emdash 0.13.0 → 0.15.0

package/src/api/schemas/bylines.ts

@@ -17,6 +17,14 @@ export const bylineSummarySchema = z
 		isGuest: z.boolean(),
 		createdAt: z.string(),
 		updatedAt: z.string(),
+		/** Locale this byline row is presented in (migration 040). */
+		locale: z.string(),
+		/**
+		 * Shared across translations of the same byline (migration 040).
+		 * Equals `id` for the anchor row; siblings inherit it from their
+		 * source. Nullable in storage for backwards compatibility.
+		 */
+		translationGroup: z.string().nullable(),
 	})
 	.meta({ id: "BylineSummary" });
 
@@ -43,6 +51,12 @@ export const bylinesListQuery = cursorPaginationQuery
 		search: z.string().optional(),
 		isGuest: z.coerce.boolean().optional(),
 		userId: z.string().optional(),
+		/**
+		 * Filter by locale (strict per-locale matching, post-migration 040).
+		 * Rejects empty strings so the picker can't silently fetch the
+		 * unfiltered list when the admin URL has `?locale=` with no value.
+		 */
+		locale: z.string().min(1).optional(),
 	})
 	.meta({ id: "BylinesListQuery" });
 
@@ -58,9 +72,41 @@ export const bylineCreateBody = z
 		websiteUrl: httpUrl.nullish(),
 		userId: z.string().nullish(),
 		isGuest: z.boolean().optional(),
+		/**
+		 * Locale this byline row belongs to. When omitted, the DB DEFAULT (the
+		 * configured `defaultLocale`) is used. Rejects empty strings — an
+		 * empty locale would create rows no resolver requests.
+		 */
+		locale: z.string().min(1).optional(),
+		/**
+		 * When set, the new row joins the source byline's translation_group
+		 * rather than minting a fresh one. Requires `locale`.
+		 */
+		translationOf: z.string().min(1).optional(),
 	})
 	.meta({ id: "BylineCreateBody" });
 
+export const bylineTranslationCreateBody = z
+	.object({
+		locale: z.string().min(1),
+		slug: z
+			.string()
+			.min(1)
+			.regex(bylineSlugPattern, "Slug must contain only lowercase letters, digits, and hyphens")
+			.optional(),
+		displayName: z.string().min(1).optional(),
+		bio: z.string().nullish(),
+		avatarMediaId: z.string().nullish(),
+		websiteUrl: httpUrl.nullish(),
+	})
+	.meta({ id: "BylineTranslationCreateBody" });
+
+export const bylineTranslationsResponseSchema = z
+	.object({
+		items: z.array(bylineSummarySchema),
+	})
+	.meta({ id: "BylineTranslationsResponse" });
+
 export const bylineUpdateBody = z
 	.object({
 		slug: z

package/src/astro/integration/index.ts

@@ -22,7 +22,7 @@ import {
 	injectAuthProviderRoutes,
 	injectMcpRoute,
 } from "./routes.js";
-import type { EmDashConfig, PluginDescriptor } from "./runtime.js";
+import type { EmDashConfig } from "./runtime.js";
 import { createViteConfig } from "./vite-config.js";
 
 // Re-export runtime types and functions

package/src/astro/integration/routes.ts

@@ -447,6 +447,11 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/admin/bylines/[id]/index.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/admin/bylines/[id]/translations",
+		entrypoint: resolveRoute("api/admin/bylines/[id]/translations.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/admin/users/[id]",
 		entrypoint: resolveRoute("api/admin/users/[id]/index.ts"),

package/src/astro/integration/runtime.ts

@@ -199,6 +199,17 @@ export interface EmDashConfig {
 	 */
 	sandboxRunner?: string;
 
+	/**
+	 * Explicitly disable plugin sandboxing, even if a sandbox runner is configured.
+	 * Use this as a debugging escape hatch to determine whether a bug is in your
+	 * plugin code or in the sandbox runtime.
+	 *
+	 * When set to `false`, all plugins run in-process without isolation.
+	 *
+	 * @default true (sandboxing enabled if sandboxRunner is configured)
+	 */
+	sandbox?: boolean;
+
 	/**
 	 * Authentication configuration
 	 *
@@ -526,7 +537,7 @@ const configHolder = globalThis as Record<symbol, unknown>;
  * This is set by the virtual module at build time
  */
 export function getStoredConfig(): EmDashConfig | null {
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- globalThis singleton pattern (see request-context.ts)
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)
 	return (configHolder[STORED_CONFIG_KEY] as EmDashConfig | undefined) ?? null;
 }
 

package/src/astro/integration/virtual-modules.ts

@@ -283,10 +283,14 @@ ${entries.join("\n")}
 /**
  * Generates the sandbox runner module.
  * Imports the configured sandbox runner factory or provides a noop default.
+ *
+ * When sandbox is explicitly false (debugging escape hatch), we still mark
+ * sandboxEnabled = true so sandboxed plugin entries are loaded, but we use
+ * the noop runner which falls through to in-process loading via adaptSandboxEntry.
  */
-export function generateSandboxRunnerModule(sandboxRunner?: string): string {
+export function generateSandboxRunnerModule(sandboxRunner?: string, sandbox?: boolean): string {
 	if (!sandboxRunner) {
-		// No sandbox runner configured - use noop
+		// No sandbox runner configured - sandboxed plugins disabled
 		return `
 // No sandbox runner configured - sandboxed plugins disabled
 import { createNoopSandboxRunner } from "emdash";
@@ -296,6 +300,19 @@ export const sandboxEnabled = false;
 `;
 	}
 
+	if (sandbox === false) {
+		// sandbox: false escape hatch - plugins are loaded but run in-process
+		// (no isolation, for debugging)
+		return `
+// Sandbox explicitly disabled (sandbox: false) - plugins run in-process
+import { createNoopSandboxRunner } from "emdash";
+
+export const createSandboxRunner = createNoopSandboxRunner;
+export const sandboxEnabled = true;
+export const sandboxBypassed = true;
+`;
+	}
+
 	return `
 // Auto-generated sandbox runner module
 import { createSandboxRunner as _createSandboxRunner } from "${sandboxRunner}";

package/src/astro/integration/vite-config.ts

@@ -233,7 +233,7 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 			}
 			// Generate sandbox runner module
 			if (id === RESOLVED_VIRTUAL_SANDBOX_RUNNER_ID) {
-				return generateSandboxRunnerModule(resolvedConfig.sandboxRunner);
+				return generateSandboxRunnerModule(resolvedConfig.sandboxRunner, resolvedConfig.sandbox);
 			}
 			// Generate sandboxed plugins config module
 			if (id === RESOLVED_VIRTUAL_SANDBOXED_PLUGINS_ID) {
@@ -346,7 +346,7 @@ export function createViteConfig(
 				{ find: "use-sync-external-store/shim", replacement: "use-sync-external-store" },
 			],
 		},
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Monorepo has both vite 6 (docs) and vite 7 (core). tsgo resolves correctly.
+		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Monorepo has both vite 6 (docs) and vite 7 (core). tsgo resolves correctly.
 		plugins: [
 			createVirtualModulesPlugin(options),
 			// In dev mode with source alias, compile Lingui macros on the fly

package/src/astro/middleware/auth.ts

@@ -475,11 +475,11 @@ async function handleExternalAuth(
 		const authResult = await virtualAuthenticate(request, authMode.config);
 
 		// Get external auth config for auto-provision settings
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- narrowing AuthModeConfig to ExternalAuthConfig after provider check
+		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowing AuthModeConfig to ExternalAuthConfig after provider check
 		const externalConfig = authMode.config as ExternalAuthConfig;
 
 		// Find or create user
-		const adapter = createKyselyAdapter(emdash!.db);
+		const adapter = createKyselyAdapter(emdash.db);
 		let user = await adapter.getUserByEmail(authResult.email);
 
 		if (!user) {
@@ -492,9 +492,9 @@ async function handleExternalAuth(
 			}
 
 			// Check if this is the first user (they become admin)
-			const userCount = await emdash!.db
+			const userCount = await emdash.db
 				.selectFrom("users")
-				.select(emdash!.db.fn.count("id").as("count"))
+				.select(emdash.db.fn.count("id").as("count"))
 				.executeTakeFirst();
 
 			const isFirstUser = Number(userCount?.count ?? 0) === 0;
@@ -512,7 +512,7 @@ async function handleExternalAuth(
 				updated_at: now,
 			};
 
-			await emdash!.db.insertInto("users").values(newUser).execute();
+			await emdash.db.insertInto("users").values(newUser).execute();
 
 			user = await adapter.getUserByEmail(authResult.email);
 
@@ -539,7 +539,7 @@ async function handleExternalAuth(
 
 			if (Object.keys(updates).length > 0) {
 				updates.updated_at = new Date().toISOString();
-				await emdash!.db.updateTable("users").set(updates).where("id", "=", user.id).execute();
+				await emdash.db.updateTable("users").set(updates).where("id", "=", user.id).execute();
 
 				user = {
 					...user,
@@ -665,7 +665,7 @@ async function handlePasskeyAuth(
 		}
 
 		// Get full user from database
-		const adapter = createKyselyAdapter(emdash!.db);
+		const adapter = createKyselyAdapter(emdash.db);
 		const user = await adapter.getUserById(sessionUser.id);
 
 		if (!user) {

package/src/astro/middleware/request-context.ts

@@ -78,7 +78,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	const editMode = hasEditCookie && isEditor;
 
 	// Read locale from Astro's i18n routing
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Astro context includes currentLocale when i18n is configured
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Astro context includes currentLocale when i18n is configured
 	const locale = (context as { currentLocale?: string }).currentLocale;
 
 	// Verify preview token if present.

package/src/astro/middleware.ts

@@ -20,11 +20,8 @@ import type { RequestScopedDbOpts } from "virtual:emdash/dialect";
 import { mediaProviders as virtualMediaProviders } from "virtual:emdash/media-providers";
 // @ts-ignore - virtual module
 import { plugins as virtualPlugins } from "virtual:emdash/plugins";
-import {
-	createSandboxRunner as virtualCreateSandboxRunner,
-	sandboxEnabled as virtualSandboxEnabled,
-	// @ts-ignore - virtual module
-} from "virtual:emdash/sandbox-runner";
+// @ts-ignore - virtual module
+import * as virtualSandboxRunnerModule from "virtual:emdash/sandbox-runner";
 // @ts-ignore - virtual module
 import { sandboxedPlugins as virtualSandboxedPlugins } from "virtual:emdash/sandboxed-plugins";
 // @ts-ignore - virtual module
@@ -82,11 +79,11 @@ function getConfig(): EmDashConfig | null {
 		// Initialize i18n config on first access (once per worker lifetime)
 		if (!i18nInitialized) {
 			i18nInitialized = true;
-			// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module checked as object above
+			// eslint-disable-next-line typescript/no-unsafe-type-assertion -- virtual module checked as object above
 			const config = virtualConfig as Record<string, unknown>;
 			if (config.i18n && typeof config.i18n === "object") {
 				setI18nConfig(
-					// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- runtime-checked above
+					// eslint-disable-next-line typescript/no-unsafe-type-assertion -- runtime-checked above
 					config.i18n as {
 						defaultLocale: string;
 						locales: string[];
@@ -98,7 +95,7 @@ function getConfig(): EmDashConfig | null {
 			}
 		}
 
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
+		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- virtual module import is untyped (@ts-ignore above)
 		return virtualConfig as EmDashConfig;
 	}
 	return null;
@@ -108,7 +105,7 @@ function getConfig(): EmDashConfig | null {
  * Get plugins from virtual module
  */
 function getPlugins(): ResolvedPlugin[] {
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- virtual module import is untyped (@ts-ignore above)
 	return (virtualPlugins as ResolvedPlugin[]) || [];
 }
 
@@ -116,24 +113,37 @@ function getPlugins(): ResolvedPlugin[] {
  * Build runtime dependencies from virtual modules
  */
 function buildDependencies(config: EmDashConfig): RuntimeDependencies {
+	/* eslint-disable typescript-eslint/no-unsafe-type-assertion --
+	   The virtual:emdash/* imports above use @ts-ignore because tsgo/IDE
+	   resolution can't see virtual-modules.d.ts in every consumer setup,
+	   so they arrive as `any`. The casts here line each entry up with
+	   RuntimeDependencies's expected shape. The contract is enforced by
+	   the integration that populates these virtual modules. */
+	const sandboxModule = virtualSandboxRunnerModule as Record<string, unknown>;
 	return {
 		config,
 		plugins: getPlugins(),
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
 		createDialect: virtualCreateDialect as (config: Record<string, unknown>) => unknown,
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
 		createStorage: virtualCreateStorage as ((config: Record<string, unknown>) => Storage) | null,
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
-		sandboxEnabled: virtualSandboxEnabled as boolean,
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
+		sandboxEnabled: sandboxModule.sandboxEnabled as boolean,
+		sandboxBypassed: (sandboxModule.sandboxBypassed as boolean) ?? false,
 		sandboxedPluginEntries: (virtualSandboxedPlugins as SandboxedPluginEntry[]) || [],
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
-		createSandboxRunner: virtualCreateSandboxRunner as
-			| ((opts: { db: Kysely<Database> }) => SandboxRunner)
+		createSandboxRunner: sandboxModule.createSandboxRunner as
+			| ((opts: {
+					db: Kysely<Database>;
+					mediaStorage?: {
+						upload(options: {
+							key: string;
+							body: Uint8Array;
+							contentType: string;
+						}): Promise<unknown>;
+						delete(key: string): Promise<unknown>;
+					};
+			  }) => SandboxRunner)
 			| null,
-		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- virtual module import is untyped (@ts-ignore above)
 		mediaProviderEntries: (virtualMediaProviders as MediaProviderEntry[]) || [],
 	};
+	/* eslint-enable typescript-eslint/no-unsafe-type-assertion */
 }
 
 /**
@@ -255,7 +265,7 @@ function createRequestScopedDb(
 	opts: RequestScopedDbOpts,
 ): { db: Kysely<Database>; commit: () => void } | null {
 	if (typeof virtualCreateRequestScopedDb !== "function") return null;
-	// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- adapter returns Kysely<unknown>; cast to Database since core owns that type
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- adapter returns Kysely<unknown>; cast to Database since core owns that type
 	const fn = virtualCreateRequestScopedDb as (
 		o: RequestScopedDbOpts,
 	) => { db: Kysely<Database>; commit: () => void } | null;
@@ -358,7 +368,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					try {
 						const runtime = await getRuntime(config, initSubTimings);
 						setupVerified = true;
-						// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- partial object; getPageRuntime() only checks for the page-contribution methods
+						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
 						locals.emdash = {
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
@@ -523,6 +533,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 					// Sandbox runner (for marketplace plugin install/update)
 					getSandboxRunner: runtime.getSandboxRunner.bind(runtime),
+					isSandboxBypassed: runtime.isSandboxBypassed.bind(runtime),
 
 					// Sync marketplace plugin states (after install/update/uninstall)
 					syncMarketplacePlugins: runtime.syncMarketplacePlugins.bind(runtime),

package/src/astro/routes/api/admin/bylines/[id]/index.ts

@@ -1,4 +1,3 @@
-import { Role } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
@@ -10,17 +9,9 @@ import { BylineRepository } from "#db/repositories/byline.js";
 
 export const prerender = false;
 
-function requireEditor(user: { role: number } | undefined): Response | null {
-	if (!user || user.role < Role.EDITOR) {
-		return apiError("FORBIDDEN", "Editor privileges required", 403);
-	}
-	return null;
-}
-
 export const GET: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
-	// Read access uses content:read so all authenticated roles can view byline data
-	const denied = requirePerm(user, "content:read");
+	const denied = requirePerm(user, "bylines:read");
 	if (denied) return denied;
 
 	if (!emdash?.db) {
@@ -39,7 +30,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 
 export const PUT: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
-	const denied = requireEditor(user);
+	const denied = requirePerm(user, "bylines:manage");
 	if (denied) return denied;
 
 	if (!emdash?.db) {
@@ -71,7 +62,7 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 
 export const DELETE: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
-	const denied = requireEditor(user);
+	const denied = requirePerm(user, "bylines:manage");
 	if (denied) return denied;
 
 	if (!emdash?.db) {

package/src/astro/routes/api/admin/bylines/[id]/translations.ts

@@ -0,0 +1,99 @@
+/**
+ * Byline translation endpoints
+ *
+ * GET  /_emdash/api/admin/bylines/:id/translations  — list every translation
+ *                                                     of a byline (siblings
+ *                                                     in the same
+ *                                                     translation_group)
+ * POST /_emdash/api/admin/bylines/:id/translations  — create a new locale
+ *                                                     variant joining the
+ *                                                     source's
+ *                                                     translation_group
+ *                                                     (body: { locale, ... })
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleBylineCreate, handleBylineTranslations } from "#api/handlers/bylines.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { bylineTranslationCreateBody } from "#api/schemas.js";
+import { invalidateBylineCache } from "#bylines/index.js";
+import { BylineRepository } from "#db/repositories/byline.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const id = params.id!;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "bylines:read");
+	if (denied) return denied;
+
+	try {
+		const result = await handleBylineTranslations(emdash.db, id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to fetch byline translations", "BYLINE_TRANSLATIONS_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const id = params.id!;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "bylines:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, bylineTranslationCreateBody);
+		if (isParseError(body)) return body;
+
+		// Look up the source byline so we can:
+		//  (a) emit a clean 404 when it doesn't exist (route layer);
+		//  (b) fall back to its slug + display_name + avatar/website when
+		//      the body omits them. Editors creating a translation often
+		//      want to keep the slug stable and only enter the localized
+		//      bio/displayName — defaulting saves clicks.
+		const repo = new BylineRepository(emdash.db);
+		const source = await repo.findById(id);
+		if (!source) {
+			return new Response(
+				JSON.stringify({ error: { code: "NOT_FOUND", message: "Byline not found" } }),
+				{ status: 404, headers: { "Content-Type": "application/json" } },
+			);
+		}
+
+		const result = await handleBylineCreate(emdash.db, {
+			slug: body.slug ?? source.slug,
+			displayName: body.displayName ?? source.displayName,
+			bio: body.bio ?? null,
+			avatarMediaId: body.avatarMediaId ?? source.avatarMediaId,
+			websiteUrl: body.websiteUrl ?? source.websiteUrl,
+			// Translations don't inherit the source's user_id or guest flag —
+			// the partial unique on (user_id, locale) means a single user can
+			// own one byline per locale, but the editor must opt into linking
+			// the new row by editing it after creation.
+			userId: null,
+			isGuest: source.isGuest,
+			locale: body.locale,
+			translationOf: id,
+		});
+
+		if (result.success) invalidateBylineCache();
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(
+			error,
+			"Failed to create byline translation",
+			"BYLINE_TRANSLATION_CREATE_ERROR",
+		);
+	}
+};

package/src/astro/routes/api/admin/bylines/index.ts

@@ -1,13 +1,15 @@
-import { Role } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
-import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
+import { handleBylineCreate } from "#api/handlers/bylines.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { bylineCreateBody, bylinesListQuery } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { getI18nConfig } from "../../../../../i18n/config.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ url, locals }) => {
@@ -17,19 +19,28 @@ export const GET: APIRoute = async ({ url, locals }) => {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
 
-	// Read access uses content:read so all authenticated roles can view byline data
-	const denied = requirePerm(user, "content:read");
+	const denied = requirePerm(user, "bylines:read");
 	if (denied) return denied;
 
 	const query = parseQuery(url, bylinesListQuery);
 	if (isParseError(query)) return query;
 
+	const i18n = getI18nConfig();
+	if (query.locale && i18n && !i18n.locales.includes(query.locale)) {
+		return apiError(
+			"VALIDATION_ERROR",
+			`Locale "${query.locale}" is not configured for this site`,
+			400,
+		);
+	}
+
 	try {
 		const repo = new BylineRepository(emdash.db);
 		const result = await repo.findMany({
 			search: query.search,
 			isGuest: query.isGuest,
 			userId: query.userId,
+			locale: query.locale,
 			cursor: query.cursor,
 			limit: query.limit,
 		});
@@ -47,16 +58,14 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
 
-	if (!user || user.role < Role.EDITOR) {
-		return apiError("FORBIDDEN", "Editor privileges required", 403);
-	}
+	const denied = requirePerm(user, "bylines:manage");
+	if (denied) return denied;
 
 	const body = await parseBody(request, bylineCreateBody);
 	if (isParseError(body)) return body;
 
 	try {
-		const repo = new BylineRepository(emdash.db);
-		const byline = await repo.create({
+		const result = await handleBylineCreate(emdash.db, {
 			slug: body.slug,
 			displayName: body.displayName,
 			bio: body.bio ?? null,
@@ -64,10 +73,12 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			websiteUrl: body.websiteUrl ?? null,
 			userId: body.userId ?? null,
 			isGuest: body.isGuest,
+			locale: body.locale,
+			translationOf: body.translationOf,
 		});
 
-		invalidateBylineCache();
-		return apiSuccess(byline, 201);
+		if (result.success) invalidateBylineCache();
+		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create byline", "BYLINE_CREATE_ERROR");
 	}

package/src/astro/routes/api/admin/plugins/[id]/update.ts

@@ -48,6 +48,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			version: body.version,
 			confirmCapabilityChanges: body.confirmCapabilityChanges,
 			confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+			sandboxBypassed: emdash.isSandboxBypassed(),
 		},
 	);
 

package/src/astro/routes/api/admin/plugins/marketplace/[id]/install.ts

@@ -49,7 +49,12 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			emdash.getSandboxRunner(),
 			emdash.config.marketplace,
 			id,
-			{ version: body.version, configuredPluginIds, siteOrigin },
+			{
+				version: body.version,
+				configuredPluginIds,
+				siteOrigin,
+				sandboxBypassed: emdash.isSandboxBypassed(),
+			},
 		);
 
 		if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/admin/plugins/registry/[id]/uninstall.ts

@@ -0,0 +1,51 @@
+/**
+ * Registry plugin uninstall endpoint (experimental)
+ *
+ * POST /_emdash/api/admin/plugins/registry/:id/uninstall — Uninstall a
+ * registry-source plugin. Mirrors the marketplace uninstall route; the
+ * handler refuses non-registry sources, so this won't trash a marketplace
+ * or config plugin that shares the id namespace.
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+import { handleRegistryUninstall } from "#api/index.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+
+export const prerender = false;
+
+const uninstallBodySchema = z.object({
+	deleteData: z.boolean().optional(),
+});
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+	}
+
+	const body = await parseOptionalBody(request, uninstallBodySchema, {});
+	if (isParseError(body)) return body;
+
+	const result = await handleRegistryUninstall(emdash.db, emdash.storage, id, {
+		deleteData: body.deleteData ?? false,
+	});
+
+	if (!result.success) return unwrapResult(result);
+
+	await emdash.syncRegistryPlugins();
+
+	return unwrapResult(result);
+};