emdash 0.35.0 → 0.36.0

package/src/api/handlers/registry.ts

@@ -8,11 +8,10 @@
  *      aggregator's `resolvePackage` XRPC.
  *   2. Look up the requested release (or the policy-filtered latest one)
  *      via `getLatestRelease` / `listReleases`.
- *   3. Reject the install if the aggregator surfaces a `security:yanked`
- *      hard-enforcement label or the release is below the configured
- *      minimum release age.
- *   4. Fetch the bundle artifact, walking aggregator mirrors first and
- *      falling back to the publisher-declared URL.
+ *   3. Require the aggregator's approved listing projection, then apply the
+ *      independent release-age and environment policies.
+ *   4. Fetch the bundle artifact through an advertised record-scoped cache,
+ *      the publisher PDS, or the publisher-declared URL.
  *   5. Verify the artifact's multibase checksum against the signed
  *      release record's `artifacts.package.checksum`.
  *   6. Extract `manifest.json` + `backend.js` + optional `admin.js` from
@@ -32,16 +31,22 @@
  *     The artifact checksum is verified end-to-end against the value
  *     in the (aggregator-relayed) release record, which is the actual
  *     trust boundary for the bytes that end up in the sandbox.
- *   - `acceptLabelers` is forwarded as-is to the aggregator; this
- *     handler does not independently re-fetch and verify labels from
- *     each labeller's DID. Aggregator label envelope tampering is
- *     mitigated by the artifact checksum but not detected.
+ *   - Listing approval controls whether metadata is eligible for discovery.
+ *     It is never treated as approval of plugin code: checksum, bundle,
+ *     manifest, access, consent, sandbox, and environment gates remain
+ *     independent below.
  */
 
 import { ClientResponseError, ClientValidationError } from "@atcute/client";
 import type { Did } from "@atcute/lexicons";
 import { checkEnvCompatibility, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
 import type { HostEnv } from "@emdash-cms/registry-client/env";
+import { evaluateRegistryReleaseWithdrawal } from "@emdash-cms/registry-client/withdrawal";
+import { NSID } from "@emdash-cms/registry-lexicons";
+import {
+	fetchReleaseArtifact,
+	type ReleaseArtifactReference,
+} from "@emdash-cms/registry-verification/artifact";
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
@@ -55,6 +60,7 @@ import {
 } from "../../plugins/storage-indexes.js";
 import { declaredAccessToCapabilities } from "../../plugins/types.js";
 import type { DeclaredAccess } from "../../plugins/types.js";
+import { fetchRegistryArtifactUrl } from "../../registry/artifact-fetch.js";
 import {
 	canonicalCapabilitiesForDriftCheck,
 	coerceRegistryConfig,
@@ -64,7 +70,7 @@ import {
 } from "../../registry/config.js";
 import { makeRegistryPluginId } from "../../registry/plugin-id.js";
 import type { RegistryConfigInput } from "../../registry/types.js";
-import { resolveAndValidateExternalUrl, SsrfError } from "../../security/ssrf.js";
+import { resolveAndValidateExternalUrlTarget } from "../../security/ssrf.js";
 import { EmDashStorageError } from "../../storage/types.js";
 import type { Storage } from "../../storage/types.js";
 import type { ApiResult } from "../types.js";
@@ -76,6 +82,8 @@ import {
 	storeBundleInR2,
 } from "./marketplace.js";
 
+export { assertSafeArtifactUrl } from "../../registry/artifact-fetch.js";
+
 const RELEASE_EXTENSION_NSID = "com.emdashcms.experimental.package.releaseExtension";
 
 /**
@@ -241,30 +249,21 @@ const MAX_REDIRECTS = 5;
 
 /**
  * Wall-clock cap on any single artifact fetch attempt (per URL).
- * Defends against slow-loris mirrors that accept the connection but
+ * Defends against slow-loris artifact sources that accept the connection but
  * never finish sending headers or body.
  */
 const ARTIFACT_FETCH_TIMEOUT_MS = 15_000;
 
 /**
  * Total wall-clock budget for the artifact-download phase across all
- * mirrors and the declared URL. Even with the per-URL timeout, a
- * malicious mirror list could otherwise tie up the install request for
+ * advertised caches, the publisher PDS, and the declared URL. Even with the
+ * per-URL timeout, unavailable sources could otherwise tie up the install request for
  * minutes; this caps total time at a budget interactive admins can
  * tolerate. Tuned so a fast happy path takes <1s of budget per
  * attempt and a worst case still completes in under a minute.
  */
 const ARTIFACT_TOTAL_BUDGET_MS = 45_000;
 
-/**
- * Cap on the number of mirror URLs we try before falling back to the
- * publisher-declared URL. Matches the aggregator lexicon's
- * `mirrors` array length cap (16) but enforced here independently so
- * a misbehaving aggregator can't slow-loris us through hundreds of
- * URLs.
- */
-const MAX_MIRRORS = 16;
-
 /**
  * Per-request timeout applied to every aggregator XRPC call
  * (`resolvePackage`, `getLatestRelease`, `listReleases`). Matches the
@@ -304,249 +303,45 @@ function timedFetch(totalDeadline: number): typeof fetch {
 	};
 }
 
-/**
- * Localhost-equivalent hostnames the artifact fetcher rejects in
- * production. The full literal-IP / DNS-rebinding blocklist lives in
- * `#security/ssrf.js` and is invoked via `resolveAndValidateExternalUrl`
- * below; this small set exists only because the artifact handler has
- * a dev-mode escape hatch that lets `http://localhost` through.
- */
-const FORBIDDEN_HOSTNAMES = new Set([
-	"localhost",
-	"localhost.localdomain",
-	"ip6-localhost",
-	"ip6-loopback",
-]);
-
-/** Trailing dot on a hostname, stripped before URL host comparisons. */
-const TRAILING_DOT = /\.$/;
-
-/** Hostnames that resolve to the local machine; rejected outright in production. */
-function isLocalhostHostname(hostname: string): boolean {
-	// WHATWG URL preserves brackets on IPv6 hostnames; strip them before
-	// comparison so `[::1]` is recognised as localhost.
-	const stripped = hostname.toLowerCase().replace(TRAILING_DOT, "");
-	const h = stripped.startsWith("[") && stripped.endsWith("]") ? stripped.slice(1, -1) : stripped;
-	if (FORBIDDEN_HOSTNAMES.has(h)) return true;
-	if (h === "localhost") return true;
-	if (h.endsWith(".localhost")) return true;
-	if (h === "127.0.0.1" || h === "::1") return true;
-	if (h.startsWith("::ffff:127.") || h.startsWith("::ffff:7f00:")) return true;
-	return false;
-}
-
-/**
- * Validate that `urlString` is a safe outbound target for artifact
- * downloads. Rejects non-HTTPS (except localhost in dev), embedded
- * credentials, any host that's a loopback / private / link-local
- * literal address, and any hostname whose resolved A or AAAA records
- * point at one of those addresses (closes the DNS-rebinding gap).
- *
- * Wraps `resolveAndValidateExternalUrl` from the import-pipeline SSRF
- * module so both code paths share one DoH cache, one resolver, one
- * blocklist, and one set of regression tests. Layers an
- * artifact-specific protocol/dev-localhost policy on top.
- *
- * `import.meta.env.DEV` is a Vite/Astro compile-time constant, so
- * production bundles cannot enable the dev escape hatch at runtime.
- */
-export async function assertSafeArtifactUrl(urlString: string): Promise<URL> {
-	let url: URL;
-	try {
-		url = new URL(urlString);
-	} catch {
-		throw new Error(`Invalid artifact URL: ${urlString}`);
-	}
-	if (url.protocol !== "https:" && url.protocol !== "http:") {
-		throw new Error(`Artifact URL protocol not allowed: ${url.protocol}`);
-	}
-	if (url.username || url.password) {
-		throw new Error("Artifact URL must not contain embedded credentials");
-	}
-
-	const rawHostname = url.hostname.toLowerCase().replace(TRAILING_DOT, "");
-	// Strip brackets so the IPv4/IPv6 checks see the canonical form.
-	const hostname =
-		rawHostname.startsWith("[") && rawHostname.endsWith("]")
-			? rawHostname.slice(1, -1)
-			: rawHostname;
-	const localhost = isLocalhostHostname(hostname);
-
-	// In production: reject HTTP entirely and reject localhost over any
-	// protocol -- a publisher pointing at `https://localhost` is still
-	// trying to bounce the server through its own loopback interface.
-	if (!import.meta.env.DEV) {
-		if (url.protocol === "http:") {
-			throw new Error("Artifact URL must use https");
-		}
-		if (localhost) {
-			throw new Error(`Artifact URL points to localhost: ${hostname}`);
-		}
-	} else if (url.protocol === "http:" && !localhost) {
-		// Dev mode: http allowed only for localhost.
-		throw new Error("Artifact URL must use https (http allowed only for localhost in dev)");
-	}
-
-	if (localhost) {
-		// Dev-only path; nothing to resolve.
-		return url;
-	}
-
-	// Delegate IP-literal + DNS-rebinding validation to the import
-	// pipeline's SSRF helper. Adapts the SsrfError to the existing
-	// artifact-URL error vocabulary so callers keep their current
-	// catch shape.
-	try {
-		return await resolveAndValidateExternalUrl(url.href);
-	} catch (err) {
-		if (err instanceof SsrfError) {
-			throw new Error(`Artifact URL rejected: ${err.message}`, { cause: err });
-		}
-		throw err;
-	}
-}
-
-/**
- * Fetch one URL with manual redirect handling so every hop is
- * URL-validated, a hard byte cap so a malicious response body cannot
- * exhaust memory before the checksum check rejects it, and a wall-clock
- * timeout that covers connect, headers, and body together. The timeout
- * is the minimum of the per-URL cap and the remaining total budget so
- * a late-arriving mirror still respects the install's global budget.
- */
-async function fetchWithLimits(initialUrl: string, totalDeadline: number): Promise<Uint8Array> {
-	const now = Date.now();
-	const remaining = Math.max(0, totalDeadline - now);
-	if (remaining === 0) {
-		throw new Error("Artifact download budget exhausted");
-	}
-	const perUrlTimeout = Math.min(ARTIFACT_FETCH_TIMEOUT_MS, remaining);
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(), perUrlTimeout);
-	try {
-		let current = await assertSafeArtifactUrl(initialUrl);
-		let response: Response;
-		for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-			response = await fetch(current.href, { redirect: "manual", signal: controller.signal });
-			if (response.status < 300 || response.status >= 400) break;
-			const location = response.headers.get("location");
-			if (!location) break;
-			if (hop === MAX_REDIRECTS) {
-				throw new Error(`Too many redirects fetching artifact (>${MAX_REDIRECTS})`);
-			}
-			const next = new URL(location, current);
-			current = await assertSafeArtifactUrl(next.href);
-		}
-		// eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- response is assigned in the first loop iteration
-		const finalResponse = response!;
-		if (!finalResponse.ok) {
-			throw new Error(`HTTP ${finalResponse.status}`);
-		}
-
-		// Check Content-Length up front when present. Untrusted servers can
-		// lie or omit it; the streaming cap below is the real defense.
-		const lengthHeader = finalResponse.headers.get("content-length");
-		if (lengthHeader) {
-			const declared = Number(lengthHeader);
-			if (Number.isFinite(declared) && declared > MAX_ARTIFACT_BYTES) {
-				throw new Error(
-					`Artifact too large (declared ${declared} bytes, limit ${MAX_ARTIFACT_BYTES})`,
-				);
-			}
-		}
-
-		const body = finalResponse.body;
-		if (!body) {
-			// Workers can't return a null body for a normal GET; defensive fallback.
-			const buf = new Uint8Array(await finalResponse.arrayBuffer());
-			if (buf.byteLength > MAX_ARTIFACT_BYTES) {
-				throw new Error(`Artifact too large (limit ${MAX_ARTIFACT_BYTES} bytes)`);
-			}
-			return buf;
-		}
-
-		const reader = body.getReader();
-		const chunks: Uint8Array[] = [];
-		let total = 0;
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			if (!value) continue;
-			total += value.byteLength;
-			if (total > MAX_ARTIFACT_BYTES) {
-				try {
-					await reader.cancel();
-				} catch {
-					// nothing to do
-				}
-				throw new Error(`Artifact too large (limit ${MAX_ARTIFACT_BYTES} bytes)`);
-			}
-			chunks.push(value);
-		}
-
-		const out = new Uint8Array(total);
-		let offset = 0;
-		for (const chunk of chunks) {
-			out.set(chunk, offset);
-			offset += chunk.byteLength;
-		}
-		return out;
-	} finally {
-		clearTimeout(timer);
-	}
-}
-
-/**
- * Strip query string and fragment from a URL for use in
- * client-visible error messages. Registry artifacts are often hosted
- * on storage backends that include presigned tokens in the query
- * string; surfacing the raw URL on a failed install leaks those
- * tokens into the admin's HTTP response and any log drain that
- * captures the error chain. Origin + pathname is enough to identify
- * the host and resource without exposing credentials.
- *
- * Falls back to a generic placeholder when the URL is malformed.
- */
-function redactUrlForError(raw: string): string {
-	try {
-		const u = new URL(raw);
-		return `${u.origin}${u.pathname}`;
-	} catch {
-		return "<malformed url>";
-	}
-}
-
-/** Walk artifact source URLs in priority order and return the first that fetches successfully. */
-async function fetchArtifact(mirrors: string[], declaredUrl: string): Promise<Uint8Array> {
-	// Clamp mirrors regardless of what the lexicon type says -- a buggy
-	// or malicious aggregator could return more than the spec'd limit
-	// and slow-loris each one. The declared URL is always tried last.
-	const clampedMirrors = mirrors.slice(0, MAX_MIRRORS);
-	const urls = [...clampedMirrors, declaredUrl];
-	// Client-visible errors carry redacted URLs (origin + path only).
-	// The full URL with any query-string token is logged server-side
-	// so operators can still debug delivery failures.
-	const clientErrors: string[] = [];
-
-	const totalDeadline = Date.now() + ARTIFACT_TOTAL_BUDGET_MS;
-
-	for (const url of urls) {
-		if (Date.now() >= totalDeadline) {
-			clientErrors.push("(total artifact download budget exhausted)");
-			break;
-		}
-		try {
-			return await fetchWithLimits(url, totalDeadline);
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			console.warn(`[registry-install] Artifact fetch failed from ${url}:`, message);
-			clientErrors.push(`${redactUrlForError(url)}: ${message}`);
-		}
-	}
-
-	throw new Error(
-		`Failed to download artifact from any source. Tried:\n  ${clientErrors.join("\n  ")}`,
+async function fetchArtifact(
+	artifactCaches: readonly unknown[],
+	artifact: ReleaseArtifactReference,
+	record: {
+		did: string;
+		collection: string;
+		rkey: string;
+		cid: string;
+	},
+	auth?: unknown,
+): Promise<Uint8Array> {
+	const result = await fetchReleaseArtifact(
+		{
+			artifact,
+			record,
+			artifactCaches,
+			...(auth === undefined ? {} : { auth }),
+		},
+		{
+			fetch: async (url, init) => {
+				if (!init.signal) throw new Error("Registry artifact fetch requires an abort signal");
+				return fetchRegistryArtifactUrl(url.href, {
+					signal: init.signal,
+					maxResponseBytes: MAX_ARTIFACT_BYTES,
+				});
+			},
+			resolveHostname: async (hostname) =>
+				(await resolveAndValidateExternalUrlTarget(`https://${hostname}`)).addresses,
+			allowHttpLocalhost: import.meta.env.DEV,
+			headerTimeoutMs: ARTIFACT_FETCH_TIMEOUT_MS,
+			totalTimeoutMs: ARTIFACT_TOTAL_BUDGET_MS,
+			maxBytes: MAX_ARTIFACT_BYTES,
+			maxRedirects: MAX_REDIRECTS,
+		},
 	);
+	if (!result.success) {
+		throw new Error(`Artifact retrieval failed (${result.error.code}): ${result.error.message}`);
+	}
+	return result.value.bytes;
 }
 
 /**
@@ -658,7 +453,8 @@ export async function handleRegistryInstall(
 
 	// Lazy-load the discovery client. Avoids pulling @atcute/client into
 	// every code path that imports core/api/handlers.
-	const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+	const { DiscoveryClient, registryLabelerPolicy } =
+		await import("@emdash-cms/registry-client/discovery");
 
 	// Every aggregator XRPC call passes through `timedFetch`, which
 	// enforces a per-request timeout and shares a single total-budget
@@ -668,6 +464,7 @@ export async function handleRegistryInstall(
 	const discovery = new DiscoveryClient({
 		aggregatorUrl: registryConfig.aggregatorUrl,
 		acceptLabelers: registryConfig.acceptLabelers,
+		labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
 		fetch: timedFetch(aggregatorDeadline),
 	});
 
@@ -792,28 +589,19 @@ export async function handleRegistryInstall(
 		}
 
 		const version = releaseView.version;
-
-		// Step 3: takedown label check (hard-enforced via aggregator's
-		// `atproto-accept-labelers` filtering, but we belt-and-suspenders
-		// the package-level labels too).
-		const yanked = (packageView.labels ?? []).some(
-			(l: { val?: string }) => l.val === "security:yanked",
-		);
-		const releaseYanked = (releaseView.labels ?? []).some(
-			(l: { val?: string }) => l.val === "security:yanked",
-		);
-		if (yanked || releaseYanked) {
+		if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {
 			return {
 				success: false,
 				error: {
 					code: "RELEASE_YANKED",
-					message: "This release has been withdrawn (security:yanked label).",
+					message: "This release has been withdrawn",
 				},
 			};
 		}
 
-		// Step 3b: environment compatibility. The signed release record may
-		// carry a `requires` block (`env:emdash`, `env:astro`, ...). Refuse
+		// Environment compatibility remains an install-safety gate. Listing
+		// approval says only that displayed metadata passed moderation. A release
+		// may carry a `requires` block (`env:emdash`, `env:astro`, ...). Refuse
 		// the install if the running host doesn't satisfy a constraint, so a
 		// stale browser tab or non-UI caller can't bypass the admin's
 		// disabled Install button. `requires` is lexicon-`unknown`; the
@@ -942,25 +730,33 @@ export async function handleRegistryInstall(
 
 		// Step 4: fetch the artifact bytes.
 		// `releaseView.release` is lexicon-validated by DiscoveryClient (or
-		// `null`); a missing url/checksum (incl. the `null` case) fails closed
-		// below. Mirrors come from the envelope (aggregator operational data,
-		// not part of the signed record).
+		// `null`); a missing source/checksum (including the `null` case) fails
+		// closed below. Cache descriptors are unsigned aggregator operational data.
 		const release = releaseView.release;
-		const declaredUrl = release?.artifacts?.package?.url;
-		const declaredChecksum = release?.artifacts?.package?.checksum;
+		const packageArtifact = release?.artifacts?.package;
+		const declaredChecksum = packageArtifact?.checksum;
 
-		if (!declaredUrl || !declaredChecksum) {
+		if (!packageArtifact || !declaredChecksum) {
 			return {
 				success: false,
 				error: {
 					code: "INVALID_RELEASE",
-					message: "Release record is missing artifact url or checksum",
+					message: "Release record is missing its package artifact or checksum",
 				},
 			};
 		}
 
-		const mirrors = releaseView.mirrors ?? [];
-		const artifactBytes = await fetchArtifact(mirrors, declaredUrl);
+		const artifactBytes = await fetchArtifact(
+			releaseView.artifactCaches ?? [],
+			packageArtifact,
+			{
+				did: publisherDid,
+				collection: NSID.packageRelease,
+				rkey: `${slug}:${version}`,
+				cid: releaseView.cid,
+			},
+			release.auth,
+		);
 
 		// Step 5: verify the bytes against the signed record's checksum.
 		const checksumOk = await verifyChecksum(artifactBytes, declaredChecksum);
@@ -1208,6 +1004,15 @@ export async function handleRegistryInstall(
 			};
 		}
 		if (err instanceof ClientResponseError) {
+			if (err.error === "ListingUnavailable") {
+				return {
+					success: false,
+					error: {
+						code: "LISTING_UNAVAILABLE",
+						message: "This plugin is unavailable under the active registry policy",
+					},
+				};
+			}
 			return {
 				success: false,
 				error: {
@@ -1408,11 +1213,13 @@ export async function handleRegistryUpdate(
 		const publisherDid = existing.registryPublisherDid as Did;
 		const slug = existing.registrySlug;
 
-		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const { DiscoveryClient, registryLabelerPolicy } =
+			await import("@emdash-cms/registry-client/discovery");
 		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
 		const discovery = new DiscoveryClient({
 			aggregatorUrl: registryConfig.aggregatorUrl,
 			acceptLabelers: registryConfig.acceptLabelers,
+			labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
 			fetch: timedFetch(aggregatorDeadline),
 		});
 
@@ -1479,6 +1286,12 @@ export async function handleRegistryUpdate(
 		}
 
 		const newVersion = releaseView.version;
+		if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {
+			return {
+				success: false,
+				error: { code: "YANKED", message: "Release has been withdrawn" },
+			};
+		}
 		if (newVersion === oldVersion) {
 			return {
 				success: false,
@@ -1489,18 +1302,8 @@ export async function handleRegistryUpdate(
 			};
 		}
 
-		// Yanked label check (mirrors install).
-		const releaseYanked = (releaseView.labels ?? []).some(
-			(l: { val?: string }) => l.val === "security:yanked",
-		);
-		if (releaseYanked) {
-			return {
-				success: false,
-				error: { code: "YANKED", message: "Release has been yanked by a trusted labeller" },
-			};
-		}
-
-		// Environment compatibility gate. An ungated update could otherwise
+		// Environment compatibility remains independent from listing approval.
+		// An ungated update could otherwise
 		// land a version whose `requires` the host doesn't satisfy. Same
 		// guard as install; `requires` is lexicon-`unknown`.
 		if (opts?.hostEnv) {
@@ -1508,28 +1311,29 @@ export async function handleRegistryUpdate(
 			if (envError) return { success: false, error: envError };
 		}
 
-		const declaredUrl = signedRelease.artifacts?.package?.url;
-		const declaredChecksum = signedRelease.artifacts?.package?.checksum;
-		if (!declaredUrl || !declaredChecksum) {
+		const packageArtifact = signedRelease.artifacts?.package;
+		const declaredChecksum = packageArtifact?.checksum;
+		if (!packageArtifact || !declaredChecksum) {
 			return {
 				success: false,
 				error: {
 					code: "INVALID_RELEASE",
-					message: "Release record is missing artifact url or checksum",
+					message: "Release record is missing its package artifact or checksum",
 				},
 			};
 		}
 
-		// SSRF check on declared URL + each mirror.
-		await assertSafeArtifactUrl(declaredUrl);
-		const rawMirrors = releaseView.mirrors ?? [];
-		const mirrors = rawMirrors.slice(0, MAX_MIRRORS);
-		for (const mirror of mirrors) {
-			await assertSafeArtifactUrl(mirror);
-		}
-
-		// `fetchArtifact` derives its own per-call deadline internally.
-		const artifactBytes = await fetchArtifact(mirrors, declaredUrl);
+		const artifactBytes = await fetchArtifact(
+			releaseView.artifactCaches ?? [],
+			packageArtifact,
+			{
+				did: publisherDid,
+				collection: NSID.packageRelease,
+				rkey: `${slug}:${newVersion}`,
+				cid: releaseView.cid,
+			},
+			signedRelease.auth,
+		);
 		if (!(await verifyChecksum(artifactBytes, declaredChecksum))) {
 			return {
 				success: false,
@@ -1686,6 +1490,15 @@ export async function handleRegistryUpdate(
 			};
 		}
 		if (err instanceof ClientResponseError) {
+			if (err.error === "ListingUnavailable") {
+				return {
+					success: false,
+					error: {
+						code: "LISTING_UNAVAILABLE",
+						message: "This plugin is unavailable under the active registry policy",
+					},
+				};
+			}
 			return {
 				success: false,
 				error: {
@@ -1759,11 +1572,13 @@ export async function handleRegistryUpdateCheck(
 			return { success: true, data: { items: [] } };
 		}
 
-		const { DiscoveryClient } = await import("@emdash-cms/registry-client/discovery");
+		const { DiscoveryClient, registryLabelerPolicy } =
+			await import("@emdash-cms/registry-client/discovery");
 		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
 		const discovery = new DiscoveryClient({
 			aggregatorUrl: registryConfig.aggregatorUrl,
 			acceptLabelers: registryConfig.acceptLabelers,
+			labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
 			fetch: timedFetch(aggregatorDeadline),
 		});
 
@@ -1776,6 +1591,9 @@ export async function handleRegistryUpdateCheck(
 					did: plugin.registryPublisherDid as Did,
 					package: plugin.registrySlug,
 				});
+				if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {
+					continue;
+				}
 				const latest = releaseView.version;
 				if (!latest) continue;
 				const installed = plugin.version;