emdash 0.38.0 → 0.39.0

package/dist/astro/routes/api/admin/plugins/registry/artifact.mjs

@@ -1,10 +1,11 @@
-import "../../../../../../base64-CvLhUKQv.mjs";
-import "../../../../../../types-CQPWhPxE.mjs";
-import { a as fetchVerifiedResource, c as verifyMultihash, i as resolvePublisherPdsEndpoint, r as recordScopedImageCacheUrl, s as multihashFromBlobCid, t as fetchRegistryArtifactUrl } from "../../../../../../artifact-fetch-P2JXVwOq.mjs";
-import { i as resolveAndValidateExternalUrlTarget } from "../../../../../../ssrf-gl4gFNhw.mjs";
-import { n as coerceRegistryConfig, s as validateAggregatorUrl } from "../../../../../../config--eWjQJE5.mjs";
-import { t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
-import { r as requirePerm } from "../../../../../../authorize-C2QHlWSS.mjs";
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../types-BkUg2yHx.mjs";
+import { n as multihashFromBlobCid, r as verifyMultihash } from "../../../../../../checksum-Bsi2D9M1.mjs";
+import { a as fetchVerifiedResource, i as resolvePublisherPdsEndpoint, r as recordScopedImageCacheUrl, t as fetchRegistryArtifactUrl } from "../../../../../../artifact-fetch-COiMhVgk.mjs";
+import { i as resolveAndValidateExternalUrlTarget } from "../../../../../../ssrf-Co1GGFZz.mjs";
+import { l as validateAggregatorUrl, n as coerceRegistryConfig, r as getRegistryConfigInput } from "../../../../../../config-B2acLeC5.mjs";
+import { t as apiError } from "../../../../../../error-CCTCskie.mjs";
+import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
 import { evaluateRegistryReleaseWithdrawal } from "@emdash-cms/registry-client/withdrawal";
 import { NSID, RECORD_SCOPED_BLOB_CACHE_TYPE } from "@emdash-cms/registry-lexicons";
 
@@ -150,7 +151,7 @@ const GET = async ({ url, locals }) => {
 		if (versionParam.length > 64) return apiError("INVALID_REQUEST", "Invalid version", 400);
 		version = versionParam;
 	}
-	const registryConfig = coerceRegistryConfig(emdash.config.experimental?.registry);
+	const registryConfig = coerceRegistryConfig(getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry));
 	if (!registryConfig) return apiError("REGISTRY_NOT_CONFIGURED", "Registry is not configured", 400);
 	try {
 		validateAggregatorUrl(registryConfig.aggregatorUrl);

package/dist/astro/routes/api/admin/plugins/registry/artifact.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"artifact.mjs","names":[],"sources":["../../../../../../../src/registry/artifact-checksum.ts","../../../../../../../src/astro/routes/api/admin/plugins/registry/artifact.ts"],"sourcesContent":["import { verifyMultihash } from \"@emdash-cms/registry-verification/checksum\";\n\nconst SHA256_HEX_PATTERN = /^[0-9a-fA-F]{64}$/;\n\nexport async function verifyRegistryArtifactChecksum(\n\tbytes: Uint8Array,\n\tchecksum: string,\n): Promise<boolean> {\n\tif (SHA256_HEX_PATTERN.test(checksum)) {\n\t\tconst digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", Uint8Array.from(bytes)));\n\t\tconst actual = Array.from(digest, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\t\treturn actual === checksum.toLowerCase();\n\t}\n\treturn (await verifyMultihash(bytes, checksum)).success;\n}\n","/**\n * Registry artifact proxy\n *\n * GET /_emdash/api/admin/plugins/registry/artifact?did=&slug=&version=&kind=&index=\n *\n * Proxies an icon / screenshot / banner image referenced by a registry\n * release record so the admin UI can display it without cross-origin\n * requests to arbitrary publisher hosting.\n *\n * Trust model (CRITICAL): the proxy never accepts an artifact URL from the\n * client. The caller addresses an artifact by its coordinates\n * `(did, slug, version, kind, index)`; the server resolves the *declared*\n * artifact source from the validated release record fetched from the\n * configured aggregator. Blob-backed images resolve to the record-scoped\n * Cumulus deployment; URL artifacts retain the external fallback.\n *\n * The publisher-declared URL is still untrusted (an attacker who controls a\n * publisher record, or the aggregator, can point it anywhere), so the\n * resolved URL passes through the SSRF defences (`assertSafeArtifactUrl`,\n * re-validated on every redirect hop) before any fetch, and only allowlisted\n * image content types are served back.\n */\n\nimport type { Did } from \"@atcute/lexicons\";\nimport { evaluateRegistryReleaseWithdrawal } from \"@emdash-cms/registry-client/withdrawal\";\nimport { NSID, RECORD_SCOPED_BLOB_CACHE_TYPE } from \"@emdash-cms/registry-lexicons\";\nimport {\n\trecordScopedImageCacheUrl,\n\tresolvePublisherPdsEndpoint,\n\ttype ReleaseArtifactReference,\n} from \"@emdash-cms/registry-verification/artifact\";\nimport { multihashFromBlobCid } from \"@emdash-cms/registry-verification/checksum\";\nimport { fetchVerifiedResource } from \"@emdash-cms/registry-verification/fetch\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError } from \"#api/error.js\";\n\nimport { verifyRegistryArtifactChecksum } from \"../../../../../../registry/artifact-checksum.js\";\nimport { fetchRegistryArtifactUrl } from \"../../../../../../registry/artifact-fetch.js\";\nimport { coerceRegistryConfig, validateAggregatorUrl } from \"../../../../../../registry/config.js\";\nimport { resolveAndValidateExternalUrlTarget } from \"../../../../../../security/ssrf.js\";\n\nexport const prerender = false;\n\n/**\n * Image content types the proxy will pass through. Anything else is rejected.\n *\n * SVG is deliberately excluded: it is active content (an `<svg><script>`\n * executes when navigated to as a top-level document), and the publisher\n * supplies the bytes. Rather than serve it behind mitigations, we refuse it\n * end-to-end — the publish CLI rejects SVG artifacts too, so a conforming\n * release never references one.\n */\nconst ALLOWED_IMAGE_TYPES = new Set([\"image/png\", \"image/jpeg\", \"image/webp\"]);\n\n/** Artifact kinds the proxy can resolve. `screenshot` additionally needs `index`. */\nconst ALLOWED_KINDS = new Set([\"icon\", \"banner\", \"screenshot\"]);\n\n/** Loose DID shape (`did:method:id`); the aggregator lexicon is authoritative. */\nconst DID_PATTERN = /^did:[a-z]+:.+/;\n/** Slug grammar: ASCII letter then letters / digits / `-` / `_`. Mirrors the install route. */\nconst SLUG_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;\nconst CID_PATTERN = /^b[a-z2-7]+$/;\n/** Non-negative integer, for the screenshot index param. */\nconst INDEX_PATTERN = /^\\d+$/;\n\n/** Cap proxied images so a hostile host can't stream an unbounded body. */\nconst MAX_IMAGE_BYTES = 1024 * 1024;\n\n/** Redirect hops to follow, re-validating each target against SSRF rules. */\nconst MAX_REDIRECTS = 5;\n\n/** Wall-clock budget covering connect + headers + body for the artifact fetch. */\nconst FETCH_TIMEOUT_MS = 15_000;\n\n/** Per-aggregator-request timeout and overall budget for release resolution. */\nconst AGGREGATOR_REQUEST_TIMEOUT_MS = 15_000;\nconst AGGREGATOR_TOTAL_BUDGET_MS = 30_000;\n\n/** Bound the version search: 20 pages * 50 per page = 1000 releases worth. */\nconst MAX_LIST_PAGES = 20;\n\n/** Build a fetch that enforces a per-request and per-budget timeout. Mirrors the install handler. */\nfunction timedFetch(totalDeadline: number): typeof fetch {\n\treturn (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n\t\tconst now = Date.now();\n\t\tconst remaining = Math.max(0, totalDeadline - now);\n\t\tif (remaining === 0) {\n\t\t\treturn Promise.reject(new Error(\"Aggregator request budget exhausted\"));\n\t\t}\n\t\tconst timeout = Math.min(AGGREGATOR_REQUEST_TIMEOUT_MS, remaining);\n\t\tconst controller = new AbortController();\n\t\tconst timer = setTimeout(() => controller.abort(), timeout);\n\t\tconst callerSignal = init?.signal;\n\t\tif (callerSignal) {\n\t\t\tif (callerSignal.aborted) controller.abort(callerSignal.reason);\n\t\t\telse callerSignal.addEventListener(\"abort\", () => controller.abort(callerSignal.reason));\n\t\t}\n\t\treturn fetch(input, { ...init, signal: controller.signal }).finally(() => {\n\t\t\tclearTimeout(timer);\n\t\t});\n\t};\n}\n\n/**\n * Narrow one entry of a release's `artifacts` map to a usable image source.\n *\n * The embedded `release` record is lexicon-validated at the DiscoveryClient\n * boundary, but `artifacts` is an aggregator pass-through typed `unknown`, so\n * the entry's shape is not guaranteed.\n */\ntype DeclaredArtifact = ReleaseArtifactReference & { requiresAuth: boolean };\n\ninterface ResolvedArtifact {\n\tartifact: DeclaredArtifact;\n\trecord: {\n\t\tdid: string;\n\t\tcollection: string;\n\t\trkey: string;\n\t\tcid: string;\n\t};\n\timageCacheUrl?: URL;\n}\n\nfunction declaredArtifact(value: unknown): DeclaredArtifact | null {\n\tif (!value || typeof value !== \"object\") return null;\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- narrowed to non-null object above; fields checked below\n\tconst entry = value as Record<string, unknown>;\n\tconst url = entry.url;\n\tconst blob = entry.blob;\n\tconst checksum = entry.checksum;\n\tconst ref = objectProperty(blob, \"ref\");\n\tconst blobCid = objectProperty(ref, \"$link\");\n\tconst blobMimeType = objectProperty(blob, \"mimeType\");\n\tconst blobSize = objectProperty(blob, \"size\");\n\tconst hasUrl = typeof url === \"string\" && url.length > 0;\n\tconst hasBlob =\n\t\ttypeof blobCid === \"string\" &&\n\t\tblobCid.length > 0 &&\n\t\ttypeof blobMimeType === \"string\" &&\n\t\tNumber.isSafeInteger(blobSize) &&\n\t\tNumber(blobSize) >= 0;\n\tif ((!hasUrl && !hasBlob) || typeof checksum !== \"string\" || checksum.length === 0) {\n\t\treturn null;\n\t}\n\treturn {\n\t\t...(hasUrl ? { url } : {}),\n\t\t...(hasBlob\n\t\t\t? {\n\t\t\t\t\tblob: {\n\t\t\t\t\t\t$type: \"blob\" as const,\n\t\t\t\t\t\tref: { $link: blobCid },\n\t\t\t\t\t\tmimeType: blobMimeType,\n\t\t\t\t\t\tsize: Number(blobSize),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tchecksum,\n\t\trequiresAuth: entry.requiresAuth === true,\n\t};\n}\n\n/**\n * Resolve the declared artifact source for `(kind, index)` from a release's\n * `artifacts` map. Returns `null` when the requested artifact isn't present\n * or doesn't carry a usable URL.\n */\nfunction resolveDeclaredArtifact(\n\tartifacts: unknown,\n\tkind: string,\n\tindex: number,\n): DeclaredArtifact | null {\n\tif (!artifacts || typeof artifacts !== \"object\") return null;\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- narrowed to non-null object above; each entry shape-narrowed by declaredArtifactUrl\n\tconst map = artifacts as Record<string, unknown>;\n\n\tif (kind === \"icon\") return declaredArtifact(map.icon);\n\tif (kind === \"banner\") return declaredArtifact(map.banner);\n\t// kind === \"screenshot\"\n\tconst screenshots = map.screenshots;\n\tif (!Array.isArray(screenshots)) return null;\n\tif (index < 0 || index >= screenshots.length) return null;\n\treturn declaredArtifact(screenshots[index]);\n}\n\nfunction objectProperty(value: unknown, key: string): unknown {\n\tif (!value || typeof value !== \"object\") return undefined;\n\treturn Object.getOwnPropertyDescriptor(value, key)?.value;\n}\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"plugins:read\");\n\tif (denied) return denied;\n\n\tconst did = url.searchParams.get(\"did\");\n\tconst slug = url.searchParams.get(\"slug\");\n\tconst cid = url.searchParams.get(\"cid\");\n\tconst kind = url.searchParams.get(\"kind\");\n\tconst versionParam = url.searchParams.get(\"version\");\n\tconst indexParam = url.searchParams.get(\"index\");\n\n\tif (!did || !slug || !cid || !kind) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Missing did, slug, cid, or kind\", 400);\n\t}\n\tif (did.length > 256 || !DID_PATTERN.test(did)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid did\", 400);\n\t}\n\tif (slug.length > 64 || !SLUG_PATTERN.test(slug)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid slug\", 400);\n\t}\n\tif (cid.length > 256 || !CID_PATTERN.test(cid)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid release CID\", 400);\n\t}\n\tif (!ALLOWED_KINDS.has(kind)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid kind\", 400);\n\t}\n\n\tlet index = 0;\n\tif (kind === \"screenshot\") {\n\t\tif (indexParam === null) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Missing index for screenshot\", 400);\n\t\t}\n\t\tif (!INDEX_PATTERN.test(indexParam)) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid index\", 400);\n\t\t}\n\t\tindex = Number(indexParam);\n\t\tif (!Number.isSafeInteger(index)) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid index\", 400);\n\t\t}\n\t}\n\n\tlet version: string | undefined;\n\tif (versionParam !== null && versionParam.length > 0) {\n\t\tif (versionParam.length > 64) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid version\", 400);\n\t\t}\n\t\tversion = versionParam;\n\t}\n\n\tconst registryConfig = coerceRegistryConfig(emdash.config.experimental?.registry);\n\tif (!registryConfig) {\n\t\treturn apiError(\"REGISTRY_NOT_CONFIGURED\", \"Registry is not configured\", 400);\n\t}\n\ttry {\n\t\tvalidateAggregatorUrl(registryConfig.aggregatorUrl);\n\t} catch {\n\t\treturn apiError(\"REGISTRY_NOT_CONFIGURED\", \"Registry aggregator URL is invalid\", 500);\n\t}\n\n\t// Resolve the publisher-declared artifact URL from the release record.\n\tlet resolvedArtifact: ResolvedArtifact;\n\ttry {\n\t\tconst resolved = await resolveArtifact(registryConfig, did, slug, version, cid, kind, index);\n\t\tif (resolved === null) {\n\t\t\treturn apiError(\"ARTIFACT_NOT_FOUND\", \"Artifact not found\", 404);\n\t\t}\n\t\tresolvedArtifact = resolved;\n\t} catch {\n\t\treturn apiError(\"ARTIFACT_RESOLVE_FAILED\", \"Failed to resolve artifact\", 502);\n\t}\n\tconst controller = new AbortController();\n\tconst timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);\n\ttry {\n\t\tconst fetchOptions = proxyFetchOptions(controller.signal);\n\t\tlet bytes: Uint8Array | undefined;\n\t\tlet headers: Headers | undefined;\n\t\tlet checksumValid: boolean | undefined;\n\t\tif (resolvedArtifact.imageCacheUrl) {\n\t\t\tconst transformed = await fetchVerifiedResource(resolvedArtifact.imageCacheUrl, fetchOptions);\n\t\t\tif (transformed.success) {\n\t\t\t\tbytes = transformed.value.bytes;\n\t\t\t\theaders = transformed.value.headers;\n\t\t\t}\n\t\t}\n\t\tif (!bytes || !headers) {\n\t\t\tconst raw = await fetchRawArtifact(resolvedArtifact, fetchOptions);\n\t\t\tif (!raw.success) return artifactFetchError(raw.code);\n\t\t\tbytes = raw.bytes;\n\t\t\theaders = raw.headers;\n\t\t\tchecksumValid = raw.checksumValid;\n\t\t}\n\n\t\t// Content-Type allowlist: only image types are proxied. A non-image\n\t\t// (HTML error page, JSON, octet-stream) is rejected so the admin\n\t\t// never renders publisher-controlled markup from the EmDash origin.\n\t\tconst rawType = headers.get(\"content-type\") ?? \"\";\n\t\tconst contentType = rawType.split(\";\", 1)[0]!.trim().toLowerCase();\n\t\tif (!ALLOWED_IMAGE_TYPES.has(contentType)) {\n\t\t\treturn apiError(\"ARTIFACT_NOT_IMAGE\", \"Artifact is not an allowed image type\", 415);\n\t\t}\n\n\t\tconst declaredLength = headers.get(\"content-length\");\n\t\tif (declaredLength) {\n\t\t\tconst declared = Number(declaredLength);\n\t\t\tif (Number.isFinite(declared) && declared > MAX_IMAGE_BYTES) {\n\t\t\t\treturn apiError(\"ARTIFACT_TOO_LARGE\", \"Artifact exceeds size limit\", 413);\n\t\t\t}\n\t\t}\n\t\tif (checksumValid === false) {\n\t\t\treturn artifactFetchError(\"CHECKSUM_MISMATCH\");\n\t\t}\n\n\t\t// Only the allowlisted Content-Type is forwarded — never copy other\n\t\t// upstream headers. `private, no-store` keeps publisher images out of\n\t\t// shared caches in the authenticated admin origin.\n\t\t//\n\t\t// SVG is not in the allowlist, so active-content bytes never reach\n\t\t// here. `Content-Disposition: attachment`, the sandbox CSP, and\n\t\t// `nosniff` remain as defence-in-depth: they force a download and\n\t\t// neutralise script/plugins for any image type if a client navigates\n\t\t// directly to the proxy URL.\n\t\treturn new Response(bytes, {\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": contentType,\n\t\t\t\t\"Cache-Control\": \"private, no-store\",\n\t\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t\t\"Content-Disposition\": \"attachment\",\n\t\t\t\t\"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n\t\t\t},\n\t\t});\n\t} catch {\n\t\treturn apiError(\"ARTIFACT_FETCH_FAILED\", \"Failed to fetch artifact\", 502);\n\t} finally {\n\t\tclearTimeout(timer);\n\t}\n};\n\n/**\n * Resolve the declared artifact URL for `(did, slug, version, kind, index)`\n * from the aggregator's release record. Mirrors the install handler's release\n * lookup. Returns `null` when the package/release/artifact isn't found.\n *\n * Self-contained to this route: the install/update handlers are intentionally\n * left untouched, so a small amount of resolution-pattern duplication is\n * accepted here.\n */\nasync function resolveArtifact(\n\tregistryConfig: { aggregatorUrl: string; acceptLabelers?: string },\n\tdid: string,\n\tslug: string,\n\tversion: string | undefined,\n\tcid: string,\n\tkind: string,\n\tindex: number,\n): Promise<ResolvedArtifact | null> {\n\t// Lazy-load the discovery client so the `@atcute/client` dependency only\n\t// loads when the registry path is exercised.\n\tconst { DiscoveryClient, registryLabelerPolicy } =\n\t\tawait import(\"@emdash-cms/registry-client/discovery\");\n\n\tconst aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;\n\tconst discovery = new DiscoveryClient({\n\t\taggregatorUrl: registryConfig.aggregatorUrl,\n\t\tacceptLabelers: registryConfig.acceptLabelers,\n\t\tlabelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),\n\t\tfetch: timedFetch(aggregatorDeadline),\n\t});\n\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- DID shape validated by the route before this call\n\tconst publisherDid = did as Did;\n\n\tconst releaseView = await (async () => {\n\t\tif (!version) {\n\t\t\treturn discovery.getLatestRelease({ did: publisherDid, package: slug });\n\t\t}\n\t\tlet cursor: string | undefined;\n\t\tconst seenCursors = new Set<string>();\n\t\tfor (let page = 0; page < MAX_LIST_PAGES; page++) {\n\t\t\tif (cursor !== undefined) {\n\t\t\t\tif (seenCursors.has(cursor)) break;\n\t\t\t\tseenCursors.add(cursor);\n\t\t\t}\n\t\t\tconst result = await discovery.listReleases({\n\t\t\t\tdid: publisherDid,\n\t\t\t\tpackage: slug,\n\t\t\t\tcursor,\n\t\t\t\tlimit: 50,\n\t\t\t});\n\t\t\tfor (const r of result.releases) {\n\t\t\t\tif (r.version === version) return r;\n\t\t\t}\n\t\t\tif (!result.cursor) break;\n\t\t\tcursor = result.cursor;\n\t\t}\n\t\treturn undefined;\n\t})();\n\n\tif (\n\t\t!releaseView?.release ||\n\t\treleaseView.cid !== cid ||\n\t\treleaseView.did !== publisherDid ||\n\t\treleaseView.package !== slug ||\n\t\t(version !== undefined && releaseView.version !== version) ||\n\t\treleaseView.release.package !== slug ||\n\t\treleaseView.release.version !== releaseView.version\n\t) {\n\t\treturn null;\n\t}\n\tif (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {\n\t\treturn null;\n\t}\n\n\tconst descriptor = resolveDeclaredArtifact(releaseView.release.artifacts, kind, index);\n\tif (!descriptor || descriptor.requiresAuth || releaseView.release.auth !== undefined) return null;\n\tconst blobCid = descriptor.blob?.ref.$link;\n\tlet imageCacheUrl: URL | undefined;\n\tif (blobCid) {\n\t\tconst expected = multihashFromBlobCid(blobCid);\n\t\tif (!expected.success || expected.value !== descriptor.checksum) return null;\n\t\tconst rkey = `${slug}:${releaseView.version}`;\n\t\tconst serviceEndpoint = releaseView.artifactCaches\n\t\t\t.map(recordScopedCacheEndpoint)\n\t\t\t.find((value) => value !== null);\n\t\tif (serviceEndpoint) {\n\t\t\tconst preset = kind === \"icon\" ? \"avatar\" : kind === \"banner\" ? \"banner\" : \"feed_thumbnail\";\n\t\t\tconst cacheUrl = recordScopedImageCacheUrl(\n\t\t\t\tserviceEndpoint,\n\t\t\t\tpreset,\n\t\t\t\t{\n\t\t\t\t\tdid,\n\t\t\t\t\tcollection: NSID.packageRelease,\n\t\t\t\t\trkey,\n\t\t\t\t\tcid: releaseView.cid,\n\t\t\t\t},\n\t\t\t\tblobCid,\n\t\t\t);\n\t\t\tif (!cacheUrl.success) return null;\n\t\t\timageCacheUrl = cacheUrl.value;\n\t\t}\n\t}\n\treturn {\n\t\tartifact: descriptor,\n\t\trecord: {\n\t\t\tdid,\n\t\t\tcollection: NSID.packageRelease,\n\t\t\trkey: `${slug}:${releaseView.version}`,\n\t\t\tcid: releaseView.cid,\n\t\t},\n\t\t...(imageCacheUrl ? { imageCacheUrl } : {}),\n\t};\n}\n\nfunction recordScopedCacheEndpoint(value: unknown): string | null {\n\tif (objectProperty(value, \"$type\") !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;\n\tconst endpoint = objectProperty(value, \"serviceEndpoint\");\n\treturn typeof endpoint === \"string\" ? endpoint : null;\n}\n\n/** Build bounded, SSRF-validated fetch options for cache, PDS, and URL sources. */\nfunction proxyFetchOptions(signal: AbortSignal) {\n\treturn {\n\t\tfetch: async (url: URL, init: RequestInit) =>\n\t\t\tfetchRegistryArtifactUrl(url.href, {\n\t\t\t\tsignal: init.signal instanceof AbortSignal ? init.signal : signal,\n\t\t\t\tmaxResponseBytes: MAX_IMAGE_BYTES,\n\t\t\t}),\n\t\tresolveHostname: async (hostname: string) =>\n\t\t\t(await resolveAndValidateExternalUrlTarget(`https://${hostname}/`)).addresses,\n\t\tallowHttpLocalhost: import.meta.env.DEV,\n\t\tmaxBytes: MAX_IMAGE_BYTES,\n\t\tmaxRedirects: MAX_REDIRECTS,\n\t\ttotalTimeoutMs: FETCH_TIMEOUT_MS,\n\t};\n}\n\nasync function fetchRawArtifact(\n\tresolved: ResolvedArtifact,\n\toptions: ReturnType<typeof proxyFetchOptions>,\n): Promise<\n\t| { success: true; bytes: Uint8Array; headers: Headers; checksumValid: boolean }\n\t| { success: false; code: string }\n> {\n\tconst urls: URL[] = [];\n\tconst blobCid = resolved.artifact.blob?.ref.$link;\n\tlet lastCode = \"FETCH_FAILED\";\n\tlet checksumMismatch: { bytes: Uint8Array; headers: Headers } | undefined;\n\tif (blobCid) {\n\t\tconst pds = await resolvePublisherPdsEndpoint(resolved.record.did, options);\n\t\tif (pds.success) {\n\t\t\tconst url = new URL(\"/xrpc/com.atproto.sync.getBlob\", pds.value);\n\t\t\turl.searchParams.set(\"did\", resolved.record.did);\n\t\t\turl.searchParams.set(\"cid\", blobCid);\n\t\t\turls.push(url);\n\t\t} else {\n\t\t\tlastCode = pds.error.code;\n\t\t}\n\t}\n\tif (resolved.artifact.url) urls.push(new URL(resolved.artifact.url));\n\n\tfor (const url of urls) {\n\t\tconst fetched = await fetchVerifiedResource(url, options);\n\t\tif (!fetched.success) {\n\t\t\tlastCode = fetched.error.code;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!(await verifyRegistryArtifactChecksum(fetched.value.bytes, resolved.artifact.checksum))) {\n\t\t\tlastCode = \"CHECKSUM_MISMATCH\";\n\t\t\tchecksumMismatch = { bytes: fetched.value.bytes, headers: fetched.value.headers };\n\t\t\tcontinue;\n\t\t}\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tbytes: fetched.value.bytes,\n\t\t\theaders: fetched.value.headers,\n\t\t\tchecksumValid: true,\n\t\t};\n\t}\n\tif (checksumMismatch) return { success: true, ...checksumMismatch, checksumValid: false };\n\treturn { success: false, code: lastCode };\n}\n\nfunction artifactFetchError(code: string): Response {\n\tif (code === \"CHECKSUM_MISMATCH\") {\n\t\treturn apiError(\n\t\t\t\"ARTIFACT_CHECKSUM_MISMATCH\",\n\t\t\t\"Artifact bytes do not match the approved release record\",\n\t\t\t502,\n\t\t);\n\t}\n\tif (code === \"RESOURCE_SIZE_EXCEEDED\") {\n\t\treturn apiError(\"ARTIFACT_TOO_LARGE\", \"Artifact exceeds size limit\", 413);\n\t}\n\tif (code === \"HOST_REJECTED\" || code === \"INVALID_URL\") {\n\t\treturn apiError(\"ARTIFACT_URL_REJECTED\", \"Artifact URL is not allowed\", 400);\n\t}\n\treturn apiError(\"ARTIFACT_FETCH_FAILED\", \"Failed to fetch artifact\", 502);\n}\n"],"mappings":";;;;;;;;;;;AAEA,MAAM,qBAAqB;AAE3B,eAAsB,+BACrB,OACA,UACmB;AACnB,KAAI,mBAAmB,KAAK,SAAS,EAAE;EACtC,MAAM,SAAS,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,WAAW,KAAK,MAAM,CAAC,CAAC;AAE5F,SADe,MAAM,KAAK,SAAS,SAAS,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,KACtE,SAAS,aAAa;;AAEzC,SAAQ,MAAM,gBAAgB,OAAO,SAAS,EAAE;;;;;AC8BjD,MAAa,YAAY;;;;;;;;;;AAWzB,MAAM,sBAAsB,IAAI,IAAI;CAAC;CAAa;CAAc;CAAa,CAAC;;AAG9E,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAU;CAAa,CAAC;;AAG/D,MAAM,cAAc;;AAEpB,MAAM,eAAe;AACrB,MAAM,cAAc;;AAEpB,MAAM,gBAAgB;;AAGtB,MAAM,kBAAkB,OAAO;;AAG/B,MAAM,gBAAgB;;AAGtB,MAAM,mBAAmB;;AAGzB,MAAM,gCAAgC;AACtC,MAAM,6BAA6B;;AAGnC,MAAM,iBAAiB;;AAGvB,SAAS,WAAW,eAAqC;AACxD,SAAQ,OAAoC,SAAuC;EAClF,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,YAAY,KAAK,IAAI,GAAG,gBAAgB,IAAI;AAClD,MAAI,cAAc,EACjB,QAAO,QAAQ,uBAAO,IAAI,MAAM,sCAAsC,CAAC;EAExE,MAAM,UAAU,KAAK,IAAI,+BAA+B,UAAU;EAClE,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,QAAQ;EAC3D,MAAM,eAAe,MAAM;AAC3B,MAAI,aACH,KAAI,aAAa,QAAS,YAAW,MAAM,aAAa,OAAO;MAC1D,cAAa,iBAAiB,eAAe,WAAW,MAAM,aAAa,OAAO,CAAC;AAEzF,SAAO,MAAM,OAAO;GAAE,GAAG;GAAM,QAAQ,WAAW;GAAQ,CAAC,CAAC,cAAc;AACzE,gBAAa,MAAM;IAClB;;;AAwBJ,SAAS,iBAAiB,OAAyC;AAClE,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;CAEhD,MAAM,QAAQ;CACd,MAAM,MAAM,MAAM;CAClB,MAAM,OAAO,MAAM;CACnB,MAAM,WAAW,MAAM;CAEvB,MAAM,UAAU,eADJ,eAAe,MAAM,MAAM,EACH,QAAQ;CAC5C,MAAM,eAAe,eAAe,MAAM,WAAW;CACrD,MAAM,WAAW,eAAe,MAAM,OAAO;CAC7C,MAAM,SAAS,OAAO,QAAQ,YAAY,IAAI,SAAS;CACvD,MAAM,UACL,OAAO,YAAY,YACnB,QAAQ,SAAS,KACjB,OAAO,iBAAiB,YACxB,OAAO,cAAc,SAAS,IAC9B,OAAO,SAAS,IAAI;AACrB,KAAK,CAAC,UAAU,CAAC,WAAY,OAAO,aAAa,YAAY,SAAS,WAAW,EAChF,QAAO;AAER,QAAO;EACN,GAAI,SAAS,EAAE,KAAK,GAAG,EAAE;EACzB,GAAI,UACD,EACA,MAAM;GACL,OAAO;GACP,KAAK,EAAE,OAAO,SAAS;GACvB,UAAU;GACV,MAAM,OAAO,SAAS;GACtB,EACD,GACA,EAAE;EACL;EACA,cAAc,MAAM,iBAAiB;EACrC;;;;;;;AAQF,SAAS,wBACR,WACA,MACA,OAC0B;AAC1B,KAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;CAExD,MAAM,MAAM;AAEZ,KAAI,SAAS,OAAQ,QAAO,iBAAiB,IAAI,KAAK;AACtD,KAAI,SAAS,SAAU,QAAO,iBAAiB,IAAI,OAAO;CAE1D,MAAM,cAAc,IAAI;AACxB,KAAI,CAAC,MAAM,QAAQ,YAAY,CAAE,QAAO;AACxC,KAAI,QAAQ,KAAK,SAAS,YAAY,OAAQ,QAAO;AACrD,QAAO,iBAAiB,YAAY,OAAO;;AAG5C,SAAS,eAAe,OAAgB,KAAsB;AAC7D,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAO,OAAO,yBAAyB,OAAO,IAAI,EAAE;;AAGrD,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,MAAM,IAAI,aAAa,IAAI,MAAM;CACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,MAAM,IAAI,aAAa,IAAI,MAAM;CACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,eAAe,IAAI,aAAa,IAAI,UAAU;CACpD,MAAM,aAAa,IAAI,aAAa,IAAI,QAAQ;AAEhD,KAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAC7B,QAAO,SAAS,mBAAmB,mCAAmC,IAAI;AAE3E,KAAI,IAAI,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAC7C,QAAO,SAAS,mBAAmB,eAAe,IAAI;AAEvD,KAAI,KAAK,SAAS,MAAM,CAAC,aAAa,KAAK,KAAK,CAC/C,QAAO,SAAS,mBAAmB,gBAAgB,IAAI;AAExD,KAAI,IAAI,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAC7C,QAAO,SAAS,mBAAmB,uBAAuB,IAAI;AAE/D,KAAI,CAAC,cAAc,IAAI,KAAK,CAC3B,QAAO,SAAS,mBAAmB,gBAAgB,IAAI;CAGxD,IAAI,QAAQ;AACZ,KAAI,SAAS,cAAc;AAC1B,MAAI,eAAe,KAClB,QAAO,SAAS,mBAAmB,gCAAgC,IAAI;AAExE,MAAI,CAAC,cAAc,KAAK,WAAW,CAClC,QAAO,SAAS,mBAAmB,iBAAiB,IAAI;AAEzD,UAAQ,OAAO,WAAW;AAC1B,MAAI,CAAC,OAAO,cAAc,MAAM,CAC/B,QAAO,SAAS,mBAAmB,iBAAiB,IAAI;;CAI1D,IAAI;AACJ,KAAI,iBAAiB,QAAQ,aAAa,SAAS,GAAG;AACrD,MAAI,aAAa,SAAS,GACzB,QAAO,SAAS,mBAAmB,mBAAmB,IAAI;AAE3D,YAAU;;CAGX,MAAM,iBAAiB,qBAAqB,OAAO,OAAO,cAAc,SAAS;AACjF,KAAI,CAAC,eACJ,QAAO,SAAS,2BAA2B,8BAA8B,IAAI;AAE9E,KAAI;AACH,wBAAsB,eAAe,cAAc;SAC5C;AACP,SAAO,SAAS,2BAA2B,sCAAsC,IAAI;;CAItF,IAAI;AACJ,KAAI;EACH,MAAM,WAAW,MAAM,gBAAgB,gBAAgB,KAAK,MAAM,SAAS,KAAK,MAAM,MAAM;AAC5F,MAAI,aAAa,KAChB,QAAO,SAAS,sBAAsB,sBAAsB,IAAI;AAEjE,qBAAmB;SACZ;AACP,SAAO,SAAS,2BAA2B,8BAA8B,IAAI;;CAE9E,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,iBAAiB;AACpE,KAAI;EACH,MAAM,eAAe,kBAAkB,WAAW,OAAO;EACzD,IAAI;EACJ,IAAI;EACJ,IAAI;AACJ,MAAI,iBAAiB,eAAe;GACnC,MAAM,cAAc,MAAM,sBAAsB,iBAAiB,eAAe,aAAa;AAC7F,OAAI,YAAY,SAAS;AACxB,YAAQ,YAAY,MAAM;AAC1B,cAAU,YAAY,MAAM;;;AAG9B,MAAI,CAAC,SAAS,CAAC,SAAS;GACvB,MAAM,MAAM,MAAM,iBAAiB,kBAAkB,aAAa;AAClE,OAAI,CAAC,IAAI,QAAS,QAAO,mBAAmB,IAAI,KAAK;AACrD,WAAQ,IAAI;AACZ,aAAU,IAAI;AACd,mBAAgB,IAAI;;EAOrB,MAAM,eADU,QAAQ,IAAI,eAAe,IAAI,IACnB,MAAM,KAAK,EAAE,CAAC,GAAI,MAAM,CAAC,aAAa;AAClE,MAAI,CAAC,oBAAoB,IAAI,YAAY,CACxC,QAAO,SAAS,sBAAsB,yCAAyC,IAAI;EAGpF,MAAM,iBAAiB,QAAQ,IAAI,iBAAiB;AACpD,MAAI,gBAAgB;GACnB,MAAM,WAAW,OAAO,eAAe;AACvC,OAAI,OAAO,SAAS,SAAS,IAAI,WAAW,gBAC3C,QAAO,SAAS,sBAAsB,+BAA+B,IAAI;;AAG3E,MAAI,kBAAkB,MACrB,QAAO,mBAAmB,oBAAoB;AAY/C,SAAO,IAAI,SAAS,OAAO,EAC1B,SAAS;GACR,gBAAgB;GAChB,iBAAiB;GACjB,0BAA0B;GAC1B,uBAAuB;GACvB,2BAA2B;GAC3B,EACD,CAAC;SACK;AACP,SAAO,SAAS,yBAAyB,4BAA4B,IAAI;WAChE;AACT,eAAa,MAAM;;;;;;;;;;;;AAarB,eAAe,gBACd,gBACA,KACA,MACA,SACA,KACA,MACA,OACmC;CAGnC,MAAM,EAAE,iBAAiB,0BACxB,MAAM,OAAO;CAEd,MAAM,qBAAqB,KAAK,KAAK,GAAG;CACxC,MAAM,YAAY,IAAI,gBAAgB;EACrC,eAAe,eAAe;EAC9B,gBAAgB,eAAe;EAC/B,eAAe,sBAAsB,eAAe,eAAe;EACnE,OAAO,WAAW,mBAAmB;EACrC,CAAC;CAGF,MAAM,eAAe;CAErB,MAAM,cAAc,OAAO,YAAY;AACtC,MAAI,CAAC,QACJ,QAAO,UAAU,iBAAiB;GAAE,KAAK;GAAc,SAAS;GAAM,CAAC;EAExE,IAAI;EACJ,MAAM,8BAAc,IAAI,KAAa;AACrC,OAAK,IAAI,OAAO,GAAG,OAAO,gBAAgB,QAAQ;AACjD,OAAI,WAAW,QAAW;AACzB,QAAI,YAAY,IAAI,OAAO,CAAE;AAC7B,gBAAY,IAAI,OAAO;;GAExB,MAAM,SAAS,MAAM,UAAU,aAAa;IAC3C,KAAK;IACL,SAAS;IACT;IACA,OAAO;IACP,CAAC;AACF,QAAK,MAAM,KAAK,OAAO,SACtB,KAAI,EAAE,YAAY,QAAS,QAAO;AAEnC,OAAI,CAAC,OAAO,OAAQ;AACpB,YAAS,OAAO;;KAGd;AAEJ,KACC,CAAC,aAAa,WACd,YAAY,QAAQ,OACpB,YAAY,QAAQ,gBACpB,YAAY,YAAY,QACvB,YAAY,UAAa,YAAY,YAAY,WAClD,YAAY,QAAQ,YAAY,QAChC,YAAY,QAAQ,YAAY,YAAY,QAE5C,QAAO;AAER,KAAI,kCAAkC,aAAa,UAAU,cAAc,CAAC,UAC3E,QAAO;CAGR,MAAM,aAAa,wBAAwB,YAAY,QAAQ,WAAW,MAAM,MAAM;AACtF,KAAI,CAAC,cAAc,WAAW,gBAAgB,YAAY,QAAQ,SAAS,OAAW,QAAO;CAC7F,MAAM,UAAU,WAAW,MAAM,IAAI;CACrC,IAAI;AACJ,KAAI,SAAS;EACZ,MAAM,WAAW,qBAAqB,QAAQ;AAC9C,MAAI,CAAC,SAAS,WAAW,SAAS,UAAU,WAAW,SAAU,QAAO;EACxE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY;EACpC,MAAM,kBAAkB,YAAY,eAClC,IAAI,0BAA0B,CAC9B,MAAM,UAAU,UAAU,KAAK;AACjC,MAAI,iBAAiB;GAEpB,MAAM,WAAW,0BAChB,iBAFc,SAAS,SAAS,WAAW,SAAS,WAAW,WAAW,kBAI1E;IACC;IACA,YAAY,KAAK;IACjB;IACA,KAAK,YAAY;IACjB,EACD,QACA;AACD,OAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,mBAAgB,SAAS;;;AAG3B,QAAO;EACN,UAAU;EACV,QAAQ;GACP;GACA,YAAY,KAAK;GACjB,MAAM,GAAG,KAAK,GAAG,YAAY;GAC7B,KAAK,YAAY;GACjB;EACD,GAAI,gBAAgB,EAAE,eAAe,GAAG,EAAE;EAC1C;;AAGF,SAAS,0BAA0B,OAA+B;AACjE,KAAI,eAAe,OAAO,QAAQ,KAAK,8BAA+B,QAAO;CAC7E,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,QAAO,OAAO,aAAa,WAAW,WAAW;;;AAIlD,SAAS,kBAAkB,QAAqB;AAC/C,QAAO;EACN,OAAO,OAAO,KAAU,SACvB,yBAAyB,IAAI,MAAM;GAClC,QAAQ,KAAK,kBAAkB,cAAc,KAAK,SAAS;GAC3D,kBAAkB;GAClB,CAAC;EACH,iBAAiB,OAAO,cACtB,MAAM,oCAAoC,WAAW,SAAS,GAAG,EAAE;EACrE,oBAAoB,OAAO,KAAK,IAAI;EACpC,UAAU;EACV,cAAc;EACd,gBAAgB;EAChB;;AAGF,eAAe,iBACd,UACA,SAIC;CACD,MAAM,OAAc,EAAE;CACtB,MAAM,UAAU,SAAS,SAAS,MAAM,IAAI;CAC5C,IAAI,WAAW;CACf,IAAI;AACJ,KAAI,SAAS;EACZ,MAAM,MAAM,MAAM,4BAA4B,SAAS,OAAO,KAAK,QAAQ;AAC3E,MAAI,IAAI,SAAS;GAChB,MAAM,MAAM,IAAI,IAAI,kCAAkC,IAAI,MAAM;AAChE,OAAI,aAAa,IAAI,OAAO,SAAS,OAAO,IAAI;AAChD,OAAI,aAAa,IAAI,OAAO,QAAQ;AACpC,QAAK,KAAK,IAAI;QAEd,YAAW,IAAI,MAAM;;AAGvB,KAAI,SAAS,SAAS,IAAK,MAAK,KAAK,IAAI,IAAI,SAAS,SAAS,IAAI,CAAC;AAEpE,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,UAAU,MAAM,sBAAsB,KAAK,QAAQ;AACzD,MAAI,CAAC,QAAQ,SAAS;AACrB,cAAW,QAAQ,MAAM;AACzB;;AAED,MAAI,CAAE,MAAM,+BAA+B,QAAQ,MAAM,OAAO,SAAS,SAAS,SAAS,EAAG;AAC7F,cAAW;AACX,sBAAmB;IAAE,OAAO,QAAQ,MAAM;IAAO,SAAS,QAAQ,MAAM;IAAS;AACjF;;AAED,SAAO;GACN,SAAS;GACT,OAAO,QAAQ,MAAM;GACrB,SAAS,QAAQ,MAAM;GACvB,eAAe;GACf;;AAEF,KAAI,iBAAkB,QAAO;EAAE,SAAS;EAAM,GAAG;EAAkB,eAAe;EAAO;AACzF,QAAO;EAAE,SAAS;EAAO,MAAM;EAAU;;AAG1C,SAAS,mBAAmB,MAAwB;AACnD,KAAI,SAAS,oBACZ,QAAO,SACN,8BACA,2DACA,IACA;AAEF,KAAI,SAAS,yBACZ,QAAO,SAAS,sBAAsB,+BAA+B,IAAI;AAE1E,KAAI,SAAS,mBAAmB,SAAS,cACxC,QAAO,SAAS,yBAAyB,+BAA+B,IAAI;AAE7E,QAAO,SAAS,yBAAyB,4BAA4B,IAAI"}
+{"version":3,"file":"artifact.mjs","names":[],"sources":["../../../../../../../src/registry/artifact-checksum.ts","../../../../../../../src/astro/routes/api/admin/plugins/registry/artifact.ts"],"sourcesContent":["import { verifyMultihash } from \"@emdash-cms/registry-verification/checksum\";\n\nconst SHA256_HEX_PATTERN = /^[0-9a-fA-F]{64}$/;\n\nexport async function verifyRegistryArtifactChecksum(\n\tbytes: Uint8Array,\n\tchecksum: string,\n): Promise<boolean> {\n\tif (SHA256_HEX_PATTERN.test(checksum)) {\n\t\tconst digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", Uint8Array.from(bytes)));\n\t\tconst actual = Array.from(digest, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\t\treturn actual === checksum.toLowerCase();\n\t}\n\treturn (await verifyMultihash(bytes, checksum)).success;\n}\n","/**\n * Registry artifact proxy\n *\n * GET /_emdash/api/admin/plugins/registry/artifact?did=&slug=&version=&kind=&index=\n *\n * Proxies an icon / screenshot / banner image referenced by a registry\n * release record so the admin UI can display it without cross-origin\n * requests to arbitrary publisher hosting.\n *\n * Trust model (CRITICAL): the proxy never accepts an artifact URL from the\n * client. The caller addresses an artifact by its coordinates\n * `(did, slug, version, kind, index)`; the server resolves the *declared*\n * artifact source from the validated release record fetched from the\n * configured aggregator. Blob-backed images resolve to the record-scoped\n * Cumulus deployment; URL artifacts retain the external fallback.\n *\n * The publisher-declared URL is still untrusted (an attacker who controls a\n * publisher record, or the aggregator, can point it anywhere), so the\n * resolved URL passes through the SSRF defences (`assertSafeArtifactUrl`,\n * re-validated on every redirect hop) before any fetch, and only allowlisted\n * image content types are served back.\n */\n\nimport type { Did } from \"@atcute/lexicons\";\nimport { evaluateRegistryReleaseWithdrawal } from \"@emdash-cms/registry-client/withdrawal\";\nimport { NSID, RECORD_SCOPED_BLOB_CACHE_TYPE } from \"@emdash-cms/registry-lexicons\";\nimport {\n\trecordScopedImageCacheUrl,\n\tresolvePublisherPdsEndpoint,\n\ttype ReleaseArtifactReference,\n} from \"@emdash-cms/registry-verification/artifact\";\nimport { multihashFromBlobCid } from \"@emdash-cms/registry-verification/checksum\";\nimport { fetchVerifiedResource } from \"@emdash-cms/registry-verification/fetch\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError } from \"#api/error.js\";\n\nimport { verifyRegistryArtifactChecksum } from \"../../../../../../registry/artifact-checksum.js\";\nimport { fetchRegistryArtifactUrl } from \"../../../../../../registry/artifact-fetch.js\";\nimport {\n\tcoerceRegistryConfig,\n\tgetRegistryConfigInput,\n\tvalidateAggregatorUrl,\n} from \"../../../../../../registry/config.js\";\nimport { resolveAndValidateExternalUrlTarget } from \"../../../../../../security/ssrf.js\";\n\nexport const prerender = false;\n\n/**\n * Image content types the proxy will pass through. Anything else is rejected.\n *\n * SVG is deliberately excluded: it is active content (an `<svg><script>`\n * executes when navigated to as a top-level document), and the publisher\n * supplies the bytes. Rather than serve it behind mitigations, we refuse it\n * end-to-end — the publish CLI rejects SVG artifacts too, so a conforming\n * release never references one.\n */\nconst ALLOWED_IMAGE_TYPES = new Set([\"image/png\", \"image/jpeg\", \"image/webp\"]);\n\n/** Artifact kinds the proxy can resolve. `screenshot` additionally needs `index`. */\nconst ALLOWED_KINDS = new Set([\"icon\", \"banner\", \"screenshot\"]);\n\n/** Loose DID shape (`did:method:id`); the aggregator lexicon is authoritative. */\nconst DID_PATTERN = /^did:[a-z]+:.+/;\n/** Slug grammar: ASCII letter then letters / digits / `-` / `_`. Mirrors the install route. */\nconst SLUG_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;\nconst CID_PATTERN = /^b[a-z2-7]+$/;\n/** Non-negative integer, for the screenshot index param. */\nconst INDEX_PATTERN = /^\\d+$/;\n\n/** Cap proxied images so a hostile host can't stream an unbounded body. */\nconst MAX_IMAGE_BYTES = 1024 * 1024;\n\n/** Redirect hops to follow, re-validating each target against SSRF rules. */\nconst MAX_REDIRECTS = 5;\n\n/** Wall-clock budget covering connect + headers + body for the artifact fetch. */\nconst FETCH_TIMEOUT_MS = 15_000;\n\n/** Per-aggregator-request timeout and overall budget for release resolution. */\nconst AGGREGATOR_REQUEST_TIMEOUT_MS = 15_000;\nconst AGGREGATOR_TOTAL_BUDGET_MS = 30_000;\n\n/** Bound the version search: 20 pages * 50 per page = 1000 releases worth. */\nconst MAX_LIST_PAGES = 20;\n\n/** Build a fetch that enforces a per-request and per-budget timeout. Mirrors the install handler. */\nfunction timedFetch(totalDeadline: number): typeof fetch {\n\treturn (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n\t\tconst now = Date.now();\n\t\tconst remaining = Math.max(0, totalDeadline - now);\n\t\tif (remaining === 0) {\n\t\t\treturn Promise.reject(new Error(\"Aggregator request budget exhausted\"));\n\t\t}\n\t\tconst timeout = Math.min(AGGREGATOR_REQUEST_TIMEOUT_MS, remaining);\n\t\tconst controller = new AbortController();\n\t\tconst timer = setTimeout(() => controller.abort(), timeout);\n\t\tconst callerSignal = init?.signal;\n\t\tif (callerSignal) {\n\t\t\tif (callerSignal.aborted) controller.abort(callerSignal.reason);\n\t\t\telse callerSignal.addEventListener(\"abort\", () => controller.abort(callerSignal.reason));\n\t\t}\n\t\treturn fetch(input, { ...init, signal: controller.signal }).finally(() => {\n\t\t\tclearTimeout(timer);\n\t\t});\n\t};\n}\n\n/**\n * Narrow one entry of a release's `artifacts` map to a usable image source.\n *\n * The embedded `release` record is lexicon-validated at the DiscoveryClient\n * boundary, but `artifacts` is an aggregator pass-through typed `unknown`, so\n * the entry's shape is not guaranteed.\n */\ntype DeclaredArtifact = ReleaseArtifactReference & { requiresAuth: boolean };\n\ninterface ResolvedArtifact {\n\tartifact: DeclaredArtifact;\n\trecord: {\n\t\tdid: string;\n\t\tcollection: string;\n\t\trkey: string;\n\t\tcid: string;\n\t};\n\timageCacheUrl?: URL;\n}\n\nfunction declaredArtifact(value: unknown): DeclaredArtifact | null {\n\tif (!value || typeof value !== \"object\") return null;\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- narrowed to non-null object above; fields checked below\n\tconst entry = value as Record<string, unknown>;\n\tconst url = entry.url;\n\tconst blob = entry.blob;\n\tconst checksum = entry.checksum;\n\tconst ref = objectProperty(blob, \"ref\");\n\tconst blobCid = objectProperty(ref, \"$link\");\n\tconst blobMimeType = objectProperty(blob, \"mimeType\");\n\tconst blobSize = objectProperty(blob, \"size\");\n\tconst hasUrl = typeof url === \"string\" && url.length > 0;\n\tconst hasBlob =\n\t\ttypeof blobCid === \"string\" &&\n\t\tblobCid.length > 0 &&\n\t\ttypeof blobMimeType === \"string\" &&\n\t\tNumber.isSafeInteger(blobSize) &&\n\t\tNumber(blobSize) >= 0;\n\tif ((!hasUrl && !hasBlob) || typeof checksum !== \"string\" || checksum.length === 0) {\n\t\treturn null;\n\t}\n\treturn {\n\t\t...(hasUrl ? { url } : {}),\n\t\t...(hasBlob\n\t\t\t? {\n\t\t\t\t\tblob: {\n\t\t\t\t\t\t$type: \"blob\" as const,\n\t\t\t\t\t\tref: { $link: blobCid },\n\t\t\t\t\t\tmimeType: blobMimeType,\n\t\t\t\t\t\tsize: Number(blobSize),\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t: {}),\n\t\tchecksum,\n\t\trequiresAuth: entry.requiresAuth === true,\n\t};\n}\n\n/**\n * Resolve the declared artifact source for `(kind, index)` from a release's\n * `artifacts` map. Returns `null` when the requested artifact isn't present\n * or doesn't carry a usable URL.\n */\nfunction resolveDeclaredArtifact(\n\tartifacts: unknown,\n\tkind: string,\n\tindex: number,\n): DeclaredArtifact | null {\n\tif (!artifacts || typeof artifacts !== \"object\") return null;\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- narrowed to non-null object above; each entry shape-narrowed by declaredArtifactUrl\n\tconst map = artifacts as Record<string, unknown>;\n\n\tif (kind === \"icon\") return declaredArtifact(map.icon);\n\tif (kind === \"banner\") return declaredArtifact(map.banner);\n\t// kind === \"screenshot\"\n\tconst screenshots = map.screenshots;\n\tif (!Array.isArray(screenshots)) return null;\n\tif (index < 0 || index >= screenshots.length) return null;\n\treturn declaredArtifact(screenshots[index]);\n}\n\nfunction objectProperty(value: unknown, key: string): unknown {\n\tif (!value || typeof value !== \"object\") return undefined;\n\treturn Object.getOwnPropertyDescriptor(value, key)?.value;\n}\n\nexport const GET: APIRoute = async ({ url, locals }) => {\n\tconst { emdash, user } = locals;\n\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst denied = requirePerm(user, \"plugins:read\");\n\tif (denied) return denied;\n\n\tconst did = url.searchParams.get(\"did\");\n\tconst slug = url.searchParams.get(\"slug\");\n\tconst cid = url.searchParams.get(\"cid\");\n\tconst kind = url.searchParams.get(\"kind\");\n\tconst versionParam = url.searchParams.get(\"version\");\n\tconst indexParam = url.searchParams.get(\"index\");\n\n\tif (!did || !slug || !cid || !kind) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Missing did, slug, cid, or kind\", 400);\n\t}\n\tif (did.length > 256 || !DID_PATTERN.test(did)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid did\", 400);\n\t}\n\tif (slug.length > 64 || !SLUG_PATTERN.test(slug)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid slug\", 400);\n\t}\n\tif (cid.length > 256 || !CID_PATTERN.test(cid)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid release CID\", 400);\n\t}\n\tif (!ALLOWED_KINDS.has(kind)) {\n\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid kind\", 400);\n\t}\n\n\tlet index = 0;\n\tif (kind === \"screenshot\") {\n\t\tif (indexParam === null) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Missing index for screenshot\", 400);\n\t\t}\n\t\tif (!INDEX_PATTERN.test(indexParam)) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid index\", 400);\n\t\t}\n\t\tindex = Number(indexParam);\n\t\tif (!Number.isSafeInteger(index)) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid index\", 400);\n\t\t}\n\t}\n\n\tlet version: string | undefined;\n\tif (versionParam !== null && versionParam.length > 0) {\n\t\tif (versionParam.length > 64) {\n\t\t\treturn apiError(\"INVALID_REQUEST\", \"Invalid version\", 400);\n\t\t}\n\t\tversion = versionParam;\n\t}\n\n\tconst registryConfig = coerceRegistryConfig(\n\t\tgetRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),\n\t);\n\tif (!registryConfig) {\n\t\treturn apiError(\"REGISTRY_NOT_CONFIGURED\", \"Registry is not configured\", 400);\n\t}\n\ttry {\n\t\tvalidateAggregatorUrl(registryConfig.aggregatorUrl);\n\t} catch {\n\t\treturn apiError(\"REGISTRY_NOT_CONFIGURED\", \"Registry aggregator URL is invalid\", 500);\n\t}\n\n\t// Resolve the publisher-declared artifact URL from the release record.\n\tlet resolvedArtifact: ResolvedArtifact;\n\ttry {\n\t\tconst resolved = await resolveArtifact(registryConfig, did, slug, version, cid, kind, index);\n\t\tif (resolved === null) {\n\t\t\treturn apiError(\"ARTIFACT_NOT_FOUND\", \"Artifact not found\", 404);\n\t\t}\n\t\tresolvedArtifact = resolved;\n\t} catch {\n\t\treturn apiError(\"ARTIFACT_RESOLVE_FAILED\", \"Failed to resolve artifact\", 502);\n\t}\n\tconst controller = new AbortController();\n\tconst timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);\n\ttry {\n\t\tconst fetchOptions = proxyFetchOptions(controller.signal);\n\t\tlet bytes: Uint8Array | undefined;\n\t\tlet headers: Headers | undefined;\n\t\tlet checksumValid: boolean | undefined;\n\t\tif (resolvedArtifact.imageCacheUrl) {\n\t\t\tconst transformed = await fetchVerifiedResource(resolvedArtifact.imageCacheUrl, fetchOptions);\n\t\t\tif (transformed.success) {\n\t\t\t\tbytes = transformed.value.bytes;\n\t\t\t\theaders = transformed.value.headers;\n\t\t\t}\n\t\t}\n\t\tif (!bytes || !headers) {\n\t\t\tconst raw = await fetchRawArtifact(resolvedArtifact, fetchOptions);\n\t\t\tif (!raw.success) return artifactFetchError(raw.code);\n\t\t\tbytes = raw.bytes;\n\t\t\theaders = raw.headers;\n\t\t\tchecksumValid = raw.checksumValid;\n\t\t}\n\n\t\t// Content-Type allowlist: only image types are proxied. A non-image\n\t\t// (HTML error page, JSON, octet-stream) is rejected so the admin\n\t\t// never renders publisher-controlled markup from the EmDash origin.\n\t\tconst rawType = headers.get(\"content-type\") ?? \"\";\n\t\tconst contentType = rawType.split(\";\", 1)[0]!.trim().toLowerCase();\n\t\tif (!ALLOWED_IMAGE_TYPES.has(contentType)) {\n\t\t\treturn apiError(\"ARTIFACT_NOT_IMAGE\", \"Artifact is not an allowed image type\", 415);\n\t\t}\n\n\t\tconst declaredLength = headers.get(\"content-length\");\n\t\tif (declaredLength) {\n\t\t\tconst declared = Number(declaredLength);\n\t\t\tif (Number.isFinite(declared) && declared > MAX_IMAGE_BYTES) {\n\t\t\t\treturn apiError(\"ARTIFACT_TOO_LARGE\", \"Artifact exceeds size limit\", 413);\n\t\t\t}\n\t\t}\n\t\tif (checksumValid === false) {\n\t\t\treturn artifactFetchError(\"CHECKSUM_MISMATCH\");\n\t\t}\n\n\t\t// Only the allowlisted Content-Type is forwarded — never copy other\n\t\t// upstream headers. `private, no-store` keeps publisher images out of\n\t\t// shared caches in the authenticated admin origin.\n\t\t//\n\t\t// SVG is not in the allowlist, so active-content bytes never reach\n\t\t// here. `Content-Disposition: attachment`, the sandbox CSP, and\n\t\t// `nosniff` remain as defence-in-depth: they force a download and\n\t\t// neutralise script/plugins for any image type if a client navigates\n\t\t// directly to the proxy URL.\n\t\treturn new Response(bytes, {\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": contentType,\n\t\t\t\t\"Cache-Control\": \"private, no-store\",\n\t\t\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t\t\t\t\"Content-Disposition\": \"attachment\",\n\t\t\t\t\"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n\t\t\t},\n\t\t});\n\t} catch {\n\t\treturn apiError(\"ARTIFACT_FETCH_FAILED\", \"Failed to fetch artifact\", 502);\n\t} finally {\n\t\tclearTimeout(timer);\n\t}\n};\n\n/**\n * Resolve the declared artifact URL for `(did, slug, version, kind, index)`\n * from the aggregator's release record. Mirrors the install handler's release\n * lookup. Returns `null` when the package/release/artifact isn't found.\n *\n * Self-contained to this route: the install/update handlers are intentionally\n * left untouched, so a small amount of resolution-pattern duplication is\n * accepted here.\n */\nasync function resolveArtifact(\n\tregistryConfig: { aggregatorUrl: string; acceptLabelers?: string },\n\tdid: string,\n\tslug: string,\n\tversion: string | undefined,\n\tcid: string,\n\tkind: string,\n\tindex: number,\n): Promise<ResolvedArtifact | null> {\n\t// Lazy-load the discovery client so the `@atcute/client` dependency only\n\t// loads when the registry path is exercised.\n\tconst { DiscoveryClient, registryLabelerPolicy } =\n\t\tawait import(\"@emdash-cms/registry-client/discovery\");\n\n\tconst aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;\n\tconst discovery = new DiscoveryClient({\n\t\taggregatorUrl: registryConfig.aggregatorUrl,\n\t\tacceptLabelers: registryConfig.acceptLabelers,\n\t\tlabelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),\n\t\tfetch: timedFetch(aggregatorDeadline),\n\t});\n\n\t// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- DID shape validated by the route before this call\n\tconst publisherDid = did as Did;\n\n\tconst releaseView = await (async () => {\n\t\tif (!version) {\n\t\t\treturn discovery.getLatestRelease({ did: publisherDid, package: slug });\n\t\t}\n\t\tlet cursor: string | undefined;\n\t\tconst seenCursors = new Set<string>();\n\t\tfor (let page = 0; page < MAX_LIST_PAGES; page++) {\n\t\t\tif (cursor !== undefined) {\n\t\t\t\tif (seenCursors.has(cursor)) break;\n\t\t\t\tseenCursors.add(cursor);\n\t\t\t}\n\t\t\tconst result = await discovery.listReleases({\n\t\t\t\tdid: publisherDid,\n\t\t\t\tpackage: slug,\n\t\t\t\tcursor,\n\t\t\t\tlimit: 50,\n\t\t\t});\n\t\t\tfor (const r of result.releases) {\n\t\t\t\tif (r.version === version) return r;\n\t\t\t}\n\t\t\tif (!result.cursor) break;\n\t\t\tcursor = result.cursor;\n\t\t}\n\t\treturn undefined;\n\t})();\n\n\tif (\n\t\t!releaseView?.release ||\n\t\treleaseView.cid !== cid ||\n\t\treleaseView.did !== publisherDid ||\n\t\treleaseView.package !== slug ||\n\t\t(version !== undefined && releaseView.version !== version) ||\n\t\treleaseView.release.package !== slug ||\n\t\treleaseView.release.version !== releaseView.version\n\t) {\n\t\treturn null;\n\t}\n\tif (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) {\n\t\treturn null;\n\t}\n\n\tconst descriptor = resolveDeclaredArtifact(releaseView.release.artifacts, kind, index);\n\tif (!descriptor || descriptor.requiresAuth || releaseView.release.auth !== undefined) return null;\n\tconst blobCid = descriptor.blob?.ref.$link;\n\tlet imageCacheUrl: URL | undefined;\n\tif (blobCid) {\n\t\tconst expected = multihashFromBlobCid(blobCid);\n\t\tif (!expected.success || expected.value !== descriptor.checksum) return null;\n\t\tconst rkey = `${slug}:${releaseView.version}`;\n\t\tconst serviceEndpoint = releaseView.artifactCaches\n\t\t\t.map(recordScopedCacheEndpoint)\n\t\t\t.find((value) => value !== null);\n\t\tif (serviceEndpoint) {\n\t\t\tconst preset = kind === \"icon\" ? \"avatar\" : kind === \"banner\" ? \"banner\" : \"feed_thumbnail\";\n\t\t\tconst cacheUrl = recordScopedImageCacheUrl(\n\t\t\t\tserviceEndpoint,\n\t\t\t\tpreset,\n\t\t\t\t{\n\t\t\t\t\tdid,\n\t\t\t\t\tcollection: NSID.packageRelease,\n\t\t\t\t\trkey,\n\t\t\t\t\tcid: releaseView.cid,\n\t\t\t\t},\n\t\t\t\tblobCid,\n\t\t\t);\n\t\t\tif (!cacheUrl.success) return null;\n\t\t\timageCacheUrl = cacheUrl.value;\n\t\t}\n\t}\n\treturn {\n\t\tartifact: descriptor,\n\t\trecord: {\n\t\t\tdid,\n\t\t\tcollection: NSID.packageRelease,\n\t\t\trkey: `${slug}:${releaseView.version}`,\n\t\t\tcid: releaseView.cid,\n\t\t},\n\t\t...(imageCacheUrl ? { imageCacheUrl } : {}),\n\t};\n}\n\nfunction recordScopedCacheEndpoint(value: unknown): string | null {\n\tif (objectProperty(value, \"$type\") !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;\n\tconst endpoint = objectProperty(value, \"serviceEndpoint\");\n\treturn typeof endpoint === \"string\" ? endpoint : null;\n}\n\n/** Build bounded, SSRF-validated fetch options for cache, PDS, and URL sources. */\nfunction proxyFetchOptions(signal: AbortSignal) {\n\treturn {\n\t\tfetch: async (url: URL, init: RequestInit) =>\n\t\t\tfetchRegistryArtifactUrl(url.href, {\n\t\t\t\tsignal: init.signal instanceof AbortSignal ? init.signal : signal,\n\t\t\t\tmaxResponseBytes: MAX_IMAGE_BYTES,\n\t\t\t}),\n\t\tresolveHostname: async (hostname: string) =>\n\t\t\t(await resolveAndValidateExternalUrlTarget(`https://${hostname}/`)).addresses,\n\t\tallowHttpLocalhost: import.meta.env.DEV,\n\t\tmaxBytes: MAX_IMAGE_BYTES,\n\t\tmaxRedirects: MAX_REDIRECTS,\n\t\ttotalTimeoutMs: FETCH_TIMEOUT_MS,\n\t};\n}\n\nasync function fetchRawArtifact(\n\tresolved: ResolvedArtifact,\n\toptions: ReturnType<typeof proxyFetchOptions>,\n): Promise<\n\t| { success: true; bytes: Uint8Array; headers: Headers; checksumValid: boolean }\n\t| { success: false; code: string }\n> {\n\tconst urls: URL[] = [];\n\tconst blobCid = resolved.artifact.blob?.ref.$link;\n\tlet lastCode = \"FETCH_FAILED\";\n\tlet checksumMismatch: { bytes: Uint8Array; headers: Headers } | undefined;\n\tif (blobCid) {\n\t\tconst pds = await resolvePublisherPdsEndpoint(resolved.record.did, options);\n\t\tif (pds.success) {\n\t\t\tconst url = new URL(\"/xrpc/com.atproto.sync.getBlob\", pds.value);\n\t\t\turl.searchParams.set(\"did\", resolved.record.did);\n\t\t\turl.searchParams.set(\"cid\", blobCid);\n\t\t\turls.push(url);\n\t\t} else {\n\t\t\tlastCode = pds.error.code;\n\t\t}\n\t}\n\tif (resolved.artifact.url) urls.push(new URL(resolved.artifact.url));\n\n\tfor (const url of urls) {\n\t\tconst fetched = await fetchVerifiedResource(url, options);\n\t\tif (!fetched.success) {\n\t\t\tlastCode = fetched.error.code;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!(await verifyRegistryArtifactChecksum(fetched.value.bytes, resolved.artifact.checksum))) {\n\t\t\tlastCode = \"CHECKSUM_MISMATCH\";\n\t\t\tchecksumMismatch = { bytes: fetched.value.bytes, headers: fetched.value.headers };\n\t\t\tcontinue;\n\t\t}\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tbytes: fetched.value.bytes,\n\t\t\theaders: fetched.value.headers,\n\t\t\tchecksumValid: true,\n\t\t};\n\t}\n\tif (checksumMismatch) return { success: true, ...checksumMismatch, checksumValid: false };\n\treturn { success: false, code: lastCode };\n}\n\nfunction artifactFetchError(code: string): Response {\n\tif (code === \"CHECKSUM_MISMATCH\") {\n\t\treturn apiError(\n\t\t\t\"ARTIFACT_CHECKSUM_MISMATCH\",\n\t\t\t\"Artifact bytes do not match the approved release record\",\n\t\t\t502,\n\t\t);\n\t}\n\tif (code === \"RESOURCE_SIZE_EXCEEDED\") {\n\t\treturn apiError(\"ARTIFACT_TOO_LARGE\", \"Artifact exceeds size limit\", 413);\n\t}\n\tif (code === \"HOST_REJECTED\" || code === \"INVALID_URL\") {\n\t\treturn apiError(\"ARTIFACT_URL_REJECTED\", \"Artifact URL is not allowed\", 400);\n\t}\n\treturn apiError(\"ARTIFACT_FETCH_FAILED\", \"Failed to fetch artifact\", 502);\n}\n"],"mappings":";;;;;;;;;;;;AAEA,MAAM,qBAAqB;AAE3B,eAAsB,+BACrB,OACA,UACmB;AACnB,KAAI,mBAAmB,KAAK,SAAS,EAAE;EACtC,MAAM,SAAS,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,WAAW,KAAK,MAAM,CAAC,CAAC;AAE5F,SADe,MAAM,KAAK,SAAS,SAAS,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,KACtE,SAAS,aAAa;;AAEzC,SAAQ,MAAM,gBAAgB,OAAO,SAAS,EAAE;;;;;ACkCjD,MAAa,YAAY;;;;;;;;;;AAWzB,MAAM,sBAAsB,IAAI,IAAI;CAAC;CAAa;CAAc;CAAa,CAAC;;AAG9E,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAQ;CAAU;CAAa,CAAC;;AAG/D,MAAM,cAAc;;AAEpB,MAAM,eAAe;AACrB,MAAM,cAAc;;AAEpB,MAAM,gBAAgB;;AAGtB,MAAM,kBAAkB,OAAO;;AAG/B,MAAM,gBAAgB;;AAGtB,MAAM,mBAAmB;;AAGzB,MAAM,gCAAgC;AACtC,MAAM,6BAA6B;;AAGnC,MAAM,iBAAiB;;AAGvB,SAAS,WAAW,eAAqC;AACxD,SAAQ,OAAoC,SAAuC;EAClF,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,YAAY,KAAK,IAAI,GAAG,gBAAgB,IAAI;AAClD,MAAI,cAAc,EACjB,QAAO,QAAQ,uBAAO,IAAI,MAAM,sCAAsC,CAAC;EAExE,MAAM,UAAU,KAAK,IAAI,+BAA+B,UAAU;EAClE,MAAM,aAAa,IAAI,iBAAiB;EACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,QAAQ;EAC3D,MAAM,eAAe,MAAM;AAC3B,MAAI,aACH,KAAI,aAAa,QAAS,YAAW,MAAM,aAAa,OAAO;MAC1D,cAAa,iBAAiB,eAAe,WAAW,MAAM,aAAa,OAAO,CAAC;AAEzF,SAAO,MAAM,OAAO;GAAE,GAAG;GAAM,QAAQ,WAAW;GAAQ,CAAC,CAAC,cAAc;AACzE,gBAAa,MAAM;IAClB;;;AAwBJ,SAAS,iBAAiB,OAAyC;AAClE,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;CAEhD,MAAM,QAAQ;CACd,MAAM,MAAM,MAAM;CAClB,MAAM,OAAO,MAAM;CACnB,MAAM,WAAW,MAAM;CAEvB,MAAM,UAAU,eADJ,eAAe,MAAM,MAAM,EACH,QAAQ;CAC5C,MAAM,eAAe,eAAe,MAAM,WAAW;CACrD,MAAM,WAAW,eAAe,MAAM,OAAO;CAC7C,MAAM,SAAS,OAAO,QAAQ,YAAY,IAAI,SAAS;CACvD,MAAM,UACL,OAAO,YAAY,YACnB,QAAQ,SAAS,KACjB,OAAO,iBAAiB,YACxB,OAAO,cAAc,SAAS,IAC9B,OAAO,SAAS,IAAI;AACrB,KAAK,CAAC,UAAU,CAAC,WAAY,OAAO,aAAa,YAAY,SAAS,WAAW,EAChF,QAAO;AAER,QAAO;EACN,GAAI,SAAS,EAAE,KAAK,GAAG,EAAE;EACzB,GAAI,UACD,EACA,MAAM;GACL,OAAO;GACP,KAAK,EAAE,OAAO,SAAS;GACvB,UAAU;GACV,MAAM,OAAO,SAAS;GACtB,EACD,GACA,EAAE;EACL;EACA,cAAc,MAAM,iBAAiB;EACrC;;;;;;;AAQF,SAAS,wBACR,WACA,MACA,OAC0B;AAC1B,KAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;CAExD,MAAM,MAAM;AAEZ,KAAI,SAAS,OAAQ,QAAO,iBAAiB,IAAI,KAAK;AACtD,KAAI,SAAS,SAAU,QAAO,iBAAiB,IAAI,OAAO;CAE1D,MAAM,cAAc,IAAI;AACxB,KAAI,CAAC,MAAM,QAAQ,YAAY,CAAE,QAAO;AACxC,KAAI,QAAQ,KAAK,SAAS,YAAY,OAAQ,QAAO;AACrD,QAAO,iBAAiB,YAAY,OAAO;;AAG5C,SAAS,eAAe,OAAgB,KAAsB;AAC7D,KAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAO,OAAO,yBAAyB,OAAO,IAAI,EAAE;;AAGrD,MAAa,MAAgB,OAAO,EAAE,KAAK,aAAa;CACvD,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CAEnB,MAAM,MAAM,IAAI,aAAa,IAAI,MAAM;CACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,MAAM,IAAI,aAAa,IAAI,MAAM;CACvC,MAAM,OAAO,IAAI,aAAa,IAAI,OAAO;CACzC,MAAM,eAAe,IAAI,aAAa,IAAI,UAAU;CACpD,MAAM,aAAa,IAAI,aAAa,IAAI,QAAQ;AAEhD,KAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAC7B,QAAO,SAAS,mBAAmB,mCAAmC,IAAI;AAE3E,KAAI,IAAI,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAC7C,QAAO,SAAS,mBAAmB,eAAe,IAAI;AAEvD,KAAI,KAAK,SAAS,MAAM,CAAC,aAAa,KAAK,KAAK,CAC/C,QAAO,SAAS,mBAAmB,gBAAgB,IAAI;AAExD,KAAI,IAAI,SAAS,OAAO,CAAC,YAAY,KAAK,IAAI,CAC7C,QAAO,SAAS,mBAAmB,uBAAuB,IAAI;AAE/D,KAAI,CAAC,cAAc,IAAI,KAAK,CAC3B,QAAO,SAAS,mBAAmB,gBAAgB,IAAI;CAGxD,IAAI,QAAQ;AACZ,KAAI,SAAS,cAAc;AAC1B,MAAI,eAAe,KAClB,QAAO,SAAS,mBAAmB,gCAAgC,IAAI;AAExE,MAAI,CAAC,cAAc,KAAK,WAAW,CAClC,QAAO,SAAS,mBAAmB,iBAAiB,IAAI;AAEzD,UAAQ,OAAO,WAAW;AAC1B,MAAI,CAAC,OAAO,cAAc,MAAM,CAC/B,QAAO,SAAS,mBAAmB,iBAAiB,IAAI;;CAI1D,IAAI;AACJ,KAAI,iBAAiB,QAAQ,aAAa,SAAS,GAAG;AACrD,MAAI,aAAa,SAAS,GACzB,QAAO,SAAS,mBAAmB,mBAAmB,IAAI;AAE3D,YAAU;;CAGX,MAAM,iBAAiB,qBACtB,uBAAuB,OAAO,OAAO,UAAU,OAAO,OAAO,cAAc,SAAS,CACpF;AACD,KAAI,CAAC,eACJ,QAAO,SAAS,2BAA2B,8BAA8B,IAAI;AAE9E,KAAI;AACH,wBAAsB,eAAe,cAAc;SAC5C;AACP,SAAO,SAAS,2BAA2B,sCAAsC,IAAI;;CAItF,IAAI;AACJ,KAAI;EACH,MAAM,WAAW,MAAM,gBAAgB,gBAAgB,KAAK,MAAM,SAAS,KAAK,MAAM,MAAM;AAC5F,MAAI,aAAa,KAChB,QAAO,SAAS,sBAAsB,sBAAsB,IAAI;AAEjE,qBAAmB;SACZ;AACP,SAAO,SAAS,2BAA2B,8BAA8B,IAAI;;CAE9E,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,OAAO,EAAE,iBAAiB;AACpE,KAAI;EACH,MAAM,eAAe,kBAAkB,WAAW,OAAO;EACzD,IAAI;EACJ,IAAI;EACJ,IAAI;AACJ,MAAI,iBAAiB,eAAe;GACnC,MAAM,cAAc,MAAM,sBAAsB,iBAAiB,eAAe,aAAa;AAC7F,OAAI,YAAY,SAAS;AACxB,YAAQ,YAAY,MAAM;AAC1B,cAAU,YAAY,MAAM;;;AAG9B,MAAI,CAAC,SAAS,CAAC,SAAS;GACvB,MAAM,MAAM,MAAM,iBAAiB,kBAAkB,aAAa;AAClE,OAAI,CAAC,IAAI,QAAS,QAAO,mBAAmB,IAAI,KAAK;AACrD,WAAQ,IAAI;AACZ,aAAU,IAAI;AACd,mBAAgB,IAAI;;EAOrB,MAAM,eADU,QAAQ,IAAI,eAAe,IAAI,IACnB,MAAM,KAAK,EAAE,CAAC,GAAI,MAAM,CAAC,aAAa;AAClE,MAAI,CAAC,oBAAoB,IAAI,YAAY,CACxC,QAAO,SAAS,sBAAsB,yCAAyC,IAAI;EAGpF,MAAM,iBAAiB,QAAQ,IAAI,iBAAiB;AACpD,MAAI,gBAAgB;GACnB,MAAM,WAAW,OAAO,eAAe;AACvC,OAAI,OAAO,SAAS,SAAS,IAAI,WAAW,gBAC3C,QAAO,SAAS,sBAAsB,+BAA+B,IAAI;;AAG3E,MAAI,kBAAkB,MACrB,QAAO,mBAAmB,oBAAoB;AAY/C,SAAO,IAAI,SAAS,OAAO,EAC1B,SAAS;GACR,gBAAgB;GAChB,iBAAiB;GACjB,0BAA0B;GAC1B,uBAAuB;GACvB,2BAA2B;GAC3B,EACD,CAAC;SACK;AACP,SAAO,SAAS,yBAAyB,4BAA4B,IAAI;WAChE;AACT,eAAa,MAAM;;;;;;;;;;;;AAarB,eAAe,gBACd,gBACA,KACA,MACA,SACA,KACA,MACA,OACmC;CAGnC,MAAM,EAAE,iBAAiB,0BACxB,MAAM,OAAO;CAEd,MAAM,qBAAqB,KAAK,KAAK,GAAG;CACxC,MAAM,YAAY,IAAI,gBAAgB;EACrC,eAAe,eAAe;EAC9B,gBAAgB,eAAe;EAC/B,eAAe,sBAAsB,eAAe,eAAe;EACnE,OAAO,WAAW,mBAAmB;EACrC,CAAC;CAGF,MAAM,eAAe;CAErB,MAAM,cAAc,OAAO,YAAY;AACtC,MAAI,CAAC,QACJ,QAAO,UAAU,iBAAiB;GAAE,KAAK;GAAc,SAAS;GAAM,CAAC;EAExE,IAAI;EACJ,MAAM,8BAAc,IAAI,KAAa;AACrC,OAAK,IAAI,OAAO,GAAG,OAAO,gBAAgB,QAAQ;AACjD,OAAI,WAAW,QAAW;AACzB,QAAI,YAAY,IAAI,OAAO,CAAE;AAC7B,gBAAY,IAAI,OAAO;;GAExB,MAAM,SAAS,MAAM,UAAU,aAAa;IAC3C,KAAK;IACL,SAAS;IACT;IACA,OAAO;IACP,CAAC;AACF,QAAK,MAAM,KAAK,OAAO,SACtB,KAAI,EAAE,YAAY,QAAS,QAAO;AAEnC,OAAI,CAAC,OAAO,OAAQ;AACpB,YAAS,OAAO;;KAGd;AAEJ,KACC,CAAC,aAAa,WACd,YAAY,QAAQ,OACpB,YAAY,QAAQ,gBACpB,YAAY,YAAY,QACvB,YAAY,UAAa,YAAY,YAAY,WAClD,YAAY,QAAQ,YAAY,QAChC,YAAY,QAAQ,YAAY,YAAY,QAE5C,QAAO;AAER,KAAI,kCAAkC,aAAa,UAAU,cAAc,CAAC,UAC3E,QAAO;CAGR,MAAM,aAAa,wBAAwB,YAAY,QAAQ,WAAW,MAAM,MAAM;AACtF,KAAI,CAAC,cAAc,WAAW,gBAAgB,YAAY,QAAQ,SAAS,OAAW,QAAO;CAC7F,MAAM,UAAU,WAAW,MAAM,IAAI;CACrC,IAAI;AACJ,KAAI,SAAS;EACZ,MAAM,WAAW,qBAAqB,QAAQ;AAC9C,MAAI,CAAC,SAAS,WAAW,SAAS,UAAU,WAAW,SAAU,QAAO;EACxE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY;EACpC,MAAM,kBAAkB,YAAY,eAClC,IAAI,0BAA0B,CAC9B,MAAM,UAAU,UAAU,KAAK;AACjC,MAAI,iBAAiB;GAEpB,MAAM,WAAW,0BAChB,iBAFc,SAAS,SAAS,WAAW,SAAS,WAAW,WAAW,kBAI1E;IACC;IACA,YAAY,KAAK;IACjB;IACA,KAAK,YAAY;IACjB,EACD,QACA;AACD,OAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,mBAAgB,SAAS;;;AAG3B,QAAO;EACN,UAAU;EACV,QAAQ;GACP;GACA,YAAY,KAAK;GACjB,MAAM,GAAG,KAAK,GAAG,YAAY;GAC7B,KAAK,YAAY;GACjB;EACD,GAAI,gBAAgB,EAAE,eAAe,GAAG,EAAE;EAC1C;;AAGF,SAAS,0BAA0B,OAA+B;AACjE,KAAI,eAAe,OAAO,QAAQ,KAAK,8BAA+B,QAAO;CAC7E,MAAM,WAAW,eAAe,OAAO,kBAAkB;AACzD,QAAO,OAAO,aAAa,WAAW,WAAW;;;AAIlD,SAAS,kBAAkB,QAAqB;AAC/C,QAAO;EACN,OAAO,OAAO,KAAU,SACvB,yBAAyB,IAAI,MAAM;GAClC,QAAQ,KAAK,kBAAkB,cAAc,KAAK,SAAS;GAC3D,kBAAkB;GAClB,CAAC;EACH,iBAAiB,OAAO,cACtB,MAAM,oCAAoC,WAAW,SAAS,GAAG,EAAE;EACrE,oBAAoB,OAAO,KAAK,IAAI;EACpC,UAAU;EACV,cAAc;EACd,gBAAgB;EAChB;;AAGF,eAAe,iBACd,UACA,SAIC;CACD,MAAM,OAAc,EAAE;CACtB,MAAM,UAAU,SAAS,SAAS,MAAM,IAAI;CAC5C,IAAI,WAAW;CACf,IAAI;AACJ,KAAI,SAAS;EACZ,MAAM,MAAM,MAAM,4BAA4B,SAAS,OAAO,KAAK,QAAQ;AAC3E,MAAI,IAAI,SAAS;GAChB,MAAM,MAAM,IAAI,IAAI,kCAAkC,IAAI,MAAM;AAChE,OAAI,aAAa,IAAI,OAAO,SAAS,OAAO,IAAI;AAChD,OAAI,aAAa,IAAI,OAAO,QAAQ;AACpC,QAAK,KAAK,IAAI;QAEd,YAAW,IAAI,MAAM;;AAGvB,KAAI,SAAS,SAAS,IAAK,MAAK,KAAK,IAAI,IAAI,SAAS,SAAS,IAAI,CAAC;AAEpE,MAAK,MAAM,OAAO,MAAM;EACvB,MAAM,UAAU,MAAM,sBAAsB,KAAK,QAAQ;AACzD,MAAI,CAAC,QAAQ,SAAS;AACrB,cAAW,QAAQ,MAAM;AACzB;;AAED,MAAI,CAAE,MAAM,+BAA+B,QAAQ,MAAM,OAAO,SAAS,SAAS,SAAS,EAAG;AAC7F,cAAW;AACX,sBAAmB;IAAE,OAAO,QAAQ,MAAM;IAAO,SAAS,QAAQ,MAAM;IAAS;AACjF;;AAED,SAAO;GACN,SAAS;GACT,OAAO,QAAQ,MAAM;GACrB,SAAS,QAAQ,MAAM;GACvB,eAAe;GACf;;AAEF,KAAI,iBAAkB,QAAO;EAAE,SAAS;EAAM,GAAG;EAAkB,eAAe;EAAO;AACzF,QAAO;EAAE,SAAS;EAAO,MAAM;EAAU;;AAG1C,SAAS,mBAAmB,MAAwB;AACnD,KAAI,SAAS,oBACZ,QAAO,SACN,8BACA,2DACA,IACA;AAEF,KAAI,SAAS,yBACZ,QAAO,SAAS,sBAAsB,+BAA+B,IAAI;AAE1E,KAAI,SAAS,mBAAmB,SAAS,cACxC,QAAO,SAAS,yBAAyB,+BAA+B,IAAI;AAE7E,QAAO,SAAS,yBAAyB,4BAA4B,IAAI"}

package/dist/astro/routes/api/admin/plugins/registry/install.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/install.ts"],"mappings":";;;cA0Ba,SAAA;AAAA,cAuCA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"install.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/install.ts"],"mappings":";;;cA4Ba,SAAA;AAAA,cAwCA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/plugins/registry/install.mjs

@@ -1,67 +1,71 @@
-import "../../../../../../dialect-helpers-BcQvkHgn.mjs";
-import "../../../../../../config-C3EBstHi.mjs";
-import "../../../../../../after-CBU2vkoO.mjs";
-import "../../../../../../object-cache-DVKnyOfy.mjs";
-import "../../../../../../content-CNfMWuhY.mjs";
-import "../../../../../../slugify-B994zkXC.mjs";
-import "../../../../../../base64-CvLhUKQv.mjs";
-import "../../../../../../types-CQPWhPxE.mjs";
-import "../../../../../../media-BBm8Wg3f.mjs";
-import "../../../../../../user-DIsIXogT.mjs";
-import "../../../../../../taxonomy-DP1vny4K.mjs";
-import "../../../../../../comment-vxOzWbZN.mjs";
-import "../../../../../../options-D1FBiAv1.mjs";
-import "../../../../../../menus-UdwjHZJC.mjs";
-import "../../../../../../resolve-Cy0aWSRj.mjs";
-import "../../../../../../redirect-DId44BS1.mjs";
-import "../../../../../../request-cache-DAZZmesc.mjs";
-import "../../../../../../byline-registry-BxDGIO0I.mjs";
-import "../../../../../../field-defs-cache-Cf5FHK0M.mjs";
-import "../../../../../../byline-Vdi85CsZ.mjs";
-import "../../../../../../entry-locks-BEcX7ET0.mjs";
-import "../../../../../../seo-Bw68KxRc.mjs";
-import "../../../../../../cache--7HKu5Xm.mjs";
-import "../../../../../../fts-manager-iddym8cd.mjs";
-import "../../../../../../loader-WJi6GFRn.mjs";
-import "../../../../../../collection-slugs-cache-7lTmNzeA.mjs";
-import "../../../../../../taxonomies-NcFDq5Gg.mjs";
-import { t as handleRegistryInstall } from "../../../../../../api-BvxJmnFY.mjs";
-import "../../../../../../dashboard-BNSvAN8A.mjs";
-import "../../../../../../capture-triggers-CeAsC76Z.mjs";
-import "../../../../../../activation-DyNTe_Tl.mjs";
-import "../../../../../../collection-deletion-BCwaWTDw.mjs";
-import "../../../../../../content-refresh-GTMyi2Xy.mjs";
-import "../../../../../../registry-DTqaqxed.mjs";
-import "../../../../../../hash-BRweX6jz.mjs";
-import "../../../../../../media-folders-DASfX_DH.mjs";
-import "../../../../../../media-usage-work-C5B1zT1c.mjs";
-import "../../../../../../content-repair-CIMt5C0U.mjs";
-import "../../../../../../media-usage-C1EswMTq.mjs";
-import "../../../../../../media-usage-activation-CrHNltlL.mjs";
-import "../../../../../../media-usage-work-IkQx_Yz6.mjs";
-import "../../../../../../query-gtXT03Wc.mjs";
-import "../../../../../../zod-generator-CNRGdnBY.mjs";
-import "../../../../../../schema-CRu38Pr5.mjs";
-import "../../../../../../schema-DifxndJx.mjs";
-import "../../../../../../seo-C4AmbsMU.mjs";
-import "../../../../../../sections-3X52kmIR.mjs";
-import "../../../../../../settings-DcMjREe5.mjs";
-import "../../../../../../settings-AnEFYICn.mjs";
-import "../../../../../../taxonomies-BOdxuZpV.mjs";
-import "../../../../../../manifest-schema-CILooI5J.mjs";
-import "../../../../../../types-A2cN6a4a.mjs";
-import "../../../../../../artifact-fetch-P2JXVwOq.mjs";
-import "../../../../../../ssrf-gl4gFNhw.mjs";
-import "../../../../../../config--eWjQJE5.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
-import "../../../../../../media-C1EIZKh1.mjs";
-import "../../../../../../entry-lock-DIYHAaSw.mjs";
-import "../../../../../../relations-rOmbndUJ.mjs";
-import "../../../../../../status-Cenfk_r5.mjs";
-import { r as checkMediaUsageActivationWriteFence } from "../../../../../../media-usage-write-fence-B9anjOSg.mjs";
-import { n as VERSION } from "../../../../../../version-CK67_SXX.mjs";
-import { r as requirePerm } from "../../../../../../authorize-C2QHlWSS.mjs";
+import "../../../../../../dialect-helpers-CtYdsX4W.mjs";
+import "../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../datetime-normalization-PeiEdcRY.mjs";
+import "../../../../../../after-PcEvMY_6.mjs";
+import "../../../../../../options-D5WcorD5.mjs";
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../secrets-DNgVgz_e.mjs";
+import "../../../../../../content-DZ3B5qtA.mjs";
+import "../../../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../../../slugify-T5GHH42D.mjs";
+import "../../../../../../types-BkUg2yHx.mjs";
+import "../../../../../../media-TBlKCwo7.mjs";
+import "../../../../../../user-DroRntkx.mjs";
+import "../../../../../../taxonomy-Dj1vpw5E.mjs";
+import "../../../../../../comment-DcT8qdPK.mjs";
+import "../../../../../../menus-Wy8m5NcH.mjs";
+import "../../../../../../resolve-BJIS8wKr.mjs";
+import "../../../../../../redirect-D2Yo-b6S.mjs";
+import "../../../../../../request-cache-DaMhSQdx.mjs";
+import "../../../../../../byline-registry-D6lWzXk6.mjs";
+import "../../../../../../field-defs-cache-B337z8UJ.mjs";
+import "../../../../../../byline-Doh-wt99.mjs";
+import "../../../../../../entry-locks-CO_KaoU5.mjs";
+import "../../../../../../seo-_4qmazxz.mjs";
+import "../../../../../../cache-B0pOlXdM.mjs";
+import "../../../../../../fts-manager-DMb0sbIQ.mjs";
+import "../../../../../../loader-t4TxaFiQ.mjs";
+import "../../../../../../collection-slugs-cache-D9auiKmI.mjs";
+import "../../../../../../taxonomies-BpqpXJUE.mjs";
+import { n as handleRegistryUninstall, t as handleRegistryInstall } from "../../../../../../api-DmjKxPCY.mjs";
+import "../../../../../../dashboard-CZD4G7k_.mjs";
+import "../../../../../../capture-triggers-gxQxnxrJ.mjs";
+import "../../../../../../activation-CaMfdBt1.mjs";
+import "../../../../../../collection-deletion-C3Xixmkx.mjs";
+import "../../../../../../content-refresh-BHLHJgyt.mjs";
+import "../../../../../../registry-CkuPoZs7.mjs";
+import "../../../../../../hash-CLVFzWvx.mjs";
+import "../../../../../../media-folders-ClIRLUQv.mjs";
+import "../../../../../../media-usage-work-Cu5DqewW.mjs";
+import "../../../../../../content-repair-BVll5WNl.mjs";
+import "../../../../../../media-usage-C4NolTpQ.mjs";
+import "../../../../../../media-usage-activation-CAhmb14O.mjs";
+import "../../../../../../media-usage-work-DJr3rOEN.mjs";
+import "../../../../../../query-D7kHKOws.mjs";
+import "../../../../../../zod-generator-D_yHIWfs.mjs";
+import "../../../../../../schema-DEERRrKS.mjs";
+import "../../../../../../schema-CPhPM9Do.mjs";
+import "../../../../../../seo-BtU70b7l.mjs";
+import "../../../../../../settings-DmroR53o.mjs";
+import "../../../../../../sections-BIpd4Cxf.mjs";
+import "../../../../../../settings-g2F2a3Ub.mjs";
+import "../../../../../../taxonomies-ClCo4IGO.mjs";
+import "../../../../../../manifest-schema-Bkh8SeHd.mjs";
+import "../../../../../../artifact-fetch-COiMhVgk.mjs";
+import "../../../../../../ssrf-Co1GGFZz.mjs";
+import "../../../../../../authoritative-records-DbqshfKD.mjs";
+import { r as getRegistryConfigInput } from "../../../../../../config-B2acLeC5.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-CCTCskie.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-Cr379Av9.mjs";
+import "../../../../../../redirects-BCiTaIQ-.mjs";
+import "../../../../../../entry-lock-D3C99MXS.mjs";
+import "../../../../../../comments-BVzzt6x5.mjs";
+import "../../../../../../relations-B4w-G5U9.mjs";
+import "../../../../../../status-DLoBmcDz.mjs";
+import { r as checkMediaUsageActivationWriteFence } from "../../../../../../media-usage-write-fence-DW5oHT7q.mjs";
+import { n as VERSION } from "../../../../../../version-B57E4Uo7.mjs";
+import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
+import { t as finalizePluginInstall } from "../../../../../../install-finalization-5Os-QZ-2.mjs";
 import { z } from "zod";
 import { hostEnvFromVersions } from "@emdash-cms/registry-client/env";
 
@@ -86,6 +90,7 @@ const installBodySchema = z.object({
 	version: z.string().min(1).max(64).optional(),
 	acknowledgedDeclaredAccess: z.unknown().optional(),
 	acknowledgedMcpTools: z.unknown().optional(),
+	acknowledgedPublicRoutes: z.unknown().optional(),
 	acknowledgedProfileCid: z.string().min(1).max(256).optional(),
 	acknowledgedReleaseCid: z.string().min(1).max(256).optional()
 });
@@ -100,12 +105,13 @@ const POST = async ({ request, locals }) => {
 		const body = await parseBody(request, installBodySchema);
 		if (isParseError(body)) return body;
 		const reservedPluginIds = new Set([...emdash.configuredPlugins.map((p) => p.id), ...(emdash.config.sandboxed ?? []).map((p) => p.id)]);
-		const result = await handleRegistryInstall(emdash.db, emdash.storage, emdash.getSandboxRunner(), emdash.config.experimental?.registry, {
+		const result = await handleRegistryInstall(emdash.db, emdash.storage, emdash.getSandboxRunner(), getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry), {
 			did: body.did,
 			slug: body.slug,
 			version: body.version,
 			acknowledgedDeclaredAccess: body.acknowledgedDeclaredAccess,
 			acknowledgedMcpTools: body.acknowledgedMcpTools,
+			acknowledgedPublicRoutes: body.acknowledgedPublicRoutes,
 			acknowledgedProfileCid: body.acknowledgedProfileCid,
 			acknowledgedReleaseCid: body.acknowledgedReleaseCid
 		}, {
@@ -113,7 +119,12 @@ const POST = async ({ request, locals }) => {
 			hostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion)
 		});
 		if (!result.success) return unwrapResult(result);
-		await emdash.syncRegistryPlugins();
+		await finalizePluginInstall({
+			pluginId: result.data.pluginId,
+			syncRuntime: () => emdash.syncRegistryPlugins(),
+			runLifecycle: () => emdash.runPluginInstallLifecycle(result.data.pluginId),
+			rollback: () => handleRegistryUninstall(emdash.db, emdash.storage, result.data.pluginId, { deleteData: true })
+		});
 		return unwrapResult(result, 201);
 	} catch (error) {
 		console.error("[registry-install] Unhandled error:", error);

package/dist/astro/routes/api/admin/plugins/registry/install.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"install.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/install.ts"],"sourcesContent":["/**\n * Registry plugin install endpoint\n *\n * POST /_emdash/api/admin/plugins/registry/install\n *\n * Installs a plugin from the experimental decentralized plugin registry\n * (see RFC 0001). The browser resolves `(handle, slug) → (did, slug)`\n * via the aggregator before posting and sends the publisher DID\n * directly; the server skips the resolvePackage round-trip and looks\n * up the package by DID. Sending DID rather than handle means installs\n * work for publishers whose handle the aggregator couldn't resolve at\n * view time (handle is best-effort per the lexicon).\n */\n\nimport { hostEnvFromVersions } from \"@emdash-cms/registry-client/env\";\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleRegistryInstall } from \"#api/index.js\";\nimport { checkMediaUsageActivationWriteFence } from \"#api/media-usage-write-fence.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\n\nimport { VERSION } from \"../../../../../../version.js\";\n\nexport const prerender = false;\n\nconst installBodySchema = z.object({\n\t/**\n\t * Publisher DID. Required. Browser is expected to resolve\n\t * `(handle, slug) → did` against the aggregator before posting.\n\t */\n\tdid: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(2048)\n\t\t// Loose match -- atproto DID specs allow `did:plc:*` and\n\t\t// `did:web:*` plus future methods. Reject anything that\n\t\t// doesn't even start with `did:` rather than enumerating\n\t\t// methods here; downstream lexicon validation tightens.\n\t\t.regex(/^did:[a-z]+:/, \"Invalid DID\"),\n\t/** Package slug. */\n\tslug: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(64)\n\t\t// Mirrors the lexicon's slug grammar: ASCII letter followed by\n\t\t// letters / digits / `-` / `_`. Rejects anything that could\n\t\t// confuse the R2 prefix or the URL.\n\t\t.regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, \"Invalid slug\"),\n\t/** Optional explicit version. Defaults to the aggregator's latest. */\n\tversion: z.string().min(1).max(64).optional(),\n\t/**\n\t * Capabilities the admin acknowledged in the consent dialog, lifted\n\t * from the release record's declaredAccess block at browse time.\n\t * Compared against the bundle's manifest to detect drift between the\n\t * dialog and the install POST.\n\t */\n\tacknowledgedDeclaredAccess: z.unknown().optional(),\n\tacknowledgedMcpTools: z.unknown().optional(),\n\tacknowledgedProfileCid: z.string().min(1).max(256).optional(),\n\tacknowledgedReleaseCid: z.string().min(1).max(256).optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\ttry {\n\t\tconst { emdash, user } = locals;\n\n\t\tif (!emdash?.db) {\n\t\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t\t}\n\n\t\tconst denied = requirePerm(user, \"plugins:manage\");\n\t\tif (denied) return denied;\n\n\t\tconst activationFence = await checkMediaUsageActivationWriteFence(emdash.db);\n\t\tif (activationFence) return activationFence;\n\n\t\tconst body = await parseBody(request, installBodySchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Block registry installs whose derived `pluginId` collides with\n\t\t// any build-time-reserved id: configured (in-process) plugins, and\n\t\t// sandboxed plugins declared in `config.sandboxed`. The runtime\n\t\t// caches sandboxed plugins by id; a registry install at the same\n\t\t// id would silently shadow or coexist with the build-time entry.\n\t\tconst reservedPluginIds = new Set<string>([\n\t\t\t...emdash.configuredPlugins.map((p: { id: string }) => p.id),\n\t\t\t...(emdash.config.sandboxed ?? []).map((p: { id: string }) => p.id),\n\t\t]);\n\n\t\tconst result = await handleRegistryInstall(\n\t\t\temdash.db,\n\t\t\temdash.storage,\n\t\t\temdash.getSandboxRunner(),\n\t\t\temdash.config.experimental?.registry,\n\t\t\t{\n\t\t\t\tdid: body.did,\n\t\t\t\tslug: body.slug,\n\t\t\t\tversion: body.version,\n\t\t\t\tacknowledgedDeclaredAccess: body.acknowledgedDeclaredAccess,\n\t\t\t\tacknowledgedMcpTools: body.acknowledgedMcpTools,\n\t\t\t\tacknowledgedProfileCid: body.acknowledgedProfileCid,\n\t\t\t\tacknowledgedReleaseCid: body.acknowledgedReleaseCid,\n\t\t\t},\n\t\t\t{\n\t\t\t\tconfiguredPluginIds: reservedPluginIds,\n\t\t\t\thostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),\n\t\t\t},\n\t\t);\n\n\t\tif (!result.success) return unwrapResult(result);\n\n\t\t// Sync runtime so the new plugin becomes active without a worker restart.\n\t\tawait emdash.syncRegistryPlugins();\n\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\tconsole.error(\"[registry-install] Unhandled error:\", error);\n\t\treturn handleError(error, \"Failed to install plugin from registry\", \"INSTALL_FAILED\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAKlC,KAAK,EACH,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,KAAK,CAKT,MAAM,gBAAgB,cAAc;CAEtC,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,GAAG,CAIP,MAAM,4BAA4B,eAAe;CAEnD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,UAAU;CAO7C,4BAA4B,EAAE,SAAS,CAAC,UAAU;CAClD,sBAAsB,EAAE,SAAS,CAAC,UAAU;CAC5C,wBAAwB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;CAC7D,wBAAwB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;CAC7D,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;AAC5D,KAAI;EACH,MAAM,EAAE,QAAQ,SAAS;AAEzB,MAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;EAGpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,MAAI,OAAQ,QAAO;EAEnB,MAAM,kBAAkB,MAAM,oCAAoC,OAAO,GAAG;AAC5E,MAAI,gBAAiB,QAAO;EAE5B,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAO/B,MAAM,oBAAoB,IAAI,IAAY,CACzC,GAAG,OAAO,kBAAkB,KAAK,MAAsB,EAAE,GAAG,EAC5D,IAAI,OAAO,OAAO,aAAa,EAAE,EAAE,KAAK,MAAsB,EAAE,GAAG,CACnE,CAAC;EAEF,MAAM,SAAS,MAAM,sBACpB,OAAO,IACP,OAAO,SACP,OAAO,kBAAkB,EACzB,OAAO,OAAO,cAAc,UAC5B;GACC,KAAK,KAAK;GACV,MAAM,KAAK;GACX,SAAS,KAAK;GACd,4BAA4B,KAAK;GACjC,sBAAsB,KAAK;GAC3B,wBAAwB,KAAK;GAC7B,wBAAwB,KAAK;GAC7B,EACD;GACC,qBAAqB;GACrB,SAAS,oBAAoB,SAAS,OAAO,OAAO,aAAa;GACjE,CACD;AAED,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAGhD,QAAM,OAAO,qBAAqB;AAElC,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,UAAQ,MAAM,uCAAuC,MAAM;AAC3D,SAAO,YAAY,OAAO,0CAA0C,iBAAiB"}
+{"version":3,"file":"install.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/install.ts"],"sourcesContent":["/**\n * Registry plugin install endpoint\n *\n * POST /_emdash/api/admin/plugins/registry/install\n *\n * Installs a plugin from the experimental decentralized plugin registry\n * (see RFC 0001). The browser resolves `(handle, slug) → (did, slug)`\n * via the aggregator before posting and sends the publisher DID\n * directly; the server skips the resolvePackage round-trip and looks\n * up the package by DID. Sending DID rather than handle means installs\n * work for publishers whose handle the aggregator couldn't resolve at\n * view time (handle is best-effort per the lexicon).\n */\n\nimport { hostEnvFromVersions } from \"@emdash-cms/registry-client/env\";\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleRegistryInstall, handleRegistryUninstall } from \"#api/index.js\";\nimport { checkMediaUsageActivationWriteFence } from \"#api/media-usage-write-fence.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\nimport { finalizePluginInstall } from \"#plugins/install-finalization.js\";\n\nimport { getRegistryConfigInput } from \"../../../../../../registry/config.js\";\nimport { VERSION } from \"../../../../../../version.js\";\n\nexport const prerender = false;\n\nconst installBodySchema = z.object({\n\t/**\n\t * Publisher DID. Required. Browser is expected to resolve\n\t * `(handle, slug) → did` against the aggregator before posting.\n\t */\n\tdid: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(2048)\n\t\t// Loose match -- atproto DID specs allow `did:plc:*` and\n\t\t// `did:web:*` plus future methods. Reject anything that\n\t\t// doesn't even start with `did:` rather than enumerating\n\t\t// methods here; downstream lexicon validation tightens.\n\t\t.regex(/^did:[a-z]+:/, \"Invalid DID\"),\n\t/** Package slug. */\n\tslug: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(64)\n\t\t// Mirrors the lexicon's slug grammar: ASCII letter followed by\n\t\t// letters / digits / `-` / `_`. Rejects anything that could\n\t\t// confuse the R2 prefix or the URL.\n\t\t.regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, \"Invalid slug\"),\n\t/** Optional explicit version. Defaults to the aggregator's latest. */\n\tversion: z.string().min(1).max(64).optional(),\n\t/**\n\t * Capabilities the admin acknowledged in the consent dialog, lifted\n\t * from the release record's declaredAccess block at browse time.\n\t * Compared against the bundle's manifest to detect drift between the\n\t * dialog and the install POST.\n\t */\n\tacknowledgedDeclaredAccess: z.unknown().optional(),\n\tacknowledgedMcpTools: z.unknown().optional(),\n\tacknowledgedPublicRoutes: z.unknown().optional(),\n\tacknowledgedProfileCid: z.string().min(1).max(256).optional(),\n\tacknowledgedReleaseCid: z.string().min(1).max(256).optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\ttry {\n\t\tconst { emdash, user } = locals;\n\n\t\tif (!emdash?.db) {\n\t\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t\t}\n\n\t\tconst denied = requirePerm(user, \"plugins:manage\");\n\t\tif (denied) return denied;\n\n\t\tconst activationFence = await checkMediaUsageActivationWriteFence(emdash.db);\n\t\tif (activationFence) return activationFence;\n\n\t\tconst body = await parseBody(request, installBodySchema);\n\t\tif (isParseError(body)) return body;\n\n\t\t// Block registry installs whose derived `pluginId` collides with\n\t\t// any build-time-reserved id: configured (in-process) plugins, and\n\t\t// sandboxed plugins declared in `config.sandboxed`. The runtime\n\t\t// caches sandboxed plugins by id; a registry install at the same\n\t\t// id would silently shadow or coexist with the build-time entry.\n\t\tconst reservedPluginIds = new Set<string>([\n\t\t\t...emdash.configuredPlugins.map((p: { id: string }) => p.id),\n\t\t\t...(emdash.config.sandboxed ?? []).map((p: { id: string }) => p.id),\n\t\t]);\n\n\t\tconst result = await handleRegistryInstall(\n\t\t\temdash.db,\n\t\t\temdash.storage,\n\t\t\temdash.getSandboxRunner(),\n\t\t\tgetRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),\n\t\t\t{\n\t\t\t\tdid: body.did,\n\t\t\t\tslug: body.slug,\n\t\t\t\tversion: body.version,\n\t\t\t\tacknowledgedDeclaredAccess: body.acknowledgedDeclaredAccess,\n\t\t\t\tacknowledgedMcpTools: body.acknowledgedMcpTools,\n\t\t\t\tacknowledgedPublicRoutes: body.acknowledgedPublicRoutes,\n\t\t\t\tacknowledgedProfileCid: body.acknowledgedProfileCid,\n\t\t\t\tacknowledgedReleaseCid: body.acknowledgedReleaseCid,\n\t\t\t},\n\t\t\t{\n\t\t\t\tconfiguredPluginIds: reservedPluginIds,\n\t\t\t\thostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),\n\t\t\t},\n\t\t);\n\n\t\tif (!result.success) return unwrapResult(result);\n\n\t\tawait finalizePluginInstall({\n\t\t\tpluginId: result.data.pluginId,\n\t\t\tsyncRuntime: () => emdash.syncRegistryPlugins(),\n\t\t\trunLifecycle: () => emdash.runPluginInstallLifecycle(result.data.pluginId),\n\t\t\trollback: () =>\n\t\t\t\thandleRegistryUninstall(emdash.db, emdash.storage, result.data.pluginId, {\n\t\t\t\t\tdeleteData: true,\n\t\t\t\t}),\n\t\t});\n\n\t\treturn unwrapResult(result, 201);\n\t} catch (error) {\n\t\tconsole.error(\"[registry-install] Unhandled error:\", error);\n\t\treturn handleError(error, \"Failed to install plugin from registry\", \"INSTALL_FAILED\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,YAAY;AAEzB,MAAM,oBAAoB,EAAE,OAAO;CAKlC,KAAK,EACH,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,KAAK,CAKT,MAAM,gBAAgB,cAAc;CAEtC,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,GAAG,CAIP,MAAM,4BAA4B,eAAe;CAEnD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,UAAU;CAO7C,4BAA4B,EAAE,SAAS,CAAC,UAAU;CAClD,sBAAsB,EAAE,SAAS,CAAC,UAAU;CAC5C,0BAA0B,EAAE,SAAS,CAAC,UAAU;CAChD,wBAAwB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;CAC7D,wBAAwB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;CAC7D,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;AAC5D,KAAI;EACH,MAAM,EAAE,QAAQ,SAAS;AAEzB,MAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;EAGpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,MAAI,OAAQ,QAAO;EAEnB,MAAM,kBAAkB,MAAM,oCAAoC,OAAO,GAAG;AAC5E,MAAI,gBAAiB,QAAO;EAE5B,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,MAAI,aAAa,KAAK,CAAE,QAAO;EAO/B,MAAM,oBAAoB,IAAI,IAAY,CACzC,GAAG,OAAO,kBAAkB,KAAK,MAAsB,EAAE,GAAG,EAC5D,IAAI,OAAO,OAAO,aAAa,EAAE,EAAE,KAAK,MAAsB,EAAE,GAAG,CACnE,CAAC;EAEF,MAAM,SAAS,MAAM,sBACpB,OAAO,IACP,OAAO,SACP,OAAO,kBAAkB,EACzB,uBAAuB,OAAO,OAAO,UAAU,OAAO,OAAO,cAAc,SAAS,EACpF;GACC,KAAK,KAAK;GACV,MAAM,KAAK;GACX,SAAS,KAAK;GACd,4BAA4B,KAAK;GACjC,sBAAsB,KAAK;GAC3B,0BAA0B,KAAK;GAC/B,wBAAwB,KAAK;GAC7B,wBAAwB,KAAK;GAC7B,EACD;GACC,qBAAqB;GACrB,SAAS,oBAAoB,SAAS,OAAO,OAAO,aAAa;GACjE,CACD;AAED,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,QAAM,sBAAsB;GAC3B,UAAU,OAAO,KAAK;GACtB,mBAAmB,OAAO,qBAAqB;GAC/C,oBAAoB,OAAO,0BAA0B,OAAO,KAAK,SAAS;GAC1E,gBACC,wBAAwB,OAAO,IAAI,OAAO,SAAS,OAAO,KAAK,UAAU,EACxE,YAAY,MACZ,CAAC;GACH,CAAC;AAEF,SAAO,aAAa,QAAQ,IAAI;UACxB,OAAO;AACf,UAAQ,MAAM,uCAAuC,MAAM;AAC3D,SAAO,YAAY,OAAO,0CAA0C,iBAAiB"}

package/dist/astro/routes/api/admin/plugins/registry/verify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/verify.ts"],"mappings":";;;cAWa,SAAA;AAAA,cAgBA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"verify.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/verify.ts"],"mappings":";;;cAYa,SAAA;AAAA,cAgBA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/admin/plugins/registry/verify.mjs

@@ -1,66 +1,69 @@
-import "../../../../../../dialect-helpers-BcQvkHgn.mjs";
-import "../../../../../../config-C3EBstHi.mjs";
-import "../../../../../../after-CBU2vkoO.mjs";
-import "../../../../../../object-cache-DVKnyOfy.mjs";
-import "../../../../../../content-CNfMWuhY.mjs";
-import "../../../../../../slugify-B994zkXC.mjs";
-import "../../../../../../base64-CvLhUKQv.mjs";
-import "../../../../../../types-CQPWhPxE.mjs";
-import "../../../../../../media-BBm8Wg3f.mjs";
-import "../../../../../../user-DIsIXogT.mjs";
-import "../../../../../../taxonomy-DP1vny4K.mjs";
-import "../../../../../../comment-vxOzWbZN.mjs";
-import "../../../../../../options-D1FBiAv1.mjs";
-import "../../../../../../menus-UdwjHZJC.mjs";
-import "../../../../../../resolve-Cy0aWSRj.mjs";
-import "../../../../../../redirect-DId44BS1.mjs";
-import "../../../../../../request-cache-DAZZmesc.mjs";
-import "../../../../../../byline-registry-BxDGIO0I.mjs";
-import "../../../../../../field-defs-cache-Cf5FHK0M.mjs";
-import "../../../../../../byline-Vdi85CsZ.mjs";
-import "../../../../../../entry-locks-BEcX7ET0.mjs";
-import "../../../../../../seo-Bw68KxRc.mjs";
-import "../../../../../../cache--7HKu5Xm.mjs";
-import "../../../../../../fts-manager-iddym8cd.mjs";
-import "../../../../../../loader-WJi6GFRn.mjs";
-import "../../../../../../collection-slugs-cache-7lTmNzeA.mjs";
-import "../../../../../../taxonomies-NcFDq5Gg.mjs";
-import { t as handleRegistryInstall } from "../../../../../../api-BvxJmnFY.mjs";
-import "../../../../../../dashboard-BNSvAN8A.mjs";
-import "../../../../../../capture-triggers-CeAsC76Z.mjs";
-import "../../../../../../activation-DyNTe_Tl.mjs";
-import "../../../../../../collection-deletion-BCwaWTDw.mjs";
-import "../../../../../../content-refresh-GTMyi2Xy.mjs";
-import "../../../../../../registry-DTqaqxed.mjs";
-import "../../../../../../hash-BRweX6jz.mjs";
-import "../../../../../../media-folders-DASfX_DH.mjs";
-import "../../../../../../media-usage-work-C5B1zT1c.mjs";
-import "../../../../../../content-repair-CIMt5C0U.mjs";
-import "../../../../../../media-usage-C1EswMTq.mjs";
-import "../../../../../../media-usage-activation-CrHNltlL.mjs";
-import "../../../../../../media-usage-work-IkQx_Yz6.mjs";
-import "../../../../../../query-gtXT03Wc.mjs";
-import "../../../../../../zod-generator-CNRGdnBY.mjs";
-import "../../../../../../schema-CRu38Pr5.mjs";
-import "../../../../../../schema-DifxndJx.mjs";
-import "../../../../../../seo-C4AmbsMU.mjs";
-import "../../../../../../sections-3X52kmIR.mjs";
-import "../../../../../../settings-DcMjREe5.mjs";
-import "../../../../../../settings-AnEFYICn.mjs";
-import "../../../../../../taxonomies-BOdxuZpV.mjs";
-import "../../../../../../manifest-schema-CILooI5J.mjs";
-import "../../../../../../types-A2cN6a4a.mjs";
-import "../../../../../../artifact-fetch-P2JXVwOq.mjs";
-import "../../../../../../ssrf-gl4gFNhw.mjs";
-import "../../../../../../config--eWjQJE5.mjs";
-import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
-import "../../../../../../media-C1EIZKh1.mjs";
-import "../../../../../../entry-lock-DIYHAaSw.mjs";
-import "../../../../../../relations-rOmbndUJ.mjs";
-import "../../../../../../status-Cenfk_r5.mjs";
-import { n as VERSION } from "../../../../../../version-CK67_SXX.mjs";
-import { r as requirePerm } from "../../../../../../authorize-C2QHlWSS.mjs";
+import "../../../../../../dialect-helpers-CtYdsX4W.mjs";
+import "../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../datetime-normalization-PeiEdcRY.mjs";
+import "../../../../../../after-PcEvMY_6.mjs";
+import "../../../../../../options-D5WcorD5.mjs";
+import "../../../../../../base64-DvnNgP7e.mjs";
+import "../../../../../../secrets-DNgVgz_e.mjs";
+import "../../../../../../content-DZ3B5qtA.mjs";
+import "../../../../../../object-cache-DlSVbn5Y.mjs";
+import "../../../../../../slugify-T5GHH42D.mjs";
+import "../../../../../../types-BkUg2yHx.mjs";
+import "../../../../../../media-TBlKCwo7.mjs";
+import "../../../../../../user-DroRntkx.mjs";
+import "../../../../../../taxonomy-Dj1vpw5E.mjs";
+import "../../../../../../comment-DcT8qdPK.mjs";
+import "../../../../../../menus-Wy8m5NcH.mjs";
+import "../../../../../../resolve-BJIS8wKr.mjs";
+import "../../../../../../redirect-D2Yo-b6S.mjs";
+import "../../../../../../request-cache-DaMhSQdx.mjs";
+import "../../../../../../byline-registry-D6lWzXk6.mjs";
+import "../../../../../../field-defs-cache-B337z8UJ.mjs";
+import "../../../../../../byline-Doh-wt99.mjs";
+import "../../../../../../entry-locks-CO_KaoU5.mjs";
+import "../../../../../../seo-_4qmazxz.mjs";
+import "../../../../../../cache-B0pOlXdM.mjs";
+import "../../../../../../fts-manager-DMb0sbIQ.mjs";
+import "../../../../../../loader-t4TxaFiQ.mjs";
+import "../../../../../../collection-slugs-cache-D9auiKmI.mjs";
+import "../../../../../../taxonomies-BpqpXJUE.mjs";
+import { t as handleRegistryInstall } from "../../../../../../api-DmjKxPCY.mjs";
+import "../../../../../../dashboard-CZD4G7k_.mjs";
+import "../../../../../../capture-triggers-gxQxnxrJ.mjs";
+import "../../../../../../activation-CaMfdBt1.mjs";
+import "../../../../../../collection-deletion-C3Xixmkx.mjs";
+import "../../../../../../content-refresh-BHLHJgyt.mjs";
+import "../../../../../../registry-CkuPoZs7.mjs";
+import "../../../../../../hash-CLVFzWvx.mjs";
+import "../../../../../../media-folders-ClIRLUQv.mjs";
+import "../../../../../../media-usage-work-Cu5DqewW.mjs";
+import "../../../../../../content-repair-BVll5WNl.mjs";
+import "../../../../../../media-usage-C4NolTpQ.mjs";
+import "../../../../../../media-usage-activation-CAhmb14O.mjs";
+import "../../../../../../media-usage-work-DJr3rOEN.mjs";
+import "../../../../../../query-D7kHKOws.mjs";
+import "../../../../../../zod-generator-D_yHIWfs.mjs";
+import "../../../../../../schema-DEERRrKS.mjs";
+import "../../../../../../schema-CPhPM9Do.mjs";
+import "../../../../../../seo-BtU70b7l.mjs";
+import "../../../../../../settings-DmroR53o.mjs";
+import "../../../../../../sections-BIpd4Cxf.mjs";
+import "../../../../../../settings-g2F2a3Ub.mjs";
+import "../../../../../../taxonomies-ClCo4IGO.mjs";
+import "../../../../../../manifest-schema-Bkh8SeHd.mjs";
+import "../../../../../../artifact-fetch-COiMhVgk.mjs";
+import "../../../../../../ssrf-Co1GGFZz.mjs";
+import "../../../../../../authoritative-records-DbqshfKD.mjs";
+import { r as getRegistryConfigInput } from "../../../../../../config-B2acLeC5.mjs";
+import { a as unwrapResult, r as handleError, t as apiError } from "../../../../../../error-CCTCskie.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-Cr379Av9.mjs";
+import "../../../../../../redirects-BCiTaIQ-.mjs";
+import "../../../../../../entry-lock-D3C99MXS.mjs";
+import "../../../../../../comments-BVzzt6x5.mjs";
+import "../../../../../../relations-B4w-G5U9.mjs";
+import "../../../../../../status-DLoBmcDz.mjs";
+import { n as VERSION } from "../../../../../../version-B57E4Uo7.mjs";
+import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
 import { z } from "zod";
 import { hostEnvFromVersions } from "@emdash-cms/registry-client/env";
 
@@ -80,7 +83,7 @@ const POST = async ({ request, locals }) => {
 		const body = await parseBody(request, verifyBodySchema);
 		if (isParseError(body)) return body;
 		const reservedPluginIds = new Set([...emdash.configuredPlugins.map((plugin) => plugin.id), ...(emdash.config.sandboxed ?? []).map((plugin) => plugin.id)]);
-		return unwrapResult(await handleRegistryInstall(emdash.db, emdash.storage, emdash.getSandboxRunner(), emdash.config.experimental?.registry, body, {
+		return unwrapResult(await handleRegistryInstall(emdash.db, emdash.storage, emdash.getSandboxRunner(), getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry), body, {
 			configuredPluginIds: reservedPluginIds,
 			hostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),
 			verifyOnly: true

package/dist/astro/routes/api/admin/plugins/registry/verify.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/verify.ts"],"sourcesContent":["import { hostEnvFromVersions } from \"@emdash-cms/registry-client/env\";\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleRegistryInstall } from \"#api/index.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\n\nimport { VERSION } from \"../../../../../../version.js\";\n\nexport const prerender = false;\n\nconst verifyBodySchema = z.object({\n\tdid: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(2048)\n\t\t.regex(/^did:[a-z]+:/, \"Invalid DID\"),\n\tslug: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(64)\n\t\t.regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, \"Invalid slug\"),\n\tversion: z.string().min(1).max(64).optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\ttry {\n\t\tconst { emdash, user } = locals;\n\t\tif (!emdash?.db) {\n\t\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t\t}\n\t\tconst denied = requirePerm(user, \"plugins:manage\");\n\t\tif (denied) return denied;\n\t\tconst body = await parseBody(request, verifyBodySchema);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst reservedPluginIds = new Set<string>([\n\t\t\t...emdash.configuredPlugins.map((plugin: { id: string }) => plugin.id),\n\t\t\t...(emdash.config.sandboxed ?? []).map((plugin: { id: string }) => plugin.id),\n\t\t]);\n\t\tconst result = await handleRegistryInstall(\n\t\t\temdash.db,\n\t\t\temdash.storage,\n\t\t\temdash.getSandboxRunner(),\n\t\t\temdash.config.experimental?.registry,\n\t\t\tbody,\n\t\t\t{\n\t\t\t\tconfiguredPluginIds: reservedPluginIds,\n\t\t\t\thostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),\n\t\t\t\tverifyOnly: true,\n\t\t\t},\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\tconsole.error(\"[registry-verify] Unhandled error:\", error);\n\t\treturn handleError(error, \"Failed to verify registry plugin\", \"VERIFICATION_FAILED\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,MAAa,YAAY;AAEzB,MAAM,mBAAmB,EAAE,OAAO;CACjC,KAAK,EACH,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,KAAK,CACT,MAAM,gBAAgB,cAAc;CACtC,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,GAAG,CACP,MAAM,4BAA4B,eAAe;CACnD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,UAAU;CAC7C,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;AAC5D,KAAI;EACH,MAAM,EAAE,QAAQ,SAAS;AACzB,MAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;EAEpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,MAAI,OAAQ,QAAO;EACnB,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,oBAAoB,IAAI,IAAY,CACzC,GAAG,OAAO,kBAAkB,KAAK,WAA2B,OAAO,GAAG,EACtE,IAAI,OAAO,OAAO,aAAa,EAAE,EAAE,KAAK,WAA2B,OAAO,GAAG,CAC7E,CAAC;AAaF,SAAO,aAZQ,MAAM,sBACpB,OAAO,IACP,OAAO,SACP,OAAO,kBAAkB,EACzB,OAAO,OAAO,cAAc,UAC5B,MACA;GACC,qBAAqB;GACrB,SAAS,oBAAoB,SAAS,OAAO,OAAO,aAAa;GACjE,YAAY;GACZ,CACD,CAC0B;UACnB,OAAO;AACf,UAAQ,MAAM,sCAAsC,MAAM;AAC1D,SAAO,YAAY,OAAO,oCAAoC,sBAAsB"}
+{"version":3,"file":"verify.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/admin/plugins/registry/verify.ts"],"sourcesContent":["import { hostEnvFromVersions } from \"@emdash-cms/registry-client/env\";\nimport type { APIRoute } from \"astro\";\nimport { z } from \"zod\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, unwrapResult } from \"#api/error.js\";\nimport { handleRegistryInstall } from \"#api/index.js\";\nimport { isParseError, parseBody } from \"#api/parse.js\";\n\nimport { getRegistryConfigInput } from \"../../../../../../registry/config.js\";\nimport { VERSION } from \"../../../../../../version.js\";\n\nexport const prerender = false;\n\nconst verifyBodySchema = z.object({\n\tdid: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(2048)\n\t\t.regex(/^did:[a-z]+:/, \"Invalid DID\"),\n\tslug: z\n\t\t.string()\n\t\t.min(1)\n\t\t.max(64)\n\t\t.regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, \"Invalid slug\"),\n\tversion: z.string().min(1).max(64).optional(),\n});\n\nexport const POST: APIRoute = async ({ request, locals }) => {\n\ttry {\n\t\tconst { emdash, user } = locals;\n\t\tif (!emdash?.db) {\n\t\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t\t}\n\t\tconst denied = requirePerm(user, \"plugins:manage\");\n\t\tif (denied) return denied;\n\t\tconst body = await parseBody(request, verifyBodySchema);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst reservedPluginIds = new Set<string>([\n\t\t\t...emdash.configuredPlugins.map((plugin: { id: string }) => plugin.id),\n\t\t\t...(emdash.config.sandboxed ?? []).map((plugin: { id: string }) => plugin.id),\n\t\t]);\n\t\tconst result = await handleRegistryInstall(\n\t\t\temdash.db,\n\t\t\temdash.storage,\n\t\t\temdash.getSandboxRunner(),\n\t\t\tgetRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),\n\t\t\tbody,\n\t\t\t{\n\t\t\t\tconfiguredPluginIds: reservedPluginIds,\n\t\t\t\thostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),\n\t\t\t\tverifyOnly: true,\n\t\t\t},\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\tconsole.error(\"[registry-verify] Unhandled error:\", error);\n\t\treturn handleError(error, \"Failed to verify registry plugin\", \"VERIFICATION_FAILED\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAa,YAAY;AAEzB,MAAM,mBAAmB,EAAE,OAAO;CACjC,KAAK,EACH,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,KAAK,CACT,MAAM,gBAAgB,cAAc;CACtC,MAAM,EACJ,QAAQ,CACR,IAAI,EAAE,CACN,IAAI,GAAG,CACP,MAAM,4BAA4B,eAAe;CACnD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,UAAU;CAC7C,CAAC;AAEF,MAAa,OAAiB,OAAO,EAAE,SAAS,aAAa;AAC5D,KAAI;EACH,MAAM,EAAE,QAAQ,SAAS;AACzB,MAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;EAEpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,MAAI,OAAQ,QAAO;EACnB,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAE/B,MAAM,oBAAoB,IAAI,IAAY,CACzC,GAAG,OAAO,kBAAkB,KAAK,WAA2B,OAAO,GAAG,EACtE,IAAI,OAAO,OAAO,aAAa,EAAE,EAAE,KAAK,WAA2B,OAAO,GAAG,CAC7E,CAAC;AAaF,SAAO,aAZQ,MAAM,sBACpB,OAAO,IACP,OAAO,SACP,OAAO,kBAAkB,EACzB,uBAAuB,OAAO,OAAO,UAAU,OAAO,OAAO,cAAc,SAAS,EACpF,MACA;GACC,qBAAqB;GACrB,SAAS,oBAAoB,SAAS,OAAO,OAAO,aAAa;GACjE,YAAY;GACZ,CACD,CAC0B;UACnB,OAAO;AACf,UAAQ,MAAM,sCAAsC,MAAM;AAC1D,SAAO,YAAY,OAAO,oCAAoC,sBAAsB"}

package/dist/astro/routes/api/admin/plugins/updates.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"updates.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/admin/plugins/updates.ts"],"mappings":";;;cAoBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"updates.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/admin/plugins/updates.ts"],"mappings":";;;cAsBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA"}