emdash 0.11.1 → 0.13.0

package/src/api/openapi/document.ts

@@ -1416,13 +1416,17 @@ const menuPaths = {
 				...standardErrors(400, 404, 500),
 			},
 		},
+	},
+	"/_emdash/api/menus/{name}/items/{id}": {
 		put: {
 			operationId: "updateMenuItem",
 			summary: "Update a menu item",
 			tags: ["Menus"],
 			requestParams: {
-				path: z.object({ name: z.string().meta({ description: "Menu name" }) }),
-				query: z.object({ id: z.string().meta({ description: "Menu item ID" }) }),
+				path: z.object({
+					name: z.string().meta({ description: "Menu name" }),
+					id: z.string().meta({ description: "Menu item id" }),
+				}),
 			},
 			requestBody: { content: { [JSON_CONTENT]: { schema: updateMenuItemBody } } },
 			responses: {
@@ -1439,8 +1443,10 @@ const menuPaths = {
 			summary: "Delete a menu item",
 			tags: ["Menus"],
 			requestParams: {
-				path: z.object({ name: z.string().meta({ description: "Menu name" }) }),
-				query: z.object({ id: z.string().meta({ description: "Menu item ID" }) }),
+				path: z.object({
+					name: z.string().meta({ description: "Menu name" }),
+					id: z.string().meta({ description: "Menu item id" }),
+				}),
 			},
 			responses: {
 				"200": {

package/src/api/schemas/content.ts

@@ -162,6 +162,7 @@ export const contentListResponseSchema = z
 	.object({
 		items: z.array(contentItemSchema),
 		nextCursor: z.string().optional(),
+		total: z.number().int().nonnegative().optional(),
 	})
 	.meta({ id: "ContentListResponse" });
 

package/src/api/schemas/menus.ts

@@ -6,7 +6,11 @@ import { isSafeHref } from "../../utils/url.js";
 // Menus: Input schemas
 // ---------------------------------------------------------------------------
 
-const menuItemType = z.string().min(1);
+/**
+ * Allowed menu item types. `custom` uses `customUrl`; the others resolve a URL
+ * from `referenceCollection` + `referenceId` (a translation_group id).
+ */
+export const menuItemTypeEnum = z.enum(["custom", "page", "post", "taxonomy", "collection"]);
 
 const safeHref = z
 	.string()
@@ -25,17 +29,19 @@ export const createMenuBody = z
 		 * the source's translation_group. */
 		translationOf: z.string().min(1).optional(),
 	})
+	.strict()
 	.meta({ id: "CreateMenuBody" });
 
 export const updateMenuBody = z
 	.object({
 		label: z.string().min(1).optional(),
 	})
+	.strict()
 	.meta({ id: "UpdateMenuBody" });
 
 export const createMenuItemBody = z
 	.object({
-		type: menuItemType,
+		type: menuItemTypeEnum,
 		label: z.string().min(1),
 		referenceCollection: z.string().optional(),
 		referenceId: z.string().optional(),
@@ -46,6 +52,7 @@ export const createMenuItemBody = z
 		parentId: z.string().optional(),
 		sortOrder: z.number().int().min(0).optional(),
 	})
+	.strict()
 	.meta({ id: "CreateMenuItemBody" });
 
 export const updateMenuItemBody = z
@@ -58,16 +65,9 @@ export const updateMenuItemBody = z
 		parentId: z.string().nullish(),
 		sortOrder: z.number().int().min(0).optional(),
 	})
+	.strict()
 	.meta({ id: "UpdateMenuItemBody" });
 
-export const menuItemDeleteQuery = z.object({
-	id: z.string().min(1),
-});
-
-export const menuItemUpdateQuery = z.object({
-	id: z.string().min(1),
-});
-
 export const reorderMenuItemsBody = z
 	.object({
 		items: z.array(
@@ -82,6 +82,10 @@ export const reorderMenuItemsBody = z
 
 // ---------------------------------------------------------------------------
 // Menus: Response schemas
+//
+// All responses are camelCase to align with the rest of the EmDash REST API
+// (content, taxonomies, redirects, etc.). The DB columns are snake_case;
+// handlers hydrate rows into the shapes below before returning.
 // ---------------------------------------------------------------------------
 
 export const menuSchema = z
@@ -89,30 +93,30 @@ export const menuSchema = z
 		id: z.string(),
 		name: z.string(),
 		label: z.string(),
-		created_at: z.string(),
-		updated_at: z.string(),
+		createdAt: z.string(),
+		updatedAt: z.string(),
 		locale: z.string(),
-		translation_group: z.string().nullable(),
+		translationGroup: z.string().nullable(),
 	})
 	.meta({ id: "Menu" });
 
 export const menuItemSchema = z
 	.object({
 		id: z.string(),
-		menu_id: z.string(),
-		parent_id: z.string().nullable(),
-		sort_order: z.number().int(),
+		menuId: z.string(),
+		parentId: z.string().nullable(),
+		sortOrder: z.number().int(),
 		type: z.string(),
-		reference_collection: z.string().nullable(),
-		reference_id: z.string().nullable(),
-		custom_url: z.string().nullable(),
+		referenceCollection: z.string().nullable(),
+		referenceId: z.string().nullable(),
+		customUrl: z.string().nullable(),
 		label: z.string(),
-		title_attr: z.string().nullable(),
+		titleAttr: z.string().nullable(),
 		target: z.string().nullable(),
-		css_classes: z.string().nullable(),
-		created_at: z.string(),
+		cssClasses: z.string().nullable(),
+		createdAt: z.string(),
 		locale: z.string(),
-		translation_group: z.string().nullable(),
+		translationGroup: z.string().nullable(),
 	})
 	.meta({ id: "MenuItem" });
 

package/src/api/schemas/settings.ts

@@ -4,9 +4,14 @@ import { httpUrl } from "./common.js";
 
 // ---------------------------------------------------------------------------
 // Settings: Input schemas
+//
+// Media references on write are just `{ mediaId, alt? }` -- the resolved
+// fields (`url`, `contentType`, `width`, `height`) are server-computed and
+// stripped from any submitted body via Zod's default strip mode. See
+// `packages/core/src/settings/types.ts` for the in-memory shape.
 // ---------------------------------------------------------------------------
 
-const mediaReference = z.object({
+const mediaReferenceInput = z.object({
 	mediaId: z.string(),
 	alt: z.string().optional(),
 });
@@ -20,9 +25,9 @@ const socialSettings = z.object({
 	youtube: z.string().optional(),
 });
 
-const seoSettings = z.object({
+const seoSettingsInput = z.object({
 	titleSeparator: z.string().max(10).optional(),
-	defaultOgImage: mediaReference.optional(),
+	defaultOgImage: mediaReferenceInput.optional(),
 	robotsTxt: z.string().max(5000).optional(),
 	googleVerification: z.string().max(100).optional(),
 	bingVerification: z.string().max(100).optional(),
@@ -32,32 +37,59 @@ export const settingsUpdateBody = z
 	.object({
 		title: z.string().optional(),
 		tagline: z.string().optional(),
-		logo: mediaReference.optional(),
-		favicon: mediaReference.optional(),
+		logo: mediaReferenceInput.optional(),
+		favicon: mediaReferenceInput.optional(),
 		url: z.union([httpUrl, z.literal("")]).optional(),
 		postsPerPage: z.number().int().min(1).max(100).optional(),
 		dateFormat: z.string().optional(),
 		timezone: z.string().optional(),
 		social: socialSettings.optional(),
-		seo: seoSettings.optional(),
+		seo: seoSettingsInput.optional(),
 	})
 	.meta({ id: "SettingsUpdateBody" });
 
 // ---------------------------------------------------------------------------
 // Settings: Response schemas
+//
+// Responses carry the resolved fields populated by `resolveMediaReference`
+// in `settings/index.ts`. Generated OpenAPI clients need to see them so
+// they don't have to re-resolve the URL on the client. Fields stay
+// optional because the resolver returns the bare ref if the underlying
+// media row was deleted (orphaned reference).
 // ---------------------------------------------------------------------------
 
+const mediaReferenceResponse = z.object({
+	mediaId: z.string(),
+	alt: z.string().optional(),
+	/** Resolved media file URL; absent if the underlying row is missing. */
+	url: z.string().optional(),
+	/** Stored MIME type (e.g. `image/svg+xml`). Populated alongside `url`. */
+	contentType: z.string().optional(),
+	/** Pixel width if known. Populated alongside `url`. */
+	width: z.number().int().optional(),
+	/** Pixel height if known. Populated alongside `url`. */
+	height: z.number().int().optional(),
+});
+
+const seoSettingsResponse = z.object({
+	titleSeparator: z.string().max(10).optional(),
+	defaultOgImage: mediaReferenceResponse.optional(),
+	robotsTxt: z.string().max(5000).optional(),
+	googleVerification: z.string().max(100).optional(),
+	bingVerification: z.string().max(100).optional(),
+});
+
 export const siteSettingsSchema = z
 	.object({
 		title: z.string().optional(),
 		tagline: z.string().optional(),
-		logo: mediaReference.optional(),
-		favicon: mediaReference.optional(),
+		logo: mediaReferenceResponse.optional(),
+		favicon: mediaReferenceResponse.optional(),
 		url: z.string().optional(),
 		postsPerPage: z.number().int().optional(),
 		dateFormat: z.string().optional(),
 		timezone: z.string().optional(),
 		social: socialSettings.optional(),
-		seo: seoSettings.optional(),
+		seo: seoSettingsResponse.optional(),
 	})
 	.meta({ id: "SiteSettings" });

package/src/api/types.ts

@@ -10,6 +10,12 @@ import type { ContentItem } from "../database/repositories/types.js";
 export interface ListResponse<T> {
 	items: T[];
 	nextCursor?: string;
+	/**
+	 * Total number of rows matching the filters, ignoring pagination. Used
+	 * by the admin to render a stable pagination denominator. Optional so
+	 * callers that don't surface a row count don't pay for the extra query.
+	 */
+	total?: number;
 }
 
 /**

package/src/astro/integration/index.ts

@@ -181,6 +181,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		auth: resolvedConfig.auth,
 		authProviders: resolvedConfig.authProviders,
 		marketplace: resolvedConfig.marketplace,
+		experimental: resolvedConfig.experimental,
 		siteUrl: resolvedConfig.siteUrl,
 		trustedProxyHeaders: resolvedConfig.trustedProxyHeaders,
 		maxUploadSize: resolvedConfig.maxUploadSize,

package/src/astro/integration/route-naming.ts

@@ -0,0 +1,19 @@
+/**
+ * Compiled route artifact naming -- single source of truth.
+ *
+ * rolldown reserves `[name]`, `[hash]`, `[ext]` (and more) as output-filename
+ * placeholders, so compiled route files cannot keep Astro's literal
+ * `[param]` dynamic-segment filenames -- a path containing `[name]` would be
+ * substituted by the bundler. This function defines the safe artifact form.
+ *
+ * It is imported by BOTH the build (`tsdown.config.ts` `entryFileNames`) and
+ * the route injector (`resolveRoute`, which resolves `emdash/routes/*`).
+ * They must stay in lockstep: change the scheme here and both follow.
+ *
+ * `[` and `]` -> `_` (e.g. `[collection]` -> `_collection_`,
+ * `[...path]` -> `_...path_`). The Astro route URL pattern is set explicitly
+ * at injection time, so the artifact filename never affects routing.
+ */
+export function routeArtifactName(srcRelativePathNoExt: string): string {
+	return srcRelativePathNoExt.replaceAll("[", "_").replaceAll("]", "_");
+}

package/src/astro/integration/routes.ts

@@ -8,6 +8,10 @@ import { createRequire } from "node:module";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { routeArtifactName } from "./route-naming.js";
+
+const TS_EXT = /\.tsx?$/;
+
 /**
  * Resolve path to a route file in the package
  * Uses Node.js APIs - only call at build time
@@ -18,12 +22,19 @@ function resolveRoute(route: string): string {
 	const require = createRequire(import.meta.url);
 	const __dirname = dirname(fileURLToPath(import.meta.url));
 
+	// .astro routes ship as source (the consumer's Astro build processes them);
+	// .ts/.tsx routes are compiled, exported extensionless via emdash/routes/*.
+	const isAstro = route.endsWith(".astro");
+	const specifier = isAstro ? route : routeArtifactName(route.replace(TS_EXT, ""));
+
 	try {
 		// Try to resolve as package export
-		return require.resolve(`emdash/routes/${route}`);
+		return require.resolve(`emdash/routes/${specifier}`);
 	} catch {
-		// Fallback to relative path (for development)
-		return resolve(__dirname, "../routes", route);
+		// Fallback for development (e.g. dist not yet built).
+		return isAstro
+			? resolve(__dirname, "../routes", route)
+			: resolve(__dirname, "../routes", `${specifier}.mjs`);
 	}
 }
 
@@ -365,6 +376,12 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/admin/plugins/marketplace/[id]/install.ts"),
 	});
 
+	// Experimental registry routes (see RFC 0001)
+	injectRoute({
+		pattern: "/_emdash/api/admin/plugins/registry/install",
+		entrypoint: resolveRoute("api/admin/plugins/registry/install.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/admin/plugins/[id]/update",
 		entrypoint: resolveRoute("api/admin/plugins/[id]/update.ts"),
@@ -555,6 +572,11 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/menus/[name]/items.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/menus/[name]/items/[id]",
+		entrypoint: resolveRoute("api/menus/[name]/items/[id].ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/menus/[name]/reorder",
 		entrypoint: resolveRoute("api/menus/[name]/reorder.ts"),

package/src/astro/integration/runtime.ts

@@ -11,8 +11,11 @@ import type { AuthDescriptor, AuthProviderDescriptor } from "../../auth/types.js
 import type { DatabaseDescriptor } from "../../db/adapters.js";
 import type { MediaProviderDescriptor } from "../../media/types.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
+import type { ExperimentalConfig } from "../../registry/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
 
+export type { ExperimentalConfig, RegistryConfig } from "../../registry/types.js";
+
 export type { ResolvedPlugin };
 export type { MediaProviderDescriptor };
 
@@ -264,6 +267,10 @@ export interface EmDashConfig {
 	 * Must be an HTTPS URL in production, or localhost/127.0.0.1 in dev.
 	 * Requires `sandboxRunner` to be configured (marketplace plugins run sandboxed).
 	 *
+	 * When `registry` is also configured, the registry replaces the marketplace
+	 * for the admin UI's browse and install flows. Existing marketplace-installed
+	 * plugins continue to work; new installs and updates come from the registry.
+	 *
 	 * @example
 	 * ```ts
 	 * emdash({
@@ -274,6 +281,28 @@ export interface EmDashConfig {
 	 */
 	marketplace?: string;
 
+	/**
+	 * Experimental features.
+	 *
+	 * These options are not yet stable. Shape, defaults, and behavior may
+	 * change between minor versions. Use only if you're comfortable
+	 * tracking the release notes and updating your config when an
+	 * experimental feature graduates or changes.
+	 *
+	 * @example
+	 * ```ts
+	 * emdash({
+	 *   experimental: {
+	 *     registry: {
+	 *       aggregatorUrl: "https://registry.emdashcms.com",
+	 *     },
+	 *   },
+	 *   sandboxRunner: "@emdash-cms/sandbox-cloudflare",
+	 * })
+	 * ```
+	 */
+	experimental?: ExperimentalConfig;
+
 	/**
 	 * Maximum allowed media file upload size in bytes.
 	 *
@@ -489,12 +518,16 @@ export interface EmDashConfig {
 	};
 }
 
+const STORED_CONFIG_KEY = Symbol.for("emdash:stored-config");
+const configHolder = globalThis as Record<symbol, unknown>;
+
 /**
  * Get stored config from global
  * This is set by the virtual module at build time
  */
 export function getStoredConfig(): EmDashConfig | null {
-	return globalThis.__emdashConfig || null;
+	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- globalThis singleton pattern (see request-context.ts)
+	return (configHolder[STORED_CONFIG_KEY] as EmDashConfig | undefined) ?? null;
 }
 
 /**
@@ -502,11 +535,5 @@ export function getStoredConfig(): EmDashConfig | null {
  * Called by the integration at config time
  */
 export function setStoredConfig(config: EmDashConfig): void {
-	globalThis.__emdashConfig = config;
-}
-
-// Declare global type
-declare global {
-	// eslint-disable-next-line no-var
-	var __emdashConfig: EmDashConfig | undefined;
+	configHolder[STORED_CONFIG_KEY] = config;
 }

package/src/astro/middleware/auth.ts

@@ -302,7 +302,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 		const response = await next();
 		if (!import.meta.env.DEV) {
-			response.headers.set("Content-Security-Policy", buildEmDashCsp());
+			response.headers.set(
+				"Content-Security-Policy",
+				buildEmDashCsp(context.locals.emdash?.config.experimental?.registry),
+			);
 		}
 		return response;
 	}
@@ -311,7 +314,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 	// Set strict CSP on all /_emdash responses (prod only)
 	if (!import.meta.env.DEV) {
-		response.headers.set("Content-Security-Policy", buildEmDashCsp());
+		response.headers.set(
+			"Content-Security-Policy",
+			buildEmDashCsp(context.locals.emdash?.config.experimental?.registry),
+		);
 	}
 
 	return response;

package/src/astro/middleware/csp.ts

@@ -8,14 +8,36 @@
  * img-src allows any HTTPS origin because the admin renders user content that
  * may reference external images (migrations, external hosting, embeds).
  * Plugin security does not rely on img-src -- plugins run in V8 isolates with
- * no DOM access, and connect-src 'self' blocks fetch-based exfiltration.
+ * no DOM access. connect-src stays at 'self' unless the experimental registry
+ * is configured, in which case the configured aggregator origin is allowed.
  */
-export function buildEmDashCsp(): string {
+import type { RegistryConfigInput } from "../../registry/types.js";
+
+function getRegistryAggregatorOrigin(
+	registry: RegistryConfigInput | undefined,
+): string | undefined {
+	const aggregatorUrl = typeof registry === "string" ? registry : registry?.aggregatorUrl;
+	if (!aggregatorUrl) return undefined;
+
+	try {
+		const url = new URL(aggregatorUrl);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return undefined;
+		return url.origin;
+	} catch {
+		return undefined;
+	}
+}
+
+export function buildEmDashCsp(registry?: RegistryConfigInput): string {
+	const connectSrc = ["connect-src 'self'"];
+	const registryAggregatorOrigin = getRegistryAggregatorOrigin(registry);
+	if (registryAggregatorOrigin) connectSrc.push(registryAggregatorOrigin);
+
 	return [
 		"default-src 'self'",
 		"script-src 'self' 'unsafe-inline'",
 		"style-src 'self' 'unsafe-inline'",
-		"connect-src 'self'",
+		connectSrc.join(" "),
 		"form-action 'self'",
 		"frame-ancestors 'none'",
 		"img-src 'self' https: data: blob:",

package/src/astro/middleware.ts

@@ -527,6 +527,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					// Sync marketplace plugin states (after install/update/uninstall)
 					syncMarketplacePlugins: runtime.syncMarketplacePlugins.bind(runtime),
 
+					// Sync registry plugin states (after install/update/uninstall)
+					syncRegistryPlugins: runtime.syncRegistryPlugins.bind(runtime),
+
 					// Update plugin enabled/disabled status and rebuild hook pipeline
 					setPluginStatus: runtime.setPluginStatus.bind(runtime),
 				};

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -32,6 +32,16 @@ export const POST: APIRoute = async ({ params, locals }) => {
 
 	if (!result.success) return unwrapResult(result);
 
+	// If this is a runtime-installed plugin (marketplace or registry),
+	// the sandbox bundle may not be in memory yet -- a sync reloads it
+	// from R2 so the just-enabled plugin can actually run hooks.
+	const source = result.data.item.source;
+	if (source === "registry") {
+		await emdash.syncRegistryPlugins();
+	} else if (source === "marketplace") {
+		await emdash.syncMarketplacePlugins();
+	}
+
 	await emdash.setPluginStatus(id, "active");
 	await setCronTasksEnabled(emdash.db, id, true);
 

package/src/astro/routes/api/admin/plugins/registry/install.ts

@@ -0,0 +1,107 @@
+/**
+ * Registry plugin install endpoint
+ *
+ * POST /_emdash/api/admin/plugins/registry/install
+ *
+ * Installs a plugin from the experimental decentralized plugin registry
+ * (see RFC 0001). The browser resolves `(handle, slug) → (did, slug)`
+ * via the aggregator before posting and sends the publisher DID
+ * directly; the server skips the resolvePackage round-trip and looks
+ * up the package by DID. Sending DID rather than handle means installs
+ * work for publishers whose handle the aggregator couldn't resolve at
+ * view time (handle is best-effort per the lexicon).
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleRegistryInstall } from "#api/index.js";
+import { isParseError, parseBody } from "#api/parse.js";
+
+export const prerender = false;
+
+const installBodySchema = z.object({
+	/**
+	 * Publisher DID. Required. Browser is expected to resolve
+	 * `(handle, slug) → did` against the aggregator before posting.
+	 */
+	did: z
+		.string()
+		.min(1)
+		.max(2048)
+		// Loose match -- atproto DID specs allow `did:plc:*` and
+		// `did:web:*` plus future methods. Reject anything that
+		// doesn't even start with `did:` rather than enumerating
+		// methods here; downstream lexicon validation tightens.
+		.regex(/^did:[a-z]+:/, "Invalid DID"),
+	/** Package slug. */
+	slug: z
+		.string()
+		.min(1)
+		.max(64)
+		// Mirrors the lexicon's slug grammar: ASCII letter followed by
+		// letters / digits / `-` / `_`. Rejects anything that could
+		// confuse the R2 prefix or the URL.
+		.regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Invalid slug"),
+	/** Optional explicit version. Defaults to the aggregator's latest. */
+	version: z.string().min(1).max(64).optional(),
+	/**
+	 * Capabilities the admin acknowledged in the consent dialog, lifted
+	 * from the release record's declaredAccess block at browse time.
+	 * Compared against the bundle's manifest to detect drift between the
+	 * dialog and the install POST.
+	 */
+	acknowledgedDeclaredAccess: z.unknown().optional(),
+});
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	try {
+		const { emdash, user } = locals;
+
+		if (!emdash?.db) {
+			return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+		}
+
+		const denied = requirePerm(user, "plugins:manage");
+		if (denied) return denied;
+
+		const body = await parseBody(request, installBodySchema);
+		if (isParseError(body)) return body;
+
+		// Block registry installs whose derived `pluginId` collides with
+		// any build-time-reserved id: configured (in-process) plugins, and
+		// sandboxed plugins declared in `config.sandboxed`. The runtime
+		// caches sandboxed plugins by id; a registry install at the same
+		// id would silently shadow or coexist with the build-time entry.
+		const reservedPluginIds = new Set<string>([
+			...emdash.configuredPlugins.map((p: { id: string }) => p.id),
+			...(emdash.config.sandboxed ?? []).map((p: { id: string }) => p.id),
+		]);
+
+		const result = await handleRegistryInstall(
+			emdash.db,
+			emdash.storage,
+			emdash.getSandboxRunner(),
+			emdash.config.experimental?.registry,
+			{
+				did: body.did,
+				slug: body.slug,
+				version: body.version,
+				acknowledgedDeclaredAccess: body.acknowledgedDeclaredAccess,
+			},
+			{ configuredPluginIds: reservedPluginIds },
+		);
+
+		if (!result.success) return unwrapResult(result);
+
+		// Sync runtime so the new plugin becomes active without a worker restart.
+		await emdash.syncRegistryPlugins();
+
+		return unwrapResult(result, 201);
+	} catch (error) {
+		console.error("[registry-install] Unhandled error:", error);
+		return handleError(error, "Failed to install plugin from registry", "INSTALL_FAILED");
+	}
+};

package/src/astro/routes/api/auth/invite/register-options.ts

@@ -17,6 +17,7 @@ import { ulid } from "ulidx";
 
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
+import { getPublicOrigin } from "#api/public-url.js";
 import { inviteRegisterOptionsBody } from "#api/schemas.js";
 import { createChallengeStore } from "#auth/challenge-store.js";
 import { getPasskeyConfig } from "#auth/passkey-config.js";
@@ -38,10 +39,16 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const invite = await validateInvite(adapter, body.token);
 
 		// Get passkey config
+		// Resolve siteUrl from config / EMDASH_SITE_URL so the RP ID matches the
+		// browser-facing origin when running behind a TLS-terminating reverse proxy
+		// (e.g. Traefik, nginx). Without this, getPasskeyConfig falls back to
+		// url.hostname — the internal hostname like "localhost" — and the browser
+		// rejects the WebAuthn registration. See issue #994.
 		const url = new URL(request.url);
 		const options = new OptionsRepository(emdash.db);
 		const siteName = (await options.get<string>("emdash:site_title")) ?? undefined;
-		const passkeyConfig = getPasskeyConfig(url, siteName);
+		const siteUrl = getPublicOrigin(url, emdash?.config);
+		const passkeyConfig = getPasskeyConfig(url, siteName, siteUrl);
 
 		// Generate registration options with a temporary user identity
 		const challengeStore = createChallengeStore(emdash.db);