emdash 0.14.0 → 0.16.0

package/dist/{api-BMLZuwM4.mjs → api-BNKqxyFX.mjs}

@@ -1,27 +1,29 @@
 import { r as validatePluginIdentifier, t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { r as isI18nEnabled } from "./config-CVssduLe.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "./content-D6YG26WG.mjs";
+import { n as getI18nConfig, r as isI18nEnabled } from "./config-CVssduLe.mjs";
+import { r as RevisionRepository, t as ContentRepository } from "./content-8voQNTXX.mjs";
 import { r as encodeBase64, t as decodeBase64 } from "./base64-CqR-7kqF.mjs";
-import { n as InvalidCursorError, t as EmDashValidationError } from "./types-CwXMEPRr.mjs";
-import { t as MediaRepository } from "./media-Dg7he9uK.mjs";
-import { t as CommentRepository } from "./comment-Dd9MI82-.mjs";
+import { n as InvalidCursorError, t as EmDashValidationError } from "./types-B0bmgwMG.mjs";
+import { t as MediaRepository } from "./media-CKQd8AYU.mjs";
+import { t as CommentRepository } from "./comment-C76G-9tz.mjs";
 import { t as withTransaction } from "./transaction-NQj4VJ7Z.mjs";
-import { t as RedirectRepository } from "./redirect-DkaDxq8e.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-DyGtu1Bv.mjs";
-import { t as BylineRepository } from "./byline-D09BaS4j.mjs";
-import { t as SeoRepository } from "./seo-DRq9-EPP.mjs";
-import { r as invalidateRedirectCache } from "./cache-CXCpjWiL.mjs";
-import { t as isMissingTableError } from "./db-errors-CGN9kJfo.mjs";
+import { t as RedirectRepository } from "./redirect-CjfDGrTd.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-cYG4SnIP.mjs";
+import { t as BylineRepository } from "./byline-BDylH_m4.mjs";
+import { t as SeoRepository } from "./seo-BGCyDlkb.mjs";
+import { r as invalidateRedirectCache } from "./cache-BcI1yUjR.mjs";
+import { n as isMissingTableError } from "./db-errors-BiYqoX-n.mjs";
 import { r as parseAllowedMimeTypes, t as matchesMimeAllowlist } from "./mime-KV5TqkMN.mjs";
 import { n as requestCached } from "./request-cache-dzCt8TZB.mjs";
 import { n as hashString } from "./hash-DlUxGhQS.mjs";
-import { n as SchemaRegistry, t as SchemaError } from "./registry-BnCeHYsf.mjs";
-import { i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-HCtSh4Jq.mjs";
-import { r as normalizeCapabilities } from "./types-Db67HHlU.mjs";
-import { t as EmDashStorageError } from "./types-Dz9CGX_d.mjs";
-import { n as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-DzFN_qV-.mjs";
+import { n as SchemaRegistry, t as SchemaError } from "./registry-Cyp-dx6J.mjs";
+import { i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-Czqf0TLu.mjs";
+import { r as normalizeCapabilities } from "./types-1NNkmTIn.mjs";
+import { t as EmDashStorageError } from "./types-Cd9UCu3t.mjs";
+import { n as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-MZ-zrG6-.mjs";
 import { sql } from "kysely";
 import { createGzipDecoder, unpackTar } from "modern-tar";
+import { ClientResponseError, ClientValidationError } from "@atcute/client";
+import { checkEnvCompatibility, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
 
 //#region src/api/rev.ts
 /**
@@ -195,7 +197,8 @@ async function hydrateSeoMany(db, collection, items, hasSeo) {
 }
 async function hydrateBylines(db, collection, item) {
 	const bylineRepo = new BylineRepository(db);
-	const bylines = await bylineRepo.getContentBylines(collection, item.id);
+	const localeOpt = item.locale ? { locale: item.locale } : void 0;
+	const bylines = await bylineRepo.getContentBylines(collection, item.id, localeOpt);
 	if (bylines.length > 0) {
 		item.bylines = bylines.map((c) => ({
 			...c,
@@ -204,9 +207,13 @@ async function hydrateBylines(db, collection, item) {
 		item.byline = bylines[0]?.byline ?? null;
 		return;
 	}
-	if (item.primaryBylineId) item.primaryBylineId = null;
+	if (item.primaryBylineId) {
+		item.bylines = [];
+		item.byline = null;
+		return;
+	}
 	if (item.authorId) {
-		const fallback = await bylineRepo.findByUserId(item.authorId);
+		const fallback = await bylineRepo.findByUserId(item.authorId, localeOpt);
 		if (fallback) {
 			item.bylines = [{
 				byline: fallback,
@@ -223,18 +230,59 @@ async function hydrateBylines(db, collection, item) {
 }
 /**
 * Batch-hydrate bylines for multiple items using two bulk queries instead of N+1.
+*
+* Items may live at different locales (e.g. a list endpoint returning the
+* translations of an entry). Group by `item.locale` and call the strict
+* per-locale repo method once per group so each item resolves against its
+* own locale's byline rows.
 */
 async function hydrateBylinesMany(db, collection, items) {
 	if (items.length === 0) return;
 	const bylineRepo = new BylineRepository(db);
-	const contentIds = items.map((i) => i.id);
-	const bylinesMap = await bylineRepo.getContentBylinesMany(collection, contentIds);
-	const fallbackAuthorIds = [];
-	for (const item of items) if (!bylinesMap.has(item.id) && item.authorId) fallbackAuthorIds.push(item.authorId);
-	const uniqueAuthorIds = [...new Set(fallbackAuthorIds)];
-	const authorBylineMap = await bylineRepo.findByUserIds(uniqueAuthorIds);
+	const localeBuckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = item.locale ?? null;
+		const bucket = localeBuckets.get(key);
+		if (bucket) bucket.push(item);
+		else localeBuckets.set(key, [item]);
+	}
+	const bylinesByItem = /* @__PURE__ */ new Map();
+	const itemsNeedingAuthorCheck = [];
+	for (const [locale, bucket] of localeBuckets) {
+		const localeOpt = locale ? { locale } : void 0;
+		const ids = bucket.map((i) => i.id);
+		const credits = await bylineRepo.getContentBylinesMany(collection, ids, localeOpt);
+		for (const [id, list] of credits) bylinesByItem.set(id, list);
+		for (const item of bucket) {
+			if (credits.has(item.id) && credits.get(item.id).length > 0) continue;
+			if (item.authorId) itemsNeedingAuthorCheck.push(item);
+		}
+	}
+	const fallbackByItem = /* @__PURE__ */ new Map();
+	if (itemsNeedingAuthorCheck.length > 0) {
+		const authorBuckets = /* @__PURE__ */ new Map();
+		for (const item of itemsNeedingAuthorCheck) {
+			if (item.primaryBylineId) continue;
+			const key = item.locale ?? null;
+			const bucket = authorBuckets.get(key);
+			if (bucket) bucket.push(item);
+			else authorBuckets.set(key, [item]);
+		}
+		for (const [locale, bucket] of authorBuckets) {
+			const localeOpt = locale ? { locale } : void 0;
+			const authorIds = bucket.map((i) => i.authorId).filter((id) => id !== null);
+			const uniqueAuthorIds = [...new Set(authorIds)];
+			if (uniqueAuthorIds.length === 0) continue;
+			const authorMap = await bylineRepo.findByUserIds(uniqueAuthorIds, localeOpt);
+			for (const item of bucket) {
+				if (!item.authorId) continue;
+				const f = authorMap.get(item.authorId);
+				if (f) fallbackByItem.set(item.id, f);
+			}
+		}
+	}
 	for (const item of items) {
-		const explicit = bylinesMap.get(item.id);
+		const explicit = bylinesByItem.get(item.id);
 		if (explicit && explicit.length > 0) {
 			item.bylines = explicit.map((c) => ({
 				...c,
@@ -243,19 +291,16 @@ async function hydrateBylinesMany(db, collection, items) {
 			item.byline = explicit[0]?.byline ?? null;
 			continue;
 		}
-		if (item.primaryBylineId) item.primaryBylineId = null;
-		if (item.authorId) {
-			const fallback = authorBylineMap.get(item.authorId);
-			if (fallback) {
-				item.bylines = [{
-					byline: fallback,
-					sortOrder: 0,
-					roleLabel: null,
-					source: "inferred"
-				}];
-				item.byline = fallback;
-				continue;
-			}
+		const fallback = fallbackByItem.get(item.id);
+		if (fallback) {
+			item.bylines = [{
+				byline: fallback,
+				sortOrder: 0,
+				roleLabel: null,
+				source: "inferred"
+			}];
+			item.byline = fallback;
+			continue;
 		}
 		item.bylines = [];
 		item.byline = null;
@@ -426,10 +471,11 @@ async function handleContentCreate(db, collection, body) {
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
 			const bylineRepo = new BylineRepository(trx);
+			const effectiveLocale = body.locale ?? getI18nConfig()?.defaultLocale;
 			let slug = body.slug;
 			if (!slug) {
 				const slugSource = getSlugSource(body.data);
-				if (slugSource) slug = await repo.generateUniqueSlug(collection, slugSource, body.locale);
+				if (slugSource) slug = await repo.generateUniqueSlug(collection, slugSource, effectiveLocale);
 			}
 			const created = await repo.create({
 				type: collection,
@@ -437,20 +483,22 @@ async function handleContentCreate(db, collection, body) {
 				data: body.data,
 				status: body.status || "draft",
 				authorId: body.authorId,
-				locale: body.locale,
+				locale: effectiveLocale,
 				translationOf: body.translationOf,
 				createdAt: body.createdAt,
 				publishedAt: body.publishedAt
 			});
-			if (body.bylines !== void 0) {
-				await bylineRepo.setContentBylines(collection, created.id, body.bylines);
-				created.primaryBylineId = body.bylines[0]?.bylineId ?? null;
-			}
-			await hydrateBylines(trx, collection, created);
+			if (body.bylines !== void 0) created.primaryBylineId = (await bylineRepo.setContentBylines(collection, created.id, body.bylines))[0]?.byline.translationGroup ?? null;
 			if (body.translationOf) {
-				const { TaxonomyRepository } = await import("./taxonomy-wPfusMK9.mjs").then((n) => n.n);
+				const { TaxonomyRepository } = await import("./taxonomy-zqGQUqgu.mjs").then((n) => n.n);
 				await new TaxonomyRepository(trx).copyEntryTerms(collection, body.translationOf, created.id);
+				if (body.bylines === void 0) {
+					await bylineRepo.copyContentBylines(collection, body.translationOf, created.id);
+					const source = await repo.findById(collection, body.translationOf);
+					if (source) created.primaryBylineId = source.primaryBylineId;
+				}
 			}
+			await hydrateBylines(trx, collection, created);
 			if (body.seo && hasSeo) created.seo = await new SeoRepository(trx).upsert(collection, created.id, body.seo);
 			else if (hasSeo) created.seo = { ...SEO_DEFAULTS };
 			return created;
@@ -544,10 +592,7 @@ async function handleContentUpdate(db, collection, id, body) {
 				authorId: body.authorId,
 				publishedAt: body.publishedAt
 			});
-			if (body.bylines !== void 0) {
-				await bylineRepo.setContentBylines(collection, resolvedId, body.bylines);
-				updated.primaryBylineId = body.bylines[0]?.bylineId ?? null;
-			}
+			if (body.bylines !== void 0) updated.primaryBylineId = (await bylineRepo.setContentBylines(collection, resolvedId, body.bylines))[0]?.byline.translationGroup ?? null;
 			if (oldSlug && body.slug) {
 				const collectionRow = await trx.selectFrom("_emdash_collections").select("url_pattern").where("slug", "=", collection).executeTakeFirst();
 				await new RedirectRepository(trx).createAutoRedirect(collection, oldSlug, body.slug, resolvedId, collectionRow?.url_pattern ?? null);
@@ -2583,7 +2628,7 @@ async function handleMarketplaceInstall(db, storage, sandboxRunner, marketplaceU
 			message: "Storage is required for marketplace plugin installation"
 		}
 	};
-	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+	if (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) return {
 		success: false,
 		error: {
 			code: "SANDBOX_NOT_AVAILABLE",
@@ -2715,7 +2760,7 @@ async function handleMarketplaceUpdate(db, storage, sandboxRunner, marketplaceUr
 			message: "Storage is required"
 		}
 	};
-	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+	if (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) return {
 		success: false,
 		error: {
 			code: "SANDBOX_NOT_AVAILABLE",
@@ -3336,6 +3381,45 @@ async function makeRegistryPluginId(publisherDid, slug) {
 
 //#endregion
 //#region src/api/handlers/registry.ts
+/**
+* Registry plugin install handler.
+*
+* Installs a plugin published to the experimental decentralized plugin
+* registry described in RFC 0001. The install flow:
+*
+*   1. Resolve `(handle, slug)` to a publisher DID via the configured
+*      aggregator's `resolvePackage` XRPC.
+*   2. Look up the requested release (or the policy-filtered latest one)
+*      via `getLatestRelease` / `listReleases`.
+*   3. Reject the install if the aggregator surfaces a `security:yanked`
+*      hard-enforcement label or the release is below the configured
+*      minimum release age.
+*   4. Fetch the bundle artifact, walking aggregator mirrors first and
+*      falling back to the publisher-declared URL.
+*   5. Verify the artifact's multibase checksum against the signed
+*      release record's `artifacts.package.checksum`.
+*   6. Extract `manifest.json` + `backend.js` + optional `admin.js` from
+*      the gzipped tar bundle.
+*   7. Store the extracted files in site-local R2 under the
+*      `registry/<plugin-id>/<version>/` prefix.
+*   8. Write a `plugin_states` row with `source = "registry"` and the
+*      `(publisher_did, slug)` pair so updates can be resolved later.
+*   9. Sync the runtime so the plugin becomes active immediately.
+*
+* Known gaps (tracked separately):
+*
+*   - The aggregator-supplied records are not yet cryptographically
+*     verified against the publisher's MST signature. The signed bytes
+*     and CIDs are passed through verbatim per the lexicon, but full
+*     PDS-direct verification with proof traversal is follow-up work.
+*     The artifact checksum is verified end-to-end against the value
+*     in the (aggregator-relayed) release record, which is the actual
+*     trust boundary for the bytes that end up in the sandbox.
+*   - `acceptLabelers` is forwarded as-is to the aggregator; this
+*     handler does not independently re-fetch and verify labels from
+*     each labeller's DID. Aggregator label envelope tampering is
+*     mitigated by the artifact checksum but not detected.
+*/
 /** Matches a bare 64-character lowercase/uppercase hex SHA-256 digest. */
 const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/i;
 /** Compute the SHA-256 of `bytes` as a lowercase hex string. */
@@ -3530,7 +3614,7 @@ async function assertSafeArtifactUrl(urlString) {
 	try {
 		return await resolveAndValidateExternalUrl(url.href);
 	} catch (err) {
-		if (err instanceof SsrfError) throw new Error(`Artifact URL rejected: ${err.message}`);
+		if (err instanceof SsrfError) throw new Error(`Artifact URL rejected: ${err.message}`, { cause: err });
 		throw err;
 	}
 }
@@ -3642,6 +3726,31 @@ async function fetchArtifact(mirrors, declaredUrl) {
 	}
 	throw new Error(`Failed to download artifact from any source. Tried:\n  ${clientErrors.join("\n  ")}`);
 }
+/**
+* Gate a release's `requires` constraints against the running host
+* environment. `requires` is the lexicon-`unknown` value off the signed
+* release record — never trust its shape; `checkEnvCompatibility` guards it.
+*
+* Returns `null` when every advertised constraint is satisfied (or there are
+* none), or a structured `ENV_INCOMPATIBLE` error naming the unsatisfied
+* constraints and the host versions. The error carries the guarded `requires`
+* and `host` maps so the admin can render the same mismatch the UI gate shows.
+*/
+function assertEnvCompatible(requires, hostEnv) {
+	for (const skipped of findSkippedEnvConstraints(requires, hostEnv)) console.warn(`[registry] env compatibility constraint skipped: ${skipped.key} requires ${skipped.required} but host version is ${skipped.reason}`);
+	const mismatches = checkEnvCompatibility(requires, hostEnv);
+	if (mismatches.length === 0) return null;
+	const guarded = {};
+	for (const m of mismatches) guarded[m.key] = m.required;
+	return {
+		code: "ENV_INCOMPATIBLE",
+		message: `This release is not compatible with the current environment: ${mismatches.map((m) => `${m.key} requires ${m.required} but host is ${m.host}`).join("; ")}.`,
+		details: {
+			requires: guarded,
+			host: hostEnv
+		}
+	};
+}
 async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigInput, input, opts) {
 	const registryConfig = coerceRegistryConfig(registryConfigInput);
 	if (!registryConfig) return {
@@ -3753,6 +3862,13 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 				message: "This release has been withdrawn (security:yanked label)."
 			}
 		};
+		if (opts?.hostEnv) {
+			const envError = assertEnvCompatible(releaseView.release?.requires, opts.hostEnv);
+			if (envError) return {
+				success: false,
+				error: envError
+			};
+		}
 		const minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;
 		let minimumReleaseAgeSeconds = 0;
 		if (minimumReleaseAge !== void 0) try {
@@ -3918,6 +4034,20 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 			}
 		};
 	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) return {
+			success: false,
+			error: {
+				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+				message: `Aggregator returned ${err.status}: ${err.error}`
+			}
+		};
 		if (err instanceof EmDashStorageError) return {
 			success: false,
 			error: {
@@ -3935,7 +4065,381 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 		};
 	}
 }
+/**
+* Uninstall a registry-source plugin. Deletes the R2 bundle under
+* `registry/<pluginId>/<version>/`, optionally drops the plugin's
+* `_plugin_storage` rows, and removes the `_plugin_state` row. The
+* sandbox runtime is reconciled by the route's `syncRegistryPlugins`
+* call after this returns.
+*
+* Refuses to uninstall plugins whose `source` is not `"registry"` to
+* avoid trashing a marketplace/config plugin that happens to share the
+* pluginId namespace.
+*/
+async function handleRegistryUninstall(db, storage, pluginId, opts) {
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "registry") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No registry plugin found: ${pluginId}`
+			}
+		};
+		const version = existing.version;
+		let dataDeleted = false;
+		if (opts?.deleteData) {
+			await db.deleteFrom("_plugin_storage").where("plugin_id", "=", pluginId).execute();
+			dataDeleted = true;
+		}
+		if (storage) await deleteBundleFromR2(storage, pluginId, version, "registry");
+		await stateRepo.delete(pluginId);
+		return {
+			success: true,
+			data: {
+				pluginId,
+				dataDeleted
+			}
+		};
+	} catch (err) {
+		console.error("[registry-uninstall] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UNINSTALL_FAILED",
+				message: "Failed to uninstall plugin"
+			}
+		};
+	}
+}
+/**
+* Update a registry-source plugin to a newer release. Mirrors
+* `handleMarketplaceUpdate`: resolves the target version via the aggregator,
+* re-runs the artifact fetch / checksum / extract pipeline, diffs capabilities
+* and route visibility against the currently installed bundle, and gates
+* escalations behind `confirmCapabilityChanges` / `confirmRouteVisibilityChanges`
+* so the admin re-consents to widened permissions.
+*
+* Refuses non-registry sources. Refuses when the stored state row is missing
+* the `(publisherDid, slug)` it needs to resolve against the aggregator.
+*/
+async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigInput, pluginId, opts) {
+	const registryConfig = coerceRegistryConfig(registryConfigInput);
+	if (!registryConfig) return {
+		success: false,
+		error: {
+			code: "REGISTRY_NOT_CONFIGURED",
+			message: "Registry is not configured"
+		}
+	};
+	if (!storage) return {
+		success: false,
+		error: {
+			code: "STORAGE_NOT_CONFIGURED",
+			message: "Storage is required for registry plugin updates"
+		}
+	};
+	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+		success: false,
+		error: {
+			code: "SANDBOX_NOT_AVAILABLE",
+			message: "Sandbox runner is required"
+		}
+	};
+	try {
+		validateAggregatorUrl(registryConfig.aggregatorUrl);
+	} catch (err) {
+		return {
+			success: false,
+			error: {
+				code: "REGISTRY_NOT_CONFIGURED",
+				message: err instanceof Error ? err.message : "Invalid aggregator URL"
+			}
+		};
+	}
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "registry") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No registry plugin found: ${pluginId}`
+			}
+		};
+		if (!existing.registryPublisherDid || !existing.registrySlug) return {
+			success: false,
+			error: {
+				code: "INVALID_STATE",
+				message: `Registry plugin ${pluginId} is missing publisher DID or slug in state`
+			}
+		};
+		const oldVersion = existing.version;
+		const publisherDid = existing.registryPublisherDid;
+		const slug = existing.registrySlug;
+		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
+		const discovery = new DiscoveryClient({
+			aggregatorUrl: registryConfig.aggregatorUrl,
+			acceptLabelers: registryConfig.acceptLabelers,
+			fetch: timedFetch(aggregatorDeadline)
+		});
+		const MAX_LIST_PAGES = 20;
+		const releaseView = await (async () => {
+			if (!opts?.version) return discovery.getLatestRelease({
+				did: publisherDid,
+				package: slug
+			});
+			let cursor;
+			const seenCursors = /* @__PURE__ */ new Set();
+			for (let page = 0; page < MAX_LIST_PAGES; page++) {
+				if (cursor !== void 0) {
+					if (seenCursors.has(cursor)) break;
+					seenCursors.add(cursor);
+				}
+				const result = await discovery.listReleases({
+					did: publisherDid,
+					package: slug,
+					cursor,
+					limit: 50
+				});
+				for (const r of result.releases) if (r.version === opts.version) return r;
+				if (!result.cursor) break;
+				cursor = result.cursor;
+			}
+		})();
+		if (!releaseView) return {
+			success: false,
+			error: {
+				code: "NO_VERSION",
+				message: opts?.version ? `Version ${opts.version} not found for ${publisherDid}/${slug}` : `No installable release found for ${publisherDid}/${slug}`
+			}
+		};
+		const signedRelease = releaseView.release;
+		if (releaseView.did !== publisherDid || releaseView.package !== slug || signedRelease?.package !== slug || opts?.version !== void 0 && releaseView.version !== opts.version || signedRelease?.version !== releaseView.version) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_IDENTITY_MISMATCH",
+				message: "Aggregator returned a release view that does not match the requested package or version."
+			}
+		};
+		const newVersion = releaseView.version;
+		if (newVersion === oldVersion) return {
+			success: false,
+			error: {
+				code: "ALREADY_UP_TO_DATE",
+				message: "Plugin is already at the requested version"
+			}
+		};
+		if ((releaseView.labels ?? []).some((l) => l.val === "security:yanked")) return {
+			success: false,
+			error: {
+				code: "YANKED",
+				message: "Release has been yanked by a trusted labeller"
+			}
+		};
+		if (opts?.hostEnv) {
+			const envError = assertEnvCompatible(signedRelease.requires, opts.hostEnv);
+			if (envError) return {
+				success: false,
+				error: envError
+			};
+		}
+		const declaredUrl = signedRelease.artifacts?.package?.url;
+		const declaredChecksum = signedRelease.artifacts?.package?.checksum;
+		if (!declaredUrl || !declaredChecksum) return {
+			success: false,
+			error: {
+				code: "INVALID_RELEASE",
+				message: "Release record is missing artifact url or checksum"
+			}
+		};
+		await assertSafeArtifactUrl(declaredUrl);
+		const mirrors = (releaseView.mirrors ?? []).slice(0, MAX_MIRRORS);
+		for (const mirror of mirrors) await assertSafeArtifactUrl(mirror);
+		const artifactBytes = await fetchArtifact(mirrors, declaredUrl);
+		if (!await verifyChecksum(artifactBytes, declaredChecksum)) return {
+			success: false,
+			error: {
+				code: "CHECKSUM_MISMATCH",
+				message: "Artifact bytes do not match the release's published checksum"
+			}
+		};
+		const bundle = await extractBundle(artifactBytes);
+		if (bundle.manifest.version !== newVersion) return {
+			success: false,
+			error: {
+				code: "BUNDLE_VERSION_MISMATCH",
+				message: `Bundle manifest version (${bundle.manifest.version}) does not match release version (${newVersion})`
+			}
+		};
+		if (bundle.manifest.id !== slug) return {
+			success: false,
+			error: {
+				code: "BUNDLE_IDENTITY_MISMATCH",
+				message: `Bundle manifest id (${bundle.manifest.id}) does not match registry slug (${slug})`
+			}
+		};
+		bundle.manifest = {
+			...bundle.manifest,
+			id: pluginId
+		};
+		const oldBundle = await loadBundleFromR2(storage, pluginId, oldVersion, "registry");
+		const capabilityChanges = diffCapabilities(oldBundle?.manifest.capabilities ?? [], bundle.manifest.capabilities);
+		if (capabilityChanges.added.length > 0 && !opts?.confirmCapabilityChanges) return {
+			success: false,
+			error: {
+				code: "CAPABILITY_ESCALATION",
+				message: "Plugin update requires new capabilities",
+				details: { capabilityChanges }
+			}
+		};
+		const routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);
+		const hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;
+		if (hasNewPublicRoutes && !opts?.confirmRouteVisibilityChanges) return {
+			success: false,
+			error: {
+				code: "ROUTE_VISIBILITY_ESCALATION",
+				message: "Plugin update exposes new public (unauthenticated) routes",
+				details: {
+					routeVisibilityChanges,
+					capabilityChanges
+				}
+			}
+		};
+		await storeBundleInR2(storage, pluginId, newVersion, bundle, "registry");
+		await stateRepo.upsert(pluginId, newVersion, "active", {
+			source: "registry",
+			registryPublisherDid: publisherDid,
+			registrySlug: slug,
+			displayName: existing.displayName ?? slug,
+			description: existing.description ?? void 0
+		});
+		deleteBundleFromR2(storage, pluginId, oldVersion, "registry").catch(() => {});
+		return {
+			success: true,
+			data: {
+				pluginId,
+				oldVersion,
+				newVersion,
+				capabilityChanges,
+				routeVisibilityChanges: hasNewPublicRoutes ? routeVisibilityChanges : void 0
+			}
+		};
+	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) return {
+			success: false,
+			error: {
+				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+				message: `Aggregator returned ${err.status}: ${err.error}`
+			}
+		};
+		if (err instanceof EmDashStorageError) return {
+			success: false,
+			error: {
+				code: err.code ?? "STORAGE_ERROR",
+				message: "Storage error while updating plugin"
+			}
+		};
+		console.error("[registry-update] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_FAILED",
+				message: err instanceof Error ? err.message : "Failed to update plugin"
+			}
+		};
+	}
+}
+/**
+* Bulk update check across every installed registry plugin. Queries the
+* aggregator for each plugin's latest release and reports `hasUpdate`
+* based on the version comparison. Plugins whose aggregator lookup fails
+* (unreachable, delisted, malformed) are skipped silently — one bad
+* publisher must not blank the whole admin Updates list.
+*/
+async function handleRegistryUpdateCheck(db, registryConfigInput) {
+	const registryConfig = coerceRegistryConfig(registryConfigInput);
+	if (!registryConfig) return {
+		success: false,
+		error: {
+			code: "REGISTRY_NOT_CONFIGURED",
+			message: "Registry is not configured"
+		}
+	};
+	try {
+		const registryPlugins = await new PluginStateRepository(db).getRegistryPlugins();
+		if (registryPlugins.length === 0) return {
+			success: true,
+			data: { items: [] }
+		};
+		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
+		const discovery = new DiscoveryClient({
+			aggregatorUrl: registryConfig.aggregatorUrl,
+			acceptLabelers: registryConfig.acceptLabelers,
+			fetch: timedFetch(aggregatorDeadline)
+		});
+		const items = [];
+		for (const plugin of registryPlugins) {
+			if (!plugin.registryPublisherDid || !plugin.registrySlug) continue;
+			try {
+				const latest = (await discovery.getLatestRelease({
+					did: plugin.registryPublisherDid,
+					package: plugin.registrySlug
+				})).version;
+				if (!latest) continue;
+				const installed = plugin.version;
+				items.push({
+					pluginId: plugin.pluginId,
+					installed,
+					latest,
+					hasUpdate: latest !== installed,
+					hasCapabilityChanges: false,
+					hasRouteVisibilityChanges: false
+				});
+			} catch (err) {
+				console.warn(`[registry-update-check] Skipped ${plugin.pluginId}:`, err);
+			}
+		}
+		return {
+			success: true,
+			data: { items }
+		};
+	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) return {
+			success: false,
+			error: {
+				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+				message: `Aggregator returned ${err.status}: ${err.error}`
+			}
+		};
+		console.error("[registry-update-check] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_CHECK_FAILED",
+				message: "Failed to check for registry updates"
+			}
+		};
+	}
+}
 
 //#endregion
-export { handleContentSchedule as $, handleMediaCreate as A, handleContentCountScheduled as B, handleSchemaCollectionUpdate as C, handleSchemaFieldList as D, handleSchemaFieldGet as E, handleRevisionGet as F, handleContentDuplicate as G, handleContentCreate as H, handleRevisionList as I, handleContentList as J, handleContentGet as K, handleRevisionRestore as L, handleMediaGet as M, handleMediaList as N, handleSchemaFieldReorder as O, handleMediaUpdate as P, handleContentRestore as Q, generateManifest as R, handleSchemaCollectionList as S, handleSchemaFieldDelete as T, handleContentDelete as U, handleContentCountTrashed as V, handleContentDiscardDraft as W, handleContentPermanentDelete as X, handleContentListTrashed as Y, handleContentPublish as Z, handleOrphanedTableList as _, handleMarketplaceSearch as a, handleSchemaCollectionDelete as b, handleMarketplaceUpdateCheck as c, loadBundleFromR2 as d, handleContentTranslations as et, handlePluginDisable as f, PluginStateRepository as g, handlePluginList as h, handleMarketplaceInstall as i, validateRev as it, handleMediaDelete as j, handleSchemaFieldUpdate as k, handleThemeGetDetail as l, handlePluginGet as m, normalizeRegistryConfig as n, handleContentUnschedule as nt, handleMarketplaceUninstall as o, handlePluginEnable as p, handleContentGetIncludingTrashed as q, handleMarketplaceGetPlugin as r, handleContentUpdate as rt, handleMarketplaceUpdate as s, handleRegistryInstall as t, handleContentUnpublish as tt, handleThemeSearch as u, handleOrphanedTableRegister as v, handleSchemaFieldCreate as w, handleSchemaCollectionGet as x, handleSchemaCollectionCreate as y, handleContentCompare as z };
-//# sourceMappingURL=api-BMLZuwM4.mjs.map
+export { handleContentGetIncludingTrashed as $, handleSchemaFieldCreate as A, handleMediaUpdate as B, handleOrphanedTableList as C, handleSchemaCollectionGet as D, handleSchemaCollectionDelete as E, handleSchemaFieldUpdate as F, handleContentCompare as G, handleRevisionList as H, handleMediaCreate as I, handleContentCreate as J, handleContentCountScheduled as K, handleMediaDelete as L, handleSchemaFieldGet as M, handleSchemaFieldList as N, handleSchemaCollectionList as O, handleSchemaFieldReorder as P, handleContentGet as Q, handleMediaGet as R, PluginStateRepository as S, handleSchemaCollectionCreate as T, handleRevisionRestore as U, handleRevisionGet as V, generateManifest as W, handleContentDiscardDraft as X, handleContentDelete as Y, handleContentDuplicate as Z, loadBundleFromR2 as _, handleRegistryUpdateCheck as a, handleContentSchedule as at, handlePluginGet as b, validateAggregatorUrl as c, handleContentUnschedule as ct, handleMarketplaceSearch as d, handleContentList as et, handleMarketplaceUninstall as f, handleThemeSearch as g, handleThemeGetDetail as h, handleRegistryUpdate as i, handleContentRestore as it, handleSchemaFieldDelete as j, handleSchemaCollectionUpdate as k, handleMarketplaceGetPlugin as l, handleContentUpdate as lt, handleMarketplaceUpdateCheck as m, handleRegistryInstall as n, handleContentPermanentDelete as nt, coerceRegistryConfig as o, handleContentTranslations as ot, handleMarketplaceUpdate as p, handleContentCountTrashed as q, handleRegistryUninstall as r, handleContentPublish as rt, normalizeRegistryConfig as s, handleContentUnpublish as st, assertSafeArtifactUrl as t, handleContentListTrashed as tt, handleMarketplaceInstall as u, validateRev as ut, handlePluginDisable as v, handleOrphanedTableRegister as w, handlePluginList as x, handlePluginEnable as y, handleMediaList as z };
+//# sourceMappingURL=api-BNKqxyFX.mjs.map