emdash 0.13.0 → 0.15.0

package/dist/{api-ayIQ7rIe.mjs → api-CLwG_3dh.mjs}

@@ -1,27 +1,28 @@
 import { r as validatePluginIdentifier, t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { r as isI18nEnabled } from "./config-CVssduLe.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "./content-D6YG26WG.mjs";
+import { n as getI18nConfig, r as isI18nEnabled } from "./config-CVssduLe.mjs";
+import { r as RevisionRepository, t as ContentRepository } from "./content-C0ooIs-f.mjs";
 import { r as encodeBase64, t as decodeBase64 } from "./base64-CqR-7kqF.mjs";
-import { n as InvalidCursorError, t as EmDashValidationError } from "./types-CwXMEPRr.mjs";
-import { t as MediaRepository } from "./media-Dg7he9uK.mjs";
-import { t as CommentRepository } from "./comment-Dd9MI82-.mjs";
+import { n as InvalidCursorError, t as EmDashValidationError } from "./types-ByV5sgsv.mjs";
+import { t as MediaRepository } from "./media-oqRcNiQf.mjs";
+import { t as CommentRepository } from "./comment-_yzlBYPx.mjs";
 import { t as withTransaction } from "./transaction-NQj4VJ7Z.mjs";
-import { t as RedirectRepository } from "./redirect-DkaDxq8e.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-DyGtu1Bv.mjs";
-import { t as BylineRepository } from "./byline-D09BaS4j.mjs";
-import { t as SeoRepository } from "./seo-DRq9-EPP.mjs";
-import { r as invalidateRedirectCache } from "./cache-CXCpjWiL.mjs";
+import { t as RedirectRepository } from "./redirect-CNv4mHX2.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-BkfVdD-3.mjs";
+import { t as BylineRepository } from "./byline-CTaWkMh5.mjs";
+import { t as SeoRepository } from "./seo-bjDoq9Eg.mjs";
+import { r as invalidateRedirectCache } from "./cache-CNk1jIxp.mjs";
 import { t as isMissingTableError } from "./db-errors-CGN9kJfo.mjs";
 import { r as parseAllowedMimeTypes, t as matchesMimeAllowlist } from "./mime-KV5TqkMN.mjs";
 import { n as requestCached } from "./request-cache-dzCt8TZB.mjs";
 import { n as hashString } from "./hash-DlUxGhQS.mjs";
-import { n as SchemaRegistry, t as SchemaError } from "./registry-BnCeHYsf.mjs";
-import { i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-HCtSh4Jq.mjs";
-import { r as normalizeCapabilities } from "./types-Db67HHlU.mjs";
-import { t as EmDashStorageError } from "./types-Dz9CGX_d.mjs";
-import { n as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-DzFN_qV-.mjs";
+import { n as SchemaRegistry, t as SchemaError } from "./registry-DqrAQDXH.mjs";
+import { i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-Czqf0TLu.mjs";
+import { r as normalizeCapabilities } from "./types-1NNkmTIn.mjs";
+import { t as EmDashStorageError } from "./types-Cd9UCu3t.mjs";
+import { n as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-MZ-zrG6-.mjs";
 import { sql } from "kysely";
 import { createGzipDecoder, unpackTar } from "modern-tar";
+import { ClientResponseError, ClientValidationError } from "@atcute/client";
 
 //#region src/api/rev.ts
 /**
@@ -195,7 +196,8 @@ async function hydrateSeoMany(db, collection, items, hasSeo) {
 }
 async function hydrateBylines(db, collection, item) {
 	const bylineRepo = new BylineRepository(db);
-	const bylines = await bylineRepo.getContentBylines(collection, item.id);
+	const localeOpt = item.locale ? { locale: item.locale } : void 0;
+	const bylines = await bylineRepo.getContentBylines(collection, item.id, localeOpt);
 	if (bylines.length > 0) {
 		item.bylines = bylines.map((c) => ({
 			...c,
@@ -204,9 +206,13 @@ async function hydrateBylines(db, collection, item) {
 		item.byline = bylines[0]?.byline ?? null;
 		return;
 	}
-	if (item.primaryBylineId) item.primaryBylineId = null;
+	if (item.primaryBylineId) {
+		item.bylines = [];
+		item.byline = null;
+		return;
+	}
 	if (item.authorId) {
-		const fallback = await bylineRepo.findByUserId(item.authorId);
+		const fallback = await bylineRepo.findByUserId(item.authorId, localeOpt);
 		if (fallback) {
 			item.bylines = [{
 				byline: fallback,
@@ -223,18 +229,59 @@ async function hydrateBylines(db, collection, item) {
 }
 /**
 * Batch-hydrate bylines for multiple items using two bulk queries instead of N+1.
+*
+* Items may live at different locales (e.g. a list endpoint returning the
+* translations of an entry). Group by `item.locale` and call the strict
+* per-locale repo method once per group so each item resolves against its
+* own locale's byline rows.
 */
 async function hydrateBylinesMany(db, collection, items) {
 	if (items.length === 0) return;
 	const bylineRepo = new BylineRepository(db);
-	const contentIds = items.map((i) => i.id);
-	const bylinesMap = await bylineRepo.getContentBylinesMany(collection, contentIds);
-	const fallbackAuthorIds = [];
-	for (const item of items) if (!bylinesMap.has(item.id) && item.authorId) fallbackAuthorIds.push(item.authorId);
-	const uniqueAuthorIds = [...new Set(fallbackAuthorIds)];
-	const authorBylineMap = await bylineRepo.findByUserIds(uniqueAuthorIds);
+	const localeBuckets = /* @__PURE__ */ new Map();
 	for (const item of items) {
-		const explicit = bylinesMap.get(item.id);
+		const key = item.locale ?? null;
+		const bucket = localeBuckets.get(key);
+		if (bucket) bucket.push(item);
+		else localeBuckets.set(key, [item]);
+	}
+	const bylinesByItem = /* @__PURE__ */ new Map();
+	const itemsNeedingAuthorCheck = [];
+	for (const [locale, bucket] of localeBuckets) {
+		const localeOpt = locale ? { locale } : void 0;
+		const ids = bucket.map((i) => i.id);
+		const credits = await bylineRepo.getContentBylinesMany(collection, ids, localeOpt);
+		for (const [id, list] of credits) bylinesByItem.set(id, list);
+		for (const item of bucket) {
+			if (credits.has(item.id) && credits.get(item.id).length > 0) continue;
+			if (item.authorId) itemsNeedingAuthorCheck.push(item);
+		}
+	}
+	const fallbackByItem = /* @__PURE__ */ new Map();
+	if (itemsNeedingAuthorCheck.length > 0) {
+		const authorBuckets = /* @__PURE__ */ new Map();
+		for (const item of itemsNeedingAuthorCheck) {
+			if (item.primaryBylineId) continue;
+			const key = item.locale ?? null;
+			const bucket = authorBuckets.get(key);
+			if (bucket) bucket.push(item);
+			else authorBuckets.set(key, [item]);
+		}
+		for (const [locale, bucket] of authorBuckets) {
+			const localeOpt = locale ? { locale } : void 0;
+			const authorIds = bucket.map((i) => i.authorId).filter((id) => id !== null);
+			const uniqueAuthorIds = [...new Set(authorIds)];
+			if (uniqueAuthorIds.length === 0) continue;
+			const authorMap = await bylineRepo.findByUserIds(uniqueAuthorIds, localeOpt);
+			for (const item of bucket) {
+				if (!item.authorId) continue;
+				const f = authorMap.get(item.authorId);
+				if (f) fallbackByItem.set(item.id, f);
+			}
+		}
+	}
+	for (const item of items) {
+		const explicit = bylinesByItem.get(item.id);
 		if (explicit && explicit.length > 0) {
 			item.bylines = explicit.map((c) => ({
 				...c,
@@ -243,19 +290,16 @@ async function hydrateBylinesMany(db, collection, items) {
 			item.byline = explicit[0]?.byline ?? null;
 			continue;
 		}
-		if (item.primaryBylineId) item.primaryBylineId = null;
-		if (item.authorId) {
-			const fallback = authorBylineMap.get(item.authorId);
-			if (fallback) {
-				item.bylines = [{
-					byline: fallback,
-					sortOrder: 0,
-					roleLabel: null,
-					source: "inferred"
-				}];
-				item.byline = fallback;
-				continue;
-			}
+		const fallback = fallbackByItem.get(item.id);
+		if (fallback) {
+			item.bylines = [{
+				byline: fallback,
+				sortOrder: 0,
+				roleLabel: null,
+				source: "inferred"
+			}];
+			item.byline = fallback;
+			continue;
 		}
 		item.bylines = [];
 		item.byline = null;
@@ -426,10 +470,11 @@ async function handleContentCreate(db, collection, body) {
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
 			const bylineRepo = new BylineRepository(trx);
+			const effectiveLocale = body.locale ?? getI18nConfig()?.defaultLocale;
 			let slug = body.slug;
 			if (!slug) {
 				const slugSource = getSlugSource(body.data);
-				if (slugSource) slug = await repo.generateUniqueSlug(collection, slugSource, body.locale);
+				if (slugSource) slug = await repo.generateUniqueSlug(collection, slugSource, effectiveLocale);
 			}
 			const created = await repo.create({
 				type: collection,
@@ -437,20 +482,22 @@ async function handleContentCreate(db, collection, body) {
 				data: body.data,
 				status: body.status || "draft",
 				authorId: body.authorId,
-				locale: body.locale,
+				locale: effectiveLocale,
 				translationOf: body.translationOf,
 				createdAt: body.createdAt,
 				publishedAt: body.publishedAt
 			});
-			if (body.bylines !== void 0) {
-				await bylineRepo.setContentBylines(collection, created.id, body.bylines);
-				created.primaryBylineId = body.bylines[0]?.bylineId ?? null;
-			}
-			await hydrateBylines(trx, collection, created);
+			if (body.bylines !== void 0) created.primaryBylineId = (await bylineRepo.setContentBylines(collection, created.id, body.bylines))[0]?.byline.translationGroup ?? null;
 			if (body.translationOf) {
-				const { TaxonomyRepository } = await import("./taxonomy-wPfusMK9.mjs").then((n) => n.n);
+				const { TaxonomyRepository } = await import("./taxonomy-D4Uc2LsZ.mjs").then((n) => n.n);
 				await new TaxonomyRepository(trx).copyEntryTerms(collection, body.translationOf, created.id);
+				if (body.bylines === void 0) {
+					await bylineRepo.copyContentBylines(collection, body.translationOf, created.id);
+					const source = await repo.findById(collection, body.translationOf);
+					if (source) created.primaryBylineId = source.primaryBylineId;
+				}
 			}
+			await hydrateBylines(trx, collection, created);
 			if (body.seo && hasSeo) created.seo = await new SeoRepository(trx).upsert(collection, created.id, body.seo);
 			else if (hasSeo) created.seo = { ...SEO_DEFAULTS };
 			return created;
@@ -544,10 +591,7 @@ async function handleContentUpdate(db, collection, id, body) {
 				authorId: body.authorId,
 				publishedAt: body.publishedAt
 			});
-			if (body.bylines !== void 0) {
-				await bylineRepo.setContentBylines(collection, resolvedId, body.bylines);
-				updated.primaryBylineId = body.bylines[0]?.bylineId ?? null;
-			}
+			if (body.bylines !== void 0) updated.primaryBylineId = (await bylineRepo.setContentBylines(collection, resolvedId, body.bylines))[0]?.byline.translationGroup ?? null;
 			if (oldSlug && body.slug) {
 				const collectionRow = await trx.selectFrom("_emdash_collections").select("url_pattern").where("slug", "=", collection).executeTakeFirst();
 				await new RedirectRepository(trx).createAutoRedirect(collection, oldSlug, body.slug, resolvedId, collectionRow?.url_pattern ?? null);
@@ -2583,7 +2627,7 @@ async function handleMarketplaceInstall(db, storage, sandboxRunner, marketplaceU
 			message: "Storage is required for marketplace plugin installation"
 		}
 	};
-	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+	if (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) return {
 		success: false,
 		error: {
 			code: "SANDBOX_NOT_AVAILABLE",
@@ -2715,7 +2759,7 @@ async function handleMarketplaceUpdate(db, storage, sandboxRunner, marketplaceUr
 			message: "Storage is required"
 		}
 	};
-	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+	if (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) return {
 		success: false,
 		error: {
 			code: "SANDBOX_NOT_AVAILABLE",
@@ -3336,6 +3380,45 @@ async function makeRegistryPluginId(publisherDid, slug) {
 
 //#endregion
 //#region src/api/handlers/registry.ts
+/**
+* Registry plugin install handler.
+*
+* Installs a plugin published to the experimental decentralized plugin
+* registry described in RFC 0001. The install flow:
+*
+*   1. Resolve `(handle, slug)` to a publisher DID via the configured
+*      aggregator's `resolvePackage` XRPC.
+*   2. Look up the requested release (or the policy-filtered latest one)
+*      via `getLatestRelease` / `listReleases`.
+*   3. Reject the install if the aggregator surfaces a `security:yanked`
+*      hard-enforcement label or the release is below the configured
+*      minimum release age.
+*   4. Fetch the bundle artifact, walking aggregator mirrors first and
+*      falling back to the publisher-declared URL.
+*   5. Verify the artifact's multibase checksum against the signed
+*      release record's `artifacts.package.checksum`.
+*   6. Extract `manifest.json` + `backend.js` + optional `admin.js` from
+*      the gzipped tar bundle.
+*   7. Store the extracted files in site-local R2 under the
+*      `registry/<plugin-id>/<version>/` prefix.
+*   8. Write a `plugin_states` row with `source = "registry"` and the
+*      `(publisher_did, slug)` pair so updates can be resolved later.
+*   9. Sync the runtime so the plugin becomes active immediately.
+*
+* Known gaps (tracked separately):
+*
+*   - The aggregator-supplied records are not yet cryptographically
+*     verified against the publisher's MST signature. The signed bytes
+*     and CIDs are passed through verbatim per the lexicon, but full
+*     PDS-direct verification with proof traversal is follow-up work.
+*     The artifact checksum is verified end-to-end against the value
+*     in the (aggregator-relayed) release record, which is the actual
+*     trust boundary for the bytes that end up in the sandbox.
+*   - `acceptLabelers` is forwarded as-is to the aggregator; this
+*     handler does not independently re-fetch and verify labels from
+*     each labeller's DID. Aggregator label envelope tampering is
+*     mitigated by the artifact checksum but not detected.
+*/
 /** Matches a bare 64-character lowercase/uppercase hex SHA-256 digest. */
 const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/i;
 /** Compute the SHA-256 of `bytes` as a lowercase hex string. */
@@ -3530,7 +3613,7 @@ async function assertSafeArtifactUrl(urlString) {
 	try {
 		return await resolveAndValidateExternalUrl(url.href);
 	} catch (err) {
-		if (err instanceof SsrfError) throw new Error(`Artifact URL rejected: ${err.message}`);
+		if (err instanceof SsrfError) throw new Error(`Artifact URL rejected: ${err.message}`, { cause: err });
 		throw err;
 	}
 }
@@ -3817,8 +3900,8 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 			};
 		}
 		const release = releaseView.release;
-		const declaredUrl = release.artifacts?.package?.url;
-		const declaredChecksum = release.artifacts?.package?.checksum;
+		const declaredUrl = release?.artifacts?.package?.url;
+		const declaredChecksum = release?.artifacts?.package?.checksum;
 		if (!declaredUrl || !declaredChecksum) return {
 			success: false,
 			error: {
@@ -3887,8 +3970,8 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 		try {
 			await stateRepo.upsert(pluginId, version, "active", {
 				source: "registry",
-				displayName: profile.name ?? slug,
-				description: profile.description ?? void 0,
+				displayName: profile?.name ?? slug,
+				description: profile?.description ?? void 0,
 				registryPublisherDid: publisherDid,
 				registrySlug: slug
 			});
@@ -3918,6 +4001,20 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 			}
 		};
 	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) return {
+			success: false,
+			error: {
+				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+				message: `Aggregator returned ${err.status}: ${err.error}`
+			}
+		};
 		if (err instanceof EmDashStorageError) return {
 			success: false,
 			error: {
@@ -3935,7 +4032,374 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 		};
 	}
 }
+/**
+* Uninstall a registry-source plugin. Deletes the R2 bundle under
+* `registry/<pluginId>/<version>/`, optionally drops the plugin's
+* `_plugin_storage` rows, and removes the `_plugin_state` row. The
+* sandbox runtime is reconciled by the route's `syncRegistryPlugins`
+* call after this returns.
+*
+* Refuses to uninstall plugins whose `source` is not `"registry"` to
+* avoid trashing a marketplace/config plugin that happens to share the
+* pluginId namespace.
+*/
+async function handleRegistryUninstall(db, storage, pluginId, opts) {
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "registry") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No registry plugin found: ${pluginId}`
+			}
+		};
+		const version = existing.version;
+		let dataDeleted = false;
+		if (opts?.deleteData) {
+			await db.deleteFrom("_plugin_storage").where("plugin_id", "=", pluginId).execute();
+			dataDeleted = true;
+		}
+		if (storage) await deleteBundleFromR2(storage, pluginId, version, "registry");
+		await stateRepo.delete(pluginId);
+		return {
+			success: true,
+			data: {
+				pluginId,
+				dataDeleted
+			}
+		};
+	} catch (err) {
+		console.error("[registry-uninstall] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UNINSTALL_FAILED",
+				message: "Failed to uninstall plugin"
+			}
+		};
+	}
+}
+/**
+* Update a registry-source plugin to a newer release. Mirrors
+* `handleMarketplaceUpdate`: resolves the target version via the aggregator,
+* re-runs the artifact fetch / checksum / extract pipeline, diffs capabilities
+* and route visibility against the currently installed bundle, and gates
+* escalations behind `confirmCapabilityChanges` / `confirmRouteVisibilityChanges`
+* so the admin re-consents to widened permissions.
+*
+* Refuses non-registry sources. Refuses when the stored state row is missing
+* the `(publisherDid, slug)` it needs to resolve against the aggregator.
+*/
+async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigInput, pluginId, opts) {
+	const registryConfig = coerceRegistryConfig(registryConfigInput);
+	if (!registryConfig) return {
+		success: false,
+		error: {
+			code: "REGISTRY_NOT_CONFIGURED",
+			message: "Registry is not configured"
+		}
+	};
+	if (!storage) return {
+		success: false,
+		error: {
+			code: "STORAGE_NOT_CONFIGURED",
+			message: "Storage is required for registry plugin updates"
+		}
+	};
+	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+		success: false,
+		error: {
+			code: "SANDBOX_NOT_AVAILABLE",
+			message: "Sandbox runner is required"
+		}
+	};
+	try {
+		validateAggregatorUrl(registryConfig.aggregatorUrl);
+	} catch (err) {
+		return {
+			success: false,
+			error: {
+				code: "REGISTRY_NOT_CONFIGURED",
+				message: err instanceof Error ? err.message : "Invalid aggregator URL"
+			}
+		};
+	}
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "registry") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No registry plugin found: ${pluginId}`
+			}
+		};
+		if (!existing.registryPublisherDid || !existing.registrySlug) return {
+			success: false,
+			error: {
+				code: "INVALID_STATE",
+				message: `Registry plugin ${pluginId} is missing publisher DID or slug in state`
+			}
+		};
+		const oldVersion = existing.version;
+		const publisherDid = existing.registryPublisherDid;
+		const slug = existing.registrySlug;
+		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
+		const discovery = new DiscoveryClient({
+			aggregatorUrl: registryConfig.aggregatorUrl,
+			acceptLabelers: registryConfig.acceptLabelers,
+			fetch: timedFetch(aggregatorDeadline)
+		});
+		const MAX_LIST_PAGES = 20;
+		const releaseView = await (async () => {
+			if (!opts?.version) return discovery.getLatestRelease({
+				did: publisherDid,
+				package: slug
+			});
+			let cursor;
+			const seenCursors = /* @__PURE__ */ new Set();
+			for (let page = 0; page < MAX_LIST_PAGES; page++) {
+				if (cursor !== void 0) {
+					if (seenCursors.has(cursor)) break;
+					seenCursors.add(cursor);
+				}
+				const result = await discovery.listReleases({
+					did: publisherDid,
+					package: slug,
+					cursor,
+					limit: 50
+				});
+				for (const r of result.releases) if (r.version === opts.version) return r;
+				if (!result.cursor) break;
+				cursor = result.cursor;
+			}
+		})();
+		if (!releaseView) return {
+			success: false,
+			error: {
+				code: "NO_VERSION",
+				message: opts?.version ? `Version ${opts.version} not found for ${publisherDid}/${slug}` : `No installable release found for ${publisherDid}/${slug}`
+			}
+		};
+		const signedRelease = releaseView.release;
+		if (releaseView.did !== publisherDid || releaseView.package !== slug || signedRelease?.package !== slug || opts?.version !== void 0 && releaseView.version !== opts.version || signedRelease?.version !== releaseView.version) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_IDENTITY_MISMATCH",
+				message: "Aggregator returned a release view that does not match the requested package or version."
+			}
+		};
+		const newVersion = releaseView.version;
+		if (newVersion === oldVersion) return {
+			success: false,
+			error: {
+				code: "ALREADY_UP_TO_DATE",
+				message: "Plugin is already at the requested version"
+			}
+		};
+		if ((releaseView.labels ?? []).some((l) => l.val === "security:yanked")) return {
+			success: false,
+			error: {
+				code: "YANKED",
+				message: "Release has been yanked by a trusted labeller"
+			}
+		};
+		const declaredUrl = signedRelease.artifacts?.package?.url;
+		const declaredChecksum = signedRelease.artifacts?.package?.checksum;
+		if (!declaredUrl || !declaredChecksum) return {
+			success: false,
+			error: {
+				code: "INVALID_RELEASE",
+				message: "Release record is missing artifact url or checksum"
+			}
+		};
+		await assertSafeArtifactUrl(declaredUrl);
+		const mirrors = (releaseView.mirrors ?? []).slice(0, MAX_MIRRORS);
+		for (const mirror of mirrors) await assertSafeArtifactUrl(mirror);
+		const artifactBytes = await fetchArtifact(mirrors, declaredUrl);
+		if (!await verifyChecksum(artifactBytes, declaredChecksum)) return {
+			success: false,
+			error: {
+				code: "CHECKSUM_MISMATCH",
+				message: "Artifact bytes do not match the release's published checksum"
+			}
+		};
+		const bundle = await extractBundle(artifactBytes);
+		if (bundle.manifest.version !== newVersion) return {
+			success: false,
+			error: {
+				code: "BUNDLE_VERSION_MISMATCH",
+				message: `Bundle manifest version (${bundle.manifest.version}) does not match release version (${newVersion})`
+			}
+		};
+		if (bundle.manifest.id !== slug) return {
+			success: false,
+			error: {
+				code: "BUNDLE_IDENTITY_MISMATCH",
+				message: `Bundle manifest id (${bundle.manifest.id}) does not match registry slug (${slug})`
+			}
+		};
+		bundle.manifest = {
+			...bundle.manifest,
+			id: pluginId
+		};
+		const oldBundle = await loadBundleFromR2(storage, pluginId, oldVersion, "registry");
+		const capabilityChanges = diffCapabilities(oldBundle?.manifest.capabilities ?? [], bundle.manifest.capabilities);
+		if (capabilityChanges.added.length > 0 && !opts?.confirmCapabilityChanges) return {
+			success: false,
+			error: {
+				code: "CAPABILITY_ESCALATION",
+				message: "Plugin update requires new capabilities",
+				details: { capabilityChanges }
+			}
+		};
+		const routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);
+		const hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;
+		if (hasNewPublicRoutes && !opts?.confirmRouteVisibilityChanges) return {
+			success: false,
+			error: {
+				code: "ROUTE_VISIBILITY_ESCALATION",
+				message: "Plugin update exposes new public (unauthenticated) routes",
+				details: {
+					routeVisibilityChanges,
+					capabilityChanges
+				}
+			}
+		};
+		await storeBundleInR2(storage, pluginId, newVersion, bundle, "registry");
+		await stateRepo.upsert(pluginId, newVersion, "active", {
+			source: "registry",
+			registryPublisherDid: publisherDid,
+			registrySlug: slug,
+			displayName: existing.displayName ?? slug,
+			description: existing.description ?? void 0
+		});
+		deleteBundleFromR2(storage, pluginId, oldVersion, "registry").catch(() => {});
+		return {
+			success: true,
+			data: {
+				pluginId,
+				oldVersion,
+				newVersion,
+				capabilityChanges,
+				routeVisibilityChanges: hasNewPublicRoutes ? routeVisibilityChanges : void 0
+			}
+		};
+	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) return {
+			success: false,
+			error: {
+				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+				message: `Aggregator returned ${err.status}: ${err.error}`
+			}
+		};
+		if (err instanceof EmDashStorageError) return {
+			success: false,
+			error: {
+				code: err.code ?? "STORAGE_ERROR",
+				message: "Storage error while updating plugin"
+			}
+		};
+		console.error("[registry-update] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_FAILED",
+				message: err instanceof Error ? err.message : "Failed to update plugin"
+			}
+		};
+	}
+}
+/**
+* Bulk update check across every installed registry plugin. Queries the
+* aggregator for each plugin's latest release and reports `hasUpdate`
+* based on the version comparison. Plugins whose aggregator lookup fails
+* (unreachable, delisted, malformed) are skipped silently — one bad
+* publisher must not blank the whole admin Updates list.
+*/
+async function handleRegistryUpdateCheck(db, registryConfigInput) {
+	const registryConfig = coerceRegistryConfig(registryConfigInput);
+	if (!registryConfig) return {
+		success: false,
+		error: {
+			code: "REGISTRY_NOT_CONFIGURED",
+			message: "Registry is not configured"
+		}
+	};
+	try {
+		const registryPlugins = await new PluginStateRepository(db).getRegistryPlugins();
+		if (registryPlugins.length === 0) return {
+			success: true,
+			data: { items: [] }
+		};
+		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
+		const discovery = new DiscoveryClient({
+			aggregatorUrl: registryConfig.aggregatorUrl,
+			acceptLabelers: registryConfig.acceptLabelers,
+			fetch: timedFetch(aggregatorDeadline)
+		});
+		const items = [];
+		for (const plugin of registryPlugins) {
+			if (!plugin.registryPublisherDid || !plugin.registrySlug) continue;
+			try {
+				const latest = (await discovery.getLatestRelease({
+					did: plugin.registryPublisherDid,
+					package: plugin.registrySlug
+				})).version;
+				if (!latest) continue;
+				const installed = plugin.version;
+				items.push({
+					pluginId: plugin.pluginId,
+					installed,
+					latest,
+					hasUpdate: latest !== installed,
+					hasCapabilityChanges: false,
+					hasRouteVisibilityChanges: false
+				});
+			} catch (err) {
+				console.warn(`[registry-update-check] Skipped ${plugin.pluginId}:`, err);
+			}
+		}
+		return {
+			success: true,
+			data: { items }
+		};
+	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) return {
+			success: false,
+			error: {
+				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+				message: `Aggregator returned ${err.status}: ${err.error}`
+			}
+		};
+		console.error("[registry-update-check] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_CHECK_FAILED",
+				message: "Failed to check for registry updates"
+			}
+		};
+	}
+}
 
 //#endregion
-export { handleContentSchedule as $, handleMediaCreate as A, handleContentCountScheduled as B, handleSchemaCollectionUpdate as C, handleSchemaFieldList as D, handleSchemaFieldGet as E, handleRevisionGet as F, handleContentDuplicate as G, handleContentCreate as H, handleRevisionList as I, handleContentList as J, handleContentGet as K, handleRevisionRestore as L, handleMediaGet as M, handleMediaList as N, handleSchemaFieldReorder as O, handleMediaUpdate as P, handleContentRestore as Q, generateManifest as R, handleSchemaCollectionList as S, handleSchemaFieldDelete as T, handleContentDelete as U, handleContentCountTrashed as V, handleContentDiscardDraft as W, handleContentPermanentDelete as X, handleContentListTrashed as Y, handleContentPublish as Z, handleOrphanedTableList as _, handleMarketplaceSearch as a, handleSchemaCollectionDelete as b, handleMarketplaceUpdateCheck as c, loadBundleFromR2 as d, handleContentTranslations as et, handlePluginDisable as f, PluginStateRepository as g, handlePluginList as h, handleMarketplaceInstall as i, validateRev as it, handleMediaDelete as j, handleSchemaFieldUpdate as k, handleThemeGetDetail as l, handlePluginGet as m, normalizeRegistryConfig as n, handleContentUnschedule as nt, handleMarketplaceUninstall as o, handlePluginEnable as p, handleContentGetIncludingTrashed as q, handleMarketplaceGetPlugin as r, handleContentUpdate as rt, handleMarketplaceUpdate as s, handleRegistryInstall as t, handleContentUnpublish as tt, handleThemeSearch as u, handleOrphanedTableRegister as v, handleSchemaFieldCreate as w, handleSchemaCollectionGet as x, handleSchemaCollectionCreate as y, handleContentCompare as z };
-//# sourceMappingURL=api-ayIQ7rIe.mjs.map
+export { handleContentPermanentDelete as $, handleSchemaFieldList as A, handleRevisionRestore as B, handleSchemaCollectionDelete as C, handleSchemaFieldCreate as D, handleSchemaCollectionUpdate as E, handleMediaGet as F, handleContentCreate as G, handleContentCompare as H, handleMediaList as I, handleContentDuplicate as J, handleContentDelete as K, handleMediaUpdate as L, handleSchemaFieldUpdate as M, handleMediaCreate as N, handleSchemaFieldDelete as O, handleMediaDelete as P, handleContentListTrashed as Q, handleRevisionGet as R, handleSchemaCollectionCreate as S, handleSchemaCollectionList as T, handleContentCountScheduled as U, generateManifest as V, handleContentCountTrashed as W, handleContentGetIncludingTrashed as X, handleContentGet as Y, handleContentList as Z, handlePluginGet as _, normalizeRegistryConfig as a, handleContentUnschedule as at, handleOrphanedTableList as b, handleMarketplaceSearch as c, handleMarketplaceUpdateCheck as d, handleContentPublish as et, handleThemeGetDetail as f, handlePluginEnable as g, handlePluginDisable as h, handleRegistryUpdateCheck as i, handleContentUnpublish as it, handleSchemaFieldReorder as j, handleSchemaFieldGet as k, handleMarketplaceUninstall as l, loadBundleFromR2 as m, handleRegistryUninstall as n, handleContentSchedule as nt, handleMarketplaceGetPlugin as o, handleContentUpdate as ot, handleThemeSearch as p, handleContentDiscardDraft as q, handleRegistryUpdate as r, handleContentTranslations as rt, handleMarketplaceInstall as s, validateRev as st, handleRegistryInstall as t, handleContentRestore as tt, handleMarketplaceUpdate as u, handlePluginList as v, handleSchemaCollectionGet as w, handleOrphanedTableRegister as x, PluginStateRepository as y, handleRevisionList as z };
+//# sourceMappingURL=api-CLwG_3dh.mjs.map