+import { a as SUPPORTED_LOCALES, i as DEFAULT_LOCALE, l as resolveLocale, n as useLocale, o as SUPPORTED_LOCALE_CODES, t as LocaleDirectionProvider } from "./LocaleDirectionProvider-BNEVyvgW.js";
 import "./locales/index.js";
 import { Autocomplete, Badge, Button, Checkbox, CommandPalette, Dialog, Input, InputArea, Label, LinkButton, Loader, Popover, Select, Sidebar as KumoSidebar, Switch, Tabs, Toast, Toasty, Tooltip, buttonVariants, useSidebar } from "@cloudflare/kumo";
 import { i18n } from "@lingui/core";
@@ -39,6 +39,7 @@ import { isAllowedUri } from "@tiptap/extension-link";
 import { BlockRenderer } from "@emdash-cms/blocks";
 import DOMPurify from "dompurify";
 import { Marked, Renderer } from "marked";
+import { checkEnvCompatibility, hostEnvFromVersions } from "@emdash-cms/registry-client/env";
 import { useHotkeys } from "react-hotkeys-hook";
 
 //#region src/components/ThemeProvider.tsx
@@ -7957,19 +7958,17 @@ function PluginBlockModal({ block, initialValues, onClose, onInsert }) {
 			size: dialogSize,
 			children: [/* @__PURE__ */ jsxs("div", {
 				className: "flex items-start justify-between gap-4 mb-4",
-				children: [/* @__PURE__ */ jsxs(Dialog.Title, {
+				children: [/* @__PURE__ */ jsx(Dialog.Title, {
 					className: "text-lg font-semibold leading-none tracking-tight",
-					children: [
-						isEditing ? _t2({
-							id: "ePK91l",
-							message: "Edit"
-						}) : _t2({
-							id: "S8Yqbl",
-							message: "Insert"
-						}),
-						" ",
-						block?.label || ""
-					]
+					children: isEditing ? _t2({
+						id: "N6j2JH",
+						message: "Edit {0}",
+						values: { 0: block?.label || "" }
+					}) : _t2({
+						id: "yQNfsE",
+						message: "Insert {0}",
+						values: { 0: block?.label || "" }
+					})
 				}), /* @__PURE__ */ jsx(Dialog.Close, {
 					"aria-label": _t2({
 						id: "yz7wBu",
@@ -10319,6 +10318,7 @@ function termExactMatches(term, input) {
 * - Checkbox tree for hierarchical taxonomies (categories)
 * - Tag input for flat taxonomies (tags)
 */
+const EMPTY_TERMS = [];
 /**
 * Fetch taxonomy definitions
 */
@@ -10386,11 +10386,13 @@ function CategoryCheckboxTree({ term, level = 0, selectedIds, onToggle }) {
 function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, label }) {
 	const { _: _t } = useLingui();
 	const [input, setInput] = React$1.useState("");
+	const [isOpen, setIsOpen] = React$1.useState(false);
 	const selectedTerms = terms.filter((term) => selectedIds.has(term.id));
 	const trimmedInput = input.trim();
 	const suggestions = React$1.useMemo(() => {
-		if (!trimmedInput) return [];
-		return terms.filter((term) => !selectedIds.has(term.id) && termMatches(term, trimmedInput)).slice(0, 5);
+		const availableTerms = terms.filter((term) => !selectedIds.has(term.id));
+		if (!trimmedInput) return availableTerms.slice(0, 5);
+		return availableTerms.filter((term) => termMatches(term, trimmedInput)).slice(0, 5);
 	}, [
 		trimmedInput,
 		terms,
@@ -10404,11 +10406,18 @@ function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, l
 	const handleSelect = (term) => {
 		onAdd(term.id);
 		setInput("");
+		setIsOpen(false);
 	};
 	const handleCreate = () => {
 		if (!trimmedInput || isCreating) return;
 		onCreate(trimmedInput);
 		setInput("");
+		setIsOpen(false);
+	};
+	const handleBlur = (e) => {
+		const nextFocused = e.relatedTarget;
+		if (nextFocused instanceof Node && e.currentTarget.contains(nextFocused)) return;
+		setIsOpen(false);
 	};
 	const handleKeyDown = (e) => {
 		if (e.key === "Enter") {
@@ -10437,9 +10446,14 @@ function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, l
 			}, term.id))
 		}), /* @__PURE__ */ jsxs("div", {
 			className: "relative",
+			onBlur: handleBlur,
 			children: [/* @__PURE__ */ jsx(Input, {
 				value: input,
-				onChange: (e) => setInput(e.target.value),
+				onChange: (e) => {
+					setInput(e.target.value);
+					setIsOpen(true);
+				},
+				onFocus: () => setIsOpen(true),
 				onKeyDown: handleKeyDown,
 				placeholder: _t({
 					id: "SnJVrE",
@@ -10451,15 +10465,17 @@ function TagInput({ terms, selectedIds, onAdd, onRemove, onCreate, isCreating, l
 					values: { label }
 				}),
 				className: "text-sm"
-			}), (suggestions.length > 0 || showCreateOption) && /* @__PURE__ */ jsxs("div", {
+			}), isOpen && (suggestions.length > 0 || showCreateOption) && /* @__PURE__ */ jsxs("div", {
 				className: "absolute top-full start-0 end-0 mt-1 bg-kumo-overlay border rounded-md shadow-lg z-10",
 				children: [suggestions.map((term) => /* @__PURE__ */ jsx("button", {
 					type: "button",
+					onMouseDown: (e) => e.preventDefault(),
 					onClick: () => handleSelect(term),
 					className: "w-full text-start px-3 py-2 text-sm hover:bg-kumo-tint",
 					children: term.label
 				}, term.id)), showCreateOption && /* @__PURE__ */ jsxs("button", {
 					type: "button",
+					onMouseDown: (e) => e.preventDefault(),
 					onClick: handleCreate,
 					disabled: isCreating,
 					className: "w-full text-start px-3 py-2 text-sm hover:bg-kumo-tint text-kumo-accent flex items-center gap-1 border-t",
@@ -10485,11 +10501,11 @@ function TaxonomySection({ taxonomy, collection, entryId, onChange }) {
 	const toastManager = Toast.useToastManager();
 	const [newCategoryLabel, setNewCategoryLabel] = React$1.useState("");
 	const [showCategoryInput, setShowCategoryInput] = React$1.useState(false);
-	const { data: terms = [] } = useQuery({
+	const { data: terms = EMPTY_TERMS } = useQuery({
 		queryKey: ["taxonomy-terms", taxonomy.name],
 		queryFn: () => fetchTerms$1(taxonomy.name)
 	});
-	const { data: entryTerms = [] } = useQuery({
+	const { data: entryTerms = EMPTY_TERMS } = useQuery({
 		queryKey: [
 			"entry-terms",
 			collection,
@@ -18032,6 +18048,85 @@ function formatInstallCount(count) {
 	return String(count);
 }
 
+//#endregion
+//#region src/lib/markdown.ts
+const HTML_ESCAPE_MAP = {
+	"&": "&",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+};
+const HTML_ESCAPE_RE = /[&<>"']/g;
+function escapeHtml(str) {
+	return str.replace(HTML_ESCAPE_RE, (ch) => HTML_ESCAPE_MAP[ch]);
+}
+const renderer = new Renderer();
+renderer.link = function({ href, tokens }) {
+	const inner = this.parser.parseInline(tokens);
+	if (!SAFE_URL_RE.test(href)) return inner;
+	return `<a href="${escapeHtml(href)}" target="_blank" rel="noopener noreferrer">${inner}</a>`;
+};
+renderer.image = ({ text }) => escapeHtml(text);
+renderer.html = () => "";
+const md = new Marked({
+	renderer,
+	async: false
+});
+/** Allowed tags and attributes for DOMPurify — only standard markdown output. */
+const SANITIZE_CONFIG = {
+	ALLOWED_TAGS: [
+		"h1",
+		"h2",
+		"h3",
+		"h4",
+		"h5",
+		"h6",
+		"p",
+		"a",
+		"ul",
+		"ol",
+		"li",
+		"blockquote",
+		"pre",
+		"code",
+		"em",
+		"strong",
+		"del",
+		"br",
+		"hr",
+		"table",
+		"thead",
+		"tbody",
+		"tr",
+		"th",
+		"td",
+		"details",
+		"summary",
+		"sup",
+		"sub"
+	],
+	ALLOWED_ATTR: [
+		"href",
+		"target",
+		"rel"
+	]
+};
+/**
+* Render untrusted Markdown to a sanitized HTML string safe for
+* `dangerouslySetInnerHTML`.
+*
+* Defense in depth: the `marked` renderer drops raw HTML, drops images, and
+* emits only `https?:` links (escaped, with `rel="noopener noreferrer"`);
+* DOMPurify then re-sanitizes the output against a tag/attribute allowlist
+* (no `script`/`style`/`img`/`iframe`, no inline styles or event handlers).
+*/
+function renderMarkdown(markdown) {
+	const result = md.parse(markdown);
+	const html = typeof result === "string" ? result : "";
+	return DOMPurify.sanitize(html, SANITIZE_CONFIG);
+}
+
 //#endregion
 //#region src/components/CapabilityConsentDialog.tsx
 /**
@@ -18284,6 +18379,77 @@ function releaseExemptFromMinimumAge(exclude, publisherDid, slug) {
 	}
 	return false;
 }
+/**
+* The FAIR-recognised long-form section keys, in display order. Publishers may
+* also ship unrecognised keys (the lexicon's `sections` map is open), but the
+* admin renders only this known set so an aggregator can't inject a section
+* with an attacker-chosen heading; everything else is ignored.
+*/
+const SECTION_ORDER = [
+	"description",
+	"installation",
+	"faq",
+	"changelog",
+	"security"
+];
+/**
+* Select the non-empty long-form sections off a package profile, in
+* `SECTION_ORDER`. `profile.sections` is a lexicon-validated map of Markdown
+* strings (or `null` when the aggregator returned a non-conforming record), so
+* each value is narrowed to a non-whitespace string before inclusion. Empty,
+* missing, whitespace-only, and non-string entries are dropped, so callers can
+* suppress the whole sections UI when the result is empty.
+*/
+function presentSections(profile) {
+	const sections = profile?.sections;
+	if (!sections || typeof sections !== "object") return [];
+	const map = sections;
+	const out = [];
+	for (const key of SECTION_ORDER) {
+		const value = map[key];
+		if (typeof value === "string" && value.trim().length > 0) out.push({
+			key,
+			markdown: value
+		});
+	}
+	return out;
+}
+/**
+* Narrow a release record's `sbom` field to the fields the admin renders.
+* Returns `null` unless the value is an object carrying at least one usable
+* field (`format` or `url`); every field is independently optional per the
+* lexicon. `sbom` is lexicon-validated at the DiscoveryClient boundary, but the
+* record is a publisher pass-through, so its inner shape still needs narrowing.
+*/
+function extractSbom(value) {
+	if (!value || typeof value !== "object") return null;
+	const v = value;
+	const sbom = {};
+	if (typeof v.format === "string" && v.format.length > 0) sbom.format = v.format;
+	if (typeof v.url === "string" && v.url.length > 0) sbom.url = v.url;
+	if (typeof v.checksum === "string") sbom.checksum = v.checksum;
+	if (!sbom.format && !sbom.url) return null;
+	return sbom;
+}
+/**
+* Validate an SBOM document URL for use in a download `href`. Returns the
+* normalised URL only when it is an absolute `http(s)` URL; everything else
+* (relative, `javascript:`, `data:`, non-string) returns `null`. The release
+* record is a remote pass-through, so an unsanitised SBOM `href` would be
+* stored XSS in the authenticated admin origin. The browser fetches the SBOM
+* client-side on click — no server proxy, so SSRF isn't a concern here.
+*/
+function sbomDownloadHref(value) {
+	if (typeof value !== "string" || value.length === 0) return null;
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+	return parsed.href;
+}
 async function searchRegistryPackages(config, opts) {
 	return (await getDiscoveryClient(config)).searchPackages(opts);
 }
@@ -18297,6 +18463,17 @@ async function listRegistryReleases(config, did, slug, opts) {
 	return (await getDiscoveryClient(config)).listReleases(did, slug, opts);
 }
 /**
+* Derive the host environment versions (`env:emdash`, `env:astro`) the running
+* EmDash install advertises, so a release's `requires` constraints can be
+* evaluated client-side before offering install. Reads the already-fetched
+* admin manifest (`version`, `astroVersion`) rather than issuing a second
+* request. The dev-skip / astro-omit rule is shared with the server gate via
+* `hostEnvFromVersions`.
+*/
+function hostEnvFromManifest(manifest) {
+	return hostEnvFromVersions(manifest?.version, manifest?.astroVersion);
+}
+/**
 * Resolve a publisher DID to its claimed handle using the same
 * `LocalActorResolver` pattern as `@emdash-cms/plugin-cli` and
 * `@emdash-cms/auth-atproto`. Bidirectional verification (handle's
@@ -18388,6 +18565,66 @@ async function resolveDidToHandle(did) {
 	writeHandleCache(did, result);
 	return result;
 }
+const ARTIFACT_PROXY_ENDPOINT = `${API_BASE}/admin/plugins/registry/artifact`;
+/**
+* Build the URL of the server-side artifact proxy for an artifact addressed by
+* its `(did, slug, version, kind, index)` coordinates. The browser never sends
+* the publisher's URL — the proxy resolves the *declared* URL from the release
+* record, applies SSRF defences, enforces an image content-type allowlist, and
+* serves the bytes back same-origin.
+*
+* Empty `version` (latest) and `index` (non-screenshot kinds) are omitted.
+*/
+function artifactProxyUrl(coords) {
+	const params = new URLSearchParams();
+	params.set("did", coords.did);
+	params.set("slug", coords.slug);
+	params.set("kind", coords.kind);
+	if (coords.version) params.set("version", coords.version);
+	if (coords.kind === "screenshot" && coords.index !== void 0) params.set("index", String(coords.index));
+	return `${ARTIFACT_PROXY_ENDPOINT}?${params.toString()}`;
+}
+/**
+* Narrow one entry of a release's `artifacts` map to the fields we render.
+* Returns `null` when the value isn't an object carrying a usable `url`
+* (presence gate), keeping only the dimensions for layout.
+*
+* Records are lexicon-validated at the DiscoveryClient boundary, but
+* `artifacts` is an aggregator pass-through, so each entry still needs
+* shape-narrowing.
+*/
+function asMediaArtifact(value) {
+	if (!value || typeof value !== "object") return null;
+	const v = value;
+	if (typeof v.url !== "string" || v.url.length === 0) return null;
+	const artifact = {};
+	if (typeof v.width === "number") artifact.width = v.width;
+	if (typeof v.height === "number") artifact.height = v.height;
+	return artifact;
+}
+/**
+* Pull icon, banner, and the screenshot gallery out of a release's `artifacts`
+* map, keeping presence and dimensions only. The lexicon types `screenshots`
+* as an array of artifacts; entries without a usable `url` are dropped, and
+* gallery order is preserved so screenshot indices line up with the proxy's.
+*/
+function extractMediaArtifacts(artifacts) {
+	const result = { screenshots: [] };
+	if (!artifacts || typeof artifacts !== "object") return result;
+	const map = artifacts;
+	const icon = asMediaArtifact(map.icon);
+	if (icon) result.icon = icon;
+	const banner = asMediaArtifact(map.banner);
+	if (banner) result.banner = banner;
+	if (Array.isArray(map.screenshots)) map.screenshots.forEach((entry, index) => {
+		const artifact = asMediaArtifact(entry);
+		if (artifact) result.screenshots.push({
+			...artifact,
+			index
+		});
+	});
+	return result;
+}
 const INSTALL_ENDPOINT = `${API_BASE}/admin/plugins/registry/install`;
 /**
 * Install a plugin from the registry.
@@ -18895,13 +19132,10 @@ function PluginCard({ plugin, updateInfo, onEnable, onDisable, isToggling, hasMa
 											const label = CAPABILITY_LABELS[c];
 											return label ? _t2(label) : c;
 										}).join(", "),
-										children: [/* @__PURE__ */ jsx(ShieldCheck, { className: "h-3 w-3" }), _t2({
-											id: "gMTYze",
-											message: "{0} permission{1}",
-											values: {
-												0: plugin.capabilities.length,
-												1: plugin.capabilities.length !== 1 ? "s" : ""
-											}
+										children: [/* @__PURE__ */ jsx(ShieldCheck, { className: "h-3 w-3" }), i18n._({
+											id: "dB/Iw4",
+											message: "{0, plural, one {# permission} other {# permissions}}",
+											values: { 0: plugin.capabilities.length }
 										})]
 									})
 								]
@@ -19662,72 +19896,6 @@ function ScreenshotLightbox({ screenshots, index, isBlurred = false, onClose, on
 		]
 	});
 }
-const HTML_ESCAPE_MAP = {
-	"&": "&amp;",
-	"<": "&lt;",
-	">": "&gt;",
-	"\"": "&quot;",
-	"'": "&#39;"
-};
-const HTML_ESCAPE_RE = /[&<>"']/g;
-function escapeHtml(str) {
-	return str.replace(HTML_ESCAPE_RE, (ch) => HTML_ESCAPE_MAP[ch]);
-}
-const renderer = new Renderer();
-renderer.link = ({ href, text }) => {
-	if (!SAFE_URL_RE.test(href)) return escapeHtml(text);
-	return `<a href="${escapeHtml(href)}" target="_blank" rel="noopener noreferrer">${escapeHtml(text)}</a>`;
-};
-renderer.image = ({ text }) => escapeHtml(text);
-renderer.html = () => "";
-const md = new Marked({
-	renderer,
-	async: false
-});
-/** Allowed tags and attributes for DOMPurify — only standard markdown output. */
-const SANITIZE_CONFIG = {
-	ALLOWED_TAGS: [
-		"h1",
-		"h2",
-		"h3",
-		"h4",
-		"h5",
-		"h6",
-		"p",
-		"a",
-		"ul",
-		"ol",
-		"li",
-		"blockquote",
-		"pre",
-		"code",
-		"em",
-		"strong",
-		"del",
-		"br",
-		"hr",
-		"table",
-		"thead",
-		"tbody",
-		"tr",
-		"th",
-		"td",
-		"details",
-		"summary",
-		"sup",
-		"sub"
-	],
-	ALLOWED_ATTR: [
-		"href",
-		"target",
-		"rel"
-	]
-};
-function renderMarkdown(markdown) {
-	const result = md.parse(markdown);
-	const html = typeof result === "string" ? result : "";
-	return DOMPurify.sanitize(html, SANITIZE_CONFIG);
-}
 function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
 	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -23060,6 +23228,11 @@ function RegistryPluginDetail({ pluginId, config }) {
 			return fetchPlugins();
 		}
 	});
+	const { data: manifest } = useQuery({
+		queryKey: ["manifest"],
+		queryFn: fetchManifest
+	});
+	const hostEnv = React$1.useMemo(() => hostEnvFromManifest(manifest), [manifest]);
 	const slashIdx = pluginId.lastIndexOf("/");
 	const publisher = slashIdx > 0 ? pluginId.slice(0, slashIdx) : "";
 	const slug = slashIdx > 0 ? pluginId.slice(slashIdx + 1) : "";
@@ -23134,11 +23307,51 @@ function RegistryPluginDetail({ pluginId, config }) {
 		}] : [];
 	});
 	const repoHref = safeExternalHref(release?.release?.repo);
-	const verified = (pkg?.labels ?? []).some((l) => l.val === "verified");
+	const verifiedLabel = (pkg?.labels ?? []).find((l) => l.val === "verified");
+	const verified = Boolean(verifiedLabel);
+	const verifiedLabeller = typeof verifiedLabel?.src === "string" ? verifiedLabel.src : null;
+	const sections = presentSections(pkgProfile);
+	const [selectedSection, setSelectedSection] = React$1.useState(void 0);
+	const defaultSection = sections[0]?.key;
+	const activeSection = selectedSection && sections.some((s) => s.key === selectedSection) ? selectedSection : defaultSection;
+	const activePane = sections.find((s) => s.key === activeSection);
+	const sbom = extractSbom(release?.release?.sbom);
+	const sbomHref = sbom ? sbomDownloadHref(sbom.url) : null;
+	const lastUpdated = typeof pkgProfile?.lastUpdated === "string" ? pkgProfile.lastUpdated : null;
+	const mediaArtifacts = extractMediaArtifacts(release?.release?.artifacts);
+	const artifactDid = pkg?.did;
+	const artifactVersion = release?.version;
+	const iconSrc = mediaArtifacts.icon && artifactDid ? artifactProxyUrl({
+		did: artifactDid,
+		slug,
+		version: artifactVersion,
+		kind: "icon"
+	}) : null;
+	const bannerSrc = mediaArtifacts.banner && artifactDid ? artifactProxyUrl({
+		did: artifactDid,
+		slug,
+		version: artifactVersion,
+		kind: "banner"
+	}) : null;
+	const screenshots = artifactDid ? mediaArtifacts.screenshots.map((shot) => ({
+		...shot,
+		src: artifactProxyUrl({
+			did: artifactDid,
+			slug,
+			version: artifactVersion,
+			kind: "screenshot",
+			index: shot.index
+		})
+	})) : [];
 	const policyOk = release && pkg ? releasePassesPolicy(release, {
 		did: pkg.did,
 		slug
 	}, config.policy) : true;
+	const envMismatches = React$1.useMemo(() => {
+		if (!release) return [];
+		return checkEnvCompatibility(release.release?.requires, hostEnv);
+	}, [release, hostEnv]);
+	const envOk = envMismatches.length === 0;
 	const installedEntry = React$1.useMemo(() => {
 		if (!pkg || !installedPlugins) return void 0;
 		return installedPlugins.find((p) => p.source === "registry" && p.registryPublisherDid === pkg.did && p.registrySlug === slug);
@@ -23197,14 +23410,33 @@ function RegistryPluginDetail({ pluginId, config }) {
 		className: "space-y-6",
 		children: [
 			/* @__PURE__ */ jsx(BackLink, {}),
+			bannerSrc ? /* @__PURE__ */ jsx("img", {
+				src: bannerSrc,
+				alt: _t({
+					id: "aOmjNp",
+					message: "{0} banner",
+					values: { 0: displayName ?? slug }
+				}),
+				className: "h-40 w-full rounded-xl object-cover",
+				loading: "lazy"
+			}) : null,
 			/* @__PURE__ */ jsxs("div", {
 				className: "flex flex-wrap items-start gap-4",
 				children: [
 					/* @__PURE__ */ jsx("div", {
-						className: "rounded-xl bg-kumo-subtle p-3 text-kumo-subtle",
-						children: /* @__PURE__ */ jsx("span", {
+						className: "overflow-hidden rounded-xl bg-kumo-subtle text-kumo-subtle",
+						children: iconSrc ? /* @__PURE__ */ jsx("img", {
+							src: iconSrc,
+							alt: _t({
+								id: "dVaAiX",
+								message: "{0} icon",
+								values: { 0: displayName ?? slug }
+							}),
+							className: "block h-16 w-16 object-cover",
+							loading: "lazy"
+						}) : /* @__PURE__ */ jsx("span", {
 							"aria-hidden": true,
-							className: "block h-10 w-10"
+							className: "block h-16 w-16"
 						})
 					}),
 					/* @__PURE__ */ jsxs("div", {
@@ -23215,11 +23447,30 @@ function RegistryPluginDetail({ pluginId, config }) {
 								children: [/* @__PURE__ */ jsx("h1", {
 									className: "truncate text-3xl font-bold",
 									children: displayName ?? slug
-								}), verified ? /* @__PURE__ */ jsx(ShieldCheck, {
-									className: "h-5 w-5 shrink-0 text-kumo-brand",
-									"aria-label": _t({
-										id: "70QfpA",
-										message: "Verified publisher"
+								}), verified ? /* @__PURE__ */ jsx(Tooltip, {
+									content: verifiedLabeller ? _t({
+										id: "/rITsG",
+										message: "Verified publisher. A labeller ({verifiedLabeller}) has confirmed this publisher's identity.",
+										values: { verifiedLabeller }
+									}) : _t({
+										id: "PCUvJ4",
+										message: "Verified publisher. A labeller has confirmed this publisher's identity."
+									}),
+									render: /* @__PURE__ */ jsx("button", {
+										type: "button",
+										className: "inline-flex shrink-0 cursor-help rounded-full focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-kumo-brand",
+										"aria-label": verifiedLabeller ? _t({
+											id: "s7Woxs",
+											message: "Verified publisher, confirmed by labeller {verifiedLabeller}",
+											values: { verifiedLabeller }
+										}) : _t({
+											id: "70QfpA",
+											message: "Verified publisher"
+										}),
+										children: /* @__PURE__ */ jsx(ShieldCheck, {
+											className: "h-5 w-5 text-kumo-brand",
+											"aria-hidden": true
+										})
 									})
 								}) : null]
 							}),
@@ -23240,25 +23491,61 @@ function RegistryPluginDetail({ pluginId, config }) {
 							}),
 							release ? /* @__PURE__ */ jsxs("div", {
 								className: "mt-1 flex flex-wrap items-center gap-2",
-								children: [/* @__PURE__ */ jsxs("p", {
-									className: "text-xs text-kumo-subtle",
-									children: [
-										_t({
+								children: [
+									/* @__PURE__ */ jsx("p", {
+										className: "text-xs text-kumo-subtle",
+										children: _t({
 											id: "YYdC3A",
 											message: "Version {0}",
 											values: { 0: release.version }
-										}),
-										" · ",
-										_t({
-											id: "294VT5",
-											message: "indexed {0}",
-											values: { 0: formatDate(release.indexedAt) }
 										})
-									]
-								}), isPreRelease ? /* @__PURE__ */ jsx(Badge, { children: _t({
-									id: "omrja/",
-									message: "Pre-release"
-								}) }) : null]
+									}),
+									isPreRelease ? /* @__PURE__ */ jsx(Badge, { children: _t({
+										id: "omrja/",
+										message: "Pre-release"
+									}) }) : null,
+									sbom?.format ? /* @__PURE__ */ jsx(Badge, { children: _t({
+										id: "mQmHhZ",
+										message: "SBOM · {0}",
+										values: { 0: sbom.format }
+									}) }) : sbom ? /* @__PURE__ */ jsx(Badge, { children: _t({
+										id: "SBWpbn",
+										message: "SBOM"
+									}) }) : null,
+									sbomHref ? /* @__PURE__ */ jsx("a", {
+										href: sbomHref,
+										target: "_blank",
+										rel: "noopener noreferrer",
+										download: true,
+										className: "text-xs text-kumo-brand hover:underline",
+										children: _t({
+											id: "gm9IDy",
+											message: "Download SBOM"
+										})
+									}) : null
+								]
+							}) : null,
+							release ? /* @__PURE__ */ jsxs("dl", {
+								className: "mt-1 flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-kumo-subtle",
+								children: [lastUpdated ? /* @__PURE__ */ jsxs("div", {
+									className: "flex items-center gap-1",
+									children: [/* @__PURE__ */ jsx("dt", {
+										className: "font-medium",
+										children: _t({
+											id: "+b7T3G",
+											message: "Updated"
+										})
+									}), /* @__PURE__ */ jsx("dd", { children: formatDate(lastUpdated) })]
+								}) : null, /* @__PURE__ */ jsxs("div", {
+									className: "flex items-center gap-1",
+									children: [/* @__PURE__ */ jsx("dt", {
+										className: "font-medium",
+										children: _t({
+											id: "I3/r1f",
+											message: "Indexed"
+										})
+									}), /* @__PURE__ */ jsx("dd", { children: formatDate(release.indexedAt) })]
+								})]
 							}) : null
 						]
 					}),
@@ -23312,7 +23599,7 @@ function RegistryPluginDetail({ pluginId, config }) {
 							})
 						}) : /* @__PURE__ */ jsx(Button, {
 							variant: "primary",
-							disabled: !release || !policyOk || handleResult.status === "invalid",
+							disabled: !release || !policyOk || !envOk || handleResult.status === "invalid",
 							onClick: () => setShowConsent(true),
 							children: _t({
 								id: "TKQ7K+",
@@ -23374,10 +23661,66 @@ function RegistryPluginDetail({ pluginId, config }) {
 					})
 				})] })]
 			}) : null,
+			release && !envOk ? /* @__PURE__ */ jsxs("div", {
+				className: "flex items-start gap-3 rounded-md border border-kumo-warning bg-kumo-warning/10 p-4 text-kumo-warning",
+				role: "status",
+				children: [/* @__PURE__ */ jsx(Warning, { className: "mt-0.5 h-5 w-5 shrink-0" }), /* @__PURE__ */ jsxs("div", { children: [
+					/* @__PURE__ */ jsx("p", {
+						className: "font-medium",
+						children: _t({
+							id: "25SzC8",
+							message: "Not compatible with this environment"
+						})
+					}),
+					/* @__PURE__ */ jsx("p", {
+						className: "mt-1 text-sm text-kumo-default",
+						children: _t({
+							id: "RwFsM0",
+							message: "This release requires a newer environment than your site currently runs. Upgrade before installing."
+						})
+					}),
+					/* @__PURE__ */ jsx("ul", {
+						className: "mt-2 space-y-1 text-sm text-kumo-default",
+						children: envMismatches.map((m) => /* @__PURE__ */ jsx("li", { children: _t({
+							id: "XMcEUU",
+							message: "{0} {1} required — you have {2}.",
+							values: {
+								0: envLabel(m.key),
+								1: m.required,
+								2: m.host
+							}
+						}) }, m.key))
+					})
+				] })]
+			}) : null,
 			description ? /* @__PURE__ */ jsx("p", {
 				className: "text-base text-kumo-default",
 				children: description
 			}) : null,
+			screenshots.length > 0 ? /* @__PURE__ */ jsx("section", {
+				"aria-label": _t({
+					id: "lqROaa",
+					message: "Screenshots"
+				}),
+				children: /* @__PURE__ */ jsx("ul", {
+					className: "flex snap-x gap-3 overflow-x-auto pb-2",
+					children: screenshots.map((shot, i) => /* @__PURE__ */ jsx("li", {
+						className: "shrink-0 snap-start",
+						children: /* @__PURE__ */ jsx("img", {
+							src: shot.src,
+							alt: _t({
+								id: "3rcds3",
+								message: "Screenshot {0}",
+								values: { 0: i + 1 }
+							}),
+							width: shot.width,
+							height: shot.height,
+							className: "h-48 w-auto rounded-lg border border-kumo-default object-cover",
+							loading: "lazy"
+						})
+					}, shot.index))
+				})
+			}) : null,
 			licenseText || repoHref || keywordList.length > 0 ? /* @__PURE__ */ jsxs("section", {
 				className: "flex flex-wrap items-center gap-2",
 				children: [
@@ -23460,6 +23803,27 @@ function RegistryPluginDetail({ pluginId, config }) {
 				className: "mt-2 flex flex-wrap gap-2",
 				children: capabilities.map((c) => /* @__PURE__ */ jsx(Badge, { children: c }, c))
 			})] }) : null,
+			sections.length > 0 && activePane ? /* @__PURE__ */ jsxs("section", {
+				"aria-label": _t({
+					id: "TYxt+3",
+					message: "Plugin details"
+				}),
+				children: [sections.length > 1 ? /* @__PURE__ */ jsx(Tabs, {
+					variant: "underline",
+					value: activeSection,
+					onValueChange: (v) => setSelectedSection(v),
+					tabs: sections.map((s) => ({
+						value: s.key,
+						label: _t(SECTION_LABELS[s.key])
+					}))
+				}) : /* @__PURE__ */ jsx("h2", {
+					className: "text-sm font-semibold text-kumo-subtle",
+					children: _t(SECTION_LABELS[activePane.key])
+				}), /* @__PURE__ */ jsx("div", {
+					className: "prose prose-sm mt-4 max-w-none rounded-lg border bg-kumo-base p-6",
+					children: /* @__PURE__ */ jsx("div", { dangerouslySetInnerHTML: { __html: renderMarkdown(activePane.markdown) } })
+				})]
+			}) : null,
 			showConsent && release ? /* @__PURE__ */ jsx(CapabilityConsentDialog, {
 				mode: "install",
 				pluginName: displayName ?? slug,
@@ -23475,6 +23839,28 @@ function RegistryPluginDetail({ pluginId, config }) {
 		]
 	});
 }
+const SECTION_LABELS = {
+	description: {
+		id: "Nu4oKW",
+		message: "Description"
+	},
+	installation: {
+		id: "Xry+oU",
+		message: "Installation"
+	},
+	faq: {
+		id: "/lDBHm",
+		message: "FAQ"
+	},
+	changelog: {
+		id: "CWe7wB",
+		message: "Changelog"
+	},
+	security: {
+		id: "a3LDKx",
+		message: "Security"
+	}
+};
 function BackLink() {
 	const { _: _t2 } = useLingui();
 	return /* @__PURE__ */ jsxs(Link$1, {
@@ -23516,6 +23902,16 @@ const PRE_RELEASE_VERSION_RE = /^\d+\.\d+\.\d+-/;
 function isPreReleaseVersion(version) {
 	return PRE_RELEASE_VERSION_RE.test(version);
 }
+/**
+* Human-readable name for a `requires` env key. The known EmDash environments
+* get their proper product names; anything else falls back to the key with the
+* `env:` prefix stripped (product names, not localised strings).
+*/
+function envLabel(key) {
+	if (key === "env:emdash") return "EmDash";
+	if (key === "env:astro") return "Astro";
+	return key.startsWith("env:") ? key.slice(4) : key;
+}
 const YANKED_LABEL_VALUE = "security:yanked";
 /**
 * Aggregators forward labels applied by their configured labellers. `security:yanked`
@@ -28847,15 +29243,6 @@ function SidebarNav({ manifest }) {
 				border-top: 1px solid rgba(255,255,255,0.08);
 			}
 
-			/* Keep all nav icons visible when sidebar collapses to icon mode */
-			.emdash-sidebar[data-state="collapsed"] [data-sidebar="group-content"] {
-				grid-template-rows: 1fr !important;
-			}
-			/* Mobile drawer: kumo's Sheet has no data-state attribute, so group-content
-			   stays at grid-rows-[0fr] (hidden). Force it open in the mobile sidebar. */
-			.emdash-sidebar[data-mobile="true"] [data-sidebar="group-content"] {
-				grid-template-rows: 1fr !important;
-			}
 			/* Collapsed separators — thin centered line */
 			.emdash-sidebar[data-state="collapsed"] [data-sidebar="separator"] {
 				margin: 0.375rem 0.625rem;
@@ -28939,52 +29326,36 @@ function SidebarNav({ manifest }) {
 					isActive: isItemActive("/", currentPath)
 				}) }) }),
 				/* @__PURE__ */ jsx(KumoSidebar.Separator, {}),
-				visibleContent.length > 1 && /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "4b3oEV",
-							message: "Content"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleContent.filter((i) => i.to !== "/")) }) })]
-				}),
+				visibleContent.length > 1 && /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "4b3oEV",
+						message: "Content"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleContent.filter((i) => i.to !== "/")) })] }),
 				/* @__PURE__ */ jsx(KumoSidebar.Separator, {}),
-				visibleManage.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "wckWOP",
-							message: "Manage"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleManage) }) })]
-				}),
+				visibleManage.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "wckWOP",
+						message: "Manage"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleManage) })] }),
 				/* @__PURE__ */ jsx(KumoSidebar.Separator, {}),
-				visibleAdmin.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "U3pytU",
-							message: "Admin"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleAdmin) }) })]
-				}),
-				visiblePlugins.length > 0 && /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(KumoSidebar.Separator, {}), /* @__PURE__ */ jsxs(KumoSidebar.Group, {
-					collapsible: true,
-					defaultOpen: true,
-					children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
-						className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
-						children: _t({
-							id: "ohUJJM",
-							message: "Plugins"
-						})
-					}), /* @__PURE__ */ jsx(KumoSidebar.GroupContent, { children: /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visiblePlugins) }) })]
-				})] })
+				visibleAdmin.length > 0 && /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "U3pytU",
+						message: "Admin"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visibleAdmin) })] }),
+				visiblePlugins.length > 0 && /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(KumoSidebar.Separator, {}), /* @__PURE__ */ jsxs(KumoSidebar.Group, { children: [/* @__PURE__ */ jsx(KumoSidebar.GroupLabel, {
+					className: "[&>span]:text-start [&_svg]:rtl:-scale-x-100 [&_svg]:rtl:-scale-y-100",
+					children: _t({
+						id: "ohUJJM",
+						message: "Plugins"
+					})
+				}), /* @__PURE__ */ jsx(KumoSidebar.Menu, { children: renderNavItems(visiblePlugins) })] })] })
 			] }),
 			/* @__PURE__ */ jsx(KumoSidebar.Footer, { children: /* @__PURE__ */ jsxs("p", {
 				className: "emdash-nav-label px-3 py-2 text-[11px] text-white/30",
@@ -30222,22 +30593,23 @@ function TermFormDialog({ open, onClose, taxonomyName, taxonomyDef, term, allTer
 						className: "flex items-start justify-between gap-4 mb-4",
 						children: [/* @__PURE__ */ jsxs("div", {
 							className: "flex flex-col space-y-1.5",
-							children: [/* @__PURE__ */ jsxs(Dialog.Title, {
+							children: [/* @__PURE__ */ jsx(Dialog.Title, {
 								className: "text-lg font-semibold leading-none tracking-tight",
-								children: [
-									term ? _t3({
-										id: "ePK91l",
-										message: "Edit"
-									}) : _t3({
-										id: "m16xKo",
-										message: "Add"
-									}),
-									" ",
-									taxonomyDef.labelSingular || _t3({
+								children: term ? _t3({
+									id: "N6j2JH",
+									message: "Edit {0}",
+									values: { 0: taxonomyDef.labelSingular || _t3({
 										id: "k3xOSk",
 										message: "Term"
-									})
-								]
+									}) }
+								}) : _t3({
+									id: "3nLdaX",
+									message: "Add {0}",
+									values: { 0: taxonomyDef.labelSingular || _t3({
+										id: "k3xOSk",
+										message: "Term"
+									}) }
+								})
 							}), /* @__PURE__ */ jsx(Dialog.Description, {
 								className: "text-sm text-kumo-subtle",
 								children: term ? _t3({
@@ -30762,20 +31134,17 @@ function TaxonomyManager({ taxonomyName }) {
 								message: "New Taxonomy"
 							})
 						}),
-						/* @__PURE__ */ jsxs(Button, {
+						/* @__PURE__ */ jsx(Button, {
 							icon: /* @__PURE__ */ jsx(Plus, {}),
 							onClick: () => setFormOpen(true),
-							children: [
-								_t5({
-									id: "m16xKo",
-									message: "Add"
-								}),
-								" ",
-								taxonomyDef.labelSingular || _t5({
+							children: _t5({
+								id: "3nLdaX",
+								message: "Add {0}",
+								values: { 0: taxonomyDef.labelSingular || _t5({
 									id: "k3xOSk",
 									message: "Term"
-								})
-							]
+								}) }
+							})
 						})
 					]
 				})]