emdash 0.35.0 → 0.36.0

package/dist/{api-BeBglVxU.mjs → registry-BiO5WwPq.mjs}

@@ -1,2231 +1,19 @@
-import { i as validateStorageCollectionName, n as validateJsonFieldName, r as validatePluginIdentifier, t as validateIdentifier } from "./validate-BpwoDOgt.mjs";
-import { c as isSqlite, l as jsonExtractExpr, s as isPostgres } from "./dialect-helpers-BSbfaO3F.mjs";
-import { a as resolveConfiguredLocale, i as isI18nEnabled, r as getI18nConfig } from "./config-C3EBstHi.mjs";
-import { t as after } from "./after-CBU2vkoO.mjs";
-import { i as RevisionRepository, r as isSystemOrderField, t as ContentRepository } from "./content-ZHCc1ngN.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-fiZ8G9RJ.mjs";
-import { n as isMissingTableError, t as isMissingColumnError } from "./db-errors-Cl-sKYTm.mjs";
-import { i as encodeBase64, t as decodeBase64 } from "./base64-CvLhUKQv.mjs";
-import { a as ScheduledNotDueError, i as InvalidCursorError, n as ContentMutationConflictError, r as EmDashValidationError, t as ContentCollectionNotFoundError } from "./types-CQPWhPxE.mjs";
-import { t as MediaRepository } from "./media-CzhAn2--.mjs";
-import { t as UserRepository } from "./user-DJZfUJVE.mjs";
-import { t as withTransaction } from "./transaction-NQj4VJ7Z.mjs";
-import { t as TaxonomyRepository } from "./taxonomy-BqCZ1TdU.mjs";
-import { t as CommentRepository } from "./comment-Dxlep6cE.mjs";
-import { t as OptionsRepository } from "./options-CBXIHUoT.mjs";
-import { t as RedirectRepository } from "./redirect-COsS6SWJ.mjs";
-import { r as requestCached } from "./request-cache-BSUptuJR.mjs";
-import { t as BylineRepository } from "./byline-yjvWq4ip.mjs";
-import { r as parseAllowedMimeTypes, t as matchesMimeAllowlist } from "./mime-DfIVjNkr.mjs";
-import { t as SeoRepository } from "./seo-Dq4G-RrO.mjs";
-import { n as invalidateRedirectCache } from "./cache-C46-3Irl.mjs";
-import { t as FTSManager } from "./fts-manager-DyZEohZC.mjs";
-import { u as invalidateTermCache } from "./taxonomies-BlrncHi9.mjs";
-import { r as hashString } from "./hash-Cg0TXJPV.mjs";
-import { t as ErrorCode } from "./errors-CLUPm7aD.mjs";
-import { t as PluginStateRepository } from "./state-DYwPue40.mjs";
-import { a as reconcileManifestAccess, i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-BXbUAHod.mjs";
-import { a as normalizeCapabilities, r as declaredAccessToCapabilities } from "./types-CP1CflWf.mjs";
-import { t as EmDashStorageError } from "./types-BW1syrlw.mjs";
-import { n as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-Cpvg_n3A.mjs";
+import { i as validateStorageCollectionName, n as validateJsonFieldName, r as validatePluginIdentifier } from "./validate-BpwoDOgt.mjs";
+import { l as jsonExtractExpr, s as isPostgres } from "./dialect-helpers-BSbfaO3F.mjs";
+import { t as PluginStateRepository } from "./state-BJfU9Uzw.mjs";
+import { a as reconcileManifestAccess, i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-CUYPfCEH.mjs";
+import { a as normalizeCapabilities, r as declaredAccessToCapabilities } from "./types-D6OcIp2P.mjs";
+import { t as EmDashStorageError } from "./types-BXUmsINL.mjs";
+import { r as resolveAndValidateExternalUrlTarget, t as SsrfError } from "./ssrf-DqebVE34.mjs";
 import { sql } from "kysely";
 import { createGzipDecoder, unpackTar } from "modern-tar";
 import { ClientResponseError, ClientValidationError } from "@atcute/client";
 import { checkEnvCompatibility, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
+import { evaluateRegistryReleaseWithdrawal } from "@emdash-cms/registry-client/withdrawal";
+import { NSID } from "@emdash-cms/registry-lexicons";
+import { fetchReleaseArtifact } from "@emdash-cms/registry-verification/artifact";
+import { isDid } from "@atcute/lexicons/syntax";
 
-//#region src/api/rev.ts
-/**
-* Generate a _rev token from a content item's version and updatedAt.
-*/
-function encodeRev(item) {
-	return encodeBase64(`${item.version}:${item.updatedAt}`);
-}
-/**
-* Decode a _rev token into its components.
-* Returns null if the token is malformed.
-*/
-function decodeRev(rev) {
-	try {
-		const decoded = decodeBase64(rev);
-		const colonIdx = decoded.indexOf(":");
-		if (colonIdx === -1) return null;
-		const version = parseInt(decoded.slice(0, colonIdx), 10);
-		const updatedAt = decoded.slice(colonIdx + 1);
-		if (isNaN(version) || !updatedAt) return null;
-		return {
-			version,
-			updatedAt
-		};
-	} catch {
-		return null;
-	}
-}
-/**
-* Validate a _rev token against a content item.
-* Returns null if valid (or if no _rev provided), or an error message if invalid.
-*/
-function validateRev(rev, item) {
-	if (!rev) return { valid: true };
-	const decoded = decodeRev(rev);
-	if (!decoded) return {
-		valid: false,
-		message: "Malformed _rev token"
-	};
-	if (decoded.version !== item.version || decoded.updatedAt !== item.updatedAt) return {
-		valid: false,
-		message: "Content has been modified since last read (version conflict)"
-	};
-	return { valid: true };
-}
-
-//#endregion
-//#region src/api/handlers/validate-media-fields.ts
-function asMediaRef(value) {
-	if (value === null || value === void 0) return null;
-	if (typeof value !== "object" || Array.isArray(value)) return null;
-	return value;
-}
-function fail(message) {
-	return {
-		success: false,
-		error: {
-			code: "INVALID_MIME_FOR_FIELD",
-			message
-		}
-	};
-}
-async function loadMediaFieldsForCollection(db, collectionSlug) {
-	const rows = await db.selectFrom("_emdash_fields").innerJoin("_emdash_collections", "_emdash_collections.id", "_emdash_fields.collection_id").select([
-		"_emdash_fields.slug",
-		"_emdash_fields.type",
-		"_emdash_fields.validation"
-	]).where("_emdash_collections.slug", "=", collectionSlug).where("_emdash_fields.type", "in", ["file", "image"]).execute();
-	const out = [];
-	for (const row of rows) {
-		const list = parseAllowedMimeTypes(row.validation);
-		if (!list) continue;
-		out.push({
-			slug: row.slug,
-			type: row.type,
-			allowedMimeTypes: list
-		});
-	}
-	return out;
-}
-async function validateMediaFields(db, collectionSlug, data) {
-	const fields = await requestCached(`mediaFields:${collectionSlug}`, () => loadMediaFieldsForCollection(db, collectionSlug));
-	if (fields.length === 0) return {
-		success: true,
-		data: true
-	};
-	const localIds = /* @__PURE__ */ new Set();
-	for (const field of fields) {
-		const ref = asMediaRef(data[field.slug]);
-		if (!ref) continue;
-		if ((typeof ref.provider === "string" ? ref.provider : "local") === "local" && typeof ref.id === "string") localIds.add(ref.id);
-	}
-	const idList = [...localIds];
-	const mimeById = /* @__PURE__ */ new Map();
-	if (idList.length > 0) for (const batch of chunks(idList, SQL_BATCH_SIZE)) {
-		const rows = await db.selectFrom("media").select(["id", "mime_type"]).where("id", "in", batch).execute();
-		for (const r of rows) mimeById.set(r.id, r.mime_type);
-	}
-	for (const field of fields) {
-		const value = data[field.slug];
-		if (value === null || value === void 0) continue;
-		const ref = asMediaRef(value);
-		if (!ref) continue;
-		const provider = typeof ref.provider === "string" ? ref.provider : "local";
-		let mime;
-		if (provider === "local") {
-			if (typeof ref.id !== "string") return fail(`Field '${field.slug}' references media with an invalid id`);
-			mime = mimeById.get(ref.id);
-			if (!mime) return fail(`Field '${field.slug}' references media with unknown MIME type`);
-		} else {
-			if (typeof ref.mimeType !== "string") return fail(`Field '${field.slug}' requires a mimeType declaration for non-local media`);
-			mime = ref.mimeType;
-		}
-		if (!matchesMimeAllowlist(mime, field.allowedMimeTypes)) return fail(`Field '${field.slug}' does not accept ${mime}`);
-	}
-	return {
-		success: true,
-		data: true
-	};
-}
-
-//#endregion
-//#region src/api/handlers/content.ts
-/**
-* Narrow a caught error to one carrying a structured `apiError` discriminant.
-* Used by transaction callbacks that want to surface a specific error code
-* through the standard Error throwing path.
-*/
-function hasApiError(error) {
-	if (!(error instanceof Error) || !("apiError" in error)) return false;
-	const { apiError } = error;
-	return typeof apiError === "object" && apiError !== null && "code" in apiError && typeof apiError.code === "string";
-}
-/**
-* Extract a slug source (title or name) from content data.
-* Returns null if no suitable string field is found.
-*/
-function getSlugSource(data) {
-	if (typeof data.title === "string" && data.title.length > 0) return data.title;
-	if (typeof data.name === "string" && data.name.length > 0) return data.name;
-	return null;
-}
-/** Default SEO values for content without an explicit SEO row */
-const SEO_DEFAULTS = {
-	title: null,
-	description: null,
-	image: null,
-	canonical: null,
-	noIndex: false
-};
-/**
-* Check if a collection has SEO enabled.
-*/
-async function collectionHasSeo(db, collection) {
-	return (await db.selectFrom("_emdash_collections").select("has_seo").where("slug", "=", collection).executeTakeFirst())?.has_seo === 1;
-}
-async function getCollectionPublishConfig(db, collection) {
-	const row = await db.selectFrom("_emdash_collections").select(["supports", "routable"]).where("slug", "=", collection).executeTakeFirst();
-	const supports = row?.supports ? JSON.parse(row.supports) : [];
-	return {
-		supportsRevisions: Array.isArray(supports) && supports.includes("revisions"),
-		routable: row?.routable !== 0
-	};
-}
-function requireRoutablePublishSlug(routable, slug) {
-	if (routable && !slug?.trim()) throw new EmDashValidationError("Cannot publish routable content without a slug");
-}
-/**
-* Hydrate SEO data on a single content item if the collection has SEO enabled.
-*/
-async function hydrateSeo(db, collection, item, hasSeo) {
-	if (!hasSeo) return;
-	item.seo = await new SeoRepository(db).get(collection, item.id);
-}
-/**
-* Hydrate SEO data on multiple content items using a single batch query.
-*/
-async function hydrateSeoMany(db, collection, items, hasSeo) {
-	if (!hasSeo || items.length === 0) return;
-	const seoMap = await new SeoRepository(db).getMany(collection, items.map((i) => i.id));
-	for (const item of items) item.seo = seoMap.get(item.id) ?? { ...SEO_DEFAULTS };
-}
-async function hydrateBylines(db, collection, item) {
-	const bylineRepo = new BylineRepository(db);
-	const localeOpt = item.locale ? { locale: item.locale } : void 0;
-	const bylines = await bylineRepo.getContentBylines(collection, item.id, localeOpt);
-	if (bylines.length > 0) {
-		item.bylines = bylines.map((c) => ({
-			...c,
-			source: "explicit"
-		}));
-		item.byline = bylines[0]?.byline ?? null;
-		return;
-	}
-	if (item.primaryBylineId) {
-		item.bylines = [];
-		item.byline = null;
-		return;
-	}
-	if (item.authorId) {
-		const fallback = await bylineRepo.findByUserId(item.authorId, localeOpt);
-		if (fallback) {
-			item.bylines = [{
-				byline: fallback,
-				sortOrder: 0,
-				roleLabel: null,
-				source: "inferred"
-			}];
-			item.byline = fallback;
-			return;
-		}
-	}
-	item.bylines = [];
-	item.byline = null;
-}
-/**
-* Batch-hydrate bylines for multiple items using two bulk queries instead of N+1.
-*
-* Items may live at different locales (e.g. a list endpoint returning the
-* translations of an entry). Group by `item.locale` and call the strict
-* per-locale repo method once per group so each item resolves against its
-* own locale's byline rows.
-*/
-async function hydrateBylinesMany(db, collection, items) {
-	if (items.length === 0) return;
-	const bylineRepo = new BylineRepository(db);
-	const localeBuckets = /* @__PURE__ */ new Map();
-	for (const item of items) {
-		const key = item.locale ?? null;
-		const bucket = localeBuckets.get(key);
-		if (bucket) bucket.push(item);
-		else localeBuckets.set(key, [item]);
-	}
-	const bylinesByItem = /* @__PURE__ */ new Map();
-	const itemsNeedingAuthorCheck = [];
-	for (const [locale, bucket] of localeBuckets) {
-		const localeOpt = locale ? { locale } : void 0;
-		const ids = bucket.map((i) => i.id);
-		const credits = await bylineRepo.getContentBylinesMany(collection, ids, localeOpt);
-		for (const [id, list] of credits) bylinesByItem.set(id, list);
-		for (const item of bucket) {
-			if (credits.has(item.id) && credits.get(item.id).length > 0) continue;
-			if (item.authorId) itemsNeedingAuthorCheck.push(item);
-		}
-	}
-	const fallbackByItem = /* @__PURE__ */ new Map();
-	if (itemsNeedingAuthorCheck.length > 0) {
-		const authorBuckets = /* @__PURE__ */ new Map();
-		for (const item of itemsNeedingAuthorCheck) {
-			if (item.primaryBylineId) continue;
-			const key = item.locale ?? null;
-			const bucket = authorBuckets.get(key);
-			if (bucket) bucket.push(item);
-			else authorBuckets.set(key, [item]);
-		}
-		for (const [locale, bucket] of authorBuckets) {
-			const localeOpt = locale ? { locale } : void 0;
-			const authorIds = bucket.map((i) => i.authorId).filter((id) => id !== null);
-			const uniqueAuthorIds = [...new Set(authorIds)];
-			if (uniqueAuthorIds.length === 0) continue;
-			const authorMap = await bylineRepo.findByUserIds(uniqueAuthorIds, localeOpt);
-			for (const item of bucket) {
-				if (!item.authorId) continue;
-				const f = authorMap.get(item.authorId);
-				if (f) fallbackByItem.set(item.id, f);
-			}
-		}
-	}
-	for (const item of items) {
-		const explicit = bylinesByItem.get(item.id);
-		if (explicit && explicit.length > 0) {
-			item.bylines = explicit.map((c) => ({
-				...c,
-				source: "explicit"
-			}));
-			item.byline = explicit[0]?.byline ?? null;
-			continue;
-		}
-		const fallback = fallbackByItem.get(item.id);
-		if (fallback) {
-			item.bylines = [{
-				byline: fallback,
-				sortOrder: 0,
-				roleLabel: null,
-				source: "inferred"
-			}];
-			item.byline = fallback;
-			continue;
-		}
-		item.bylines = [];
-		item.byline = null;
-	}
-}
-/**
-* Resolve an identifier (ID or slug) to a real content ID.
-* Returns the ID if found, null if not found.
-* When locale is provided, slug lookups are scoped to that locale.
-*/
-async function resolveId(repo, collection, identifier, locale) {
-	return (await repo.findByIdOrSlug(collection, identifier, locale ? resolveConfiguredLocale(locale) : void 0))?.id ?? null;
-}
-/**
-* Resolve an identifier (ID or slug) to a real content ID,
-* including trashed (soft-deleted) items.
-*/
-async function resolveIdIncludingTrashed(repo, collection, identifier, locale) {
-	return (await repo.findByIdOrSlugIncludingTrashed(collection, identifier, locale ? resolveConfiguredLocale(locale) : void 0))?.id ?? null;
-}
-/**
-* Resolve the columns a content-list search should match against. Always
-* includes `slug` (a standard column), adds the configured `titleField` plus
-* the `title`/`name` display fields when the collection actually defines them,
-* mirroring the admin's item-title resolution (titleField -> title -> name ->
-* slug), and includes every field explicitly marked searchable. Returning only
-* schema-backed columns avoids "no such column" errors.
-*/
-async function resolveSearchColumns(db, collection) {
-	const row = await db.selectFrom("_emdash_collections").select(["id", "title_field"]).where("slug", "=", collection).executeTakeFirst();
-	if (!row) return ["slug"];
-	const fields = await db.selectFrom("_emdash_fields").select(["slug", "searchable"]).where("collection_id", "=", row.id).orderBy("sort_order", "asc").execute();
-	const columns = new Set(["slug"]);
-	const fieldSlugs = new Set(fields.map((f) => f.slug));
-	if (row.title_field && fieldSlugs.has(row.title_field)) columns.add(row.title_field);
-	for (const candidate of ["title", "name"]) if (fieldSlugs.has(candidate)) columns.add(candidate);
-	for (const field of fields) if (field.searchable === 1) columns.add(field.slug);
-	return [...columns];
-}
-/**
-* Decide whether the content-list `q` filter can be served from the
-* collection's FTS5 index instead of a full-scan substring LIKE (#1517).
-*
-* Requires SQLite (FTS5 is SQLite-only), search enabled on the collection,
-* every non-slug display column present in the searchable-field set (or the
-* index would miss matches the LIKE finds), and the index table actually
-* existing.
-*/
-async function canUseFtsForListFilter(db, collection, searchColumns) {
-	if (!isSqlite(db)) return false;
-	const ftsManager = new FTSManager(db);
-	if (!(await ftsManager.getSearchConfig(collection))?.enabled) return false;
-	const searchable = new Set(await ftsManager.getSearchableFields(collection));
-	if (!searchColumns.every((col) => col === "slug" || searchable.has(col))) return false;
-	return ftsManager.ftsTableExists(collection);
-}
-/**
-* Create a 301 auto-redirect from an entry's old URL to its new one after a
-* slug change, using the collection's URL pattern. Shared by
-* handleContentUpdate (direct slug edits) and handleContentPublish (slug edits
-* staged as `_slug` in a draft revision, which only land on publish).
-*/
-async function createSlugChangeRedirect(db, collection, oldSlug, newSlug, contentId) {
-	if (await slugStillTaken(db, collection, oldSlug, contentId)) return;
-	const collectionRow = await db.selectFrom("_emdash_collections").select("url_pattern").where("slug", "=", collection).executeTakeFirst();
-	await new RedirectRepository(db).createAutoRedirect(collection, oldSlug, newSlug, contentId, collectionRow?.url_pattern ?? null);
-	invalidateRedirectCache();
-}
-/** Whether a row other than `contentId` still holds `slug` in this collection. */
-async function slugStillTaken(db, collection, slug, contentId) {
-	validateIdentifier(collection, "collection slug");
-	return (await sql`
-		SELECT id FROM ${sql.ref(`ec_${collection}`)}
-		WHERE slug = ${slug}
-		AND id != ${contentId}
-		AND deleted_at IS NULL
-		LIMIT 1
-	`.execute(db)).rows.length > 0;
-}
-/** Matches a date-only `YYYY-MM-DD` bound (no time component). */
-const DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
-/**
-* Normalize a date-range bound to an ISO datetime for lexicographic comparison
-* against stored ISO 8601 timestamps. A bare `YYYY-MM-DD` is widened to the
-* appropriate UTC day boundary so the range stays inclusive: a `start` bound
-* becomes the start of the day and an `end` bound the end of the day.
-* Otherwise a date-only upper bound would exclude every same-day row (since
-* `2024-06-01T12:00:00Z` sorts after `2024-06-01`). Full datetimes pass
-* through unchanged.
-*/
-function normalizeDateBound(value, edge) {
-	if (!value) return void 0;
-	if (!DATE_ONLY_RE.test(value)) return value;
-	return edge === "start" ? `${value}T00:00:00.000Z` : `${value}T23:59:59.999Z`;
-}
-/**
-* Build the repository's byline filter from the wire params.
-*
-* `locale` is the locale the list is scoped to, which is the locale an
-* inferred credit has to resolve at — the admin list is always scoped to the
-* locale picked in its switcher.
-*/
-function resolveBylineFilter(params, locale) {
-	const includeInferred = params.includeInferredBylines === true;
-	if (params.bylinesNone) return {
-		mode: "none",
-		includeInferred,
-		locale
-	};
-	const bylineIds = params.bylines ?? [];
-	if (bylineIds.length === 0) return void 0;
-	return {
-		mode: "any",
-		bylineIds,
-		includeInferred,
-		locale
-	};
-}
-/**
-* Create content list handler
-*/
-async function handleContentList(db, collection, params) {
-	try {
-		const repo = new ContentRepository(db);
-		const where = {};
-		if (params.status) where.status = params.status;
-		const locale = params.locale ? resolveConfiguredLocale(params.locale) : void 0;
-		if (locale) where.locale = locale;
-		if (params.authorId) where.authorId = params.authorId;
-		if (params.fieldFilters && Object.keys(params.fieldFilters).length > 0) where.fieldFilters = params.fieldFilters;
-		const bylineFilter = resolveBylineFilter(params, locale);
-		if (bylineFilter) where.bylineFilter = bylineFilter;
-		if (params.dateField && (params.dateFrom || params.dateTo)) where.dateFilter = {
-			field: params.dateField,
-			from: normalizeDateBound(params.dateFrom, "start"),
-			to: normalizeDateBound(params.dateTo, "end")
-		};
-		const q = params.q?.trim();
-		if (q) {
-			where.q = q;
-			where.searchColumns = await resolveSearchColumns(db, collection);
-			where.useFts = await canUseFtsForListFilter(db, collection, where.searchColumns);
-		}
-		let sortableExtras;
-		if (params.orderBy && !isSystemOrderField(params.orderBy)) {
-			const coll = await db.selectFrom("_emdash_collections").select(["title_field", "date_field"]).where("slug", "=", collection).executeTakeFirst();
-			sortableExtras = [coll?.title_field, coll?.date_field].filter((slug) => !!slug);
-		}
-		const result = await repo.findMany(collection, {
-			cursor: params.cursor,
-			limit: params.limit || 50,
-			where: Object.keys(where).length > 0 ? where : void 0,
-			orderBy: params.orderBy ? {
-				field: params.orderBy,
-				direction: params.order || "desc"
-			} : void 0,
-			sortableExtras
-		});
-		const hasSeo = await collectionHasSeo(db, collection);
-		await hydrateSeoMany(db, collection, result.items, hasSeo);
-		await hydrateBylinesMany(db, collection, result.items);
-		return {
-			success: true,
-			data: {
-				items: result.items,
-				nextCursor: result.nextCursor,
-				total: result.total
-			}
-		};
-	} catch (error) {
-		if (error instanceof InvalidCursorError) return {
-			success: false,
-			error: {
-				code: "INVALID_CURSOR",
-				message: error.message
-			}
-		};
-		if (error instanceof ContentCollectionNotFoundError || isMissingTableError(error)) return {
-			success: false,
-			error: {
-				code: "COLLECTION_NOT_FOUND",
-				message: `Collection '${collection}' not found`
-			}
-		};
-		if (isMissingColumnError(error, "deleted_at")) return {
-			success: false,
-			error: {
-				code: "COLLECTION_SCHEMA_MISMATCH",
-				message: `Collection '${collection}' backing table is missing the 'deleted_at' column`
-			}
-		};
-		if (error instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: error.message
-			}
-		};
-		console.error("Content list error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_LIST_ERROR",
-				message: "Failed to list content"
-			}
-		};
-	}
-}
-/**
-* List the distinct authors of a collection's live content.
-*
-* Backs the admin content-list author filter. Unlike `/admin/users` (ADMIN
-* only), this is gated on `content:read`, so any editor can filter by author.
-* Returns only users who have authored at least one non-trashed entry, sorted
-* by display name then email for a stable dropdown order.
-*/
-async function handleContentAuthors(db, collection) {
-	try {
-		const authorIds = await new ContentRepository(db).findDistinctAuthorIds(collection);
-		if (authorIds.length === 0) return {
-			success: true,
-			data: { items: [] }
-		};
-		return {
-			success: true,
-			data: { items: (await new UserRepository(db).findByIds(authorIds)).map((u) => ({
-				id: u.id,
-				name: u.name,
-				email: u.email,
-				avatarUrl: u.avatarUrl
-			})).toSorted((a, b) => (a.name ?? a.email).localeCompare(b.name ?? b.email)) }
-		};
-	} catch (error) {
-		if (isMissingTableError(error)) return {
-			success: false,
-			error: {
-				code: "COLLECTION_NOT_FOUND",
-				message: `Collection '${collection}' not found`
-			}
-		};
-		console.error("Content authors error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_AUTHORS_ERROR",
-				message: "Failed to list content authors"
-			}
-		};
-	}
-}
-/**
-* Get single content item
-*/
-async function handleContentGet(db, collection, id, locale) {
-	try {
-		const item = await new ContentRepository(db).findByIdOrSlug(collection, id, locale ? resolveConfiguredLocale(locale) : void 0);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Content item not found: ${id}`
-			}
-		};
-		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
-		await hydrateBylines(db, collection, item);
-		return {
-			success: true,
-			data: {
-				item,
-				_rev: encodeRev(item)
-			}
-		};
-	} catch (error) {
-		console.error("Content get error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_GET_ERROR",
-				message: "Failed to get content"
-			}
-		};
-	}
-}
-/**
-* Get a content item by id, including trashed items.
-* Used by restore endpoint for ownership checks on soft-deleted items.
-*/
-async function handleContentGetIncludingTrashed(db, collection, id, locale) {
-	try {
-		const item = await new ContentRepository(db).findByIdOrSlugIncludingTrashed(collection, id, locale ? resolveConfiguredLocale(locale) : void 0);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Content item not found: ${id}`
-			}
-		};
-		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
-		await hydrateBylines(db, collection, item);
-		return {
-			success: true,
-			data: {
-				item,
-				_rev: encodeRev(item)
-			}
-		};
-	} catch (error) {
-		console.error("Content get error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_GET_ERROR",
-				message: "Failed to get content"
-			}
-		};
-	}
-}
-/**
-* Create content item.
-*
-* Content + SEO writes are wrapped in a transaction so either both succeed
-* or neither does. If `body.seo` is provided for a non-SEO collection, the
-* API returns a validation error rather than silently dropping it.
-*/
-async function handleContentCreate(db, collection, body) {
-	try {
-		const hasSeo = await collectionHasSeo(db, collection);
-		if (body.seo && !hasSeo) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: `Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`
-			}
-		};
-		const mimeCheck = await validateMediaFields(db, collection, body.data);
-		if (!mimeCheck.success) return mimeCheck;
-		const item = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const bylineRepo = new BylineRepository(trx);
-			const effectiveLocale = body.locale ? resolveConfiguredLocale(body.locale) : getI18nConfig()?.defaultLocale;
-			let slug = body.slug;
-			if (!slug) {
-				const slugSource = getSlugSource(body.data);
-				if (slugSource) slug = await repo.generateUniqueSlug(collection, slugSource, effectiveLocale);
-			}
-			if (body.status === "published") requireRoutablePublishSlug((await getCollectionPublishConfig(trx, collection)).routable, slug);
-			const created = await repo.create({
-				type: collection,
-				slug,
-				data: body.data,
-				status: body.status || "draft",
-				authorId: body.authorId,
-				locale: effectiveLocale,
-				translationOf: body.translationOf,
-				createdAt: body.createdAt,
-				publishedAt: body.publishedAt
-			});
-			if (body.bylines !== void 0) created.primaryBylineId = (await bylineRepo.setContentBylines(collection, created.id, body.bylines))[0]?.byline.translationGroup ?? null;
-			if (body.translationOf) {
-				if (body.bylines === void 0) {
-					await bylineRepo.copyContentBylines(collection, body.translationOf, created.id);
-					const source = await repo.findById(collection, body.translationOf);
-					if (source) created.primaryBylineId = source.primaryBylineId;
-				}
-			}
-			await hydrateBylines(trx, collection, created);
-			if (body.seo && hasSeo) created.seo = await new SeoRepository(trx).upsert(collection, created.id, body.seo);
-			else if (hasSeo) created.seo = { ...SEO_DEFAULTS };
-			if (body.taxonomies) await assignTaxonomies(trx, collection, created.id, effectiveLocale, body.taxonomies);
-			return created;
-		});
-		return {
-			success: true,
-			data: {
-				item,
-				_rev: encodeRev(item)
-			}
-		};
-	} catch (error) {
-		if (isMissingTableError(error)) return {
-			success: false,
-			error: {
-				code: "COLLECTION_NOT_FOUND",
-				message: `Collection '${collection}' not found`
-			}
-		};
-		if (error instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: error.message
-			}
-		};
-		const message = error instanceof Error ? error.message.toLowerCase() : "";
-		if (message.includes("unique constraint failed") || message.includes("duplicate key")) {
-			if (message.includes("slug")) return {
-				success: false,
-				error: {
-					code: "SLUG_CONFLICT",
-					message: `Slug '${body.slug ?? "(auto-generated)"}' already exists in collection '${collection}'`
-				}
-			};
-			return {
-				success: false,
-				error: {
-					code: "CONFLICT",
-					message: "Unique constraint violation"
-				}
-			};
-		}
-		console.error("Content create error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_CREATE_ERROR",
-				message: "Failed to create content"
-			}
-		};
-	}
-}
-/**
-* Update content item.
-* If `_rev` is provided, validates it against the current version before writing.
-* No `_rev` = blind write (backwards-compatible for admin UI).
-*
-* Content + SEO writes are wrapped in a transaction for atomicity.
-*/
-async function handleContentUpdate(db, collection, id, body) {
-	try {
-		const hasSeo = await collectionHasSeo(db, collection);
-		if (body.seo && !hasSeo) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: `Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`
-			}
-		};
-		if (body.data) {
-			const mimeCheck = await validateMediaFields(db, collection, body.data);
-			if (!mimeCheck.success) return mimeCheck;
-		}
-		const resolvedId = await resolveId(new ContentRepository(db), collection, id, body.locale) ?? id;
-		const item = await withTransaction(db, async (trx) => {
-			const trxRepo = new ContentRepository(trx);
-			const bylineRepo = new BylineRepository(trx);
-			const existing = body._rev || body.slug !== void 0 || body.status === "published" ? await trxRepo.findById(collection, resolvedId) : null;
-			if (body._rev) {
-				if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`Content item not found: ${id}`), { apiError: { code: "NOT_FOUND" } });
-				const revCheck = validateRev(body._rev, existing);
-				if (!revCheck.valid) throw Object.assign(new Error(revCheck.message), { apiError: { code: "CONFLICT" } });
-			}
-			let oldSlug;
-			if (body.slug && existing?.slug && existing.slug !== body.slug) oldSlug = existing.slug;
-			if ((body.status ?? existing?.status) === "published") {
-				if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`Content item not found: ${id}`), { apiError: { code: "NOT_FOUND" } });
-				const publishConfig = await getCollectionPublishConfig(trx, collection);
-				const intendedSlug = body.slug !== void 0 ? body.slug : existing.slug;
-				requireRoutablePublishSlug(publishConfig.routable, intendedSlug);
-			}
-			const updated = await trxRepo.update(collection, resolvedId, {
-				data: body.data,
-				slug: body.slug,
-				status: body.status,
-				authorId: body.authorId,
-				publishedAt: body.publishedAt
-			});
-			if (body.bylines !== void 0) updated.primaryBylineId = (await bylineRepo.setContentBylines(collection, resolvedId, body.bylines))[0]?.byline.translationGroup ?? null;
-			if (oldSlug && body.slug) await createSlugChangeRedirect(trx, collection, oldSlug, body.slug, resolvedId);
-			if (isI18nEnabled() && body.data && updated.translationGroup) await syncNonTranslatableFields(trx, collection, updated.id, updated.translationGroup, body.data);
-			if (body.seo && hasSeo) updated.seo = await new SeoRepository(trx).upsert(collection, resolvedId, body.seo);
-			else if (hasSeo) updated.seo = await new SeoRepository(trx).get(collection, resolvedId);
-			await hydrateBylines(trx, collection, updated);
-			if (body.taxonomies) await assignTaxonomies(trx, collection, resolvedId, updated.locale ?? body.locale, body.taxonomies);
-			return updated;
-		});
-		return {
-			success: true,
-			data: {
-				item,
-				_rev: encodeRev(item)
-			}
-		};
-	} catch (error) {
-		if (hasApiError(error)) return {
-			success: false,
-			error: {
-				code: error.apiError.code,
-				message: error.message
-			}
-		};
-		if (isMissingTableError(error)) return {
-			success: false,
-			error: {
-				code: "COLLECTION_NOT_FOUND",
-				message: `Collection '${collection}' not found`
-			}
-		};
-		if (error instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: error.message
-			}
-		};
-		const message = error instanceof Error ? error.message.toLowerCase() : "";
-		if (message.includes("unique constraint failed") || message.includes("duplicate key")) {
-			if (message.includes("slug")) return {
-				success: false,
-				error: {
-					code: "SLUG_CONFLICT",
-					message: `Slug '${body.slug ?? id}' already exists in collection '${collection}'`
-				}
-			};
-			return {
-				success: false,
-				error: {
-					code: "CONFLICT",
-					message: "Unique constraint violation"
-				}
-			};
-		}
-		console.error("Content update error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_UPDATE_ERROR",
-				message: "Failed to update content"
-			}
-		};
-	}
-}
-/**
-* Duplicate content item.
-*
-* Only copies SEO data if the collection has SEO enabled.
-* Always returns consistent `seo` shape for SEO-enabled collections.
-*/
-async function handleContentDuplicate(db, collection, id, authorId) {
-	try {
-		const hasSeo = await collectionHasSeo(db, collection);
-		return {
-			success: true,
-			data: { item: await withTransaction(db, async (trx) => {
-				const repo = new ContentRepository(trx);
-				const bylineRepo = new BylineRepository(trx);
-				const resolvedId = await resolveId(repo, collection, id) ?? id;
-				const dup = await repo.duplicate(collection, resolvedId, authorId);
-				const existingBylines = await bylineRepo.getContentBylines(collection, resolvedId);
-				if (existingBylines.length > 0) await bylineRepo.setContentBylines(collection, dup.id, existingBylines.map((entry) => ({
-					bylineId: entry.byline.id,
-					roleLabel: entry.roleLabel
-				})));
-				if (hasSeo) {
-					const seoRepo = new SeoRepository(trx);
-					await seoRepo.copyForDuplicate(collection, resolvedId, dup.id);
-					dup.seo = await seoRepo.get(collection, dup.id);
-				}
-				await hydrateBylines(trx, collection, dup);
-				return dup;
-			}) }
-		};
-	} catch (err) {
-		if (err instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: err.message
-			}
-		};
-		console.error("Content duplicate error:", err);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_DUPLICATE_ERROR",
-				message: "Failed to duplicate content"
-			}
-		};
-	}
-}
-/**
-* Delete content item (soft delete - moves to trash)
-*/
-async function handleContentDelete(db, collection, id) {
-	try {
-		const result = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const resolvedId = await resolveId(repo, collection, id) ?? id;
-			return {
-				id: resolvedId,
-				deleted: await repo.delete(collection, resolvedId)
-			};
-		});
-		if (!result.deleted) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Content item not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: {
-				deleted: true,
-				id: result.id
-			}
-		};
-	} catch (error) {
-		console.error("Content delete error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_DELETE_ERROR",
-				message: "Failed to delete content"
-			}
-		};
-	}
-}
-/**
-* Restore content item from trash
-*/
-async function handleContentRestore(db, collection, id) {
-	try {
-		const item = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const resolvedId = await resolveIdIncludingTrashed(repo, collection, id) ?? id;
-			return repo.restore(collection, resolvedId);
-		});
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Trashed content item not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: {
-				restored: true,
-				item
-			}
-		};
-	} catch (error) {
-		console.error("Content restore error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_RESTORE_ERROR",
-				message: "Failed to restore content"
-			}
-		};
-	}
-}
-/**
-* Permanently delete content item (cannot be undone).
-* Also cleans up associated SEO data.
-*/
-async function handleContentPermanentDelete(db, collection, id) {
-	try {
-		const resolvedId = await resolveIdIncludingTrashed(new ContentRepository(db), collection, id) ?? id;
-		if (!await withTransaction(db, async (trx) => {
-			const wasDeleted = await new ContentRepository(trx).permanentDelete(collection, resolvedId);
-			if (wasDeleted) {
-				await new SeoRepository(trx).delete(collection, resolvedId);
-				await new CommentRepository(trx).deleteByContent(collection, resolvedId);
-				await new RevisionRepository(trx).deleteByEntry(collection, resolvedId);
-			}
-			return wasDeleted;
-		})) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Content item not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: {
-				deleted: true,
-				id: resolvedId
-			}
-		};
-	} catch (error) {
-		console.error("Content permanent delete error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_DELETE_ERROR",
-				message: "Failed to permanently delete content"
-			}
-		};
-	}
-}
-/**
-* List trashed content items
-*/
-async function handleContentListTrashed(db, collection, options = {}) {
-	try {
-		const result = await new ContentRepository(db).findTrashed(collection, {
-			limit: options.limit,
-			cursor: options.cursor
-		});
-		return {
-			success: true,
-			data: {
-				items: result.items.map((item) => ({
-					id: item.id,
-					type: item.type,
-					slug: item.slug,
-					status: item.status,
-					data: item.data,
-					authorId: item.authorId,
-					createdAt: item.createdAt,
-					updatedAt: item.updatedAt,
-					publishedAt: item.publishedAt,
-					deletedAt: item.deletedAt
-				})),
-				nextCursor: result.nextCursor
-			}
-		};
-	} catch (error) {
-		if (error instanceof InvalidCursorError) return {
-			success: false,
-			error: {
-				code: "INVALID_CURSOR",
-				message: error.message
-			}
-		};
-		console.error("Content list trashed error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_LIST_ERROR",
-				message: "Failed to list trashed content"
-			}
-		};
-	}
-}
-/**
-* Count trashed content items
-*/
-async function handleContentCountTrashed(db, collection) {
-	try {
-		return {
-			success: true,
-			data: { count: await new ContentRepository(db).countTrashed(collection) }
-		};
-	} catch (error) {
-		console.error("Content count trashed error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_COUNT_ERROR",
-				message: "Failed to count trashed content"
-			}
-		};
-	}
-}
-/**
-* Schedule content for future publishing
-*/
-async function handleContentSchedule(db, collection, id, scheduledAt) {
-	try {
-		const item = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const existing = await repo.findByIdOrSlug(collection, id);
-			const resolvedId = existing?.id ?? id;
-			if (existing) requireRoutablePublishSlug((await getCollectionPublishConfig(trx, collection)).routable, existing.slug);
-			return repo.schedule(collection, resolvedId, scheduledAt);
-		});
-		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch (error) {
-		if (error instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: error.message
-			}
-		};
-		console.error("Content schedule error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_SCHEDULE_ERROR",
-				message: "Failed to schedule content"
-			}
-		};
-	}
-}
-/**
-* Unschedule content (revert to draft)
-*/
-async function handleContentUnschedule(db, collection, id) {
-	try {
-		const item = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const resolvedId = await resolveId(repo, collection, id) ?? id;
-			return repo.unschedule(collection, resolvedId);
-		});
-		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch (error) {
-		if (error instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: error.message
-			}
-		};
-		console.error("Content unschedule error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_UNSCHEDULE_ERROR",
-				message: "Failed to unschedule content"
-			}
-		};
-	}
-}
-/**
-* Publish content immediately.
-*
-* Publication is one atomic content-row statement. On databases that support
-* transactions, the existing slug-redirect side write remains grouped with it.
-*/
-async function handleContentPublish(db, collection, id, options = {}) {
-	try {
-		const item = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const resolvedId = await resolveId(repo, collection, id) ?? id;
-			const publishConfig = await getCollectionPublishConfig(trx, collection);
-			const existing = await repo.findById(collection, resolvedId);
-			const published = await repo.publish(collection, resolvedId, options.publishedAt, options.requireScheduledDue, options.expectedScheduledAt, publishConfig.supportsRevisions, publishConfig.routable);
-			if (existing?.status === "published" && existing.slug && published.slug && existing.slug !== published.slug) await createSlugChangeRedirect(trx, collection, existing.slug, published.slug, resolvedId);
-			return published;
-		});
-		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch (error) {
-		if (error instanceof ContentMutationConflictError) return {
-			success: false,
-			error: {
-				code: "CONFLICT",
-				message: error.message
-			}
-		};
-		if (error instanceof ScheduledNotDueError) return {
-			success: false,
-			error: {
-				code: "NOT_DUE",
-				message: error.message
-			}
-		};
-		if (error instanceof EmDashValidationError) {
-			const details = error.details;
-			return {
-				success: false,
-				error: {
-					code: typeof details === "object" && details !== null && "code" in details && details.code === "SLUG_CONFLICT" ? "SLUG_CONFLICT" : "VALIDATION_ERROR",
-					message: error.message
-				}
-			};
-		}
-		const message = error instanceof Error ? error.message.toLowerCase() : "";
-		if ((message.includes("unique constraint failed") || message.includes("duplicate key")) && message.includes("slug")) return {
-			success: false,
-			error: {
-				code: "SLUG_CONFLICT",
-				message: `The staged slug is already used by another entry in collection '${collection}'`
-			}
-		};
-		console.error("Content publish error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_PUBLISH_ERROR",
-				message: "Failed to publish content"
-			}
-		};
-	}
-}
-/**
-* Unpublish content (revert to draft).
-*
-* Wrapped in a transaction — unpublish may create a draft revision
-* from the live version then update the status, which is multi-step.
-*/
-async function handleContentUnpublish(db, collection, id) {
-	try {
-		const item = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const resolvedId = await resolveId(repo, collection, id) ?? id;
-			return repo.unpublish(collection, resolvedId);
-		});
-		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch (error) {
-		if (error instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "VALIDATION_ERROR",
-				message: error.message
-			}
-		};
-		console.error("Content unpublish error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_UNPUBLISH_ERROR",
-				message: "Failed to unpublish content"
-			}
-		};
-	}
-}
-/**
-* Count scheduled content items
-*/
-async function handleContentCountScheduled(db, collection) {
-	try {
-		return {
-			success: true,
-			data: { count: await new ContentRepository(db).countScheduled(collection) }
-		};
-	} catch (error) {
-		console.error("Content count scheduled error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_COUNT_ERROR",
-				message: "Failed to count scheduled content"
-			}
-		};
-	}
-}
-/**
-* Discard draft changes (revert to live version)
-*/
-async function handleContentDiscardDraft(db, collection, id) {
-	try {
-		const item = await withTransaction(db, async (trx) => {
-			const repo = new ContentRepository(trx);
-			const resolvedId = await resolveId(repo, collection, id) ?? id;
-			return repo.discardDraft(collection, resolvedId);
-		});
-		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch (error) {
-		if (error instanceof EmDashValidationError) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: error.message
-			}
-		};
-		console.error("Content discard draft error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_DISCARD_DRAFT_ERROR",
-				message: "Failed to discard draft"
-			}
-		};
-	}
-}
-/**
-* Compare live and draft revisions
-*/
-async function handleContentCompare(db, collection, id) {
-	try {
-		const entry = await new ContentRepository(db).findByIdOrSlug(collection, id);
-		if (!entry) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Content item not found: ${id}`
-			}
-		};
-		const revisionRepo = new RevisionRepository(db);
-		const live = entry.liveRevisionId ? await revisionRepo.findById(entry.liveRevisionId) : null;
-		const draft = entry.draftRevisionId ? await revisionRepo.findById(entry.draftRevisionId) : null;
-		return {
-			success: true,
-			data: {
-				hasChanges: entry.draftRevisionId !== null && entry.draftRevisionId !== entry.liveRevisionId,
-				live: live?.data ?? null,
-				draft: draft?.data ?? null
-			}
-		};
-	} catch (error) {
-		console.error("Content compare error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_COMPARE_ERROR",
-				message: "Failed to compare revisions"
-			}
-		};
-	}
-}
-/**
-* Get all translations for a content item.
-* Returns the item's translation group members with locale and status info.
-*/
-async function handleContentTranslations(db, collection, id) {
-	try {
-		const repo = new ContentRepository(db);
-		const item = await repo.findByIdOrSlug(collection, id);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Content item not found: ${id}`
-			}
-		};
-		if (!item.translationGroup) return {
-			success: true,
-			data: {
-				translationGroup: item.id,
-				translations: [{
-					id: item.id,
-					locale: item.locale,
-					slug: item.slug,
-					status: item.status,
-					updatedAt: item.updatedAt
-				}]
-			}
-		};
-		const translations = await repo.findTranslations(collection, item.translationGroup);
-		return {
-			success: true,
-			data: {
-				translationGroup: item.translationGroup,
-				translations: translations.map((t) => ({
-					id: t.id,
-					locale: t.locale,
-					slug: t.slug,
-					status: t.status,
-					updatedAt: t.updatedAt
-				}))
-			}
-		};
-	} catch (error) {
-		if (error instanceof Error) console.error("Content translations error:", error);
-		return {
-			success: false,
-			error: {
-				code: "CONTENT_TRANSLATIONS_ERROR",
-				message: "Failed to get translations"
-			}
-		};
-	}
-}
-/**
-* Sync non-translatable fields to sibling locales.
-*
-* When a content item is updated and it belongs to a translation group,
-* any non-translatable fields in the update data are written to all other
-* rows in the same translation group within the same transaction.
-*
-* Non-translatable fields are **copied, not linked** — each row owns its
-* own data. This keeps queries simple and avoids cross-row joins.
-*/
-async function syncNonTranslatableFields(trx, collectionSlug, updatedItemId, translationGroup, data) {
-	const collection = await trx.selectFrom("_emdash_collections").select("id").where("slug", "=", collectionSlug).executeTakeFirst();
-	if (!collection) return;
-	const nonTranslatableSlugs = (await trx.selectFrom("_emdash_fields").select("slug").where("collection_id", "=", collection.id).where("translatable", "=", 0).execute()).map((f) => f.slug);
-	if (nonTranslatableSlugs.length === 0) return;
-	const syncData = {};
-	for (const slug of nonTranslatableSlugs) if (slug in data) syncData[slug] = data[slug];
-	if (Object.keys(syncData).length === 0) return;
-	validateIdentifier(collectionSlug, "collection slug");
-	const tableName = `ec_${collectionSlug}`;
-	const setClauses = Object.entries(syncData).map(([key, value]) => {
-		validateIdentifier(key, "field slug");
-		const serialized = typeof value === "object" && value !== null ? JSON.stringify(value) : value;
-		return sql`${sql.ref(key)} = ${serialized}`;
-	});
-	await sql`
-		UPDATE ${sql.ref(tableName)}
-		SET ${sql.join(setClauses, sql`, `)}
-		WHERE translation_group = ${translationGroup}
-		AND id != ${updatedItemId}
-	`.execute(trx);
-}
-/**
-* Resolve a `{ taxonomyName: [slug, ...] }` map to term IDs and replace the
-* entry's assignments for each named taxonomy.
-*
-* Shared by handleContentCreate and handleContentUpdate so both MCP entry
-* points behave identically. Slug resolution is scoped to `locale`; passing
-* `undefined` lets `findBySlug` fall back to its default (lowest locale code)
-* so callers on single-locale sites don't need to know the site's default.
-*
-* Throws EmDashValidationError on unknown slug or wrong shape; the calling
-* handler translates that into a VALIDATION_ERROR response.
-*/
-async function assignTaxonomies(trx, collection, entryId, locale, taxonomies) {
-	const taxRepo = new TaxonomyRepository(trx);
-	let anyChange = false;
-	for (const [taxonomyName, slugs] of Object.entries(taxonomies)) {
-		if (!Array.isArray(slugs)) throw new EmDashValidationError(`taxonomies.${taxonomyName} must be an array of term slugs`);
-		const termIds = [];
-		for (const slug of slugs) {
-			if (typeof slug !== "string" || slug.length === 0) throw new EmDashValidationError(`taxonomies.${taxonomyName} contains a non-string or empty slug`);
-			const term = await taxRepo.findBySlug(taxonomyName, slug, locale);
-			if (!term) throw new EmDashValidationError(`Unknown taxonomy term: ${taxonomyName}='${slug}'${locale ? ` (locale '${locale}')` : ""}`);
-			termIds.push(term.id);
-		}
-		await taxRepo.setTermsForEntry(collection, entryId, taxonomyName, termIds);
-		anyChange = true;
-	}
-	if (anyChange) invalidateTermCache();
-}
-
-//#endregion
-//#region src/api/handlers/manifest.ts
-/**
-* Manifest generation handlers
-*/
-/** Pattern to add spaces before capital letters */
-const CAMEL_CASE_PATTERN = /([A-Z])/g;
-const FIRST_CHAR_PATTERN = /^./;
-/**
-* Generate admin manifest from collections
-*/
-async function generateManifest(collections, plugins = {}) {
-	const manifestCollections = {};
-	for (const [name, definition] of Object.entries(collections)) {
-		const fields = extractFieldDescriptors(definition.schema);
-		manifestCollections[name] = {
-			label: definition.admin.label,
-			labelSingular: definition.admin.labelSingular || definition.admin.label,
-			supports: definition.admin.supports || [],
-			routable: definition.admin.routable ?? true,
-			fields
-		};
-	}
-	return {
-		version: "0.1.0",
-		hash: await hashString(JSON.stringify(manifestCollections)),
-		collections: manifestCollections,
-		plugins
-	};
-}
-/**
-* Extract field descriptors from Zod schema
-* Note: This is a simplified implementation that handles common types
-*/
-function extractFieldDescriptors(schema) {
-	const fields = {};
-	const shape = typeof schema._def?.shape === "function" ? schema._def.shape() : schema.shape || {};
-	for (const [name, fieldSchema] of Object.entries(shape)) fields[name] = extractFieldType(name, fieldSchema);
-	return fields;
-}
-/**
-* Extract field type from Zod schema
-*/
-/** Type guard: check if a value is a non-null object */
-function isObject(value) {
-	return typeof value === "object" && value !== null;
-}
-function extractFieldType(name, schema) {
-	if (!isObject(schema)) return {
-		kind: "string",
-		label: formatLabel(name)
-	};
-	if (schema.isPortableText) return {
-		kind: "portableText",
-		label: formatLabel(name)
-	};
-	if (schema.isImage) return {
-		kind: "image",
-		label: formatLabel(name)
-	};
-	if (schema.isReference) return {
-		kind: "reference",
-		label: formatLabel(name)
-	};
-	const def = isObject(schema._def) ? schema._def : void 0;
-	switch (typeof def?.typeName === "string" ? def.typeName : void 0) {
-		case "ZodString": return {
-			kind: "string",
-			label: formatLabel(name)
-		};
-		case "ZodNumber": return {
-			kind: "number",
-			label: formatLabel(name)
-		};
-		case "ZodBoolean": return {
-			kind: "boolean",
-			label: formatLabel(name)
-		};
-		case "ZodDate": return {
-			kind: "datetime",
-			label: formatLabel(name)
-		};
-		case "ZodEnum": {
-			const values = Array.isArray(def?.values) ? def.values : [];
-			return {
-				kind: "select",
-				label: formatLabel(name),
-				options: values.filter((v) => typeof v === "string").map((v) => ({
-					value: v,
-					label: v.charAt(0).toUpperCase() + v.slice(1)
-				}))
-			};
-		}
-		case "ZodArray": return {
-			kind: "array",
-			label: formatLabel(name)
-		};
-		case "ZodObject": return {
-			kind: "object",
-			label: formatLabel(name)
-		};
-		case "ZodOptional":
-		case "ZodDefault":
-			if (def?.innerType) return extractFieldType(name, def.innerType);
-			return {
-				kind: "string",
-				label: formatLabel(name)
-			};
-		default: return {
-			kind: "string",
-			label: formatLabel(name)
-		};
-	}
-}
-/**
-* Format field name as label
-*/
-function formatLabel(name) {
-	return name.replace(CAMEL_CASE_PATTERN, " $1").replace(FIRST_CHAR_PATTERN, (str) => str.toUpperCase()).trim();
-}
-
-//#endregion
-//#region src/api/handlers/revision.ts
-/**
-* List revisions for a content entry
-*/
-async function handleRevisionList(db, collection, entryId, params = {}) {
-	try {
-		const repo = new RevisionRepository(db);
-		const [items, total] = await Promise.all([repo.findByEntry(collection, entryId, { limit: Math.min(params.limit || 50, 100) }), repo.countByEntry(collection, entryId)]);
-		return {
-			success: true,
-			data: {
-				items,
-				total
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "REVISION_LIST_ERROR",
-				message: "Failed to list revisions"
-			}
-		};
-	}
-}
-/**
-* Get a specific revision
-*/
-async function handleRevisionGet(db, revisionId) {
-	try {
-		const item = await new RevisionRepository(db).findById(revisionId);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Revision not found: ${revisionId}`
-			}
-		};
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "REVISION_GET_ERROR",
-				message: "Failed to get revision"
-			}
-		};
-	}
-}
-/**
-* Restore a revision (updates content to this revision's data and creates new revision)
-*/
-async function handleRevisionRestore(db, revisionId, callerUserId) {
-	try {
-		const revision = await new RevisionRepository(db).findById(revisionId);
-		if (!revision) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Revision not found: ${revisionId}`
-			}
-		};
-		const { _slug, ...fieldData } = revision.data;
-		const { item, queuedRevisionId } = await withTransaction(db, async (trx) => {
-			const trxContentRepo = new ContentRepository(trx);
-			const trxRevisionRepo = new RevisionRepository(trx);
-			return {
-				item: await trxContentRepo.update(revision.collection, revision.entryId, {
-					data: fieldData,
-					slug: typeof _slug === "string" ? _slug : void 0
-				}),
-				queuedRevisionId: (await trxRevisionRepo.create({
-					collection: revision.collection,
-					entryId: revision.entryId,
-					data: revision.data,
-					authorId: callerUserId
-				})).id
-			};
-		});
-		const pruneRepo = new RevisionRepository(db);
-		after(async () => {
-			try {
-				await pruneRepo.pruneQueuedEntry(revision.collection, revision.entryId, queuedRevisionId, 50);
-			} catch (error) {
-				console.error(`[revisions] Failed to prune revisions for ${revision.collection}/${revision.entryId}:`, error);
-			}
-		});
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "REVISION_RESTORE_ERROR",
-				message: "Failed to restore revision"
-			}
-		};
-	}
-}
-
-//#endregion
-//#region src/api/handlers/media.ts
-/**
-* List media items
-*/
-async function handleMediaList(db, params) {
-	try {
-		const result = await new MediaRepository(db).findMany({
-			cursor: params.cursor,
-			limit: Math.min(params.limit || 50, 100),
-			mimeType: params.mimeType,
-			q: params.q
-		});
-		return {
-			success: true,
-			data: {
-				items: result.items,
-				nextCursor: result.nextCursor
-			}
-		};
-	} catch (error) {
-		if (error instanceof InvalidCursorError) return {
-			success: false,
-			error: {
-				code: "INVALID_CURSOR",
-				message: error.message
-			}
-		};
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_LIST_ERROR",
-				message: "Failed to list media"
-			}
-		};
-	}
-}
-/**
-* Get single media item
-*/
-async function handleMediaGet(db, id) {
-	try {
-		const item = await new MediaRepository(db).findById(id);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Media item not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_GET_ERROR",
-				message: "Failed to get media"
-			}
-		};
-	}
-}
-/**
-* Create media item (after file upload)
-*/
-async function handleMediaCreate(db, input) {
-	try {
-		return {
-			success: true,
-			data: { item: await new MediaRepository(db).create(input) }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_CREATE_ERROR",
-				message: "Failed to create media"
-			}
-		};
-	}
-}
-/**
-* Update media metadata
-*/
-async function handleMediaUpdate(db, id, input) {
-	try {
-		const item = await new MediaRepository(db).update(id, input);
-		if (!item) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Media item not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: { item }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_UPDATE_ERROR",
-				message: "Failed to update media"
-			}
-		};
-	}
-}
-/**
-* Delete media item
-*/
-async function handleMediaDelete(db, id) {
-	try {
-		const storageKey = await new MediaRepository(db).deleteWithStorageKey(id);
-		if (!storageKey) return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Media item not found: ${id}`
-			}
-		};
-		return {
-			success: true,
-			data: {
-				deleted: true,
-				storageKey
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "MEDIA_DELETE_ERROR",
-				message: "Failed to delete media"
-			}
-		};
-	}
-}
-
-//#endregion
-//#region src/api/handlers/plugins.ts
-function marketplaceIconUrl(marketplaceUrl, pluginId) {
-	return `${marketplaceUrl}/api/v1/plugins/${encodeURIComponent(pluginId)}/icon`;
-}
-/**
-* Get plugin info from configured plugin and database state
-*/
-function buildPluginInfo(plugin, state, marketplaceUrl) {
-	const status = state?.status ?? "active";
-	const enabled = status === "active";
-	const isMarketplace = (state?.source ?? "config") === "marketplace";
-	return {
-		id: plugin.id,
-		name: state?.displayName || plugin.id,
-		version: plugin.version,
-		package: void 0,
-		enabled,
-		status,
-		source: state?.source ?? "config",
-		marketplaceVersion: state?.marketplaceVersion ?? void 0,
-		registryPublisherDid: state?.registryPublisherDid ?? void 0,
-		registrySlug: state?.registrySlug ?? void 0,
-		capabilities: plugin.capabilities,
-		hasAdminPages: (plugin.admin.pages?.length ?? 0) > 0,
-		hasDashboardWidgets: (plugin.admin.widgets?.length ?? 0) > 0,
-		hasHooks: Object.keys(plugin.hooks ?? {}).length > 0,
-		hasSettings: Object.keys(plugin.admin.settingsSchema ?? {}).length > 0,
-		installedAt: state?.installedAt?.toISOString(),
-		activatedAt: state?.activatedAt?.toISOString() ?? void 0,
-		deactivatedAt: state?.deactivatedAt?.toISOString() ?? void 0,
-		description: state?.description ?? void 0,
-		iconUrl: isMarketplace && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, plugin.id) : void 0,
-		mcpToolsEnabled: state?.mcpToolsEnabled ?? false,
-		mcpTools: Object.entries(plugin.mcp?.tools ?? {}).flatMap(([name, tool]) => {
-			const permission = plugin.routes[tool.route]?.permission;
-			return permission ? [{
-				name,
-				description: tool.description,
-				route: tool.route,
-				permission,
-				destructive: tool.destructive ?? false
-			}] : [];
-		})
-	};
-}
-/**
-* Build plugin info for a statically-sandboxed plugin entry
-*/
-function buildSandboxedPluginInfo(entry, state) {
-	const status = state?.status ?? "active";
-	const enabled = status === "active";
-	return {
-		id: entry.id,
-		name: state?.displayName || entry.id,
-		version: entry.version,
-		package: void 0,
-		enabled,
-		status,
-		source: "config",
-		sandboxed: true,
-		capabilities: entry.capabilities,
-		hasAdminPages: (entry.adminPages?.length ?? 0) > 0,
-		hasDashboardWidgets: (entry.adminWidgets?.length ?? 0) > 0,
-		hasHooks: false,
-		hasSettings: Object.keys(entry.settingsSchema ?? {}).length > 0,
-		installedAt: state?.installedAt?.toISOString(),
-		activatedAt: state?.activatedAt?.toISOString() ?? void 0,
-		deactivatedAt: state?.deactivatedAt?.toISOString() ?? void 0,
-		description: state?.description ?? void 0,
-		mcpToolsEnabled: state?.mcpToolsEnabled ?? false,
-		mcpTools: entry.mcp?.tools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool) ?? []
-	};
-}
-/**
-* List all configured plugins with their state
-*/
-async function handlePluginList(db, configuredPlugins, sandboxedPluginEntries, marketplaceUrl, runtimeSettingsSchemaLookup) {
-	try {
-		const allStates = await new PluginStateRepository(db).getAll();
-		const stateMap = new Map(allStates.map((s) => [s.pluginId, s]));
-		const configuredIds = new Set(configuredPlugins.map((p) => p.id));
-		const items = configuredPlugins.map((plugin) => {
-			return buildPluginInfo(plugin, stateMap.get(plugin.id) ?? null, marketplaceUrl);
-		});
-		for (const entry of sandboxedPluginEntries) {
-			if (configuredIds.has(entry.id)) continue;
-			configuredIds.add(entry.id);
-			items.push(buildSandboxedPluginInfo(entry, stateMap.get(entry.id) ?? null));
-		}
-		for (const state of allStates) {
-			if (state.source !== "marketplace" && state.source !== "registry") continue;
-			if (configuredIds.has(state.pluginId)) continue;
-			items.push({
-				id: state.pluginId,
-				name: state.displayName || state.pluginId,
-				version: state.marketplaceVersion ?? state.version,
-				enabled: state.status === "active",
-				status: state.status,
-				source: state.source,
-				marketplaceVersion: state.marketplaceVersion ?? void 0,
-				registryPublisherDid: state.registryPublisherDid ?? void 0,
-				registrySlug: state.registrySlug ?? void 0,
-				capabilities: [],
-				hasAdminPages: false,
-				hasDashboardWidgets: false,
-				hasHooks: false,
-				hasSettings: Object.keys(runtimeSettingsSchemaLookup?.(state.pluginId) ?? {}).length > 0,
-				installedAt: state.installedAt?.toISOString(),
-				activatedAt: state.activatedAt?.toISOString() ?? void 0,
-				deactivatedAt: state.deactivatedAt?.toISOString() ?? void 0,
-				description: state.description ?? void 0,
-				iconUrl: state.source === "marketplace" && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, state.pluginId) : void 0,
-				mcpToolsEnabled: state.mcpToolsEnabled,
-				mcpTools: []
-			});
-		}
-		return {
-			success: true,
-			data: { items }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "PLUGIN_LIST_ERROR",
-				message: "Failed to list plugins"
-			}
-		};
-	}
-}
-/**
-* Get a single plugin's info
-*/
-async function handlePluginGet(db, configuredPlugins, sandboxedPluginEntries, pluginId, marketplaceUrl) {
-	try {
-		const stateRepo = new PluginStateRepository(db);
-		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (plugin) return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, await stateRepo.get(pluginId), marketplaceUrl) }
-		};
-		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
-		if (sandboxed) return {
-			success: true,
-			data: { item: buildSandboxedPluginInfo(sandboxed, await stateRepo.get(pluginId)) }
-		};
-		return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Plugin not found: ${pluginId}`
-			}
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "PLUGIN_GET_ERROR",
-				message: "Failed to get plugin"
-			}
-		};
-	}
-}
-/**
-* Build a minimal `PluginInfo` for a plugin that exists only as a
-* `_plugin_state` row (marketplace or registry install), with no
-* matching `configuredPlugins` entry. Runtime-installed plugins don't
-* have ResolvedPlugin metadata until they're loaded into the sandbox,
-* so the enable/disable response surfaces the state-row view as a
-* stable shape the admin UI already understands.
-*/
-function buildStateOnlyPluginInfo(state) {
-	return {
-		id: state.pluginId,
-		name: state.displayName || state.pluginId,
-		version: state.marketplaceVersion ?? state.version,
-		enabled: state.status === "active",
-		status: state.status,
-		source: state.source,
-		marketplaceVersion: state.marketplaceVersion ?? void 0,
-		registryPublisherDid: state.registryPublisherDid ?? void 0,
-		registrySlug: state.registrySlug ?? void 0,
-		capabilities: [],
-		hasAdminPages: false,
-		hasDashboardWidgets: false,
-		hasHooks: false,
-		hasSettings: false,
-		installedAt: state.installedAt?.toISOString(),
-		activatedAt: state.activatedAt?.toISOString() ?? void 0,
-		deactivatedAt: state.deactivatedAt?.toISOString() ?? void 0,
-		description: state.description ?? void 0,
-		mcpToolsEnabled: state.mcpToolsEnabled,
-		mcpTools: []
-	};
-}
-/**
-* Enable a plugin
-*/
-async function handlePluginEnable(db, configuredPlugins, sandboxedPluginEntries, pluginId) {
-	try {
-		const stateRepo = new PluginStateRepository(db);
-		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (plugin) return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, await stateRepo.enable(pluginId, plugin.version)) }
-		};
-		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
-		if (sandboxed) return {
-			success: true,
-			data: { item: buildSandboxedPluginInfo(sandboxed, await stateRepo.enable(pluginId, sandboxed.version)) }
-		};
-		const existing = await stateRepo.get(pluginId);
-		if (!existing || existing.source !== "marketplace" && existing.source !== "registry") return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Plugin not found: ${pluginId}`
-			}
-		};
-		return {
-			success: true,
-			data: { item: buildStateOnlyPluginInfo(await stateRepo.enable(pluginId, existing.version)) }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "PLUGIN_ENABLE_ERROR",
-				message: "Failed to enable plugin"
-			}
-		};
-	}
-}
-/**
-* Disable a plugin
-*/
-async function handlePluginDisable(db, configuredPlugins, sandboxedPluginEntries, pluginId) {
-	try {
-		const stateRepo = new PluginStateRepository(db);
-		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (plugin) return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, await stateRepo.disable(pluginId, plugin.version)) }
-		};
-		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
-		if (sandboxed) return {
-			success: true,
-			data: { item: buildSandboxedPluginInfo(sandboxed, await stateRepo.disable(pluginId, sandboxed.version)) }
-		};
-		const existing = await stateRepo.get(pluginId);
-		if (!existing || existing.source !== "marketplace" && existing.source !== "registry") return {
-			success: false,
-			error: {
-				code: "NOT_FOUND",
-				message: `Plugin not found: ${pluginId}`
-			}
-		};
-		return {
-			success: true,
-			data: { item: buildStateOnlyPluginInfo(await stateRepo.disable(pluginId, existing.version)) }
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: "PLUGIN_DISABLE_ERROR",
-				message: "Failed to disable plugin"
-			}
-		};
-	}
-}
-
-//#endregion
-//#region src/api/handlers/plugin-settings.ts
-function settingsKey(pluginId, key) {
-	return `plugin:${pluginId}:settings:${key}`;
-}
-/**
-* Resolve a plugin's settings schema from either the configured
-* (in-process) plugin list or the statically-sandboxed entries.
-* Returns null when the plugin doesn't exist, undefined-equivalent
-* empty object when it declares no schema.
-*/
-function getPluginSettingsSchema(configuredPlugins, sandboxedPluginEntries, pluginId) {
-	const plugin = configuredPlugins.find((p) => p.id === pluginId);
-	if (plugin) return plugin.admin.settingsSchema ?? {};
-	const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
-	if (sandboxed) return sandboxed.settingsSchema ?? {};
-	return null;
-}
-/**
-* Validate a single value against its schema field.
-* Returns an error message, or null when valid.
-*/
-function validateValue(key, field, value) {
-	switch (field.type) {
-		case "string":
-		case "secret":
-		case "url":
-		case "email":
-			if (typeof value !== "string") return `Setting "${key}" must be a string`;
-			if (field.type === "url" && value !== "" && !URL.canParse(value)) return `Setting "${key}" must be a valid URL`;
-			if (field.type === "email" && value !== "" && !value.includes("@")) return `Setting "${key}" must be a valid email address`;
-			return null;
-		case "number":
-			if (typeof value !== "number" || Number.isNaN(value)) return `Setting "${key}" must be a number`;
-			if (field.min !== void 0 && value < field.min) return `Setting "${key}" must be at least ${field.min}`;
-			if (field.max !== void 0 && value > field.max) return `Setting "${key}" must be at most ${field.max}`;
-			return null;
-		case "boolean": return typeof value === "boolean" ? null : `Setting "${key}" must be a boolean`;
-		case "select":
-			if (typeof value !== "string" || !field.options.some((o) => o.value === value)) return `Setting "${key}" must be one of the defined options`;
-			return null;
-		default: return `Setting "${key}" has an unknown field type`;
-	}
-}
-async function buildSettingsResponse(optionsRepo, pluginId, schema) {
-	const keys = Object.keys(schema);
-	const stored = await optionsRepo.getMany(keys.map((key) => settingsKey(pluginId, key)));
-	const values = {};
-	const secretsSet = {};
-	for (const key of keys) {
-		const field = schema[key];
-		if (!field) continue;
-		const storedValue = stored.get(settingsKey(pluginId, key));
-		if (field.type === "secret") {
-			secretsSet[key] = typeof storedValue === "string" && storedValue.length > 0;
-			continue;
-		}
-		if (storedValue !== void 0 && storedValue !== null) values[key] = storedValue;
-		else if ("default" in field && field.default !== void 0) values[key] = field.default;
-		else values[key] = null;
-	}
-	return {
-		schema,
-		values,
-		secretsSet
-	};
-}
-/**
-* Get a plugin's settings (schema + current values, secrets masked)
-*/
-async function handlePluginSettingsGet(db, pluginId, schema) {
-	try {
-		return {
-			success: true,
-			data: await buildSettingsResponse(new OptionsRepository(db), pluginId, schema)
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: ErrorCode.PLUGIN_SETTINGS_READ_ERROR,
-				message: "Failed to read plugin settings"
-			}
-		};
-	}
-}
-/**
-* Update a plugin's settings.
-*
-* Only keys present in `updates` are written. A `null` value deletes the
-* stored value (reverting to the schema default). Secret fields are
-* write-only: they accept a new string value or `null` to clear, and the
-* response never echoes them back.
-*/
-async function handlePluginSettingsUpdate(db, pluginId, schema, updates) {
-	try {
-		for (const [key, value] of Object.entries(updates)) {
-			const field = schema[key];
-			if (!field) return {
-				success: false,
-				error: {
-					code: ErrorCode.VALIDATION_ERROR,
-					message: `Unknown setting "${key}" for plugin "${pluginId}"`
-				}
-			};
-			if (value === null) continue;
-			const error = validateValue(key, field, value);
-			if (error) return {
-				success: false,
-				error: {
-					code: ErrorCode.VALIDATION_ERROR,
-					message: error
-				}
-			};
-		}
-		return {
-			success: true,
-			data: await withTransaction(db, async (trx) => {
-				const txRepo = new OptionsRepository(trx);
-				for (const [key, value] of Object.entries(updates)) if (value === null) await txRepo.delete(settingsKey(pluginId, key));
-				else await txRepo.set(settingsKey(pluginId, key), value);
-				return buildSettingsResponse(txRepo, pluginId, schema);
-			})
-		};
-	} catch {
-		return {
-			success: false,
-			error: {
-				code: ErrorCode.PLUGIN_SETTINGS_UPDATE_ERROR,
-				message: "Failed to update plugin settings"
-			}
-		};
-	}
-}
-
-//#endregion
 //#region src/plugins/marketplace.ts
 /**
 * MarketplaceClient — HTTP client for the EmDash Plugin Marketplace
@@ -3307,9 +1095,368 @@ async function handleThemeGetDetail(marketplaceUrl, themeId) {
 	}
 }
 
+//#endregion
+//#region src/registry/artifact-fetch.ts
+const TRAILING_DOT$1 = /\.+$/;
+const HEADER_END = new Uint8Array([
+	13,
+	10,
+	13,
+	10
+]);
+const CRLF = new Uint8Array([13, 10]);
+const STATUS_LINE_RE = /^HTTP\/1\.[01] ([2-5][0-9]{2})(?: .*)?$/;
+const HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const FOLDED_HEADER_RE = /^[ \t]/;
+const CONTENT_LENGTH_RE = /^(0|[1-9][0-9]*)$/;
+const CHUNK_SIZE_RE = /^[0-9A-Fa-f]+$/;
+const MAX_HEADER_BYTES = 32 * 1024;
+const LOCALHOST_HOSTNAMES = new Set([
+	"localhost",
+	"localhost.localdomain",
+	"ip6-localhost",
+	"ip6-loopback"
+]);
+let defaultTransport = null;
+function isLocalhostHostname(hostname) {
+	const normalized = hostname.toLowerCase().replace(TRAILING_DOT$1, "");
+	return LOCALHOST_HOSTNAMES.has(normalized) || normalized.endsWith(".localhost") || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]" || normalized.startsWith("::ffff:127.") || normalized.startsWith("::ffff:7f00:");
+}
+async function resolveSafeArtifactTarget(urlString) {
+	let url;
+	try {
+		url = new URL(urlString);
+	} catch {
+		throw new Error(`Invalid artifact URL: ${urlString}`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`Artifact URL protocol not allowed: ${url.protocol}`);
+	if (url.username || url.password) throw new Error("Artifact URL must not contain embedded credentials");
+	const hostname = stripIpv6Brackets(url.hostname.toLowerCase().replace(TRAILING_DOT$1, ""));
+	const localhost = isLocalhostHostname(hostname);
+	if (!import.meta.env.DEV) {
+		if (url.protocol === "http:") throw new Error("Artifact URL must use https");
+		if (localhost) throw new Error(`Artifact URL points to localhost: ${hostname}`);
+	} else if (url.protocol === "http:" && !localhost) throw new Error("Artifact URL must use https (http allowed only for localhost in dev)");
+	if (localhost) return {
+		url,
+		addresses: []
+	};
+	try {
+		return await resolveAndValidateExternalUrlTarget(url.href);
+	} catch (error) {
+		if (error instanceof SsrfError) throw new Error(`Artifact URL rejected: ${error.message}`, { cause: error });
+		throw error;
+	}
+}
+async function fetchRegistryArtifactUrl(urlString, options) {
+	if (!Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 0) throw new TypeError("Registry artifact response limit is invalid");
+	const target = await resolveSafeArtifactTarget(urlString);
+	if (target.addresses.length === 0) return globalThis.fetch(target.url, {
+		redirect: "manual",
+		signal: options.signal
+	});
+	const result = await (defaultTransport ?? await createRuntimeRegistryArtifactTransport()).fetch({
+		url: target.url,
+		allowedAddresses: target.addresses,
+		signal: options.signal,
+		maxResponseBytes: options.maxResponseBytes
+	});
+	if (!target.addresses.includes(result.connectedAddress)) {
+		await result.response.body?.cancel().catch(() => void 0);
+		throw new Error("Registry artifact transport connected outside the validated address set");
+	}
+	return result.response;
+}
+async function createRuntimeRegistryArtifactTransport() {
+	try {
+		const connect = objectProperty(await import("cloudflare:sockets"), "connect");
+		if (!isWorkerSocketConnect(connect)) throw new TypeError("Workers socket binding is invalid");
+		return createWorkersRegistryArtifactTransport(connect);
+	} catch {
+		return createNodeRegistryArtifactTransport();
+	}
+}
+function createWorkersRegistryArtifactTransport(connect) {
+	return { async fetch(input) {
+		let lastError;
+		for (const address of input.allowedAddresses) {
+			if (input.signal.aborted) throw new Error("Registry artifact request was aborted");
+			let socket;
+			let tls;
+			try {
+				socket = connect({
+					hostname: address,
+					port: parseHttpsPort(input.url)
+				}, {
+					secureTransport: "starttls",
+					allowHalfOpen: false
+				});
+				await abortable(socket.opened, input.signal, () => socket?.close());
+				tls = socket.startTls({ expectedServerHostname: stripIpv6Brackets(input.url.hostname) });
+				await abortable(tls.opened, input.signal, () => tls?.close());
+				const writer = tls.writable.getWriter();
+				try {
+					await abortable(writer.write(buildHttpRequest(input.url)), input.signal, () => tls?.close());
+				} finally {
+					writer.releaseLock();
+				}
+				const bytes = await readWorkerSocketResponse(tls, input.maxResponseBytes + MAX_HEADER_BYTES, input.signal);
+				await tls.close().catch(() => void 0);
+				return {
+					response: parsedResponseToWebResponse(parsePinnedHttpResponse(bytes, input.maxResponseBytes)),
+					connectedAddress: address
+				};
+			} catch (error) {
+				await Promise.all([tls?.close().catch(() => void 0), socket?.close().catch(() => void 0)]);
+				if (input.signal.aborted) throw error;
+				lastError = error;
+			}
+		}
+		throw new Error("Registry artifact transport could not connect to an approved address", { cause: lastError });
+	} };
+}
+async function createNodeRegistryArtifactTransport() {
+	const { request } = await import("node:https");
+	return { async fetch(input) {
+		let lastError;
+		for (const address of input.allowedAddresses) try {
+			return {
+				response: await new Promise((resolve, reject) => {
+					const chunks = [];
+					let total = 0;
+					const req = request({
+						protocol: "https:",
+						hostname: stripIpv6Brackets(input.url.hostname),
+						port: parseHttpsPort(input.url),
+						path: `${input.url.pathname}${input.url.search}`,
+						method: "GET",
+						agent: false,
+						headers: {
+							Host: input.url.host,
+							Connection: "close",
+							"Accept-Encoding": "identity"
+						},
+						lookup: (_hostname, _options, callback) => {
+							callback(null, address, address.includes(":") ? 6 : 4);
+						},
+						signal: input.signal
+					}, (upstream) => {
+						const contentEncoding = upstream.headers["content-encoding"];
+						if (contentEncoding && contentEncoding.toLowerCase() !== "identity") {
+							upstream.destroy(/* @__PURE__ */ new Error("Registry artifact response content encoding is unsupported"));
+							return;
+						}
+						upstream.on("data", (chunk) => {
+							total += chunk.byteLength;
+							if (total > input.maxResponseBytes) {
+								upstream.destroy(/* @__PURE__ */ new RangeError("Registry artifact response exceeds its byte limit"));
+								return;
+							}
+							chunks.push(new Uint8Array(chunk));
+						});
+						upstream.once("error", reject);
+						upstream.once("end", () => {
+							const bytes = concatBytes(chunks, total);
+							const headers = new Headers();
+							for (let index = 0; index < upstream.rawHeaders.length; index += 2) headers.append(upstream.rawHeaders[index], upstream.rawHeaders[index + 1]);
+							resolve(parsedResponseToWebResponse({
+								status: upstream.statusCode ?? 502,
+								headers,
+								body: bytes
+							}));
+						});
+					});
+					req.once("error", reject);
+					req.end();
+				}),
+				connectedAddress: address
+			};
+		} catch (error) {
+			if (input.signal.aborted) throw error;
+			lastError = error;
+		}
+		throw new Error("Registry artifact transport could not connect to an approved address", { cause: lastError });
+	} };
+}
+function parsePinnedHttpResponse(bytes, maxResponseBytes) {
+	const headerEnd = findSequence(bytes, HEADER_END, 0);
+	if (headerEnd === -1 || headerEnd > MAX_HEADER_BYTES) throw new Error("Registry artifact response headers are invalid or too large");
+	const lines = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, headerEnd)).split("\r\n");
+	const statusMatch = STATUS_LINE_RE.exec(lines.shift() ?? "");
+	if (!statusMatch) throw new Error("Registry artifact response status line is invalid");
+	const headers = new Headers();
+	const rawHeaders = /* @__PURE__ */ new Map();
+	for (const line of lines) {
+		if (FOLDED_HEADER_RE.test(line)) throw new Error("Registry artifact response uses folded headers");
+		const separator = line.indexOf(":");
+		if (separator < 1) throw new Error("Registry artifact response header is invalid");
+		const name = line.slice(0, separator);
+		const value = line.slice(separator + 1).trim();
+		if (!HEADER_NAME_RE.test(name) || containsInvalidHeaderValue(value)) throw new Error("Registry artifact response header is invalid");
+		const normalized = name.toLowerCase();
+		const values = rawHeaders.get(normalized) ?? [];
+		values.push(value);
+		rawHeaders.set(normalized, values);
+		headers.append(name, value);
+	}
+	const contentEncoding = rawHeaders.get("content-encoding");
+	if (contentEncoding && (contentEncoding.length !== 1 || contentEncoding[0]?.toLowerCase() !== "identity")) throw new Error("Registry artifact response content encoding is unsupported");
+	const contentLength = rawHeaders.get("content-length");
+	const transferEncoding = rawHeaders.get("transfer-encoding");
+	if (contentLength && transferEncoding) throw new Error("Registry artifact response framing is ambiguous");
+	const bodyBytes = bytes.subarray(headerEnd + HEADER_END.length);
+	let body;
+	if (transferEncoding) {
+		if (transferEncoding.length !== 1 || transferEncoding[0]?.toLowerCase() !== "chunked") throw new Error("Registry artifact response transfer encoding is unsupported");
+		body = decodeChunkedBody(bodyBytes, maxResponseBytes);
+	} else if (contentLength) {
+		if (contentLength.length !== 1 || !CONTENT_LENGTH_RE.test(contentLength[0])) throw new Error("Registry artifact response content length is invalid");
+		const length = Number(contentLength[0]);
+		if (!Number.isSafeInteger(length) || length !== bodyBytes.byteLength) throw new Error("Registry artifact response body length does not match its framing");
+		body = new Uint8Array(bodyBytes);
+	} else body = new Uint8Array(bodyBytes);
+	if (body.byteLength > maxResponseBytes) throw new RangeError("Registry artifact response exceeds its byte limit");
+	return {
+		status: Number(statusMatch[1]),
+		headers,
+		body
+	};
+}
+function parsedResponseToWebResponse(parsed) {
+	const bodyAllowed = ![
+		204,
+		205,
+		304
+	].includes(parsed.status);
+	let body = null;
+	if (bodyAllowed) {
+		body = new ArrayBuffer(parsed.body.byteLength);
+		new Uint8Array(body).set(parsed.body);
+	}
+	return new Response(body, {
+		status: parsed.status,
+		headers: parsed.headers
+	});
+}
+function buildHttpRequest(url) {
+	return new TextEncoder().encode([
+		`GET ${url.pathname}${url.search} HTTP/1.1`,
+		`Host: ${url.host}`,
+		"Connection: close",
+		"Accept-Encoding: identity",
+		"",
+		""
+	].join("\r\n"));
+}
+async function readWorkerSocketResponse(socket, maximumBytes, signal) {
+	const reader = socket.readable.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const next = await abortable(reader.read(), signal, () => socket.close());
+			if (next.done) break;
+			total += next.value.byteLength;
+			if (total > maximumBytes) throw new RangeError("Registry artifact response exceeds its byte limit");
+			chunks.push(next.value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return concatBytes(chunks, total);
+}
+function decodeChunkedBody(bytes, maximumBytes) {
+	const chunks = [];
+	let offset = 0;
+	let total = 0;
+	for (;;) {
+		const lineEnd = findSequence(bytes, CRLF, offset);
+		if (lineEnd === -1 || lineEnd - offset > 128) throw new Error("Registry artifact chunk size line is invalid");
+		const sizeText = new TextDecoder().decode(bytes.subarray(offset, lineEnd)).split(";", 1)[0];
+		if (!sizeText || !CHUNK_SIZE_RE.test(sizeText)) throw new Error("Registry artifact chunk size is invalid");
+		const size = Number.parseInt(sizeText, 16);
+		if (!Number.isSafeInteger(size)) throw new Error("Registry artifact chunk size is invalid");
+		offset = lineEnd + CRLF.length;
+		if (size === 0) {
+			if (offset + CRLF.length !== bytes.length || bytes[offset] !== 13 || bytes[offset + 1] !== 10) throw new Error("Registry artifact chunk trailer is invalid");
+			break;
+		}
+		if (offset + size + CRLF.length > bytes.length) throw new Error("Registry artifact chunk body is truncated");
+		if (bytes[offset + size] !== 13 || bytes[offset + size + 1] !== 10) throw new Error("Registry artifact chunk delimiter is invalid");
+		total += size;
+		if (total > maximumBytes) throw new RangeError("Registry artifact response exceeds its byte limit");
+		chunks.push(new Uint8Array(bytes.subarray(offset, offset + size)));
+		offset += size + CRLF.length;
+	}
+	return concatBytes(chunks, total);
+}
+function findSequence(bytes, sequence, start) {
+	outer: for (let offset = start; offset <= bytes.length - sequence.length; offset += 1) {
+		for (let index = 0; index < sequence.length; index += 1) if (bytes[offset + index] !== sequence[index]) continue outer;
+		return offset;
+	}
+	return -1;
+}
+function concatBytes(chunks, total) {
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+function containsInvalidHeaderValue(value) {
+	for (const character of value) {
+		const code = character.codePointAt(0);
+		if (code === 0 || code === 10 || code === 13) return true;
+	}
+	return false;
+}
+function parseHttpsPort(url) {
+	const port = url.port === "" ? 443 : Number(url.port);
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new TypeError("Registry artifact HTTPS port is invalid");
+	return port;
+}
+function stripIpv6Brackets(hostname) {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function objectProperty(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	return Object.getOwnPropertyDescriptor(value, key)?.value;
+}
+function isWorkerSocketConnect(value) {
+	return typeof value === "function";
+}
+async function abortable(operation, signal, onAbort) {
+	if (signal.aborted) throw new Error("Registry artifact request was aborted");
+	let abort;
+	const aborted = new Promise((_resolve, reject) => {
+		abort = () => {
+			onAbort();
+			reject(/* @__PURE__ */ new Error("Registry artifact request was aborted"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+	});
+	try {
+		return await Promise.race([operation, aborted]);
+	} finally {
+		if (abort) signal.removeEventListener("abort", abort);
+	}
+}
+
 //#endregion
 //#region src/registry/config.ts
 /**
+* Helpers for normalizing the experimental registry integration option
+* (`config.experimental.registry` in `astro.config.mjs`) into the shape
+* exposed on the admin manifest.
+*
+* The integration option accepts a human-friendly duration string for
+* `policy.minimumReleaseAge` (`"48h"`, `"7d"`); the manifest exposes
+* seconds so the browser doesn't need a duration parser.
+*/
+/**
 * Canonicalize a capabilities list for set-style comparison.
 *
 * Capabilities (the legacy declared-access shape used by the current
@@ -3366,7 +1513,8 @@ const DURATION_PATTERN = /^(\d+)(s|m|h|d|w)$/;
 /** Trailing slashes on the aggregator URL, stripped during normalization. */
 const TRAILING_SLASHES = /\/+$/;
 /** Trailing dot on a hostname, stripped before URL host comparisons. */
-const TRAILING_DOT$1 = /\.$/;
+const TRAILING_DOT = /\.$/;
+const REGISTRY_PACKAGE_SLUG_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
 /**
 * Parse a duration string or raw second count into a non-negative
 * integer count of seconds. Throws on unrecognised input so config
@@ -3396,7 +1544,7 @@ function parseDurationSeconds(duration) {
 * required in production; `http://localhost` allowed only in dev.
 *
 * The aggregator's responses are the trust source for release records,
-* checksums, labels, mirrors, and `indexedAt` (until full MST
+* checksums, labels, artifact cache descriptors, and `indexedAt` (until full MST
 * verification lands). Allowing plain HTTP here would let a network
 * attacker swap a release record and point the artifact URL at their
 * own HTTPS bundle, defeating the checksum trust chain because the
@@ -3411,7 +1559,7 @@ function validateAggregatorUrl(aggregatorUrl) {
 	}
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`registry.aggregatorUrl must use http or https: ${aggregatorUrl}`);
 	if (parsed.username || parsed.password) throw new Error("registry.aggregatorUrl must not contain embedded credentials (user:pass@)");
-	const rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT$1, "");
+	const rawHostname = parsed.hostname.toLowerCase().replace(TRAILING_DOT, "");
 	const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
 	const isLocalhost = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "::1" || hostname.startsWith("::ffff:127.") || hostname.startsWith("::ffff:7f00:");
 	if (!import.meta.env.DEV) {
@@ -3473,7 +1621,10 @@ function normalizeRegistryConfig(input) {
 		const list = config.policy.minimumReleaseAgeExclude.map((entry) => {
 			const trimmed = entry.trim();
 			if (!trimmed) throw new Error("registry.policy.minimumReleaseAgeExclude entries cannot be empty");
-			return trimmed.toLowerCase();
+			const lower = trimmed.toLowerCase();
+			const [did, slug, ...extra] = lower.split("/");
+			if (!did || !isDid(did) || extra.length > 0 || slug !== void 0 && !REGISTRY_PACKAGE_SLUG_PATTERN.test(slug)) throw new Error(`registry.policy.minimumReleaseAgeExclude entry must be a DID or <did>/<slug>: ${trimmed}`);
+			return lower;
 		});
 		if (list.length > 0) {
 			policy.minimumReleaseAgeExclude = list;
@@ -3582,11 +1733,10 @@ async function makeRegistryPluginId(publisherDid, slug) {
 *      aggregator's `resolvePackage` XRPC.
 *   2. Look up the requested release (or the policy-filtered latest one)
 *      via `getLatestRelease` / `listReleases`.
-*   3. Reject the install if the aggregator surfaces a `security:yanked`
-*      hard-enforcement label or the release is below the configured
-*      minimum release age.
-*   4. Fetch the bundle artifact, walking aggregator mirrors first and
-*      falling back to the publisher-declared URL.
+*   3. Require the aggregator's approved listing projection, then apply the
+*      independent release-age and environment policies.
+*   4. Fetch the bundle artifact through an advertised record-scoped cache,
+*      the publisher PDS, or the publisher-declared URL.
 *   5. Verify the artifact's multibase checksum against the signed
 *      release record's `artifacts.package.checksum`.
 *   6. Extract `manifest.json` + `backend.js` + optional `admin.js` from
@@ -3606,10 +1756,10 @@ async function makeRegistryPluginId(publisherDid, slug) {
 *     The artifact checksum is verified end-to-end against the value
 *     in the (aggregator-relayed) release record, which is the actual
 *     trust boundary for the bytes that end up in the sandbox.
-*   - `acceptLabelers` is forwarded as-is to the aggregator; this
-*     handler does not independently re-fetch and verify labels from
-*     each labeller's DID. Aggregator label envelope tampering is
-*     mitigated by the artifact checksum but not detected.
+*   - Listing approval controls whether metadata is eligible for discovery.
+*     It is never treated as approval of plugin code: checksum, bundle,
+*     manifest, access, consent, sandbox, and environment gates remain
+*     independent below.
 */
 const RELEASE_EXTENSION_NSID = "com.emdashcms.experimental.package.releaseExtension";
 /**
@@ -3703,28 +1853,20 @@ const MAX_ARTIFACT_BYTES = 512 * 1024;
 const MAX_REDIRECTS = 5;
 /**
 * Wall-clock cap on any single artifact fetch attempt (per URL).
-* Defends against slow-loris mirrors that accept the connection but
+* Defends against slow-loris artifact sources that accept the connection but
 * never finish sending headers or body.
 */
 const ARTIFACT_FETCH_TIMEOUT_MS = 15e3;
 /**
 * Total wall-clock budget for the artifact-download phase across all
-* mirrors and the declared URL. Even with the per-URL timeout, a
-* malicious mirror list could otherwise tie up the install request for
+* advertised caches, the publisher PDS, and the declared URL. Even with the
+* per-URL timeout, unavailable sources could otherwise tie up the install request for
 * minutes; this caps total time at a budget interactive admins can
 * tolerate. Tuned so a fast happy path takes <1s of budget per
 * attempt and a worst case still completes in under a minute.
 */
 const ARTIFACT_TOTAL_BUDGET_MS = 45e3;
 /**
-* Cap on the number of mirror URLs we try before falling back to the
-* publisher-declared URL. Matches the aggregator lexicon's
-* `mirrors` array length cap (16) but enforced here independently so
-* a misbehaving aggregator can't slow-loris us through hundreds of
-* URLs.
-*/
-const MAX_MIRRORS = 16;
-/**
 * Per-request timeout applied to every aggregator XRPC call
 * (`resolvePackage`, `getLatestRelease`, `listReleases`). Matches the
 * per-URL artifact-fetch cap. Without this, a slow-loris aggregator
@@ -3759,178 +1901,29 @@ function timedFetch(totalDeadline) {
 		});
 	};
 }
-/**
-* Localhost-equivalent hostnames the artifact fetcher rejects in
-* production. The full literal-IP / DNS-rebinding blocklist lives in
-* `#security/ssrf.js` and is invoked via `resolveAndValidateExternalUrl`
-* below; this small set exists only because the artifact handler has
-* a dev-mode escape hatch that lets `http://localhost` through.
-*/
-const FORBIDDEN_HOSTNAMES = new Set([
-	"localhost",
-	"localhost.localdomain",
-	"ip6-localhost",
-	"ip6-loopback"
-]);
-/** Trailing dot on a hostname, stripped before URL host comparisons. */
-const TRAILING_DOT = /\.$/;
-/** Hostnames that resolve to the local machine; rejected outright in production. */
-function isLocalhostHostname(hostname) {
-	const stripped = hostname.toLowerCase().replace(TRAILING_DOT, "");
-	const h = stripped.startsWith("[") && stripped.endsWith("]") ? stripped.slice(1, -1) : stripped;
-	if (FORBIDDEN_HOSTNAMES.has(h)) return true;
-	if (h === "localhost") return true;
-	if (h.endsWith(".localhost")) return true;
-	if (h === "127.0.0.1" || h === "::1") return true;
-	if (h.startsWith("::ffff:127.") || h.startsWith("::ffff:7f00:")) return true;
-	return false;
-}
-/**
-* Validate that `urlString` is a safe outbound target for artifact
-* downloads. Rejects non-HTTPS (except localhost in dev), embedded
-* credentials, any host that's a loopback / private / link-local
-* literal address, and any hostname whose resolved A or AAAA records
-* point at one of those addresses (closes the DNS-rebinding gap).
-*
-* Wraps `resolveAndValidateExternalUrl` from the import-pipeline SSRF
-* module so both code paths share one DoH cache, one resolver, one
-* blocklist, and one set of regression tests. Layers an
-* artifact-specific protocol/dev-localhost policy on top.
-*
-* `import.meta.env.DEV` is a Vite/Astro compile-time constant, so
-* production bundles cannot enable the dev escape hatch at runtime.
-*/
-async function assertSafeArtifactUrl(urlString) {
-	let url;
-	try {
-		url = new URL(urlString);
-	} catch {
-		throw new Error(`Invalid artifact URL: ${urlString}`);
-	}
-	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`Artifact URL protocol not allowed: ${url.protocol}`);
-	if (url.username || url.password) throw new Error("Artifact URL must not contain embedded credentials");
-	const rawHostname = url.hostname.toLowerCase().replace(TRAILING_DOT, "");
-	const hostname = rawHostname.startsWith("[") && rawHostname.endsWith("]") ? rawHostname.slice(1, -1) : rawHostname;
-	const localhost = isLocalhostHostname(hostname);
-	if (!import.meta.env.DEV) {
-		if (url.protocol === "http:") throw new Error("Artifact URL must use https");
-		if (localhost) throw new Error(`Artifact URL points to localhost: ${hostname}`);
-	} else if (url.protocol === "http:" && !localhost) throw new Error("Artifact URL must use https (http allowed only for localhost in dev)");
-	if (localhost) return url;
-	try {
-		return await resolveAndValidateExternalUrl(url.href);
-	} catch (err) {
-		if (err instanceof SsrfError) throw new Error(`Artifact URL rejected: ${err.message}`, { cause: err });
-		throw err;
-	}
-}
-/**
-* Fetch one URL with manual redirect handling so every hop is
-* URL-validated, a hard byte cap so a malicious response body cannot
-* exhaust memory before the checksum check rejects it, and a wall-clock
-* timeout that covers connect, headers, and body together. The timeout
-* is the minimum of the per-URL cap and the remaining total budget so
-* a late-arriving mirror still respects the install's global budget.
-*/
-async function fetchWithLimits(initialUrl, totalDeadline) {
-	const now = Date.now();
-	const remaining = Math.max(0, totalDeadline - now);
-	if (remaining === 0) throw new Error("Artifact download budget exhausted");
-	const perUrlTimeout = Math.min(ARTIFACT_FETCH_TIMEOUT_MS, remaining);
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(), perUrlTimeout);
-	try {
-		let current = await assertSafeArtifactUrl(initialUrl);
-		let response;
-		for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-			response = await fetch(current.href, {
-				redirect: "manual",
-				signal: controller.signal
+async function fetchArtifact(artifactCaches, artifact, record, auth) {
+	const result = await fetchReleaseArtifact({
+		artifact,
+		record,
+		artifactCaches,
+		...auth === void 0 ? {} : { auth }
+	}, {
+		fetch: async (url, init) => {
+			if (!init.signal) throw new Error("Registry artifact fetch requires an abort signal");
+			return fetchRegistryArtifactUrl(url.href, {
+				signal: init.signal,
+				maxResponseBytes: MAX_ARTIFACT_BYTES
 			});
-			if (response.status < 300 || response.status >= 400) break;
-			const location = response.headers.get("location");
-			if (!location) break;
-			if (hop === MAX_REDIRECTS) throw new Error(`Too many redirects fetching artifact (>${MAX_REDIRECTS})`);
-			current = await assertSafeArtifactUrl(new URL(location, current).href);
-		}
-		const finalResponse = response;
-		if (!finalResponse.ok) throw new Error(`HTTP ${finalResponse.status}`);
-		const lengthHeader = finalResponse.headers.get("content-length");
-		if (lengthHeader) {
-			const declared = Number(lengthHeader);
-			if (Number.isFinite(declared) && declared > MAX_ARTIFACT_BYTES) throw new Error(`Artifact too large (declared ${declared} bytes, limit ${MAX_ARTIFACT_BYTES})`);
-		}
-		const body = finalResponse.body;
-		if (!body) {
-			const buf = new Uint8Array(await finalResponse.arrayBuffer());
-			if (buf.byteLength > MAX_ARTIFACT_BYTES) throw new Error(`Artifact too large (limit ${MAX_ARTIFACT_BYTES} bytes)`);
-			return buf;
-		}
-		const reader = body.getReader();
-		const chunks = [];
-		let total = 0;
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (!value) continue;
-			total += value.byteLength;
-			if (total > MAX_ARTIFACT_BYTES) {
-				try {
-					await reader.cancel();
-				} catch {}
-				throw new Error(`Artifact too large (limit ${MAX_ARTIFACT_BYTES} bytes)`);
-			}
-			chunks.push(value);
-		}
-		const out = new Uint8Array(total);
-		let offset = 0;
-		for (const chunk of chunks) {
-			out.set(chunk, offset);
-			offset += chunk.byteLength;
-		}
-		return out;
-	} finally {
-		clearTimeout(timer);
-	}
-}
-/**
-* Strip query string and fragment from a URL for use in
-* client-visible error messages. Registry artifacts are often hosted
-* on storage backends that include presigned tokens in the query
-* string; surfacing the raw URL on a failed install leaks those
-* tokens into the admin's HTTP response and any log drain that
-* captures the error chain. Origin + pathname is enough to identify
-* the host and resource without exposing credentials.
-*
-* Falls back to a generic placeholder when the URL is malformed.
-*/
-function redactUrlForError(raw) {
-	try {
-		const u = new URL(raw);
-		return `${u.origin}${u.pathname}`;
-	} catch {
-		return "<malformed url>";
-	}
-}
-/** Walk artifact source URLs in priority order and return the first that fetches successfully. */
-async function fetchArtifact(mirrors, declaredUrl) {
-	const urls = [...mirrors.slice(0, MAX_MIRRORS), declaredUrl];
-	const clientErrors = [];
-	const totalDeadline = Date.now() + ARTIFACT_TOTAL_BUDGET_MS;
-	for (const url of urls) {
-		if (Date.now() >= totalDeadline) {
-			clientErrors.push("(total artifact download budget exhausted)");
-			break;
-		}
-		try {
-			return await fetchWithLimits(url, totalDeadline);
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			console.warn(`[registry-install] Artifact fetch failed from ${url}:`, message);
-			clientErrors.push(`${redactUrlForError(url)}: ${message}`);
-		}
-	}
-	throw new Error(`Failed to download artifact from any source. Tried:\n  ${clientErrors.join("\n  ")}`);
+		},
+		resolveHostname: async (hostname) => (await resolveAndValidateExternalUrlTarget(`https://${hostname}`)).addresses,
+		allowHttpLocalhost: import.meta.env.DEV,
+		headerTimeoutMs: ARTIFACT_FETCH_TIMEOUT_MS,
+		totalTimeoutMs: ARTIFACT_TOTAL_BUDGET_MS,
+		maxBytes: MAX_ARTIFACT_BYTES,
+		maxRedirects: MAX_REDIRECTS
+	});
+	if (!result.success) throw new Error(`Artifact retrieval failed (${result.error.code}): ${result.error.message}`);
+	return result.value.bytes;
 }
 /**
 * Gate a release's `requires` constraints against the running host
@@ -3992,11 +1985,12 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 		};
 	}
 	const { did, slug, version: requestedVersion } = input;
-	const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+	const { DiscoveryClient, registryLabelerPolicy } = await import("@emdash-cms/registry-client/discovery");
 	const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
 	const discovery = new DiscoveryClient({
 		aggregatorUrl: registryConfig.aggregatorUrl,
 		acceptLabelers: registryConfig.acceptLabelers,
+		labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
 		fetch: timedFetch(aggregatorDeadline)
 	});
 	if (!did.startsWith("did:") || did.split(":").length < 3) return {
@@ -4059,13 +2053,11 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 			}
 		};
 		const version = releaseView.version;
-		const yanked = (packageView.labels ?? []).some((l) => l.val === "security:yanked");
-		const releaseYanked = (releaseView.labels ?? []).some((l) => l.val === "security:yanked");
-		if (yanked || releaseYanked) return {
+		if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) return {
 			success: false,
 			error: {
 				code: "RELEASE_YANKED",
-				message: "This release has been withdrawn (security:yanked label)."
+				message: "This release has been withdrawn"
 			}
 		};
 		if (opts?.hostEnv) {
@@ -4139,16 +2131,21 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 			};
 		}
 		const release = releaseView.release;
-		const declaredUrl = release?.artifacts?.package?.url;
-		const declaredChecksum = release?.artifacts?.package?.checksum;
-		if (!declaredUrl || !declaredChecksum) return {
+		const packageArtifact = release?.artifacts?.package;
+		const declaredChecksum = packageArtifact?.checksum;
+		if (!packageArtifact || !declaredChecksum) return {
 			success: false,
 			error: {
 				code: "INVALID_RELEASE",
-				message: "Release record is missing artifact url or checksum"
+				message: "Release record is missing its package artifact or checksum"
 			}
 		};
-		const artifactBytes = await fetchArtifact(releaseView.mirrors ?? [], declaredUrl);
+		const artifactBytes = await fetchArtifact(releaseView.artifactCaches ?? [], packageArtifact, {
+			did: publisherDid,
+			collection: NSID.packageRelease,
+			rkey: `${slug}:${version}`,
+			cid: releaseView.cid
+		}, release.auth);
 		if (!await verifyChecksum(artifactBytes, declaredChecksum)) return {
 			success: false,
 			error: {
@@ -4267,13 +2264,22 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
 			}
 		};
-		if (err instanceof ClientResponseError) return {
-			success: false,
-			error: {
-				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
-				message: `Aggregator returned ${err.status}: ${err.error}`
-			}
-		};
+		if (err instanceof ClientResponseError) {
+			if (err.error === "ListingUnavailable") return {
+				success: false,
+				error: {
+					code: "LISTING_UNAVAILABLE",
+					message: "This plugin is unavailable under the active registry policy"
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+					message: `Aggregator returned ${err.status}: ${err.error}`
+				}
+			};
+		}
 		if (err instanceof EmDashStorageError) return {
 			success: false,
 			error: {
@@ -4407,11 +2413,12 @@ async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigIn
 		const oldVersion = existing.version;
 		const publisherDid = existing.registryPublisherDid;
 		const slug = existing.registrySlug;
-		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const { DiscoveryClient, registryLabelerPolicy } = await import("@emdash-cms/registry-client/discovery");
 		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
 		const discovery = new DiscoveryClient({
 			aggregatorUrl: registryConfig.aggregatorUrl,
 			acceptLabelers: registryConfig.acceptLabelers,
+			labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
 			fetch: timedFetch(aggregatorDeadline)
 		});
 		const MAX_LIST_PAGES = 20;
@@ -4454,18 +2461,18 @@ async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigIn
 			}
 		};
 		const newVersion = releaseView.version;
-		if (newVersion === oldVersion) return {
+		if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) return {
 			success: false,
 			error: {
-				code: "ALREADY_UP_TO_DATE",
-				message: "Plugin is already at the requested version"
+				code: "YANKED",
+				message: "Release has been withdrawn"
 			}
 		};
-		if ((releaseView.labels ?? []).some((l) => l.val === "security:yanked")) return {
+		if (newVersion === oldVersion) return {
 			success: false,
 			error: {
-				code: "YANKED",
-				message: "Release has been yanked by a trusted labeller"
+				code: "ALREADY_UP_TO_DATE",
+				message: "Plugin is already at the requested version"
 			}
 		};
 		if (opts?.hostEnv) {
@@ -4475,19 +2482,21 @@ async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigIn
 				error: envError
 			};
 		}
-		const declaredUrl = signedRelease.artifacts?.package?.url;
-		const declaredChecksum = signedRelease.artifacts?.package?.checksum;
-		if (!declaredUrl || !declaredChecksum) return {
+		const packageArtifact = signedRelease.artifacts?.package;
+		const declaredChecksum = packageArtifact?.checksum;
+		if (!packageArtifact || !declaredChecksum) return {
 			success: false,
 			error: {
 				code: "INVALID_RELEASE",
-				message: "Release record is missing artifact url or checksum"
+				message: "Release record is missing its package artifact or checksum"
 			}
 		};
-		await assertSafeArtifactUrl(declaredUrl);
-		const mirrors = (releaseView.mirrors ?? []).slice(0, MAX_MIRRORS);
-		for (const mirror of mirrors) await assertSafeArtifactUrl(mirror);
-		const artifactBytes = await fetchArtifact(mirrors, declaredUrl);
+		const artifactBytes = await fetchArtifact(releaseView.artifactCaches ?? [], packageArtifact, {
+			did: publisherDid,
+			collection: NSID.packageRelease,
+			rkey: `${slug}:${newVersion}`,
+			cid: releaseView.cid
+		}, signedRelease.auth);
 		if (!await verifyChecksum(artifactBytes, declaredChecksum)) return {
 			success: false,
 			error: {
@@ -4585,13 +2594,22 @@ async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigIn
 				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
 			}
 		};
-		if (err instanceof ClientResponseError) return {
-			success: false,
-			error: {
-				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
-				message: `Aggregator returned ${err.status}: ${err.error}`
-			}
-		};
+		if (err instanceof ClientResponseError) {
+			if (err.error === "ListingUnavailable") return {
+				success: false,
+				error: {
+					code: "LISTING_UNAVAILABLE",
+					message: "This plugin is unavailable under the active registry policy"
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+					message: `Aggregator returned ${err.status}: ${err.error}`
+				}
+			};
+		}
 		if (err instanceof EmDashStorageError) return {
 			success: false,
 			error: {
@@ -4631,21 +2649,24 @@ async function handleRegistryUpdateCheck(db, registryConfigInput) {
 			success: true,
 			data: { items: [] }
 		};
-		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const { DiscoveryClient, registryLabelerPolicy } = await import("@emdash-cms/registry-client/discovery");
 		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
 		const discovery = new DiscoveryClient({
 			aggregatorUrl: registryConfig.aggregatorUrl,
 			acceptLabelers: registryConfig.acceptLabelers,
+			labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
 			fetch: timedFetch(aggregatorDeadline)
 		});
 		const items = [];
 		for (const plugin of registryPlugins) {
 			if (!plugin.registryPublisherDid || !plugin.registrySlug) continue;
 			try {
-				const latest = (await discovery.getLatestRelease({
+				const releaseView = await discovery.getLatestRelease({
 					did: plugin.registryPublisherDid,
 					package: plugin.registrySlug
-				})).version;
+				});
+				if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) continue;
+				const latest = releaseView.version;
 				if (!latest) continue;
 				const installed = plugin.version;
 				items.push({
@@ -4691,5 +2712,5 @@ async function handleRegistryUpdateCheck(db, registryConfigInput) {
 }
 
 //#endregion
-export { handleContentUnschedule as $, handleMediaUpdate as A, handleContentDelete as B, handlePluginEnable as C, handleMediaDelete as D, handleMediaCreate as E, handleContentAuthors as F, handleContentList as G, handleContentDuplicate as H, handleContentCompare as I, handleContentPublish as J, handleContentListTrashed as K, handleContentCountScheduled as L, handleRevisionList as M, handleRevisionRestore as N, handleMediaGet as O, generateManifest as P, handleContentUnpublish as Q, handleContentCountTrashed as R, handlePluginDisable as S, handlePluginList as T, handleContentGet as U, handleContentDiscardDraft as V, handleContentGetIncludingTrashed as W, handleContentSchedule as X, handleContentRestore as Y, handleContentTranslations as Z, loadBundleFromR2 as _, handleRegistryUpdateCheck as a, handlePluginSettingsGet as b, validateAggregatorUrl as c, handleMarketplaceSearch as d, handleContentUpdate as et, handleMarketplaceUninstall as f, handleThemeSearch as g, handleThemeGetDetail as h, handleRegistryUpdate as i, handleRevisionGet as j, handleMediaList as k, handleMarketplaceGetPlugin as l, handleMarketplaceUpdateCheck as m, handleRegistryInstall as n, coerceRegistryConfig as o, handleMarketplaceUpdate as p, handleContentPermanentDelete as q, handleRegistryUninstall as r, normalizeRegistryConfig as s, assertSafeArtifactUrl as t, validateRev as tt, handleMarketplaceInstall as u, syncDeclaredStorageIndexes as v, handlePluginGet as w, handlePluginSettingsUpdate as x, getPluginSettingsSchema as y, handleContentCreate as z };
-//# sourceMappingURL=api-BeBglVxU.mjs.map
+export { handleThemeSearch as _, verifyChecksum as a, validateAggregatorUrl as c, handleMarketplaceInstall as d, handleMarketplaceSearch as f, handleThemeGetDetail as g, handleMarketplaceUpdateCheck as h, handleRegistryUpdateCheck as i, fetchRegistryArtifactUrl as l, handleMarketplaceUpdate as m, handleRegistryUninstall as n, coerceRegistryConfig as o, handleMarketplaceUninstall as p, handleRegistryUpdate as r, normalizeRegistryConfig as s, handleRegistryInstall as t, handleMarketplaceGetPlugin as u, loadBundleFromR2 as v, syncDeclaredStorageIndexes as y };
+//# sourceMappingURL=registry-BiO5WwPq.mjs.map