emdash 0.37.0 → 0.39.0

package/src/astro/middleware/request-context.ts

@@ -10,9 +10,10 @@
  * - Toolbar injection: floating pill for authenticated editors
  * - Client toolbar mode (`toolbar: "client"`): cache-identical HTML with a
  *   client-side bootstrap pill and an `_edit` query param for fresh editor
- *   renders (Discussion #1742)
+ *   renders; the backend verifies the `_edit` param and redirects non-editors
  */
 
+import { loadVisualEditingToolbarLabels } from "@emdash-cms/admin/locales/server";
 import type { APIContext } from "astro";
 import { defineMiddleware } from "astro:middleware";
 // @ts-ignore - virtual module
@@ -22,6 +23,7 @@ import { resolveSecretsCached } from "#config/secrets.js";
 
 import { verifyPreviewToken, parseContentId } from "../../preview/tokens.js";
 import { getRequestContext, runWithContext } from "../../request-context.js";
+import { generateVisualEditingActionToken } from "../../visual-editing/action-token.js";
 import { EDIT_PARAM, renderToolbarBootstrap } from "../../visual-editing/toolbar-bootstrap.js";
 import { renderToolbar } from "../../visual-editing/toolbar.js";
 
@@ -29,8 +31,24 @@ type ToolbarMode = "server" | "client" | false;
 
 const toolbarMode: ToolbarMode = virtualConfig?.toolbar ?? "server";
 
-/** Astro's route-cache handle. EmDash requires Astro 6+, so it's always present. */
-type RouteCache = APIContext["cache"];
+/**
+ * Astro's route-cache handle. Astro defines `context.cache` only on requests
+ * that went through its cache handler, so it is `undefined` on some renders,
+ * such as the 404 page for a URL that matches no route.
+ */
+type RouteCache = APIContext["cache"] | undefined;
+
+async function renderEditorToolbar(
+	context: APIContext,
+	config: { editMode: boolean; isPreview: boolean },
+): Promise<string> {
+	const labels = await loadVisualEditingToolbarLabels(context.request);
+	const { emdash, user } = context.locals;
+	if (!emdash?.db || !user) return renderToolbar({ ...config, labels });
+	const { previewSecret } = await resolveSecretsCached(emdash.db);
+	const actionToken = await generateVisualEditingActionToken(previewSecret, user.id);
+	return renderToolbar({ ...config, actionToken, labels });
+}
 
 /**
  * Opt the current request out of Astro's route cache (e.g. Workers Cache on
@@ -39,10 +57,10 @@ type RouteCache = APIContext["cache"];
  * `Cloudflare-CDN-Cache-Control`), so session-specific responses must
  * explicitly disable it or they get stored in the shared cache and served to
  * anonymous visitors without ever invoking the middleware again. With no cache
- * provider configured this is a no-op (`NoopAstroCache`/`DisabledAstroCache`).
+ * provider configured, or no cache handle on the request, this is a no-op.
  */
 function optOutOfRouteCache(cache: RouteCache): void {
-	cache.set(false);
+	cache?.set(false);
 }
 
 /**
@@ -86,8 +104,8 @@ async function injectToolbar(
 	if (result.injected) {
 		// Toolbar-injected HTML is session-specific (its presence reveals an
 		// active editor session); it must never be stored in a shared CDN cache
-		// and served to anonymous visitors. Mirrors the preview branch's guard
-		// (#1398). `Cache-Control` covers browsers/downstream proxies; the
+		// and served to anonymous visitors. `Cache-Control` covers
+		// browsers/downstream proxies; the
 		// route-cache opt-out covers the shared edge cache, which ignores
 		// `Cache-Control`.
 		result.response.headers.set("Cache-Control", "private, no-store");
@@ -109,7 +127,7 @@ async function injectBootstrap(response: Response): Promise<Response> {
 /**
  * Redirect an `_edit` URL to its canonical form (same URL without the param).
  * Applied when the requester is not an authenticated editor, so a shared
- * `?_edit` link degrades gracefully for everyone else (Discussion #1742).
+ * `?_edit` link degrades gracefully for everyone else.
  */
 function redirectToCanonical(url: URL): Response {
 	const canonical = new URL(url);
@@ -250,7 +268,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			// opt-out) in every toolbar mode, so the server toolbar is safe to
 			// inject here even in client mode.
 			if (isEditor && toolbarMode !== false) {
-				const toolbarHtml = renderToolbar({
+				const toolbarHtml = await renderEditorToolbar(context, {
 					editMode,
 					isPreview: !!preview,
 				});
@@ -285,7 +303,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// toolbar (response becomes `private, no-store` and route-cache
 		// opted out).
 		const response = await next();
-		const toolbarHtml = renderToolbar({
+		const toolbarHtml = await renderEditorToolbar(context, {
 			editMode: false,
 			isPreview: false,
 		});

package/src/astro/middleware.ts

@@ -34,6 +34,8 @@ import { createScheduler as virtualCreateScheduler } from "virtual:emdash/schedu
 import { createStorage as virtualCreateStorage } from "virtual:emdash/storage";
 
 import { after } from "../after.js";
+import { apiError } from "../api/error.js";
+import { EmDashConfigurationError } from "../config/errors.js";
 import {
 	createRecorder,
 	flushRecorder,
@@ -57,6 +59,7 @@ import { setI18nConfig } from "../i18n/config.js";
 import type { Database, Storage } from "../index.js";
 import { createPublicMediaUrlResolver } from "../media/url.js";
 import { getLastContentWriteAt } from "../object-cache/index.js";
+import type { PluginContentCacheInvalidator } from "../plugins/routes.js";
 import type { SandboxRunnerFactory } from "../plugins/sandbox/types.js";
 import type { ResolvedPlugin } from "../plugins/types.js";
 import { invalidateUrlPatternCache } from "../query.js";
@@ -67,6 +70,7 @@ import {
 	runWithContext,
 } from "../request-context.js";
 import type { PublishedRef } from "../scheduled-publish.js";
+import { EmDashStorageError } from "../storage/types.js";
 import { isMissingTableError } from "../utils/db-errors.js";
 import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
 import type { EmDashConfig } from "./integration/runtime.js";
@@ -292,7 +296,10 @@ async function getRuntime(
  * rather than only after the whole sweep.
  */
 export async function runScheduledTasks(
-	options: { onPublished?: (refs: PublishedRef[]) => Promise<void> } = {},
+	options: {
+		onPublished?: (refs: PublishedRef[]) => Promise<void>;
+		invalidateContentCache?: PluginContentCacheInvalidator;
+	} = {},
 ): Promise<{ published: PublishedRef[] }> {
 	const config = getConfig();
 	if (!config) return { published: [] };
@@ -482,6 +489,17 @@ function migrationRequiredResponse(): Response {
 	);
 }
 
+function runtimeConfigurationErrorResponse(error: unknown, pathname: string): Response | null {
+	if (!pathname.startsWith("/_emdash/api/")) return null;
+	if (error instanceof EmDashConfigurationError) {
+		return apiError(error.code, error.message, 500);
+	}
+	if (error instanceof EmDashStorageError && error.code === "BINDING_NOT_FOUND") {
+		return apiError(error.code, error.message, 500);
+	}
+	return null;
+}
+
 /**
  * Baseline security headers applied to all responses.
  * Admin routes get additional headers (strict CSP) from auth middleware.
@@ -907,6 +925,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					// Media handlers
 					handleMediaList: runtime.handleMediaList.bind(runtime),
 					handleMediaGet: runtime.handleMediaGet.bind(runtime),
+					handleMediaUpload: runtime.handleMediaUpload.bind(runtime),
 					handleMediaCreate: runtime.handleMediaCreate.bind(runtime),
 					handleMediaUpdate: runtime.handleMediaUpdate.bind(runtime),
 					...(runtime.handleMediaReplaceMetadata
@@ -916,6 +935,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						: {}),
 					handleMediaDelete: runtime.handleMediaDelete.bind(runtime),
 
+					// Comment administration
+					...(runtime.handleCommentModerate
+						? { handleCommentModerate: runtime.handleCommentModerate.bind(runtime) }
+						: {}),
+
 					// Revision handlers
 					handleRevisionList: runtime.handleRevisionList.bind(runtime),
 					handleRevisionGet: runtime.handleRevisionGet.bind(runtime),
@@ -923,6 +947,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 					// Plugin routes
 					handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
+					getPluginEditorExtension: runtime.getPluginEditorExtension.bind(runtime),
+					getPluginEditorDraftSchema: runtime.getPluginEditorDraftSchema.bind(runtime),
 					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
 					getPluginMcpTools: runtime.getPluginMcpTools.bind(runtime),
@@ -984,6 +1010,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 					// Sync registry plugin states (after install/update/uninstall)
 					syncRegistryPlugins: runtime.syncRegistryPlugins.bind(runtime),
+					runPluginInstallLifecycle: runtime.runPluginInstallLifecycle.bind(runtime),
+					runPluginActivateLifecycle: runtime.runPluginActivateLifecycle.bind(runtime),
+					runPluginUninstallLifecycle: runtime.runPluginUninstallLifecycle.bind(runtime),
+					getRuntimePluginSettingsSchema: runtime.getRuntimePluginSettingsSchema.bind(runtime),
 
 					// Update plugin enabled/disabled status and rebuild hook pipeline
 					setPluginStatus: runtime.setPluginStatus.bind(runtime),
@@ -997,6 +1027,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					return migrationRequiredResponse();
 				}
 				console.error("EmDash middleware error:", error);
+				const configurationError = runtimeConfigurationErrorResponse(error, url.pathname);
+				if (configurationError) return configurationError;
 			}
 
 			// Ask the adapter for a request-scoped db. When it returns one, we stash

package/src/astro/prefetch.ts

@@ -25,14 +25,14 @@
 
 import { getDb } from "../loader.js";
 import { getMenu } from "../menus/index.js";
-import { setRequestCacheEntry } from "../request-cache.js";
+import { requestCached, setRequestCacheEntry } from "../request-cache.js";
 import { getSiteSettings } from "../settings/index.js";
 import { getTaxonomyDefs, getTaxonomyTerms } from "../taxonomies/index.js";
 import { getWidgetAreas } from "../widgets/index.js";
 
 /** Warm widget areas: one bulk load, primed under each per-area cache key. */
 async function prefetchWidgetAreas(): Promise<void> {
-	const areas = await getWidgetAreas();
+	const areas = await requestCached("widget-areas", getWidgetAreas);
 	// getWidgetArea(name) caches under `widget-area:${name}` and returns the same
 	// WidgetArea shape getWidgetAreas yields, so priming here makes those calls hit.
 	for (const area of areas) {

package/src/astro/routes/api/admin/comments/[id]/status.ts

@@ -11,10 +11,7 @@ import { apiError, apiSuccess, handleError, requireDb, unwrapResult } from "#api
 import { handleCommentGet } from "#api/handlers/comments.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { commentStatusBody } from "#api/schemas.js";
-import { getSiteBaseUrl } from "#api/site-url.js";
-import { lookupContentAuthor, sendCommentNotification } from "#comments/notifications.js";
-import { moderateComment, type CommentHookRunner } from "#comments/service.js";
-import type { ModerationDecision } from "#plugins/types.js";
+import { CommentStatusConflictError } from "#comments/service.js";
 
 export const prerender = false;
 
@@ -38,78 +35,45 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 
 		const newStatus = body.status;
 
-		// Build hook runner for the service
-		const hookRunner: CommentHookRunner = {
-			async runBeforeCreate(event) {
-				return emdash.hooks.runCommentBeforeCreate(event);
-			},
-			async runModerate(event) {
-				const result = await emdash.hooks.invokeExclusiveHook("comment:moderate", event);
-				if (!result) return { status: "pending" as const, reason: "No moderator configured" };
-				if (result.error) return { status: "pending" as const, reason: "Moderation error" };
-				return result.result as ModerationDecision;
-			},
-			fireAfterCreate(event) {
-				emdash.hooks
-					.runCommentAfterCreate(event)
-					.catch((err) =>
-						console.error(
-							"[comments] afterCreate error:",
-							err instanceof Error ? err.message : err,
-						),
-					);
-			},
-			fireAfterModerate(event) {
-				emdash.hooks
-					.runCommentAfterModerate(event)
-					.catch((err) =>
-						console.error(
-							"[comments] afterModerate error:",
-							err instanceof Error ? err.message : err,
-						),
-					);
-			},
-		};
-
 		// Read the comment before updating so we know the previous status
 		const existing = await handleCommentGet(emdash.db, id);
 		if (!existing.success) {
 			return unwrapResult(existing);
 		}
 		const previousStatus = existing.data.status;
+		if (!emdash.handleCommentModerate) {
+			return apiError("COMMENT_MODERATION_UNAVAILABLE", "Comment moderation is unavailable", 500);
+		}
 
-		const updated = await moderateComment(
-			emdash.db,
+		const updated = await emdash.handleCommentModerate(
 			id,
 			newStatus,
 			{ id: user!.id, name: user!.name ?? null },
-			hookRunner,
+			previousStatus,
+			request,
 		);
 
 		if (!updated) {
 			return apiError("NOT_FOUND", "Comment not found", 404);
 		}
 
-		// Send notification when a comment is newly approved
-		if (newStatus === "approved" && previousStatus !== "approved" && emdash.email) {
-			try {
-				const adminBaseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
-				const content = await lookupContentAuthor(emdash.db, updated.collection, updated.contentId);
-				if (content?.author) {
-					await sendCommentNotification({
-						email: emdash.email,
-						comment: updated,
-						contentAuthor: content.author,
-						adminBaseUrl,
-					});
-				}
-			} catch (err) {
-				console.error("[comments] notification error:", err instanceof Error ? err.message : err);
-			}
-		}
-
 		return apiSuccess(updated);
 	} catch (error) {
+		if (error instanceof CommentStatusConflictError) {
+			return apiError(error.code, error.message, 409, { currentStatus: error.currentStatus });
+		}
+		if (
+			typeof error === "object" &&
+			error !== null &&
+			"code" in error &&
+			error.code === "COMMENT_MODERATION_IN_PROGRESS"
+		) {
+			return apiError(
+				"COMMENT_MODERATION_IN_PROGRESS",
+				"Comment moderation is already in progress",
+				409,
+			);
+		}
 		return handleError(error, "Failed to update comment status", "COMMENT_STATUS_ERROR");
 	}
 };

package/src/astro/routes/api/admin/plugins/[id]/disable.ts

@@ -8,9 +8,8 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { handlePluginDisable } from "#api/index.js";
 import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
-import { setCronTasksEnabled } from "#plugins/cron.js";
+import { disableRuntimePlugin } from "#plugins/lifecycle.js";
 
 export const prerender = false;
 
@@ -32,17 +31,5 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginDisable(
-		emdash.db,
-		emdash.configuredPlugins,
-		emdash.sandboxedPluginEntries,
-		id,
-	);
-
-	if (!result.success) return unwrapResult(result);
-
-	await emdash.setPluginStatus(id, "inactive");
-	await setCronTasksEnabled(emdash.db, id, false);
-
-	return unwrapResult(result);
+	return unwrapResult(await disableRuntimePlugin(emdash, id));
 };

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -8,9 +8,8 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { handlePluginEnable } from "#api/index.js";
 import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
-import { setCronTasksEnabled } from "#plugins/cron.js";
+import { enableRuntimePlugin } from "#plugins/lifecycle.js";
 
 export const prerender = false;
 
@@ -32,27 +31,5 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginEnable(
-		emdash.db,
-		emdash.configuredPlugins,
-		emdash.sandboxedPluginEntries,
-		id,
-	);
-
-	if (!result.success) return unwrapResult(result);
-
-	// If this is a runtime-installed plugin (marketplace or registry),
-	// the sandbox bundle may not be in memory yet -- a sync reloads it
-	// from R2 so the just-enabled plugin can actually run hooks.
-	const source = result.data.item.source;
-	if (source === "registry") {
-		await emdash.syncRegistryPlugins();
-	} else if (source === "marketplace") {
-		await emdash.syncMarketplacePlugins();
-	}
-
-	await emdash.setPluginStatus(id, "active");
-	await setCronTasksEnabled(emdash.db, id, true);
-
-	return unwrapResult(result);
+	return unwrapResult(await enableRuntimePlugin(emdash, id));
 };

package/src/astro/routes/api/admin/plugins/[id]/uninstall.ts

@@ -42,6 +42,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 	const result = await handleMarketplaceUninstall(emdash.db, emdash.storage, id, {
 		deleteData: body.deleteData ?? false,
+		beforeDelete: () => emdash.runPluginUninstallLifecycle(id, body.deleteData ?? false),
 	});
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/admin/plugins/[id]/update.ts

@@ -9,16 +9,19 @@ import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
-import { handleMarketplaceUpdate } from "#api/index.js";
+import { handleMarketplaceUpdate, rollbackPluginUpdate } from "#api/index.js";
 import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { finalizePluginUpdate } from "#plugins/install-finalization.js";
+import { pluginPublicRouteAcknowledgementSchema } from "#plugins/routes.js";
+import { PluginStateRepository } from "#plugins/state.js";
 
 export const prerender = false;
 
 const updateBodySchema = z.object({
 	version: z.string().min(1).optional(),
 	confirmCapabilityChanges: z.boolean().optional(),
-	confirmRouteVisibilityChanges: z.boolean().optional(),
+	acknowledgedPublicRoutes: pluginPublicRouteAcknowledgementSchema.optional(),
 	confirmMcpTools: z.boolean().optional(),
 });
 
@@ -42,6 +45,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 	const body = await parseOptionalBody(request, updateBodySchema, {});
 	if (isParseError(body)) return body;
+	const previousState = await new PluginStateRepository(emdash.db).get(id);
 
 	const result = await handleMarketplaceUpdate(
 		emdash.db,
@@ -52,15 +56,30 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		{
 			version: body.version,
 			confirmCapabilityChanges: body.confirmCapabilityChanges,
-			confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+			acknowledgedPublicRoutes: body.acknowledgedPublicRoutes,
 			confirmMcpTools: body.confirmMcpTools,
 			sandboxBypassed: emdash.isSandboxBypassed(),
 		},
 	);
 
 	if (!result.success) return unwrapResult(result);
+	if (!previousState) return apiError("UPDATE_FAILED", "Failed to update plugin", 500);
 
-	await emdash.syncMarketplacePlugins();
+	await finalizePluginUpdate({
+		pluginId: id,
+		syncRuntime: () => emdash.syncMarketplacePlugins(),
+		runLifecycle: () => emdash.runPluginActivateLifecycle(id),
+		rollback: () =>
+			rollbackPluginUpdate(
+				emdash.db,
+				emdash.storage,
+				previousState,
+				result.data.newVersion,
+				"marketplace",
+			),
+		runRollbackLifecycle: () =>
+			previousState.status === "active" ? emdash.runPluginActivateLifecycle(id) : Promise.resolve(),
+	});
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/marketplace/[id]/install.ts

@@ -9,15 +9,18 @@ import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
-import { handleMarketplaceInstall } from "#api/index.js";
+import { handleMarketplaceInstall, handleMarketplaceUninstall } from "#api/index.js";
 import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { finalizePluginInstall } from "#plugins/install-finalization.js";
+import { pluginPublicRouteAcknowledgementSchema } from "#plugins/routes.js";
 
 export const prerender = false;
 
 const installBodySchema = z.object({
 	version: z.string().min(1).optional(),
 	confirmMcpTools: z.boolean().optional(),
+	acknowledgedPublicRoutes: pluginPublicRouteAcknowledgementSchema.optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -60,12 +63,19 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 				siteOrigin,
 				sandboxBypassed: emdash.isSandboxBypassed(),
 				confirmMcpTools: body.confirmMcpTools,
+				acknowledgedPublicRoutes: body.acknowledgedPublicRoutes,
 			},
 		);
 
 		if (!result.success) return unwrapResult(result);
 
-		await emdash.syncMarketplacePlugins();
+		await finalizePluginInstall({
+			pluginId: id,
+			syncRuntime: () => emdash.syncMarketplacePlugins(),
+			runLifecycle: () => emdash.runPluginInstallLifecycle(id),
+			rollback: () =>
+				handleMarketplaceUninstall(emdash.db, emdash.storage, id, { deleteData: true }),
+		});
 
 		return unwrapResult(result, 201);
 	} catch (error) {

package/src/astro/routes/api/admin/plugins/registry/[id]/uninstall.ts

@@ -45,6 +45,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 	const result = await handleRegistryUninstall(emdash.db, emdash.storage, id, {
 		deleteData: body.deleteData ?? false,
+		beforeDelete: () => emdash.runPluginUninstallLifecycle(id, body.deleteData ?? false),
 	});
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/admin/plugins/registry/[id]/update.ts

@@ -6,7 +6,7 @@
  * update route's escalation gates: `CAPABILITY_ESCALATION` if the new
  * version declares new capabilities and `confirmCapabilityChanges` is
  * absent, and `ROUTE_VISIBILITY_ESCALATION` if it newly exposes public
- * routes and `confirmRouteVisibilityChanges` is absent.
+ * routes and `acknowledgedPublicRoutes` does not exactly match them.
  */
 
 import { hostEnvFromVersions } from "@emdash-cms/registry-client/env";
@@ -15,10 +15,14 @@ import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
-import { handleRegistryUpdate } from "#api/index.js";
+import { handleRegistryUpdate, rollbackPluginUpdate } from "#api/index.js";
 import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { finalizePluginUpdate } from "#plugins/install-finalization.js";
+import { pluginPublicRouteAcknowledgementSchema } from "#plugins/routes.js";
+import { PluginStateRepository } from "#plugins/state.js";
 
+import { getRegistryConfigInput } from "../../../../../../../registry/config.js";
 import { VERSION } from "../../../../../../../version.js";
 
 export const prerender = false;
@@ -32,11 +36,8 @@ const updateBodySchema = z.object({
 	 * the handler returns `CAPABILITY_ESCALATION` carrying the diff.
 	 */
 	confirmCapabilityChanges: z.boolean().optional(),
-	/**
-	 * Set by the admin's route-visibility re-consent dialog when the new
-	 * version newly exposes a public (unauthenticated) route.
-	 */
-	confirmRouteVisibilityChanges: z.boolean().optional(),
+	/** Exact newly public route names reviewed by the admin. */
+	acknowledgedPublicRoutes: pluginPublicRouteAcknowledgementSchema.optional(),
 	confirmMcpTools: z.boolean().optional(),
 	acknowledgedProfileCid: z.string().min(1).max(256).optional(),
 	acknowledgedReleaseCid: z.string().min(1).max(256).optional(),
@@ -63,17 +64,18 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 		const body = await parseOptionalBody(request, updateBodySchema, {});
 		if (isParseError(body)) return body;
+		const previousState = await new PluginStateRepository(emdash.db).get(id);
 
 		const result = await handleRegistryUpdate(
 			emdash.db,
 			emdash.storage,
 			emdash.getSandboxRunner(),
-			emdash.config.experimental?.registry,
+			getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),
 			id,
 			{
 				version: body.version,
 				confirmCapabilityChanges: body.confirmCapabilityChanges,
-				confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+				acknowledgedPublicRoutes: body.acknowledgedPublicRoutes,
 				confirmMcpTools: body.confirmMcpTools,
 				acknowledgedProfileCid: body.acknowledgedProfileCid,
 				acknowledgedReleaseCid: body.acknowledgedReleaseCid,
@@ -82,8 +84,25 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		);
 
 		if (!result.success) return unwrapResult(result);
+		if (!previousState) return apiError("UPDATE_FAILED", "Failed to update plugin", 500);
 
-		await emdash.syncRegistryPlugins();
+		await finalizePluginUpdate({
+			pluginId: id,
+			syncRuntime: () => emdash.syncRegistryPlugins(),
+			runLifecycle: () => emdash.runPluginActivateLifecycle(id),
+			rollback: () =>
+				rollbackPluginUpdate(
+					emdash.db,
+					emdash.storage,
+					previousState,
+					result.data.newVersion,
+					"registry",
+				),
+			runRollbackLifecycle: () =>
+				previousState.status === "active"
+					? emdash.runPluginActivateLifecycle(id)
+					: Promise.resolve(),
+		});
 
 		return unwrapResult(result);
 	} catch (error) {

package/src/astro/routes/api/admin/plugins/registry/artifact.ts

@@ -38,7 +38,11 @@ import { apiError } from "#api/error.js";
 
 import { verifyRegistryArtifactChecksum } from "../../../../../../registry/artifact-checksum.js";
 import { fetchRegistryArtifactUrl } from "../../../../../../registry/artifact-fetch.js";
-import { coerceRegistryConfig, validateAggregatorUrl } from "../../../../../../registry/config.js";
+import {
+	coerceRegistryConfig,
+	getRegistryConfigInput,
+	validateAggregatorUrl,
+} from "../../../../../../registry/config.js";
 import { resolveAndValidateExternalUrlTarget } from "../../../../../../security/ssrf.js";
 
 export const prerender = false;
@@ -244,7 +248,9 @@ export const GET: APIRoute = async ({ url, locals }) => {
 		version = versionParam;
 	}
 
-	const registryConfig = coerceRegistryConfig(emdash.config.experimental?.registry);
+	const registryConfig = coerceRegistryConfig(
+		getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),
+	);
 	if (!registryConfig) {
 		return apiError("REGISTRY_NOT_CONFIGURED", "Registry is not configured", 400);
 	}