emdash 0.41.0 → 0.42.0

package/dist/api-CFQn8VLR.mjs

@@ -0,0 +1,4973 @@
+import { n as isMissingTableError, t as isMissingColumnError } from "./db-errors-CBD5yMro.mjs";
+import { i as validateStorageCollectionName, n as validateJsonFieldName, r as validatePluginIdentifier, t as validateIdentifier } from "./validate-DANX1-Qi.mjs";
+import { d as isSqlite, f as jsonExtractExpr, u as isPostgres } from "./dialect-helpers-7_IqPdh9.mjs";
+import { i as isI18nEnabled, o as resolveConfiguredLocale, r as getI18nConfig } from "./config-CvmjJcVw.mjs";
+import { t as after } from "./after-PcEvMY_6.mjs";
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { i as encodeBase64, t as decodeBase64 } from "./base64-DvnNgP7e.mjs";
+import { t as EmDashSecretsError } from "./secrets-CIi0nFiR.mjs";
+import { r as isSystemOrderField, t as ContentRepository } from "./content-RzEXY3QX.mjs";
+import { m as isStoragelessFieldRow, p as isStoragelessField, s as MAX_COLLECTION_LIST_COLUMNS } from "./types-BGmQ0uXs.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-DBmkKmBH.mjs";
+import { r as requestCached } from "./request-cache-C4CIo5ad.mjs";
+import { i as InvalidCursorError, n as ContentMutationConflictError, o as ScheduledNotDueError, r as EmDashValidationError, t as ContentCollectionNotFoundError } from "./types-j6MBDjlZ.mjs";
+import { t as RevisionRepository } from "./revision-CGkQA0e5.mjs";
+import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
+import { t as UserRepository } from "./user-BOvuF1sQ.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-BesdHIwi.mjs";
+import { t as CommentRepository } from "./comment-Cq1UYN8_.mjs";
+import { t as RedirectRepository } from "./redirect-BvFKh8Sz.mjs";
+import { t as BylineRepository } from "./byline-02tu_Uc-.mjs";
+import { c as readStagedReferenceBaselines, d as RelationRepository, i as STAGED_REFERENCES_KEY, l as readStagedReferences, r as STAGED_REFERENCES_BASELINE_KEY, s as pageStagedGroups } from "./staged-Bw5eHbKS.mjs";
+import { r as parseAllowedMimeTypes, t as matchesMimeAllowlist } from "./mime-IZf-LHIS.mjs";
+import { t as EntryLockRepository } from "./entry-locks-DJAqVweV.mjs";
+import { t as SeoRepository } from "./seo-DpYxmGaL.mjs";
+import { i as scheduledPolicyRejectionKey } from "./content-policy-Dm32n9C6.mjs";
+import { n as invalidateRedirectCache } from "./cache-CPanL9IO.mjs";
+import { t as FTSManager } from "./fts-manager-DU03MxWu.mjs";
+import { d as invalidateTermCache } from "./taxonomies-DWv-OYT0.mjs";
+import { L as BlockTypeRegistry, n as SchemaRegistry } from "./registry-CtHRqVe-.mjs";
+import { r as hashString } from "./hash-CY4QdeMJ.mjs";
+import { n as expandCollectionBlockFields } from "./block-values-BrTrtA-v.mjs";
+import { _ as referenceFieldConstraints, d as resolveEntryGroups, f as resolveReferenceSelection, g as writeReferenceSelection, h as validateOppositeSideLimit, n as getReferenceTitleField, p as resolveReferenceSelectionTargets, u as resolveEntries, v as validateReferenceSelection, y as validateRequiredReferencesPresent } from "./relations-CVI2nbrn.mjs";
+import { a as parseDurationSeconds, l as validateAggregatorUrl, n as coerceRegistryConfig, o as releaseExemptFromMinimumAge, t as canonicalCapabilitiesForDriftCheck } from "./config-BnuORwSP.mjs";
+import { t as ErrorCode } from "./errors-CNvATh_7.mjs";
+import { t as PluginStateRepository } from "./state-kGdOMQRY.mjs";
+import { f as encodePluginSettingValue, l as PluginSettingEncryptionError } from "./settings-BbVRRGDp.mjs";
+import { a as pluginManifestSchema$1, i as normalizeManifestRoute$1, o as reconcileManifestAccess$1 } from "./manifest-schema-gy37bD_D.mjs";
+import { n as MarketplaceUnavailableError, r as createMarketplaceClient, t as MarketplaceError } from "./marketplace-tHWSsCUo.mjs";
+import { o as withUnavailableReason } from "./types-CdEMurNh.mjs";
+import { r as normalizeCapabilities } from "./types-CsmwbOwa.mjs";
+import { t as EmDashStorageError } from "./types-DGw8KMX_.mjs";
+import { i as verificationError, r as verifyMultihash, t as computeArtifactDigestCandidates } from "./checksum-DtH6m5uk.mjs";
+import { n as fetchReleaseArtifact, t as fetchRegistryArtifactUrl } from "./artifact-fetch-CWxyELVI.mjs";
+import { i as resolveAndValidateExternalUrlTarget } from "./ssrf-DsmvZB80.mjs";
+import { r as verifyAuthoritativePackageRelease, t as readAuthoritativePackageRelease } from "./authoritative-records-dSvXCfzb.mjs";
+import { sql } from "kysely";
+import { canonicalizeDeclaredAccess, pluginManifestSchema, reconcileManifestAccess } from "@emdash-cms/plugin-types";
+import { createGzipDecoder } from "modern-tar";
+import { ClientResponseError, ClientValidationError } from "@atcute/client";
+import { checkEnvCompatibility, compareVersions, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
+import { isProvenFirstRelease } from "@emdash-cms/registry-client/listing-policy";
+import { evaluateRegistryReleaseWithdrawal } from "@emdash-cms/registry-client/withdrawal";
+import { NSID } from "@emdash-cms/registry-lexicons";
+
+//#region src/api/rev.ts
+/**
+* Generate a _rev token from a content item's version and updatedAt.
+*/
+function encodeRev(item) {
+	return encodeBase64(`${item.version}:${item.updatedAt}`);
+}
+/**
+* Decode a _rev token into its components.
+* Returns null if the token is malformed.
+*/
+function decodeRev(rev) {
+	try {
+		const decoded = decodeBase64(rev);
+		const colonIdx = decoded.indexOf(":");
+		if (colonIdx === -1) return null;
+		const version = parseInt(decoded.slice(0, colonIdx), 10);
+		const updatedAt = decoded.slice(colonIdx + 1);
+		if (isNaN(version) || !updatedAt) return null;
+		return {
+			version,
+			updatedAt
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Validate a _rev token against a content item.
+* Returns null if valid (or if no _rev provided), or an error message if invalid.
+*/
+function validateRev(rev, item) {
+	if (!rev) return { valid: true };
+	const decoded = decodeRev(rev);
+	if (!decoded) return {
+		valid: false,
+		message: "Malformed _rev token"
+	};
+	if (decoded.version !== item.version || decoded.updatedAt !== item.updatedAt) return {
+		valid: false,
+		message: "Content has been modified since last read (version conflict)"
+	};
+	return { valid: true };
+}
+
+//#endregion
+//#region src/api/handlers/staged-references.ts
+/** One bound field's live selection as translation groups. */
+async function liveFieldSelection(repo, field, entryGroup) {
+	return (field.relationSide === "child" ? await repo.getParents(field.relation, entryGroup) : await repo.getChildren(field.relation, entryGroup)).map((link) => field.relationSide === "child" ? link.parentGroup : link.childGroup);
+}
+/**
+* Re-check what publication is about to make live against the relation's current
+* cardinality.
+*
+* A draft can sit unpublished across a schema edit that makes its field required
+* or narrows the relation's limits, and across another entry claiming what it
+* selected. It is publication — not the save that staged it — that has to hold
+* the line on both ends. So this walks the collection's bound fields rather than
+* the staged keys: a field added as required after the entry was written appears
+* in no existing draft, and iterating `staged` would never reach it. A field the
+* draft does stage needs no link read.
+*/
+async function validateStagedReferences(db, collection, staged, entryGroup, baselines) {
+	const repo = new RelationRepository(db);
+	for (const field of (await referenceFieldConstraints(db, collection)).values()) {
+		const isStaged = Object.hasOwn(staged, field.slug);
+		let groups = isStaged ? staged[field.slug] ?? [] : void 0;
+		const baseline = baselines?.[field.slug];
+		if (groups && baseline) {
+			const live = await liveFieldSelection(repo, field, entryGroup);
+			groups = applyReferenceDiff(baseline, groups, live);
+		}
+		groups ??= await liveFieldSelection(repo, field, entryGroup);
+		const valid = validateReferenceSelection(field, groups);
+		if (!valid.success) return valid;
+		if (!isStaged || field.relationId === null) continue;
+		const far = await validateOppositeSideLimit(db, {
+			relationId: field.relationId,
+			farLimit: field.maxOpposite,
+			side: field.relationSide,
+			entryGroup,
+			groups
+		});
+		if (!far.success) return far;
+	}
+	return {
+		success: true,
+		data: true
+	};
+}
+/**
+* The live selection, in the same shape a draft stages: every bound reference
+* field on the collection, by field slug, as translation groups.
+*
+* One link read per bound field. Used where both selections have to be
+* comparable — the live and draft sides of a compare — never on a render path.
+*/
+async function liveReferenceSelection(db, collection, entryGroup) {
+	const repo = new RelationRepository(db);
+	const selection = {};
+	for (const field of (await referenceFieldConstraints(db, collection)).values()) selection[field.slug] = await liveFieldSelection(repo, field, entryGroup);
+	return selection;
+}
+/**
+* Compute the selection that results from applying the staged-versus-baseline
+* diff on top of the current live selection.
+*
+* Additions and removals made in the draft win. Items the draft left unchanged
+* follow the current live selection, preserving additions and removals made
+* from the relation's opposite end.
+*/
+function applyReferenceDiff(baseline, staged, live) {
+	const baselineSet = new Set(baseline);
+	const stagedSet = new Set(staged);
+	const liveSet = new Set(live);
+	const additionSet = new Set(staged.filter((group) => !baselineSet.has(group)));
+	const removalSet = new Set(baseline.filter((group) => !stagedSet.has(group)));
+	const result = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const group of staged) {
+		if (!additionSet.has(group) && !liveSet.has(group) || seen.has(group)) continue;
+		result.push(group);
+		seen.add(group);
+	}
+	for (const group of live) {
+		if (removalSet.has(group) || seen.has(group)) continue;
+		result.push(group);
+		seen.add(group);
+	}
+	return result;
+}
+/**
+* Record the complete live selection in the revision publication just made live.
+*
+* A draft stages only the fields its saves named, and a revision written from
+* the columns stages none. Restoring either would otherwise leave whatever was
+* published after it linked in the fields it does not carry.
+*/
+async function recordPublishedReferences(db, collection, revisionId, entryGroup) {
+	const selection = await liveReferenceSelection(db, collection, entryGroup);
+	if (Object.keys(selection).length === 0) return;
+	await new RevisionRepository(db).mergeData(revisionId, { [STAGED_REFERENCES_KEY]: selection });
+}
+/**
+* Promote a staged selection to live links.
+*
+* A field slug the collection no longer carries as a bound reference field is
+* skipped: the revision outlived the field, and there is no relation left to
+* write into.
+*
+* When `baselines` are provided, each staged field is promoted as a diff
+* against its baseline rather than as a wholesale replacement. That prevents a
+* draft saved before a concurrent opposite-end publish from undoing the links
+* that publish added or removed.
+*/
+async function applyStagedReferences(db, collection, entryGroup, staged, baselines) {
+	const constraints = await referenceFieldConstraints(db, collection);
+	const repo = new RelationRepository(db);
+	for (const [fieldSlug, groups] of Object.entries(staged)) {
+		const field = constraints.get(fieldSlug);
+		if (!field) continue;
+		const baseline = baselines?.[fieldSlug];
+		let selection;
+		if (baseline) selection = applyReferenceDiff(baseline, groups, await liveFieldSelection(repo, field, entryGroup));
+		else selection = groups;
+		await writeReferenceSelection(db, {
+			relation: field.relation,
+			side: field.relationSide,
+			entryGroup,
+			groups: selection
+		});
+	}
+}
+
+//#endregion
+//#region src/api/handlers/validate-media-fields.ts
+function asMediaRef(value) {
+	if (value === null || value === void 0) return null;
+	if (typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+function fail(message) {
+	return {
+		success: false,
+		error: {
+			code: "INVALID_MIME_FOR_FIELD",
+			message
+		}
+	};
+}
+function addTarget(targets, path, value, allowedMimeTypes, includeDarkVariant) {
+	if (!allowedMimeTypes?.length || value == null) return;
+	targets.push({
+		path,
+		value,
+		allowedMimeTypes: [...allowedMimeTypes]
+	});
+	const ref = includeDarkVariant ? asMediaRef(value) : null;
+	if (ref && "darkVariant" in ref && ref.darkVariant != null) targets.push({
+		path: `${path}.darkVariant`,
+		value: ref.darkVariant,
+		allowedMimeTypes: [...allowedMimeTypes]
+	});
+}
+function collectBlockTargets(targets, field, value) {
+	if (!Array.isArray(value)) return {
+		success: true,
+		data: true
+	};
+	const types = new Map((field.blockTypes ?? []).map((type) => [type.slug, type]));
+	for (const [index, block] of value.entries()) {
+		if (!block || typeof block !== "object" || Array.isArray(block)) continue;
+		const typeSlug = "_type" in block && typeof block._type === "string" ? block._type : void 0;
+		const versionNumber = "_version" in block && typeof block._version === "number" ? block._version : void 0;
+		const key = "_key" in block && typeof block._key === "string" ? block._key : String(index);
+		const type = typeSlug ? types.get(typeSlug) : void 0;
+		const version = type?.versions.find((candidate) => candidate.version === versionNumber);
+		if (!type || !version || version.unsupportedTypes?.length) return {
+			success: false,
+			error: {
+				code: "UNSUPPORTED_FIELD_TYPE",
+				message: `Field '${field.slug}' block '${key}' has no retained definition`
+			}
+		};
+		for (const nestedField of version.fields) {
+			const nestedValue = nestedField.slug in block ? block[nestedField.slug] : void 0;
+			const nestedPath = `${field.slug}.${key}.${nestedField.slug}`;
+			if (nestedField.type !== "image" && nestedField.type !== "file") continue;
+			addTarget(targets, nestedPath, nestedValue, nestedField.validation?.allowedMimeTypes, nestedField.type === "image");
+		}
+	}
+	return {
+		success: true,
+		data: true
+	};
+}
+async function loadMediaFieldsForCollection(db, collectionSlug) {
+	const rows = await db.selectFrom("_emdash_fields").innerJoin("_emdash_collections", "_emdash_collections.id", "_emdash_fields.collection_id").select([
+		"_emdash_fields.slug",
+		"_emdash_fields.type",
+		"_emdash_fields.validation"
+	]).where("_emdash_collections.slug", "=", collectionSlug).where("_emdash_fields.type", "in", [
+		"file",
+		"image",
+		"blocks"
+	]).execute();
+	const out = [];
+	const allBlockTypes = rows.some((row) => row.type === "blocks") ? await new BlockTypeRegistry(db).listBlockTypes() : [];
+	const blockTypeBySlug = new Map(allBlockTypes.map((type) => [type.slug, type]));
+	for (const row of rows) {
+		if (row.type === "blocks") {
+			let validation;
+			try {
+				validation = row.validation ? JSON.parse(row.validation) : {};
+			} catch {
+				validation = {};
+			}
+			let configured = [];
+			if (validation && typeof validation === "object" && !Array.isArray(validation)) {
+				const allowed = "allowedTypes" in validation && Array.isArray(validation.allowedTypes) ? validation.allowedTypes : [];
+				const retired = "retiredTypes" in validation && Array.isArray(validation.retiredTypes) ? validation.retiredTypes : [];
+				configured = [...allowed, ...retired];
+			}
+			out.push({
+				slug: row.slug,
+				type: row.type,
+				allowedMimeTypes: [],
+				blockTypes: configured.flatMap((slug) => {
+					const type = typeof slug === "string" ? blockTypeBySlug.get(slug) : void 0;
+					return type ? [type] : [];
+				})
+			});
+			continue;
+		}
+		const list = parseAllowedMimeTypes(row.validation);
+		if (!list) continue;
+		out.push({
+			slug: row.slug,
+			type: row.type,
+			allowedMimeTypes: list
+		});
+	}
+	return out;
+}
+async function validateMediaFields(db, collectionSlug, data) {
+	const fields = await requestCached(`mediaFields:${collectionSlug}`, () => loadMediaFieldsForCollection(db, collectionSlug));
+	if (fields.length === 0) return {
+		success: true,
+		data: true
+	};
+	const targets = [];
+	for (const field of fields) {
+		const value = data[field.slug];
+		if (field.type === "blocks") {
+			const collected = collectBlockTargets(targets, field, value);
+			if (!collected.success) return collected;
+		} else addTarget(targets, field.slug, value, field.allowedMimeTypes, field.type === "image");
+	}
+	if (targets.length === 0) return {
+		success: true,
+		data: true
+	};
+	const localIds = /* @__PURE__ */ new Set();
+	for (const target of targets) {
+		const ref = asMediaRef(target.value);
+		if (!ref) continue;
+		if ((typeof ref.provider === "string" ? ref.provider : "local") === "local" && typeof ref.id === "string") localIds.add(ref.id);
+	}
+	const idList = [...localIds];
+	const mimeById = /* @__PURE__ */ new Map();
+	if (idList.length > 0) for (const batch of chunks(idList, SQL_BATCH_SIZE)) {
+		const rows = await db.selectFrom("media").select(["id", "mime_type"]).where("id", "in", batch).execute();
+		for (const r of rows) mimeById.set(r.id, r.mime_type);
+	}
+	for (const target of targets) {
+		const ref = asMediaRef(target.value);
+		if (!ref) continue;
+		const provider = typeof ref.provider === "string" ? ref.provider : "local";
+		let mime;
+		if (provider === "local") {
+			if (typeof ref.id !== "string") return fail(`Field '${target.path}' references media with an invalid id`);
+			mime = mimeById.get(ref.id);
+			if (!mime) return fail(`Field '${target.path}' references media with unknown MIME type`);
+		} else {
+			if (typeof ref.mimeType !== "string") return fail(`Field '${target.path}' requires a mimeType declaration for non-local media`);
+			mime = ref.mimeType;
+		}
+		if (!matchesMimeAllowlist(mime, target.allowedMimeTypes)) return fail(`Field '${target.path}' does not accept ${mime}`);
+	}
+	return {
+		success: true,
+		data: true
+	};
+}
+
+//#endregion
+//#region src/api/handlers/content.ts
+/**
+* Narrow a caught error to one carrying a structured `apiError` discriminant.
+* Used by transaction callbacks that want to surface a specific error code
+* through the standard Error throwing path.
+*/
+function hasApiError(error) {
+	if (!(error instanceof Error) || !("apiError" in error)) return false;
+	const { apiError } = error;
+	return typeof apiError === "object" && apiError !== null && "code" in apiError && typeof apiError.code === "string";
+}
+/**
+* Abort the surrounding transaction when a relation's limit refused an edge.
+*
+* `farSide` names the end that filled up, which is the opposite of the end the
+* refused group sits on: a child that cannot take another parent refuses with
+* `"parent"`.
+*/
+function throwIfReferenceLimitRefused(rejected, farSide) {
+	if (rejected.length === 0) return;
+	throw Object.assign(/* @__PURE__ */ new Error(`Entry '${rejected[0]}' already has the maximum number of ${farSide} entries on this relation.`), { apiError: { code: "VALIDATION_ERROR" } });
+}
+/** The slug a draft revision stages, when it stages one. */
+function readStagedSlug(data) {
+	return typeof data?._slug === "string" ? data._slug : null;
+}
+/**
+* Make every refusal `publish()` decides before it writes, ahead of it.
+*
+* `publish()` decides all of them again and stays authoritative; this does not
+* replace it. It exists for the one caller that has irreversible work to do
+* first — promoting a draft's staged reference selection, which nothing takes
+* back where `withTransaction` degrades to plain statements. A refusal that
+* landed after that promotion would leave a draft's links live on an entry that
+* never published.
+*
+* The optimistic fence `publish()` ends on is not checked here, because it is
+* the write itself: a publish lost to a concurrent edit still promotes.
+*/
+async function assertPublishWillNotBeRefused(db, collection, id, existing, options) {
+	const { expectedRevision } = options;
+	if (expectedRevision && (existing.version !== expectedRevision.version || existing.updatedAt !== expectedRevision.updatedAt)) throw new ContentMutationConflictError();
+	if (options.requireDue && options.expectedScheduledAt !== void 0 && existing.scheduledAt !== options.expectedScheduledAt) throw new ScheduledNotDueError();
+	const intendedSlug = options.stagedSlug ?? existing.slug;
+	if (options.requireSlug && !intendedSlug?.trim()) throw new EmDashValidationError("Cannot publish routable content without a slug");
+	if (options.stagedSlug !== null && options.stagedSlug !== existing.slug && existing.locale !== null) {
+		const conflict = await new ContentRepository(db).findBySlugIncludingTrashed(collection, options.stagedSlug, existing.locale);
+		if (conflict && conflict.id !== id) throw new EmDashValidationError(`Cannot publish: slug '${options.stagedSlug}' is already used by another entry in this collection (id: ${conflict.id}). Choose a different slug.`, { code: "SLUG_CONFLICT" });
+	}
+}
+function isTranslationLocaleConflict(error, collection) {
+	if (!(error instanceof Error)) return false;
+	const message = error.message.toLowerCase();
+	const storedIndexName = `uidx_ec_${collection}_active_tg_locale`.slice(0, 63).toLowerCase();
+	return message.includes(storedIndexName) || message.includes("unique constraint failed") && message.includes("translation_group") && message.includes("locale");
+}
+function decodeRevisionPrecondition(rev) {
+	if (rev === void 0) return void 0;
+	const decoded = decodeRev(rev);
+	if (!decoded) throw new ContentMutationConflictError("Revision precondition did not match");
+	return decoded;
+}
+/**
+* Extract a slug source (title or name) from content data.
+* Returns null if no suitable string field is found.
+*/
+function getSlugSource(data) {
+	if (typeof data.title === "string" && data.title.length > 0) return data.title;
+	if (typeof data.name === "string" && data.name.length > 0) return data.name;
+	return null;
+}
+/** Default SEO values for content without an explicit SEO row */
+const SEO_DEFAULTS = {
+	title: null,
+	description: null,
+	image: null,
+	canonical: null,
+	noIndex: false
+};
+/**
+* Check if a collection has SEO enabled.
+*
+* Cached per request so bulk imports do not re-query `_emdash_collections`
+* for every item they create.
+*/
+async function collectionHasSeo(db, collection) {
+	return requestCached(`collectionHasSeo:${collection}`, async () => {
+		return (await db.selectFrom("_emdash_collections").select("has_seo").where("slug", "=", collection).executeTakeFirst())?.has_seo === 1;
+	});
+}
+/**
+* Collection publication metadata, cached per request for bulk imports.
+*/
+async function getCollectionPublishConfig(db, collection) {
+	return requestCached(`collectionPublishConfig:${collection}`, async () => {
+		const row = await db.selectFrom("_emdash_collections").select(["supports", "routable"]).where("slug", "=", collection).executeTakeFirst();
+		const supports = row?.supports ? JSON.parse(row.supports) : [];
+		return {
+			supportsRevisions: Array.isArray(supports) && supports.includes("revisions"),
+			routable: row?.routable !== 0
+		};
+	});
+}
+function requireRoutablePublishSlug(routable, slug) {
+	if (routable && !slug?.trim()) throw new EmDashValidationError("Cannot publish routable content without a slug");
+}
+/**
+* Hydrate SEO data on a single content item if the collection has SEO enabled.
+*/
+async function hydrateSeo(db, collection, item, hasSeo) {
+	if (!hasSeo) return;
+	item.seo = await new SeoRepository(db).get(collection, item.id);
+}
+/**
+* Hydrate SEO data on multiple content items using a single batch query.
+*/
+async function hydrateSeoMany(db, collection, items, hasSeo) {
+	if (!hasSeo || items.length === 0) return;
+	const seoMap = await new SeoRepository(db).getMany(collection, items.map((i) => i.id));
+	for (const item of items) item.seo = seoMap.get(item.id) ?? { ...SEO_DEFAULTS };
+}
+async function hydrateBylines(db, collection, item) {
+	const bylineRepo = new BylineRepository(db);
+	const localeOpt = item.locale ? { locale: item.locale } : void 0;
+	const bylines = await bylineRepo.getContentBylines(collection, item.id, localeOpt);
+	if (bylines.length > 0) {
+		item.bylines = bylines.map((c) => ({
+			...c,
+			source: "explicit"
+		}));
+		item.byline = bylines[0]?.byline ?? null;
+		return;
+	}
+	if (item.primaryBylineId) {
+		item.bylines = [];
+		item.byline = null;
+		return;
+	}
+	if (item.authorId) {
+		const fallback = await bylineRepo.findByUserId(item.authorId, localeOpt);
+		if (fallback) {
+			item.bylines = [{
+				byline: fallback,
+				sortOrder: 0,
+				roleLabel: null,
+				source: "inferred"
+			}];
+			item.byline = fallback;
+			return;
+		}
+	}
+	item.bylines = [];
+	item.byline = null;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+/**
+* Hydrate the first page of each reference field's selection onto a single
+* content item, keyed by field slug — the same key the create and update bodies
+* take a selection under.
+*
+* Callers must have already decided `includeDrafts` — draft visibility is
+* enforced by the caller, not this helper — because a resolved entry can carry
+* a draft or scheduled entry's id and slug. The admin's REST GET route is the
+* only caller, and it asks for every entry it serves, so a collection with no
+* reference field still pays the two lookups below.
+*
+* For a caller that opted into drafts, a field whose selection is staged in the
+* entry's draft revision is answered from that revision; every other field, and
+* every field for a caller that did not opt in, is answered from the links,
+* which hold the published selection. That is what keeps a picker change on a
+* published entry invisible until it is published.
+*
+* Either selection arrives one page at a time, with the cursor to walk the rest
+* through the edge routes — a draft's pending selection can be as long as a
+* published one, and a caller that reads an entry should not have to take a
+* field of a thousand entries to find out.
+*/
+async function hydrateReferences(db, collection, item, includeDrafts) {
+	if (!item.translationGroup) return;
+	const collectionRow = await db.selectFrom("_emdash_collections").select("id").where("slug", "=", collection).executeTakeFirst();
+	if (!collectionRow) return;
+	const fields = await db.selectFrom("_emdash_fields").select(["slug", "validation"]).where("collection_id", "=", collectionRow.id).where("type", "=", "reference").execute();
+	const references = {};
+	if (fields.length === 0) {
+		item.references = references;
+		return;
+	}
+	const repo = new RelationRepository(db);
+	const content = new ContentRepository(db);
+	const staged = includeDrafts && item.draftRevisionId ? readStagedReferences((await new RevisionRepository(db).findById(item.draftRevisionId))?.data) : void 0;
+	for (const field of fields) {
+		let validation = {};
+		if (field.validation) {
+			let parsed;
+			try {
+				parsed = JSON.parse(field.validation);
+			} catch {
+				continue;
+			}
+			if (isRecord(parsed)) validation = parsed;
+		}
+		const relation = typeof validation.relation === "string" ? validation.relation : void 0;
+		const targetCollection = typeof validation.targetCollection === "string" ? validation.targetCollection : void 0;
+		if (!relation || !targetCollection) continue;
+		const stagedGroups = staged?.[field.slug];
+		if (stagedGroups) {
+			const page = pageStagedGroups(stagedGroups);
+			references[field.slug] = {
+				children: await resolveEntryGroups(content, targetCollection, page.groups, item.locale, includeDrafts, await getReferenceTitleField(db, targetCollection)),
+				...page.nextCursor ? { nextCursor: page.nextCursor } : {}
+			};
+			continue;
+		}
+		const onChildSide = validation.relationSide === "child";
+		const edges = onChildSide ? await repo.getParentsPage(relation, item.translationGroup) : await repo.getChildrenPage(relation, item.translationGroup);
+		const children = await resolveEntries(content, targetCollection, edges.items, (e) => onChildSide ? e.parentGroup : e.childGroup, item.locale, includeDrafts, await getReferenceTitleField(db, targetCollection));
+		references[field.slug] = {
+			children,
+			...edges.nextCursor ? { nextCursor: edges.nextCursor } : {}
+		};
+	}
+	item.references = references;
+}
+/**
+* Batch-hydrate bylines for multiple items using two bulk queries instead of N+1.
+*
+* Items may live at different locales (e.g. a list endpoint returning the
+* translations of an entry). Group by `item.locale` and call the strict
+* per-locale repo method once per group so each item resolves against its
+* own locale's byline rows.
+*/
+async function hydrateBylinesMany(db, collection, items) {
+	if (items.length === 0) return;
+	const bylineRepo = new BylineRepository(db);
+	const localeBuckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = item.locale ?? null;
+		const bucket = localeBuckets.get(key);
+		if (bucket) bucket.push(item);
+		else localeBuckets.set(key, [item]);
+	}
+	const bylinesByItem = /* @__PURE__ */ new Map();
+	const itemsNeedingAuthorCheck = [];
+	for (const [locale, bucket] of localeBuckets) {
+		const localeOpt = locale ? { locale } : void 0;
+		const ids = bucket.map((i) => i.id);
+		const credits = await bylineRepo.getContentBylinesMany(collection, ids, localeOpt);
+		for (const [id, list] of credits) bylinesByItem.set(id, list);
+		for (const item of bucket) {
+			if (credits.has(item.id) && credits.get(item.id).length > 0) continue;
+			if (item.authorId) itemsNeedingAuthorCheck.push(item);
+		}
+	}
+	const fallbackByItem = /* @__PURE__ */ new Map();
+	if (itemsNeedingAuthorCheck.length > 0) {
+		const authorBuckets = /* @__PURE__ */ new Map();
+		for (const item of itemsNeedingAuthorCheck) {
+			if (item.primaryBylineId) continue;
+			const key = item.locale ?? null;
+			const bucket = authorBuckets.get(key);
+			if (bucket) bucket.push(item);
+			else authorBuckets.set(key, [item]);
+		}
+		for (const [locale, bucket] of authorBuckets) {
+			const localeOpt = locale ? { locale } : void 0;
+			const authorIds = bucket.map((i) => i.authorId).filter((id) => id !== null);
+			const uniqueAuthorIds = [...new Set(authorIds)];
+			if (uniqueAuthorIds.length === 0) continue;
+			const authorMap = await bylineRepo.findByUserIds(uniqueAuthorIds, localeOpt);
+			for (const item of bucket) {
+				if (!item.authorId) continue;
+				const f = authorMap.get(item.authorId);
+				if (f) fallbackByItem.set(item.id, f);
+			}
+		}
+	}
+	for (const item of items) {
+		const explicit = bylinesByItem.get(item.id);
+		if (explicit && explicit.length > 0) {
+			item.bylines = explicit.map((c) => ({
+				...c,
+				source: "explicit"
+			}));
+			item.byline = explicit[0]?.byline ?? null;
+			continue;
+		}
+		const fallback = fallbackByItem.get(item.id);
+		if (fallback) {
+			item.bylines = [{
+				byline: fallback,
+				sortOrder: 0,
+				roleLabel: null,
+				source: "inferred"
+			}];
+			item.byline = fallback;
+			continue;
+		}
+		item.bylines = [];
+		item.byline = null;
+	}
+}
+/**
+* Resolve an identifier (ID or slug) to a real content ID.
+* Returns the ID if found, null if not found.
+* When locale is provided, slug lookups are scoped to that locale.
+*/
+async function resolveId(repo, collection, identifier, locale) {
+	return (await repo.findByIdOrSlug(collection, identifier, locale ? resolveConfiguredLocale(locale) : void 0))?.id ?? null;
+}
+/**
+* Resolve an identifier (ID or slug) to a real content ID,
+* including trashed (soft-deleted) items.
+*/
+async function resolveIdIncludingTrashed(repo, collection, identifier, locale) {
+	return (await repo.findByIdOrSlugIncludingTrashed(collection, identifier, locale ? resolveConfiguredLocale(locale) : void 0))?.id ?? null;
+}
+/**
+* Resolve the columns a content-list search should match against. Always
+* includes `slug` (a standard column), adds the configured `titleField` plus
+* the `title`/`name` display fields when the collection actually defines them,
+* mirroring the admin's item-title resolution (titleField -> title -> name ->
+* slug), and includes every field explicitly marked searchable. Returning only
+* schema-backed columns avoids "no such column" errors.
+*/
+async function resolveSearchColumns(db, collection) {
+	const row = await db.selectFrom("_emdash_collections").select(["id", "title_field"]).where("slug", "=", collection).executeTakeFirst();
+	if (!row) return ["slug"];
+	const fields = await db.selectFrom("_emdash_fields").select(["slug", "searchable"]).where("collection_id", "=", row.id).orderBy("sort_order", "asc").execute();
+	const columns = new Set(["slug"]);
+	const fieldSlugs = new Set(fields.map((f) => f.slug));
+	if (row.title_field && fieldSlugs.has(row.title_field)) columns.add(row.title_field);
+	for (const candidate of ["title", "name"]) if (fieldSlugs.has(candidate)) columns.add(candidate);
+	for (const field of fields) if (field.searchable === 1) columns.add(field.slug);
+	return [...columns];
+}
+/**
+* The keys of `data` that name a storage-less field — a reference field bound
+* to a relation, whose selection lives in the edge table and reaches the API
+* under the separate `references` key.
+*
+* A reference field with no relation still owns its column, so its value in
+* `data` is exactly where it belongs and is not returned here.
+*/
+async function storagelessDataKeys(db, collection, data) {
+	const collectionRow = await db.selectFrom("_emdash_collections").select("id").where("slug", "=", collection).executeTakeFirst();
+	if (!collectionRow) return [];
+	const fields = await db.selectFrom("_emdash_fields").select([
+		"slug",
+		"type",
+		"validation"
+	]).where("collection_id", "=", collectionRow.id).execute();
+	const storageless = new Set(fields.filter(isStoragelessFieldRow).map((f) => f.slug));
+	if (storageless.size === 0) return [];
+	return Object.keys(data).filter((key) => storageless.has(key));
+}
+/**
+* Refuse a `data` payload that tries to set a storage-less field.
+*
+* Such a key would otherwise reach the column writer and throw "no such
+* column". Dropping it instead is worse than refusing it: a client that can
+* only write `data` would be told its write succeeded while nothing was linked.
+* On a collection that keeps drafts the key never reaches the column writer at
+* all — it is merged into the draft revision's JSON — so the runtime applies
+* this before staging rather than leaving it to the write below.
+*/
+function storagelessDataKeyError(keys) {
+	return {
+		success: false,
+		error: {
+			code: "VALIDATION_ERROR",
+			message: `Reference fields bound to a relation are set through 'references', not 'data': ${keys.join(", ")}`
+		}
+	};
+}
+/**
+* The storage-less keys in `data` that an update is actually trying to change.
+*
+* A field bound to a relation after its column existed keeps that column, and
+* every read hands the value frozen in it back under the field's own slug. A
+* read-then-write client — the admin editor among them — therefore echoes a key
+* it never touched, and refusing that would make such an entry unsaveable. An
+* echo asks for nothing; a different value is an attempt to set a selection
+* through the one channel that cannot carry it.
+*
+* A key the entry does not store counts as changed, which is every key of a
+* field that never had a column: there is nothing for such a payload to be
+* echoing, and letting it through would reach the column writer.
+*/
+function changedStoragelessDataKeys(storageless, data, stored) {
+	return Object.keys(data).filter((key) => storageless.has(key) && (!Object.hasOwn(stored, key) || JSON.stringify(data[key]) !== JSON.stringify(stored[key])));
+}
+/**
+* Decide whether the content-list `q` filter can be served from the
+* collection's FTS5 index instead of a full-scan substring LIKE (#1517).
+*
+* Requires SQLite (FTS5 is SQLite-only), search enabled on the collection,
+* every non-slug display column present in the searchable-field set (or the
+* index would miss matches the LIKE finds), and the index table actually
+* existing.
+*/
+async function canUseFtsForListFilter(db, collection, searchColumns) {
+	if (!isSqlite(db)) return false;
+	const ftsManager = new FTSManager(db);
+	if (!(await ftsManager.getSearchConfig(collection))?.enabled) return false;
+	const searchable = new Set(await ftsManager.getSearchableFields(collection));
+	if (!searchColumns.every((col) => col === "slug" || searchable.has(col))) return false;
+	return ftsManager.ftsTableExists(collection);
+}
+/**
+* Create a 301 auto-redirect from an entry's old URL to its new one after a
+* slug change, using the collection's URL pattern. Shared by
+* handleContentUpdate (direct slug edits) and handleContentPublish (slug edits
+* staged as `_slug` in a draft revision, which only land on publish).
+*/
+async function createSlugChangeRedirect(db, collection, oldSlug, newSlug, contentId, oldPublishedAt, newPublishedAt) {
+	if (await slugStillTaken(db, collection, oldSlug, contentId)) return;
+	const collectionRow = await db.selectFrom("_emdash_collections").select("url_pattern").where("slug", "=", collection).executeTakeFirst();
+	await new RedirectRepository(db).createAutoRedirect(collection, oldSlug, newSlug, contentId, collectionRow?.url_pattern ?? null, oldPublishedAt, newPublishedAt);
+	invalidateRedirectCache();
+}
+/** Whether a row other than `contentId` still holds `slug` in this collection. */
+async function slugStillTaken(db, collection, slug, contentId) {
+	validateIdentifier(collection, "collection slug");
+	return (await sql`
+		SELECT id FROM ${sql.ref(`ec_${collection}`)}
+		WHERE slug = ${slug}
+		AND id != ${contentId}
+		AND deleted_at IS NULL
+		LIMIT 1
+	`.execute(db)).rows.length > 0;
+}
+/** Matches a date-only `YYYY-MM-DD` bound (no time component). */
+const DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
+/**
+* Normalize a date-range bound to an ISO datetime for lexicographic comparison
+* against stored ISO 8601 timestamps. A bare `YYYY-MM-DD` is widened to the
+* appropriate UTC day boundary so the range stays inclusive: a `start` bound
+* becomes the start of the day and an `end` bound the end of the day.
+* Otherwise a date-only upper bound would exclude every same-day row (since
+* `2024-06-01T12:00:00Z` sorts after `2024-06-01`). Full datetimes pass
+* through unchanged.
+*/
+function normalizeDateBound(value, edge) {
+	if (!value) return void 0;
+	if (!DATE_ONLY_RE.test(value)) return new Date(value).toISOString();
+	return edge === "start" ? `${value}T00:00:00.000Z` : `${value}T23:59:59.999Z`;
+}
+/**
+* Build the repository's byline filter from the wire params.
+*
+* `locale` is the locale the list is scoped to, which is the locale an
+* inferred credit has to resolve at — the admin list is always scoped to the
+* locale picked in its switcher.
+*/
+function resolveBylineFilter(params, locale) {
+	const includeInferred = params.includeInferredBylines === true;
+	if (params.bylinesNone) return {
+		mode: "none",
+		includeInferred,
+		locale
+	};
+	const bylineIds = params.bylines ?? [];
+	if (bylineIds.length === 0) return void 0;
+	return {
+		mode: "any",
+		bylineIds,
+		includeInferred,
+		locale
+	};
+}
+/**
+* Create content list handler
+*/
+async function handleContentList(db, collection, params) {
+	try {
+		const repo = new ContentRepository(db);
+		const where = {};
+		if (params.status) where.status = params.status;
+		const locale = params.locale ? resolveConfiguredLocale(params.locale) : void 0;
+		if (locale) where.locale = locale;
+		if (params.authorId) where.authorId = params.authorId;
+		if (params.fieldFilters && Object.keys(params.fieldFilters).length > 0) where.fieldFilters = params.fieldFilters;
+		const bylineFilter = resolveBylineFilter(params, locale);
+		if (bylineFilter) where.bylineFilter = bylineFilter;
+		if (params.dateField && (params.dateFrom || params.dateTo)) where.dateFilter = {
+			field: params.dateField,
+			from: normalizeDateBound(params.dateFrom, "start"),
+			to: normalizeDateBound(params.dateTo, "end")
+		};
+		const q = params.q?.trim();
+		if (q) {
+			where.q = q;
+			where.searchColumns = await resolveSearchColumns(db, collection);
+			where.useFts = await canUseFtsForListFilter(db, collection, where.searchColumns);
+		}
+		let sortableExtras;
+		if (params.orderBy && !isSystemOrderField(params.orderBy)) {
+			const coll = await db.selectFrom("_emdash_collections").select(["title_field", "date_field"]).where("slug", "=", collection).executeTakeFirst();
+			sortableExtras = [coll?.title_field, coll?.date_field].filter((slug) => !!slug);
+		}
+		const result = await repo.findMany(collection, {
+			cursor: params.cursor,
+			limit: params.limit || 50,
+			where: Object.keys(where).length > 0 ? where : void 0,
+			orderBy: params.orderBy ? {
+				field: params.orderBy,
+				direction: params.order || "desc"
+			} : void 0,
+			sortableExtras
+		});
+		const hasSeo = await collectionHasSeo(db, collection);
+		await hydrateSeoMany(db, collection, result.items, hasSeo);
+		await hydrateBylinesMany(db, collection, result.items);
+		return {
+			success: true,
+			data: {
+				items: result.items,
+				nextCursor: result.nextCursor,
+				total: result.total
+			}
+		};
+	} catch (error) {
+		if (error instanceof InvalidCursorError) return {
+			success: false,
+			error: {
+				code: "INVALID_CURSOR",
+				message: error.message
+			}
+		};
+		if (error instanceof ContentCollectionNotFoundError || isMissingTableError(error)) return {
+			success: false,
+			error: {
+				code: "COLLECTION_NOT_FOUND",
+				message: `Collection '${collection}' not found`
+			}
+		};
+		if (isMissingColumnError(error, "deleted_at")) return {
+			success: false,
+			error: {
+				code: "COLLECTION_SCHEMA_MISMATCH",
+				message: `Collection '${collection}' backing table is missing the 'deleted_at' column`
+			}
+		};
+		if (error instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: error.message
+			}
+		};
+		console.error("Content list error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_LIST_ERROR",
+				message: "Failed to list content"
+			}
+		};
+	}
+}
+/**
+* List the distinct authors of a collection's live content.
+*
+* Backs the admin content-list author filter. Unlike `/admin/users` (ADMIN
+* only), this is gated on `content:read`, so any editor can filter by author.
+* Returns only users who have authored at least one non-trashed entry, sorted
+* by display name then email for a stable dropdown order.
+*/
+async function handleContentAuthors(db, collection) {
+	try {
+		const authorIds = await new ContentRepository(db).findDistinctAuthorIds(collection);
+		if (authorIds.length === 0) return {
+			success: true,
+			data: { items: [] }
+		};
+		return {
+			success: true,
+			data: { items: (await new UserRepository(db).findByIds(authorIds)).map((u) => ({
+				id: u.id,
+				name: u.name,
+				email: u.email,
+				avatarUrl: u.avatarUrl
+			})).toSorted((a, b) => (a.name ?? a.email).localeCompare(b.name ?? b.email)) }
+		};
+	} catch (error) {
+		if (isMissingTableError(error)) return {
+			success: false,
+			error: {
+				code: "COLLECTION_NOT_FOUND",
+				message: `Collection '${collection}' not found`
+			}
+		};
+		console.error("Content authors error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_AUTHORS_ERROR",
+				message: "Failed to list content authors"
+			}
+		};
+	}
+}
+/**
+* Get single content item
+*/
+async function handleContentGet(db, collection, id, locale, referenceOptions) {
+	try {
+		const item = await new ContentRepository(db).findByIdOrSlug(collection, id, locale ? resolveConfiguredLocale(locale) : void 0);
+		if (!item) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Content item not found: ${id}`
+			}
+		};
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		await hydrateBylines(db, collection, item);
+		if (referenceOptions) await hydrateReferences(db, collection, item, referenceOptions.includeDrafts);
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		console.error("Content get error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_GET_ERROR",
+				message: "Failed to get content"
+			}
+		};
+	}
+}
+/**
+* Get a content item by id, including trashed items.
+* Used by restore endpoint for ownership checks on soft-deleted items.
+*/
+async function handleContentGetIncludingTrashed(db, collection, id, locale) {
+	try {
+		const item = await new ContentRepository(db).findByIdOrSlugIncludingTrashed(collection, id, locale ? resolveConfiguredLocale(locale) : void 0);
+		if (!item) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Content item not found: ${id}`
+			}
+		};
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		await hydrateBylines(db, collection, item);
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		console.error("Content get error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_GET_ERROR",
+				message: "Failed to get content"
+			}
+		};
+	}
+}
+/**
+* Create content item.
+*
+* Content + SEO writes are wrapped in a transaction so either both succeed
+* or neither does. If `body.seo` is provided for a non-SEO collection, the
+* API returns a validation error rather than silently dropping it.
+*/
+async function handleContentCreate(db, collection, body) {
+	try {
+		const hasSeo = await collectionHasSeo(db, collection);
+		if (body.seo && !hasSeo) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: `Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`
+			}
+		};
+		const storagelessKeys = await storagelessDataKeys(db, collection, body.data);
+		if (storagelessKeys.length > 0) return storagelessDataKeyError(storagelessKeys);
+		const mimeCheck = await validateMediaFields(db, collection, body.data);
+		if (!mimeCheck.success) return mimeCheck;
+		const requiredReferences = await validateRequiredReferencesPresent(db, collection, body.references, body.translationOf);
+		if (!requiredReferences.success) return requiredReferences;
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const bylineRepo = new BylineRepository(trx);
+			const inheritedFields = body.translationOf ? (await trx.selectFrom("_emdash_fields as field").innerJoin("_emdash_collections as collection", "collection.id", "field.collection_id").select("field.slug").where("collection.slug", "=", collection).where("field.translatable", "=", 0).execute()).map((field) => field.slug) : [];
+			const referenceWrites = [];
+			if (body.references) {
+				const entryGroup = body.translationOf ? (await repo.findById(collection, body.translationOf))?.translationGroup ?? null : null;
+				for (const [fieldSlug, selectedIds] of Object.entries(body.references)) {
+					const resolved = await resolveReferenceSelectionTargets(trx, collection, fieldSlug, selectedIds, entryGroup);
+					if (!resolved.success) throw Object.assign(new Error(resolved.error.message), { apiError: { code: resolved.error.code } });
+					referenceWrites.push(resolved.data);
+				}
+			}
+			const effectiveLocale = body.locale ? resolveConfiguredLocale(body.locale) : getI18nConfig()?.defaultLocale;
+			let slug = body.slug;
+			if (!slug) {
+				const slugSource = getSlugSource(body.data);
+				if (slugSource) slug = await repo.generateUniqueSlug(collection, slugSource, effectiveLocale);
+			}
+			if (body.status === "published") requireRoutablePublishSlug((await getCollectionPublishConfig(trx, collection)).routable, slug);
+			const created = await repo.create({
+				type: collection,
+				slug,
+				data: body.data,
+				status: body.status || "draft",
+				authorId: body.authorId,
+				locale: effectiveLocale,
+				translationOf: body.translationOf,
+				inheritFields: inheritedFields,
+				createdAt: body.createdAt,
+				publishedAt: body.publishedAt
+			});
+			if (body.bylines !== void 0) created.primaryBylineId = (await bylineRepo.setContentBylines(collection, created.id, body.bylines))[0]?.byline.translationGroup ?? null;
+			if (body.translationOf) {
+				if (body.bylines === void 0) {
+					await bylineRepo.copyContentBylines(collection, body.translationOf, created.id);
+					const source = await repo.findById(collection, body.translationOf);
+					if (source) created.primaryBylineId = source.primaryBylineId;
+				}
+			}
+			await hydrateBylines(trx, collection, created);
+			if (body.seo && hasSeo) created.seo = await new SeoRepository(trx).upsert(collection, created.id, body.seo);
+			else if (hasSeo) created.seo = { ...SEO_DEFAULTS };
+			if (body.taxonomies) await assignTaxonomies(trx, collection, created.id, effectiveLocale, body.taxonomies);
+			if (created.translationGroup) for (const write of referenceWrites) await writeReferenceSelection(trx, {
+				...write,
+				entryGroup: created.translationGroup
+			});
+			return created;
+		});
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (hasApiError(error)) return {
+			success: false,
+			error: {
+				code: error.apiError.code,
+				message: error.message
+			}
+		};
+		if (isMissingTableError(error)) return {
+			success: false,
+			error: {
+				code: "COLLECTION_NOT_FOUND",
+				message: `Collection '${collection}' not found`
+			}
+		};
+		if (error instanceof EmDashValidationError) {
+			if (error.message === "Translation source content not found") return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: error.message
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: error.message
+				}
+			};
+		}
+		const message = error instanceof Error ? error.message.toLowerCase() : "";
+		if (message.includes("unique constraint failed") || message.includes("duplicate key")) {
+			if (message.includes("active_tg_locale") || message.includes("translation_group") && message.includes("locale")) return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: `Translation already exists in locale "${body.locale ?? getI18nConfig()?.defaultLocale ?? "en"}" for this content item`
+				}
+			};
+			if (message.includes("slug")) return {
+				success: false,
+				error: {
+					code: "SLUG_CONFLICT",
+					message: `Slug '${body.slug ?? "(auto-generated)"}' already exists in collection '${collection}'`
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: "Unique constraint violation"
+				}
+			};
+		}
+		console.error("Content create error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_CREATE_ERROR",
+				message: "Failed to create content"
+			}
+		};
+	}
+}
+/**
+* Update content item.
+* If `_rev` is provided, validates it against the current version before writing.
+* No `_rev` = blind write (backwards-compatible for admin UI).
+*
+* Content + SEO writes are wrapped in a transaction for atomicity.
+*/
+async function handleContentUpdate(db, collection, id, body) {
+	try {
+		const hasSeo = await collectionHasSeo(db, collection);
+		if (body.seo && !hasSeo) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: `Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`
+			}
+		};
+		if (body.data) {
+			const mimeCheck = await validateMediaFields(db, collection, body.data);
+			if (!mimeCheck.success) return mimeCheck;
+		}
+		const repo = new ContentRepository(db);
+		const resolvedId = await resolveId(repo, collection, id, body.locale) ?? id;
+		if (body.data) {
+			const storagelessKeys = await storagelessDataKeys(db, collection, body.data);
+			if (storagelessKeys.length > 0) {
+				const stored = await repo.findById(collection, resolvedId);
+				const changed = changedStoragelessDataKeys(new Set(storagelessKeys), body.data, stored?.data ?? {});
+				if (changed.length > 0) return storagelessDataKeyError(changed);
+			}
+		}
+		const item = await withTransaction(db, async (trx) => {
+			const trxRepo = new ContentRepository(trx);
+			const bylineRepo = new BylineRepository(trx);
+			const existing = body._rev || body.slug !== void 0 || body.status === "published" ? await trxRepo.findById(collection, resolvedId) : null;
+			if (body._rev) {
+				if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`Content item not found: ${id}`), { apiError: { code: "NOT_FOUND" } });
+				const revCheck = validateRev(body._rev, existing);
+				if (!revCheck.valid) throw Object.assign(new Error(revCheck.message), { apiError: { code: "CONFLICT" } });
+			}
+			let oldSlug;
+			if (body.slug && existing?.slug && existing.slug !== body.slug) oldSlug = existing.slug;
+			if ((body.status ?? existing?.status) === "published") {
+				if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`Content item not found: ${id}`), { apiError: { code: "NOT_FOUND" } });
+				const publishConfig = await getCollectionPublishConfig(trx, collection);
+				const intendedSlug = body.slug !== void 0 ? body.slug : existing.slug;
+				requireRoutablePublishSlug(publishConfig.routable, intendedSlug);
+			}
+			const referenceWrites = [];
+			if (body.references) for (const [fieldSlug, selectedIds] of Object.entries(body.references)) {
+				const resolved = await resolveReferenceSelection(trx, collection, resolvedId, fieldSlug, selectedIds);
+				if (!resolved.success) throw Object.assign(new Error(resolved.error.message), { apiError: { code: resolved.error.code } });
+				referenceWrites.push(resolved.data);
+			}
+			const updated = await trxRepo.update(collection, resolvedId, {
+				data: body.data,
+				slug: body.slug,
+				status: body.status,
+				authorId: body.authorId,
+				publishedAt: body.publishedAt
+			});
+			if (body.bylines !== void 0) updated.primaryBylineId = (await bylineRepo.setContentBylines(collection, resolvedId, body.bylines))[0]?.byline.translationGroup ?? null;
+			if (oldSlug && body.slug) await createSlugChangeRedirect(trx, collection, oldSlug, body.slug, resolvedId, existing?.publishedAt ?? null, updated.publishedAt ?? null);
+			if (isI18nEnabled() && body.data && updated.translationGroup) await trxRepo.syncNonTranslatableFields(collection, updated.id, updated.translationGroup, body.data);
+			if (body.seo && hasSeo) updated.seo = await new SeoRepository(trx).upsert(collection, resolvedId, body.seo);
+			else if (hasSeo) updated.seo = await new SeoRepository(trx).get(collection, resolvedId);
+			await hydrateBylines(trx, collection, updated);
+			if (body.taxonomies) await assignTaxonomies(trx, collection, resolvedId, updated.locale ?? body.locale, body.taxonomies);
+			for (const write of referenceWrites) await writeReferenceSelection(trx, write);
+			return updated;
+		});
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (hasApiError(error)) return {
+			success: false,
+			error: {
+				code: error.apiError.code,
+				message: error.message
+			}
+		};
+		if (isMissingTableError(error)) return {
+			success: false,
+			error: {
+				code: "COLLECTION_NOT_FOUND",
+				message: `Collection '${collection}' not found`
+			}
+		};
+		if (error instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: error.message
+			}
+		};
+		const message = error instanceof Error ? error.message.toLowerCase() : "";
+		if (message.includes("unique constraint failed") || message.includes("duplicate key")) {
+			if (message.includes("slug")) return {
+				success: false,
+				error: {
+					code: "SLUG_CONFLICT",
+					message: `Slug '${body.slug ?? id}' already exists in collection '${collection}'`
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: "Unique constraint violation"
+				}
+			};
+		}
+		console.error("Content update error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_UPDATE_ERROR",
+				message: "Failed to update content"
+			}
+		};
+	}
+}
+/**
+* Duplicate content item.
+*
+* Only copies SEO data if the collection has SEO enabled.
+* Always returns consistent `seo` shape for SEO-enabled collections.
+*/
+async function handleContentDuplicate(db, collection, id, authorId) {
+	try {
+		const hasSeo = await collectionHasSeo(db, collection);
+		return {
+			success: true,
+			data: { item: await withTransaction(db, async (trx) => {
+				const repo = new ContentRepository(trx);
+				const bylineRepo = new BylineRepository(trx);
+				const resolvedId = await resolveId(repo, collection, id) ?? id;
+				const original = await repo.findById(collection, resolvedId);
+				const dup = await repo.duplicate(collection, resolvedId, authorId);
+				if (original?.translationGroup && dup.translationGroup) {
+					const relations = new RelationRepository(trx);
+					throwIfReferenceLimitRefused(await relations.copyParentEdges(original.translationGroup, dup.translationGroup), "parent");
+					for (const field of (await referenceFieldConstraints(trx, collection)).values()) {
+						if (field.relationSide !== "child") continue;
+						const parents = await relations.getParents(field.relation, original.translationGroup);
+						if (parents.length === 0) continue;
+						throwIfReferenceLimitRefused(await relations.setParents(field.relation, dup.translationGroup, parents.map((parent) => parent.parentGroup)), "child");
+					}
+				}
+				const existingBylines = await bylineRepo.getContentBylines(collection, resolvedId);
+				if (existingBylines.length > 0) await bylineRepo.setContentBylines(collection, dup.id, existingBylines.map((entry) => ({
+					bylineId: entry.byline.id,
+					roleLabel: entry.roleLabel
+				})));
+				if (hasSeo) {
+					const seoRepo = new SeoRepository(trx);
+					await seoRepo.copyForDuplicate(collection, resolvedId, dup.id);
+					dup.seo = await seoRepo.get(collection, dup.id);
+				}
+				await hydrateBylines(trx, collection, dup);
+				return dup;
+			}) }
+		};
+	} catch (err) {
+		if (err instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: err.message
+			}
+		};
+		if (hasApiError(err)) return {
+			success: false,
+			error: {
+				code: err.apiError.code,
+				message: err.message
+			}
+		};
+		console.error("Content duplicate error:", err);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_DUPLICATE_ERROR",
+				message: "Failed to duplicate content"
+			}
+		};
+	}
+}
+/**
+* Delete content item (soft delete - moves to trash)
+*/
+async function handleContentDelete(db, collection, id) {
+	try {
+		const result = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const resolvedId = await resolveId(repo, collection, id) ?? id;
+			const deleted = await repo.delete(collection, resolvedId);
+			if (deleted) await new EntryLockRepository(trx).releaseEntry(collection, resolvedId);
+			return {
+				id: resolvedId,
+				deleted
+			};
+		});
+		if (!result.deleted) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Content item not found: ${id}`
+			}
+		};
+		return {
+			success: true,
+			data: {
+				deleted: true,
+				id: result.id
+			}
+		};
+	} catch (error) {
+		console.error("Content delete error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_DELETE_ERROR",
+				message: "Failed to delete content"
+			}
+		};
+	}
+}
+/**
+* Restore content item from trash
+*/
+async function handleContentRestore(db, collection, id, options = {}) {
+	try {
+		const expectedRevision = decodeRevisionPrecondition(options._rev);
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const resolvedId = await resolveIdIncludingTrashed(repo, collection, id) ?? id;
+			return repo.restore(collection, resolvedId, expectedRevision);
+		});
+		if (!item) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Trashed content item not found: ${id}`
+			}
+		};
+		return {
+			success: true,
+			data: {
+				restored: true,
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		if (isTranslationLocaleConflict(error, collection)) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: "An active translation already exists in this locale"
+			}
+		};
+		console.error("Content restore error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_RESTORE_ERROR",
+				message: "Failed to restore content"
+			}
+		};
+	}
+}
+/**
+* Permanently delete content item (cannot be undone).
+* Also cleans up associated SEO data.
+*/
+async function handleContentPermanentDelete(db, collection, id) {
+	try {
+		const resolvedId = await resolveIdIncludingTrashed(new ContentRepository(db), collection, id) ?? id;
+		if (!await withTransaction(db, async (trx) => {
+			const trxRepo = new ContentRepository(trx);
+			const item = await trxRepo.findByIdIncludingTrashed(collection, resolvedId);
+			if (!item || item.deletedAt === null) return false;
+			const lastOfGroup = item.translationGroup !== null ? !await trxRepo.hasTranslationsIncludingTrashed(collection, item.translationGroup, { excludeId: resolvedId }) : false;
+			if (lastOfGroup && item.translationGroup) await new RelationRepository(trx).clearReferencesForGroup(item.translationGroup);
+			const wasDeleted = await trxRepo.permanentDelete(collection, resolvedId);
+			if (wasDeleted) {
+				await new SeoRepository(trx).delete(collection, resolvedId);
+				await new CommentRepository(trx).deleteByContent(collection, resolvedId);
+				await new RevisionRepository(trx).deleteByEntry(collection, resolvedId);
+				await new EntryLockRepository(trx).releaseEntry(collection, resolvedId);
+				await new BylineRepository(trx).deleteContentBylines(collection, resolvedId);
+				if (lastOfGroup && item.translationGroup) await new TaxonomyRepository(trx).clearEntryGroupTerms(collection, item.translationGroup);
+			}
+			return wasDeleted;
+		})) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Content item not found: ${id}`
+			}
+		};
+		return {
+			success: true,
+			data: {
+				deleted: true,
+				id: resolvedId
+			}
+		};
+	} catch (error) {
+		console.error("Content permanent delete error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_DELETE_ERROR",
+				message: "Failed to permanently delete content"
+			}
+		};
+	}
+}
+/**
+* List trashed content items
+*/
+async function handleContentListTrashed(db, collection, options = {}) {
+	try {
+		const result = await new ContentRepository(db).findTrashed(collection, {
+			limit: options.limit,
+			cursor: options.cursor,
+			where: { locale: options.locale }
+		});
+		return {
+			success: true,
+			data: {
+				items: result.items.map((item) => ({
+					id: item.id,
+					type: item.type,
+					slug: item.slug,
+					status: item.status,
+					locale: item.locale,
+					translationGroup: item.translationGroup,
+					data: item.data,
+					authorId: item.authorId,
+					createdAt: item.createdAt,
+					updatedAt: item.updatedAt,
+					publishedAt: item.publishedAt,
+					deletedAt: item.deletedAt
+				})),
+				nextCursor: result.nextCursor
+			}
+		};
+	} catch (error) {
+		if (error instanceof InvalidCursorError) return {
+			success: false,
+			error: {
+				code: "INVALID_CURSOR",
+				message: error.message
+			}
+		};
+		console.error("Content list trashed error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_LIST_ERROR",
+				message: "Failed to list trashed content"
+			}
+		};
+	}
+}
+/**
+* Count trashed content items
+*/
+async function handleContentCountTrashed(db, collection, options = {}) {
+	try {
+		return {
+			success: true,
+			data: { count: await new ContentRepository(db).countTrashed(collection, { locale: options.locale }) }
+		};
+	} catch (error) {
+		console.error("Content count trashed error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_COUNT_ERROR",
+				message: "Failed to count trashed content"
+			}
+		};
+	}
+}
+/**
+* Schedule content for future publishing
+*/
+async function handleContentSchedule(db, collection, id, scheduledAt, currentTime = /* @__PURE__ */ new Date(), _rev) {
+	try {
+		const expectedRevision = decodeRevisionPrecondition(_rev);
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const existing = await repo.findByIdOrSlug(collection, id);
+			const resolvedId = existing?.id ?? id;
+			if (existing) requireRoutablePublishSlug((await getCollectionPublishConfig(trx, collection)).routable, existing.slug);
+			return repo.schedule(collection, resolvedId, scheduledAt, currentTime, expectedRevision);
+		});
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		if (error instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: error.message
+			}
+		};
+		console.error("Content schedule error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_SCHEDULE_ERROR",
+				message: "Failed to schedule content"
+			}
+		};
+	}
+}
+/**
+* Unschedule content (revert to draft)
+*/
+async function handleContentUnschedule(db, collection, id, options = {}) {
+	try {
+		const expectedRevision = decodeRevisionPrecondition(options._rev);
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const resolvedId = await resolveId(repo, collection, id) ?? id;
+			return repo.unschedule(collection, resolvedId, expectedRevision);
+		});
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		if (error instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: error.message
+			}
+		};
+		console.error("Content unschedule error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_UNSCHEDULE_ERROR",
+				message: "Failed to unschedule content"
+			}
+		};
+	}
+}
+/**
+* Persist a permanent policy rejection and unschedule the publication.
+* Databases with transactions commit both writes together. D1 persists the
+* reason first so a failed option write cannot silently remove the entry from
+* future sweeps; if unscheduling then fails, the due entry and its dashboard
+* notice remain available for retry and operator action.
+*/
+async function handleScheduledPolicyRejection(db, collection, id, options) {
+	try {
+		const expectedRevision = decodeRevisionPrecondition(options._rev);
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const resolvedId = await resolveId(repo, collection, id) ?? id;
+			const optionsRepo = new OptionsRepository(trx);
+			const rejectionKey = scheduledPolicyRejectionKey(collection, resolvedId);
+			const rejectionRevision = await optionsRepo.setVersioned(rejectionKey, {
+				...options.rejection,
+				id: resolvedId
+			});
+			try {
+				return await repo.unschedule(collection, resolvedId, expectedRevision);
+			} catch (error) {
+				if (error instanceof ContentMutationConflictError) try {
+					await optionsRepo.compareAndDelete(rejectionKey, rejectionRevision);
+				} catch (cleanupError) {
+					console.error("Failed to clear stale scheduled policy rejection:", cleanupError);
+				}
+				throw error;
+			}
+		});
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		if (error instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: error.message
+			}
+		};
+		console.error("Scheduled policy rejection error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_UNSCHEDULE_ERROR",
+				message: "Failed to record scheduled publication rejection"
+			}
+		};
+	}
+}
+/**
+* Publish content immediately.
+*
+* Publication is one atomic content-row statement. On databases that support
+* transactions, the slug redirect and the locale sync stay grouped with it.
+*/
+async function handleContentPublish(db, collection, id, options = {}) {
+	try {
+		const expectedRevision = decodeRevisionPrecondition(options._rev);
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const resolvedId = await resolveId(repo, collection, id) ?? id;
+			const publishConfig = await getCollectionPublishConfig(trx, collection);
+			const existing = await repo.findById(collection, resolvedId);
+			const draftRevision = publishConfig.supportsRevisions && existing?.draftRevisionId ? await new RevisionRepository(trx).findById(existing.draftRevisionId) : void 0;
+			const stagedReferences = draftRevision ? readStagedReferences(draftRevision.data) : void 0;
+			const stagedReferenceBaselines = draftRevision ? readStagedReferenceBaselines(draftRevision.data) : void 0;
+			if (existing?.translationGroup) {
+				const valid = await validateStagedReferences(trx, collection, stagedReferences ?? {}, existing.translationGroup, stagedReferenceBaselines);
+				if (!valid.success) throw Object.assign(new Error(valid.error.message), { apiError: { code: valid.error.code } });
+				if (stagedReferences) {
+					await assertPublishWillNotBeRefused(trx, collection, resolvedId, existing, {
+						stagedSlug: readStagedSlug(draftRevision?.data),
+						requireSlug: publishConfig.routable,
+						requireDue: options.requireScheduledDue,
+						expectedScheduledAt: options.expectedScheduledAt,
+						expectedRevision
+					});
+					await applyStagedReferences(trx, collection, existing.translationGroup, stagedReferences, stagedReferenceBaselines);
+				}
+			}
+			const published = await repo.publish(collection, resolvedId, options.publishedAt, options.requireScheduledDue, options.expectedScheduledAt, publishConfig.supportsRevisions, publishConfig.routable, expectedRevision, options.currentTime);
+			if (publishConfig.supportsRevisions && published.liveRevisionId && published.translationGroup) await recordPublishedReferences(trx, collection, published.liveRevisionId, published.translationGroup);
+			if (existing && isI18nEnabled() && publishConfig.supportsRevisions && published.translationGroup) await repo.syncNonTranslatableFields(collection, published.id, published.translationGroup, published.data, { previous: existing.data });
+			if (existing?.status === "published" && existing.slug && published.slug && existing.slug !== published.slug) await createSlugChangeRedirect(trx, collection, existing.slug, published.slug, resolvedId, existing.publishedAt ?? null, published.publishedAt ?? null);
+			return published;
+		});
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (hasApiError(error)) return {
+			success: false,
+			error: {
+				code: error.apiError.code,
+				message: error.message
+			}
+		};
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		if (error instanceof ScheduledNotDueError) return {
+			success: false,
+			error: {
+				code: "NOT_DUE",
+				message: error.message
+			}
+		};
+		if (error instanceof EmDashValidationError) {
+			const details = error.details;
+			return {
+				success: false,
+				error: {
+					code: typeof details === "object" && details !== null && "code" in details && details.code === "SLUG_CONFLICT" ? "SLUG_CONFLICT" : "VALIDATION_ERROR",
+					message: error.message
+				}
+			};
+		}
+		const message = error instanceof Error ? error.message.toLowerCase() : "";
+		if ((message.includes("unique constraint failed") || message.includes("duplicate key")) && message.includes("slug")) return {
+			success: false,
+			error: {
+				code: "SLUG_CONFLICT",
+				message: `The staged slug is already used by another entry in collection '${collection}'`
+			}
+		};
+		console.error("Content publish error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_PUBLISH_ERROR",
+				message: "Failed to publish content"
+			}
+		};
+	}
+}
+/**
+* Unpublish content (revert to draft).
+*
+* Wrapped in a transaction — unpublish may create a draft revision
+* from the live version then update the status, which is multi-step.
+*/
+async function handleContentUnpublish(db, collection, id, options = {}) {
+	try {
+		const expectedRevision = decodeRevisionPrecondition(options._rev);
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const resolvedId = await resolveId(repo, collection, id) ?? id;
+			return repo.unpublish(collection, resolvedId, expectedRevision);
+		});
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		if (error instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "VALIDATION_ERROR",
+				message: error.message
+			}
+		};
+		console.error("Content unpublish error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_UNPUBLISH_ERROR",
+				message: "Failed to unpublish content"
+			}
+		};
+	}
+}
+/**
+* Count scheduled content items
+*/
+async function handleContentCountScheduled(db, collection) {
+	try {
+		return {
+			success: true,
+			data: { count: await new ContentRepository(db).countScheduled(collection) }
+		};
+	} catch (error) {
+		console.error("Content count scheduled error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_COUNT_ERROR",
+				message: "Failed to count scheduled content"
+			}
+		};
+	}
+}
+/**
+* Discard draft changes (revert to live version)
+*/
+async function handleContentDiscardDraft(db, collection, id, options = {}) {
+	try {
+		const expectedRevision = decodeRevisionPrecondition(options._rev);
+		const item = await withTransaction(db, async (trx) => {
+			const repo = new ContentRepository(trx);
+			const resolvedId = await resolveId(repo, collection, id) ?? id;
+			return repo.discardDraft(collection, resolvedId, expectedRevision);
+		});
+		await hydrateSeo(db, collection, item, await collectionHasSeo(db, collection));
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		if (error instanceof EmDashValidationError) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: error.message
+			}
+		};
+		console.error("Content discard draft error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_DISCARD_DRAFT_ERROR",
+				message: "Failed to discard draft"
+			}
+		};
+	}
+}
+/**
+* Compare live and draft revisions
+*/
+async function handleContentCompare(db, collection, id) {
+	try {
+		const entry = await new ContentRepository(db).findByIdOrSlug(collection, id);
+		if (!entry) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Content item not found: ${id}`
+			}
+		};
+		const revisionRepo = new RevisionRepository(db);
+		const live = entry.liveRevisionId ? await revisionRepo.findById(entry.liveRevisionId) : null;
+		const draft = entry.draftRevisionId ? await revisionRepo.findById(entry.draftRevisionId) : null;
+		const liveReferences = entry.translationGroup ? await liveReferenceSelection(db, collection, entry.translationGroup) : {};
+		const withReferences = (revisionData, staged) => {
+			if (!revisionData) return void 0;
+			const selection = {
+				...liveReferences,
+				...staged
+			};
+			if (Object.keys(selection).length === 0) return revisionData;
+			return {
+				...revisionData,
+				[STAGED_REFERENCES_KEY]: selection
+			};
+		};
+		return {
+			success: true,
+			data: {
+				hasChanges: entry.draftRevisionId !== null && entry.draftRevisionId !== entry.liveRevisionId,
+				live: withReferences(live?.data, {}) ?? null,
+				draft: withReferences(draft?.data, readStagedReferences(draft?.data) ?? {}) ?? null
+			}
+		};
+	} catch (error) {
+		console.error("Content compare error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_COMPARE_ERROR",
+				message: "Failed to compare revisions"
+			}
+		};
+	}
+}
+/**
+* Get all translations for a content item.
+* Returns the item's translation group members with locale and status info.
+*/
+async function handleContentTranslations(db, collection, id) {
+	try {
+		const repo = new ContentRepository(db);
+		const item = await repo.findByIdOrSlug(collection, id);
+		if (!item) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Content item not found: ${id}`
+			}
+		};
+		if (!item.translationGroup) return {
+			success: true,
+			data: {
+				translationGroup: item.id,
+				translations: [{
+					id: item.id,
+					locale: item.locale,
+					slug: item.slug,
+					status: item.status,
+					updatedAt: item.updatedAt
+				}]
+			}
+		};
+		const translations = await repo.findTranslations(collection, item.translationGroup);
+		return {
+			success: true,
+			data: {
+				translationGroup: item.translationGroup,
+				translations: translations.map((t) => ({
+					id: t.id,
+					locale: t.locale,
+					slug: t.slug,
+					status: t.status,
+					updatedAt: t.updatedAt
+				}))
+			}
+		};
+	} catch (error) {
+		if (error instanceof Error) console.error("Content translations error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_TRANSLATIONS_ERROR",
+				message: "Failed to get translations"
+			}
+		};
+	}
+}
+/**
+* Resolve a `{ taxonomyName: [slug, ...] }` map to term IDs and replace the
+* entry's assignments for each named taxonomy.
+*
+* Shared by handleContentCreate and handleContentUpdate so both MCP entry
+* points behave identically. Slug resolution is scoped to `locale`; passing
+* `undefined` lets `findBySlug` fall back to its default (lowest locale code)
+* so callers on single-locale sites don't need to know the site's default.
+*
+* Throws EmDashValidationError on unknown slug or wrong shape; the calling
+* handler translates that into a VALIDATION_ERROR response.
+*/
+async function assignTaxonomies(trx, collection, entryId, locale, taxonomies) {
+	const taxRepo = new TaxonomyRepository(trx);
+	let anyChange = false;
+	for (const [taxonomyName, slugs] of Object.entries(taxonomies)) {
+		if (!Array.isArray(slugs)) throw new EmDashValidationError(`taxonomies.${taxonomyName} must be an array of term slugs`);
+		const termIds = [];
+		for (const slug of slugs) {
+			if (typeof slug !== "string" || slug.length === 0) throw new EmDashValidationError(`taxonomies.${taxonomyName} contains a non-string or empty slug`);
+			const term = await taxRepo.findBySlug(taxonomyName, slug, locale);
+			if (!term) throw new EmDashValidationError(`Unknown taxonomy term: ${taxonomyName}='${slug}'${locale ? ` (locale '${locale}')` : ""}`);
+			termIds.push(term.id);
+		}
+		await taxRepo.setTermsForEntry(collection, entryId, taxonomyName, termIds);
+		anyChange = true;
+	}
+	if (anyChange) invalidateTermCache();
+}
+
+//#endregion
+//#region src/api/handlers/manifest.ts
+/** Pattern to add spaces before capital letters */
+const CAMEL_CASE_PATTERN = /([A-Z])/g;
+const FIRST_CHAR_PATTERN = /^./;
+/**
+* Map schema field types to editor field kinds.
+*/
+/** Field types that can be surfaced as list columns in the admin. */
+const LIST_COLUMN_FIELD_TYPES = new Set([
+	"string",
+	"number",
+	"integer",
+	"boolean",
+	"datetime",
+	"select",
+	"multiSelect"
+]);
+const FIELD_TYPE_TO_KIND = {
+	string: "string",
+	slug: "string",
+	url: "url",
+	text: "richText",
+	number: "number",
+	integer: "number",
+	boolean: "boolean",
+	datetime: "datetime",
+	select: "select",
+	multiSelect: "multiSelect",
+	portableText: "portableText",
+	image: "image",
+	file: "file",
+	reference: "reference",
+	json: "json",
+	repeater: "repeater",
+	blocks: "blocks"
+};
+/**
+* Generate admin manifest from collections
+*/
+async function generateManifest(collections, plugins = {}, options = {}) {
+	const manifestCollections = await buildManifestCollections(collections, options.db);
+	return {
+		version: "0.1.0",
+		hash: await hashString(JSON.stringify(manifestCollections)),
+		collections: manifestCollections,
+		plugins
+	};
+}
+/**
+* Build collection descriptors from build-time config plus live database rows.
+*
+* Config collections are added first and win on slug conflicts. Runtime/manual
+* collections have no Zod schema to inspect, so their field descriptors are
+* synthesized from `_emdash_fields`.
+*/
+async function buildManifestCollections(collections, db) {
+	const manifestCollections = {};
+	for (const [name, definition] of Object.entries(collections)) {
+		const fields = extractFieldDescriptors(definition.schema);
+		manifestCollections[name] = {
+			label: definition.admin.label,
+			labelSingular: definition.admin.labelSingular || definition.admin.label,
+			supports: definition.admin.supports || [],
+			hasSeo: (definition.admin.supports || []).includes("seo"),
+			routable: definition.admin.routable ?? true,
+			fields
+		};
+	}
+	if (!db) return manifestCollections;
+	try {
+		const storedCollections = await new SchemaRegistry(db).listCollectionsWithFields();
+		const dbCollections = await Promise.all(storedCollections.map((collection) => expandCollectionBlockFields(db, collection)));
+		const cardinality = await relationCardinality(db, dbCollections);
+		for (const collection of dbCollections) {
+			if (manifestCollections[collection.slug]) continue;
+			const fields = {};
+			for (const field of collection.fields) fields[field.slug] = dbFieldDescriptor(field, cardinality);
+			const configuredListColumns = collection.admin?.listColumns ?? [];
+			const fieldTypes = new Map(collection.fields.map((field) => [field.slug, field.type]));
+			const listColumns = [];
+			for (const slug of configuredListColumns) {
+				if (listColumns.includes(slug)) continue;
+				const fieldType = fieldTypes.get(slug);
+				if (!fieldType || !LIST_COLUMN_FIELD_TYPES.has(fieldType)) {
+					console.warn(`EmDash: Ignoring unsupported or unknown list column "${slug}" in collection "${collection.slug}".`);
+					continue;
+				}
+				if (listColumns.length >= MAX_COLLECTION_LIST_COLUMNS) {
+					console.warn(`EmDash: Collection "${collection.slug}" declares more than ${MAX_COLLECTION_LIST_COLUMNS} list columns; extra columns are ignored.`);
+					break;
+				}
+				listColumns.push(slug);
+			}
+			manifestCollections[collection.slug] = {
+				label: collection.label,
+				labelSingular: collection.labelSingular || collection.label,
+				supports: collection.supports || [],
+				hasSeo: collection.hasSeo,
+				urlPattern: collection.urlPattern,
+				routable: collection.routable !== false,
+				titleField: collection.titleField,
+				dateField: collection.dateField,
+				...collection.hidden ? { hidden: true } : {},
+				...collection.icon ? { icon: collection.icon } : {},
+				...collection.group ? { group: collection.group } : {},
+				...collection.admin?.quickCreate === false ? { quickCreate: false } : {},
+				listColumns: listColumns.length > 0 ? listColumns : void 0,
+				fields
+			};
+		}
+	} catch (error) {
+		console.debug("EmDash: Could not load database collections for manifest:", error);
+	}
+	return manifestCollections;
+}
+/**
+* Extract field descriptors from Zod schema
+* Note: This is a simplified implementation that handles common types
+*/
+function extractFieldDescriptors(schema) {
+	const fields = {};
+	const shape = typeof schema._def?.shape === "function" ? schema._def.shape() : schema.shape || {};
+	for (const [name, fieldSchema] of Object.entries(shape)) fields[name] = extractFieldType(name, fieldSchema);
+	return fields;
+}
+/**
+* Extract field type from Zod schema
+*/
+/** Type guard: check if a value is a non-null object */
+function isObject(value) {
+	return typeof value === "object" && value !== null;
+}
+function extractFieldType(name, schema) {
+	if (!isObject(schema)) return {
+		kind: "string",
+		label: formatLabel(name)
+	};
+	if (schema.isPortableText) return {
+		kind: "portableText",
+		label: formatLabel(name)
+	};
+	if (schema.isImage) return {
+		kind: "image",
+		label: formatLabel(name)
+	};
+	if (schema.isReference) return {
+		kind: "reference",
+		label: formatLabel(name)
+	};
+	const def = isObject(schema._def) ? schema._def : void 0;
+	switch (typeof def?.typeName === "string" ? def.typeName : void 0) {
+		case "ZodString": return {
+			kind: "string",
+			label: formatLabel(name)
+		};
+		case "ZodNumber": return {
+			kind: "number",
+			label: formatLabel(name)
+		};
+		case "ZodBoolean": return {
+			kind: "boolean",
+			label: formatLabel(name)
+		};
+		case "ZodDate": return {
+			kind: "datetime",
+			label: formatLabel(name)
+		};
+		case "ZodEnum": {
+			const values = Array.isArray(def?.values) ? def.values : [];
+			return {
+				kind: "select",
+				label: formatLabel(name),
+				options: values.filter((v) => typeof v === "string").map((v) => ({
+					value: v,
+					label: v.charAt(0).toUpperCase() + v.slice(1)
+				}))
+			};
+		}
+		case "ZodArray": return {
+			kind: "array",
+			label: formatLabel(name)
+		};
+		case "ZodObject": return {
+			kind: "object",
+			label: formatLabel(name)
+		};
+		case "ZodOptional":
+		case "ZodDefault":
+			if (def?.innerType) return extractFieldType(name, def.innerType);
+			return {
+				kind: "string",
+				label: formatLabel(name)
+			};
+		default: return {
+			kind: "string",
+			label: formatLabel(name)
+		};
+	}
+}
+/**
+* The limits of every relation a bound reference field names, by relation slug.
+*
+* Empty when nothing is bound, so a site with no reference fields never issues
+* the query, and empty before migration 086 has created the table.
+*/
+async function relationCardinality(db, collections) {
+	if (!collections.some((collection) => collection.fields.some(isStoragelessField))) return /* @__PURE__ */ new Map();
+	try {
+		const rows = await db.selectFrom("_emdash_relations").select([
+			"slug",
+			"max_children_per_parent",
+			"max_parents_per_child"
+		]).execute();
+		return new Map(rows.map((row) => [row.slug, {
+			maxChildrenPerParent: row.max_children_per_parent,
+			maxParentsPerChild: row.max_parents_per_child
+		}]));
+	} catch (error) {
+		if (isMissingTableError(error)) return /* @__PURE__ */ new Map();
+		throw error;
+	}
+}
+/**
+* Whether the editor may select more than one entry for a bound reference
+* field: the question the relation answers, from the end the field views.
+*
+* `validation.multiple` on the field row is a create-time input — it is what
+* set the relation's limit — and the relation is what the write path enforces.
+* Reading the field back would let the two disagree, which is what happens when
+* a later edit rewrites the row's validation without it.
+*/
+function boundReferenceIsMultiple(validation, cardinality) {
+	return (validation.relationSide === "child" ? cardinality.maxParentsPerChild : cardinality.maxChildrenPerParent) !== 1;
+}
+function dbFieldDescriptor(field, cardinality) {
+	const entry = {
+		kind: field.unsupportedType ? "unsupported" : FIELD_TYPE_TO_KIND[field.type],
+		label: field.label,
+		required: field.required,
+		translatable: field.translatable,
+		id: field.id
+	};
+	if (field.unsupportedType) entry.unsupportedType = field.unsupportedType;
+	if (field.blockTypes) entry.blockTypes = field.blockTypes;
+	if (field.blockTypeFingerprint) entry.blockTypeFingerprint = field.blockTypeFingerprint;
+	if (field.widget) entry.widget = field.widget;
+	if (field.options) entry.options = field.options;
+	if (field.validation?.options) entry.options = field.validation.options.map((value) => ({
+		value,
+		label: value.charAt(0).toUpperCase() + value.slice(1)
+	}));
+	if (field.validation) {
+		const validation = { ...field.validation };
+		if (isStoragelessField(field) && field.validation.relation) {
+			const limits = cardinality.get(field.validation.relation);
+			if (limits) validation.multiple = boundReferenceIsMultiple(field.validation, limits);
+		}
+		entry.validation = validation;
+	}
+	return entry;
+}
+/**
+* Format field name as label
+*/
+function formatLabel(name) {
+	return name.replace(CAMEL_CASE_PATTERN, " $1").replace(FIRST_CHAR_PATTERN, (str) => str.toUpperCase()).trim();
+}
+
+//#endregion
+//#region src/api/handlers/revision.ts
+/**
+* List revisions for a content entry
+*/
+async function handleRevisionList(db, collection, entryId, params = {}) {
+	try {
+		const repo = new RevisionRepository(db);
+		const [items, total] = await Promise.all([repo.findByEntry(collection, entryId, { limit: Math.max(1, Math.min(params.limit || 50, 100)) }), repo.countByEntry(collection, entryId)]);
+		return {
+			success: true,
+			data: {
+				items,
+				total
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "REVISION_LIST_ERROR",
+				message: "Failed to list revisions"
+			}
+		};
+	}
+}
+/**
+* Get a specific revision
+*/
+async function handleRevisionGet(db, revisionId) {
+	try {
+		const item = await new RevisionRepository(db).findById(revisionId);
+		if (!item) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Revision not found: ${revisionId}`
+			}
+		};
+		return {
+			success: true,
+			data: { item }
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "REVISION_GET_ERROR",
+				message: "Failed to get revision"
+			}
+		};
+	}
+}
+/**
+* Restore a revision (updates content to this revision's data and creates new revision)
+*/
+async function handleRevisionRestore(db, revisionId, callerUserId) {
+	try {
+		const revision = await new RevisionRepository(db).findById(revisionId);
+		if (!revision) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Revision not found: ${revisionId}`
+			}
+		};
+		const stagedReferences = readStagedReferences(revision.data);
+		if (stagedReferences) {
+			const entry = await new ContentRepository(db).findById(revision.collection, revision.entryId);
+			if (entry?.translationGroup) {
+				const valid = await validateStagedReferences(db, revision.collection, stagedReferences, entry.translationGroup);
+				if (!valid.success) return valid;
+			}
+		}
+		const restoredData = { ...revision.data };
+		delete restoredData[STAGED_REFERENCES_BASELINE_KEY];
+		const { item, revisionId: queuedRevisionId } = await new ContentRepository(db).restoreRevision(revision.collection, revision.entryId, restoredData, callerUserId);
+		if (stagedReferences && item.translationGroup) await applyStagedReferences(db, revision.collection, item.translationGroup, stagedReferences);
+		const pruneRepo = new RevisionRepository(db);
+		after(async () => {
+			try {
+				await pruneRepo.pruneQueuedEntry(revision.collection, revision.entryId, queuedRevisionId, 50);
+			} catch (error) {
+				console.error(`[revisions] Failed to prune revisions for ${revision.collection}/${revision.entryId}:`, error);
+			}
+		});
+		return {
+			success: true,
+			data: {
+				item,
+				_rev: encodeRev(item)
+			}
+		};
+	} catch (error) {
+		if (error instanceof ContentMutationConflictError) return {
+			success: false,
+			error: {
+				code: "CONFLICT",
+				message: error.message
+			}
+		};
+		return {
+			success: false,
+			error: {
+				code: "REVISION_RESTORE_ERROR",
+				message: "Failed to restore revision"
+			}
+		};
+	}
+}
+
+//#endregion
+//#region src/api/handlers/plugin-settings.ts
+function settingsKey(pluginId, key) {
+	return `plugin:${pluginId}:settings:${key}`;
+}
+/**
+* Resolve a plugin's settings schema from either the configured
+* (in-process) plugin list or the statically-sandboxed entries.
+* Returns null when the plugin doesn't exist, undefined-equivalent
+* empty object when it declares no schema.
+*/
+function getPluginSettingsSchema(configuredPlugins, sandboxedPluginEntries, pluginId) {
+	const plugin = configuredPlugins.find((p) => p.id === pluginId);
+	if (plugin) return plugin.admin.settingsSchema ?? {};
+	const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+	if (sandboxed) return sandboxed.settingsSchema ?? {};
+	return null;
+}
+/**
+* Validate a single value against its schema field.
+* Returns an error message, or null when valid.
+*/
+function validateValue(key, field, value) {
+	switch (field.type) {
+		case "string":
+		case "secret":
+		case "url":
+		case "email":
+			if (typeof value !== "string") return `Setting "${key}" must be a string`;
+			if (field.type === "url" && value !== "" && !URL.canParse(value)) return `Setting "${key}" must be a valid URL`;
+			if (field.type === "email" && value !== "" && !value.includes("@")) return `Setting "${key}" must be a valid email address`;
+			return null;
+		case "number":
+			if (typeof value !== "number" || Number.isNaN(value)) return `Setting "${key}" must be a number`;
+			if (field.min !== void 0 && value < field.min) return `Setting "${key}" must be at least ${field.min}`;
+			if (field.max !== void 0 && value > field.max) return `Setting "${key}" must be at most ${field.max}`;
+			return null;
+		case "boolean": return typeof value === "boolean" ? null : `Setting "${key}" must be a boolean`;
+		case "select":
+			if (typeof value !== "string" || !field.options.some((o) => o.value === value)) return `Setting "${key}" must be one of the defined options`;
+			return null;
+		default: return `Setting "${key}" has an unknown field type`;
+	}
+}
+async function buildSettingsResponse(optionsRepo, pluginId, schema) {
+	const keys = Object.keys(schema);
+	const stored = await optionsRepo.getMany(keys.map((key) => settingsKey(pluginId, key)));
+	const values = {};
+	const secretsSet = {};
+	for (const key of keys) {
+		const field = schema[key];
+		if (!field) continue;
+		const storedValue = stored.get(settingsKey(pluginId, key));
+		if (field.type === "secret") {
+			secretsSet[key] = storedValue !== void 0 && storedValue !== null && storedValue !== "";
+			continue;
+		}
+		if (storedValue !== void 0 && storedValue !== null) values[key] = storedValue;
+		else if ("default" in field && field.default !== void 0) values[key] = field.default;
+		else values[key] = null;
+	}
+	return {
+		schema,
+		values,
+		secretsSet
+	};
+}
+/**
+* Get a plugin's settings (schema + current values, secrets masked)
+*/
+async function handlePluginSettingsGet(db, pluginId, schema) {
+	try {
+		return {
+			success: true,
+			data: await buildSettingsResponse(new OptionsRepository(db), pluginId, schema)
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.PLUGIN_SETTINGS_READ_ERROR,
+				message: "Failed to read plugin settings"
+			}
+		};
+	}
+}
+/**
+* Update a plugin's settings.
+*
+* Only keys present in `updates` are written. A `null` value deletes the
+* stored value (reverting to the schema default). Secret fields are
+* write-only: they accept a new string value or `null` to clear, and the
+* response never echoes them back.
+*/
+async function handlePluginSettingsUpdate(db, pluginId, schema, updates) {
+	try {
+		for (const [key, value] of Object.entries(updates)) {
+			const field = schema[key];
+			if (!field) return {
+				success: false,
+				error: {
+					code: ErrorCode.VALIDATION_ERROR,
+					message: `Unknown setting "${key}" for plugin "${pluginId}"`
+				}
+			};
+			if (value === null) continue;
+			const error = validateValue(key, field, value);
+			if (error) return {
+				success: false,
+				error: {
+					code: ErrorCode.VALIDATION_ERROR,
+					message: error
+				}
+			};
+		}
+		const encodedUpdates = /* @__PURE__ */ new Map();
+		for (const [key, value] of Object.entries(updates)) encodedUpdates.set(key, value === null ? null : await encodePluginSettingValue(pluginId, key, value, schema));
+		return {
+			success: true,
+			data: await withTransaction(db, async (trx) => {
+				const txRepo = new OptionsRepository(trx);
+				for (const [key, value] of encodedUpdates) {
+					if (value === null) await txRepo.delete(settingsKey(pluginId, key));
+					else await txRepo.set(settingsKey(pluginId, key), value);
+					await trx.deleteFrom("_plugin_storage").where("plugin_id", "=", pluginId).where("collection", "=", "__kv").where("id", "=", `settings:${key}`).execute();
+				}
+				return buildSettingsResponse(txRepo, pluginId, schema);
+			})
+		};
+	} catch (error) {
+		if (error instanceof PluginSettingEncryptionError) return {
+			success: false,
+			error: {
+				code: error.code,
+				message: error.message
+			}
+		};
+		if (error instanceof EmDashSecretsError) return {
+			success: false,
+			error: {
+				code: ErrorCode.PLUGIN_SETTING_ENCRYPTION_KEY_INVALID,
+				message: "EMDASH_ENCRYPTION_KEY is malformed. Restore or correct the configured key from its secret backup. Generate a new key only if no stored plugin setting depends on the lost key."
+			}
+		};
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.PLUGIN_SETTINGS_UPDATE_ERROR,
+				message: "Failed to update plugin settings"
+			}
+		};
+	}
+}
+
+//#endregion
+//#region src/plugins/storage-indexes.ts
+/**
+* Generate a deterministic index name.
+* Unique indexes use a `uidx_` prefix to avoid collisions with regular indexes on the same fields.
+*/
+function generateIndexName(pluginId, collection, fields, options) {
+	return `${options?.unique ? "uidx" : "idx"}_plugin_${pluginId}_${collection}_${fields.join("_")}`.substring(0, 128);
+}
+/**
+* Generate a Kysely sql expression for creating an expression index.
+*
+* Validates all inputs before interpolation. The collection uses the
+* permissive manifest-key rules rather than SQL-identifier rules — it is
+* stored as opaque text and only reaches SQL inside the generated index
+* name — so kebab-case collections index like any other.
+*/
+function generateCreateIndexSql(db, pluginId, collection, fields, options) {
+	validatePluginIdentifier(pluginId, "plugin ID");
+	validateStorageCollectionName(collection, "collection name");
+	for (const field of fields) validateJsonFieldName(field, "index field name");
+	const indexName = generateIndexName(pluginId, collection, fields, options);
+	const expressions = fields.map((field) => {
+		if (isPostgres(db)) return `(${jsonExtractExpr(db, "data", field)})`;
+		return jsonExtractExpr(db, "data", field);
+	}).join(", ");
+	const createKeyword = options?.unique ? "CREATE UNIQUE INDEX" : "CREATE INDEX";
+	return sql`${sql.raw(createKeyword)} IF NOT EXISTS ${sql.ref(indexName)}
+		ON _plugin_storage(plugin_id, collection, ${sql.raw(expressions)})
+	`;
+}
+/**
+* Generate a Kysely sql expression for dropping an index.
+*
+* Uses sql.ref() for safe identifier quoting.
+*/
+function generateDropIndexSql(indexName) {
+	return sql`DROP INDEX IF EXISTS ${sql.ref(indexName)}`;
+}
+/**
+* Normalize index declarations to arrays of field arrays
+*/
+function normalizeIndexes(indexes) {
+	return indexes.map((index) => Array.isArray(index) ? index : [index]);
+}
+/**
+* Create all declared indexes for a plugin collection
+*/
+async function createStorageIndexes(db, pluginId, collection, indexes, options) {
+	const normalized = normalizeIndexes(indexes);
+	const uniqueNormalized = options?.uniqueIndexes ? normalizeIndexes(options.uniqueIndexes) : [];
+	const uniqueSet = new Set(uniqueNormalized.map((f) => f.join(",")));
+	const allEntries = [...normalized.filter((f) => !uniqueSet.has(f.join(","))).map((fields) => ({
+		fields,
+		unique: false
+	})), ...uniqueNormalized.map((fields) => ({
+		fields,
+		unique: true
+	}))];
+	const created = [];
+	const errors = [];
+	for (const entry of allEntries) {
+		const { fields } = entry;
+		const indexName = generateIndexName(pluginId, collection, fields, { unique: entry.unique });
+		try {
+			await generateCreateIndexSql(db, pluginId, collection, fields, { unique: entry.unique }).execute(db);
+			await db.insertInto("_plugin_indexes").values({
+				plugin_id: pluginId,
+				collection,
+				index_name: indexName,
+				fields: JSON.stringify(fields)
+			}).onConflict((oc) => oc.columns([
+				"plugin_id",
+				"collection",
+				"index_name"
+			]).doUpdateSet({ fields: JSON.stringify(fields) })).execute();
+			created.push(indexName);
+		} catch (error) {
+			errors.push({
+				index: indexName,
+				error: error instanceof Error ? error.message : String(error)
+			});
+		}
+	}
+	return {
+		created,
+		errors
+	};
+}
+/**
+* Remove indexes that are no longer declared
+*/
+async function removeOrphanedIndexes(db, pluginId, collection, currentIndexes, options) {
+	const normalized = normalizeIndexes(currentIndexes);
+	const uniqueNormalized = options?.uniqueIndexes ? normalizeIndexes(options.uniqueIndexes) : [];
+	const uniqueSet = new Set(uniqueNormalized.map((f) => f.join(",")));
+	const currentIndexNames = /* @__PURE__ */ new Set();
+	for (const fields of normalized) if (!uniqueSet.has(fields.join(","))) currentIndexNames.add(generateIndexName(pluginId, collection, fields));
+	for (const fields of uniqueNormalized) currentIndexNames.add(generateIndexName(pluginId, collection, fields, { unique: true }));
+	const existingIndexes = await db.selectFrom("_plugin_indexes").select(["index_name"]).where("plugin_id", "=", pluginId).where("collection", "=", collection).execute();
+	const removed = [];
+	const errors = [];
+	for (const { index_name } of existingIndexes) if (!currentIndexNames.has(index_name)) try {
+		await generateDropIndexSql(index_name).execute(db);
+		await db.deleteFrom("_plugin_indexes").where("plugin_id", "=", pluginId).where("collection", "=", collection).where("index_name", "=", index_name).execute();
+		removed.push(index_name);
+	} catch (error) {
+		errors.push({
+			index: index_name,
+			error: error instanceof Error ? error.message : String(error)
+		});
+	}
+	return {
+		removed,
+		errors
+	};
+}
+/**
+* Sync indexes for a plugin collection (create new, remove old)
+*/
+async function syncStorageIndexes(db, pluginId, collection, indexes, options) {
+	const [createResult, removeResult] = await Promise.all([createStorageIndexes(db, pluginId, collection, indexes, options), removeOrphanedIndexes(db, pluginId, collection, indexes, options)]);
+	return {
+		created: createResult.created,
+		removed: removeResult.removed,
+		errors: [...createResult.errors, ...removeResult.errors]
+	};
+}
+/**
+* Materialize the storage indexes a set of plugins declare in their
+* manifests. Failures are logged per collection and never thrown — a missing
+* index affects query performance, not correctness, so it must not fail an
+* install or a scheduler tick.
+*/
+async function syncDeclaredStorageIndexes(db, plugins) {
+	for (const plugin of plugins) for (const [collection, config] of Object.entries(plugin.storage ?? {})) try {
+		const result = await syncStorageIndexes(db, plugin.id, collection, config.indexes, { uniqueIndexes: config.uniqueIndexes });
+		for (const failure of result.errors) console.error(`[plugins] Failed to sync storage index ${failure.index} for ${plugin.id}/${collection}: ${failure.error}`);
+	} catch (error) {
+		console.error(`[plugins] Failed to sync storage indexes for ${plugin.id}/${collection}:`, error);
+	}
+}
+/**
+* Remove all indexes for a plugin
+*/
+async function removeAllPluginIndexes(db, pluginId) {
+	const existingIndexes = await db.selectFrom("_plugin_indexes").select(["index_name", "collection"]).where("plugin_id", "=", pluginId).execute();
+	const removed = [];
+	const errors = [];
+	for (const { index_name } of existingIndexes) try {
+		await generateDropIndexSql(index_name).execute(db);
+		removed.push(index_name);
+	} catch (error) {
+		errors.push({
+			index: index_name,
+			error: error instanceof Error ? error.message : String(error)
+		});
+	}
+	await db.deleteFrom("_plugin_indexes").where("plugin_id", "=", pluginId).execute();
+	return {
+		removed,
+		errors
+	};
+}
+
+//#endregion
+//#region src/api/handlers/marketplace.ts
+/** Semver-like pattern: digits, dots, hyphens, plus signs (e.g. 1.0.0, 1.0.0-beta.1) */
+const VERSION_PATTERN = /^[a-z0-9][a-z0-9._+-]*$/i;
+function validateVersion(version) {
+	if (version.includes("..")) throw new Error("Invalid version format");
+	if (!VERSION_PATTERN.test(version)) throw new Error("Invalid version format");
+}
+function getClient(marketplaceUrl, siteOrigin) {
+	if (!marketplaceUrl) return null;
+	return createMarketplaceClient(marketplaceUrl, siteOrigin);
+}
+function diffCapabilities(oldCaps, newCaps) {
+	const oldNorm = normalizeCapabilities(oldCaps);
+	const newNorm = normalizeCapabilities(newCaps);
+	const oldSet = new Set(oldNorm);
+	const newSet = new Set(newNorm);
+	return {
+		added: newNorm.filter((c) => !oldSet.has(c)),
+		removed: oldNorm.filter((c) => !newSet.has(c))
+	};
+}
+/**
+* Diff route visibility between two manifests.
+* Returns routes that changed from private to public (newly exposed).
+*/
+function diffRouteVisibility(oldManifest, newManifest) {
+	const oldPublicRoutes = /* @__PURE__ */ new Set();
+	if (oldManifest) for (const entry of oldManifest.routes) {
+		const normalized = normalizeManifestRoute$1(entry);
+		if (normalized.public === true) oldPublicRoutes.add(normalized.name);
+	}
+	const newlyPublic = [];
+	for (const entry of newManifest.routes) {
+		const normalized = normalizeManifestRoute$1(entry);
+		if (normalized.public === true && !oldPublicRoutes.has(normalized.name)) newlyPublic.push(normalized.name);
+	}
+	return { newlyPublic };
+}
+async function resolveVersionMetadata(client, pluginId, pluginDetail, version) {
+	if (pluginDetail.latestVersion?.version === version) return {
+		version: pluginDetail.latestVersion.version,
+		minEmDashVersion: pluginDetail.latestVersion.minEmDashVersion,
+		bundleSize: pluginDetail.latestVersion.bundleSize,
+		checksum: pluginDetail.latestVersion.checksum,
+		changelog: pluginDetail.latestVersion.changelog,
+		capabilities: pluginDetail.latestVersion.capabilities,
+		status: pluginDetail.latestVersion.status,
+		auditVerdict: pluginDetail.latestVersion.audit?.verdict ?? null,
+		imageAuditVerdict: pluginDetail.latestVersion.imageAudit?.verdict ?? null,
+		publishedAt: pluginDetail.latestVersion.publishedAt
+	};
+	return (await client.getVersions(pluginId)).find((v) => v.version === version) ?? null;
+}
+/** A null verdict means no audit ran, which is allowed; "fail" and "warn" are not. */
+function checkAuditVerdict(versionMetadata) {
+	if (versionMetadata.auditVerdict !== "fail" && versionMetadata.auditVerdict !== "warn") return null;
+	return {
+		success: false,
+		error: {
+			code: "AUDIT_FAILED",
+			message: versionMetadata.auditVerdict === "fail" ? "Plugin failed security audit and cannot be installed or updated" : "Plugin audit was inconclusive and cannot be installed or updated until reviewed"
+		}
+	};
+}
+function validateBundleIdentity(bundle, pluginId, version) {
+	if (bundle.manifest.id !== pluginId) return {
+		success: false,
+		error: {
+			code: "MANIFEST_MISMATCH",
+			message: `Bundle manifest ID (${bundle.manifest.id}) does not match requested plugin (${pluginId})`
+		}
+	};
+	if (bundle.manifest.version !== version) return {
+		success: false,
+		error: {
+			code: "MANIFEST_VERSION_MISMATCH",
+			message: `Bundle manifest version (${bundle.manifest.version}) does not match requested version (${version})`
+		}
+	};
+	return null;
+}
+function bundlePrefix(source, pluginId, version) {
+	return `${source}/${pluginId}/${version}`;
+}
+async function storeBundleInR2(storage, pluginId, version, bundle, source = "marketplace") {
+	validatePluginIdentifier(pluginId, "plugin ID");
+	validateVersion(version);
+	const prefix = bundlePrefix(source, pluginId, version);
+	await storage.upload({
+		key: `${prefix}/manifest.json`,
+		body: new TextEncoder().encode(JSON.stringify(bundle.manifest)),
+		contentType: "application/json"
+	});
+	await storage.upload({
+		key: `${prefix}/backend.js`,
+		body: new TextEncoder().encode(bundle.backendCode),
+		contentType: "application/javascript"
+	});
+	if (bundle.adminCode) await storage.upload({
+		key: `${prefix}/admin.js`,
+		body: new TextEncoder().encode(bundle.adminCode),
+		contentType: "application/javascript"
+	});
+}
+/** Read a ReadableStream to string */
+async function streamToText(stream) {
+	return new Response(stream).text();
+}
+/**
+* Load a plugin bundle from site-local R2 storage.
+*
+* `source` selects the R2 key prefix: marketplace plugins are stored
+* under `marketplace/<id>/<version>/`, registry plugins under
+* `registry/<id>/<version>/`. Defaults to `"marketplace"` for
+* backwards compatibility with pre-registry call sites.
+*/
+async function loadBundleFromR2(storage, pluginId, version, source = "marketplace") {
+	validatePluginIdentifier(pluginId, "plugin ID");
+	validateVersion(version);
+	const prefix = bundlePrefix(source, pluginId, version);
+	try {
+		const manifestResult = await storage.download(`${prefix}/manifest.json`);
+		const backendResult = await storage.download(`${prefix}/backend.js`);
+		const manifestText = await streamToText(manifestResult.body);
+		const backendCode = await streamToText(backendResult.body);
+		const parsed = JSON.parse(manifestText);
+		const result = pluginManifestSchema$1.safeParse(parsed);
+		if (!result.success) return null;
+		const manifest = reconcileManifestAccess$1(result.data);
+		let adminCode;
+		try {
+			adminCode = await streamToText((await storage.download(`${prefix}/admin.js`)).body);
+		} catch {}
+		return {
+			manifest,
+			backendCode,
+			adminCode
+		};
+	} catch {
+		return null;
+	}
+}
+/** Delete a plugin bundle from site-local R2 storage */
+async function deleteBundleFromR2(storage, pluginId, version, source = "marketplace") {
+	validatePluginIdentifier(pluginId, "plugin ID");
+	validateVersion(version);
+	const prefix = bundlePrefix(source, pluginId, version);
+	for (const file of [
+		"manifest.json",
+		"backend.js",
+		"admin.js"
+	]) try {
+		await storage.delete(`${prefix}/${file}`);
+	} catch {}
+}
+async function rollbackPluginUpdate(db, storage, previousState, failedVersion, source) {
+	if (!storage) return {
+		success: false,
+		error: {
+			code: "STORAGE_NOT_CONFIGURED",
+			message: "Storage is required"
+		}
+	};
+	if (previousState.source !== source) return {
+		success: false,
+		error: {
+			code: "UPDATE_ROLLBACK_CONFLICT",
+			message: "Plugin source changed during update"
+		}
+	};
+	try {
+		if (!await new PluginStateRepository(db).restoreIfVersion(failedVersion, previousState)) return {
+			success: false,
+			error: {
+				code: "UPDATE_ROLLBACK_CONFLICT",
+				message: "Plugin state changed before the failed update could be rolled back"
+			}
+		};
+		await deleteBundleFromR2(storage, previousState.pluginId, failedVersion, source);
+		return {
+			success: true,
+			data: {
+				pluginId: previousState.pluginId,
+				version: previousState.version
+			}
+		};
+	} catch (error) {
+		console.error("Failed to roll back plugin update:", error);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_ROLLBACK_FAILED",
+				message: "Failed to roll back plugin update"
+			}
+		};
+	}
+}
+async function handleMarketplaceInstall(db, storage, sandboxRunner, marketplaceUrl, pluginId, opts) {
+	const client = getClient(marketplaceUrl, opts?.siteOrigin);
+	if (!client) return {
+		success: false,
+		error: {
+			code: "MARKETPLACE_NOT_CONFIGURED",
+			message: "Marketplace is not configured"
+		}
+	};
+	if (!storage) return {
+		success: false,
+		error: {
+			code: "STORAGE_NOT_CONFIGURED",
+			message: "Storage is required for marketplace plugin installation"
+		}
+	};
+	if (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) return {
+		success: false,
+		error: {
+			code: "SANDBOX_NOT_AVAILABLE",
+			message: withUnavailableReason("Sandbox runner is required for marketplace plugins", sandboxRunner)
+		}
+	};
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (existing && existing.source === "marketplace") return {
+			success: false,
+			error: {
+				code: "ALREADY_INSTALLED",
+				message: `Plugin ${pluginId} is already installed`
+			}
+		};
+		if (opts?.configuredPluginIds?.has(pluginId)) return {
+			success: false,
+			error: {
+				code: "PLUGIN_ID_CONFLICT",
+				message: `Cannot install marketplace plugin "${pluginId}" — a configured plugin with the same ID already exists`
+			}
+		};
+		const pluginDetail = await client.getPlugin(pluginId);
+		const version = opts?.version ?? pluginDetail.latestVersion?.version;
+		if (!version) return {
+			success: false,
+			error: {
+				code: "NO_VERSION",
+				message: `No published versions found for plugin ${pluginId}`
+			}
+		};
+		const versionMetadata = await resolveVersionMetadata(client, pluginId, pluginDetail, version);
+		if (!versionMetadata) return {
+			success: false,
+			error: {
+				code: "NO_VERSION",
+				message: `Version ${version} was not found for plugin ${pluginId}`
+			}
+		};
+		const auditError = checkAuditVerdict(versionMetadata);
+		if (auditError) return auditError;
+		const bundle = await client.downloadBundle(pluginId, version);
+		if (versionMetadata.checksum && bundle.checksum !== versionMetadata.checksum) return {
+			success: false,
+			error: {
+				code: "CHECKSUM_MISMATCH",
+				message: "Bundle checksum does not match marketplace record. Download may be corrupted."
+			}
+		};
+		const bundleIdentityError = validateBundleIdentity(bundle, pluginId, version);
+		if (bundleIdentityError) return bundleIdentityError;
+		const routeVisibilityChanges = diffRouteVisibility(void 0, bundle.manifest);
+		const hasPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;
+		const publicRoutes = routeVisibilityChanges.newlyPublic.toSorted();
+		const acknowledgedPublicRoutes = (opts?.acknowledgedPublicRoutes ?? []).toSorted();
+		const mcpTools = bundle.manifest.mcp?.tools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool);
+		const consentDetails = {
+			routeVisibilityChanges: hasPublicRoutes ? { newlyPublic: publicRoutes } : void 0,
+			mcpTools
+		};
+		if (hasPublicRoutes && JSON.stringify(acknowledgedPublicRoutes) !== JSON.stringify(publicRoutes)) return {
+			success: false,
+			error: {
+				code: "ROUTE_VISIBILITY_ESCALATION",
+				message: "Plugin install exposes public (unauthenticated) routes",
+				details: consentDetails
+			}
+		};
+		if ((mcpTools?.length ?? 0) > 0 && !opts?.confirmMcpTools) return {
+			success: false,
+			error: {
+				code: "MCP_TOOL_CONSENT_REQUIRED",
+				message: "Plugin MCP tools require explicit consent",
+				details: consentDetails
+			}
+		};
+		await storeBundleInR2(storage, pluginId, version, bundle);
+		await stateRepo.upsert(pluginId, version, "active", {
+			source: "marketplace",
+			marketplaceVersion: version,
+			displayName: pluginDetail.name,
+			description: pluginDetail.description ?? void 0
+		});
+		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
+		client.reportInstall(pluginId, version).catch(() => {});
+		return {
+			success: true,
+			data: {
+				pluginId,
+				version,
+				capabilities: bundle.manifest.capabilities
+			}
+		};
+	} catch (err) {
+		if (err instanceof MarketplaceUnavailableError) return {
+			success: false,
+			error: {
+				code: "MARKETPLACE_UNAVAILABLE",
+				message: "Plugin marketplace is currently unavailable"
+			}
+		};
+		if (err instanceof MarketplaceError) return {
+			success: false,
+			error: {
+				code: err.code ?? "MARKETPLACE_ERROR",
+				message: err.message
+			}
+		};
+		if (err instanceof EmDashStorageError) return {
+			success: false,
+			error: {
+				code: err.code ?? "STORAGE_ERROR",
+				message: "Storage error while installing plugin"
+			}
+		};
+		if (err && typeof err === "object" && "code" in err) {
+			const code = err.code;
+			if (typeof code === "string" && code.trim()) return {
+				success: false,
+				error: {
+					code,
+					message: "Failed to install plugin from marketplace"
+				}
+			};
+		}
+		console.error("Failed to install marketplace plugin:", err);
+		return {
+			success: false,
+			error: {
+				code: "INSTALL_FAILED",
+				message: "Failed to install plugin from marketplace"
+			}
+		};
+	}
+}
+async function handleMarketplaceUpdate(db, storage, sandboxRunner, marketplaceUrl, pluginId, opts) {
+	const client = getClient(marketplaceUrl);
+	if (!client) return {
+		success: false,
+		error: {
+			code: "MARKETPLACE_NOT_CONFIGURED",
+			message: "Marketplace is not configured"
+		}
+	};
+	if (!storage) return {
+		success: false,
+		error: {
+			code: "STORAGE_NOT_CONFIGURED",
+			message: "Storage is required"
+		}
+	};
+	if (!opts?.sandboxBypassed && (!sandboxRunner || !sandboxRunner.isAvailable())) return {
+		success: false,
+		error: {
+			code: "SANDBOX_NOT_AVAILABLE",
+			message: withUnavailableReason("Sandbox runner is required", sandboxRunner)
+		}
+	};
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "marketplace") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No marketplace plugin found: ${pluginId}`
+			}
+		};
+		const oldVersion = existing.marketplaceVersion ?? existing.version;
+		const pluginDetail = await client.getPlugin(pluginId);
+		const newVersion = opts?.version ?? pluginDetail.latestVersion?.version;
+		if (!newVersion) return {
+			success: false,
+			error: {
+				code: "NO_VERSION",
+				message: "No newer version available"
+			}
+		};
+		if (newVersion === oldVersion) return {
+			success: false,
+			error: {
+				code: "ALREADY_UP_TO_DATE",
+				message: "Plugin is already up to date"
+			}
+		};
+		const versionMetadata = await resolveVersionMetadata(client, pluginId, pluginDetail, newVersion);
+		if (!versionMetadata) return {
+			success: false,
+			error: {
+				code: "NO_VERSION",
+				message: `Version ${newVersion} was not found for plugin ${pluginId}`
+			}
+		};
+		const auditError = checkAuditVerdict(versionMetadata);
+		if (auditError) return auditError;
+		const bundle = await client.downloadBundle(pluginId, newVersion);
+		if (versionMetadata.checksum && bundle.checksum !== versionMetadata.checksum) return {
+			success: false,
+			error: {
+				code: "CHECKSUM_MISMATCH",
+				message: "Bundle checksum does not match marketplace record. Download may be corrupted."
+			}
+		};
+		const bundleIdentityError = validateBundleIdentity(bundle, pluginId, newVersion);
+		if (bundleIdentityError) return bundleIdentityError;
+		const oldBundle = await loadBundleFromR2(storage, pluginId, oldVersion);
+		const capabilityChanges = diffCapabilities(oldBundle?.manifest.capabilities ?? [], bundle.manifest.capabilities);
+		const hasEscalation = capabilityChanges.added.length > 0;
+		const routeVisibilityChanges = diffRouteVisibility(oldBundle?.manifest, bundle.manifest);
+		const hasNewPublicRoutes = routeVisibilityChanges.newlyPublic.length > 0;
+		const newlyPublicRoutes = routeVisibilityChanges.newlyPublic.toSorted();
+		const acknowledgedPublicRoutes = (opts?.acknowledgedPublicRoutes ?? []).toSorted();
+		const oldMcpTools = [...oldBundle?.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		const newMcpTools = [...bundle.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		const hasMcpChanges = JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools);
+		const mcpTools = newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool);
+		const consentDetails = {
+			capabilityChanges,
+			routeVisibilityChanges: hasNewPublicRoutes ? { newlyPublic: newlyPublicRoutes } : void 0,
+			mcpTools: hasMcpChanges ? mcpTools : void 0
+		};
+		if (hasEscalation && !opts?.confirmCapabilityChanges) return {
+			success: false,
+			error: {
+				code: "CAPABILITY_ESCALATION",
+				message: "Plugin update requires new capabilities",
+				details: consentDetails
+			}
+		};
+		if (hasNewPublicRoutes && JSON.stringify(acknowledgedPublicRoutes) !== JSON.stringify(newlyPublicRoutes)) return {
+			success: false,
+			error: {
+				code: "ROUTE_VISIBILITY_ESCALATION",
+				message: "Plugin update exposes new public (unauthenticated) routes",
+				details: consentDetails
+			}
+		};
+		if (hasMcpChanges && !opts?.confirmMcpTools) return {
+			success: false,
+			error: {
+				code: "MCP_TOOL_CONSENT_REQUIRED",
+				message: "Plugin update changes its MCP tools",
+				details: consentDetails
+			}
+		};
+		await storeBundleInR2(storage, pluginId, newVersion, bundle);
+		await stateRepo.upsert(pluginId, newVersion, "active", {
+			source: "marketplace",
+			marketplaceVersion: newVersion,
+			displayName: pluginDetail.name,
+			description: pluginDetail.description ?? void 0,
+			mcpToolsEnabled: false,
+			mcpToolsConsent: null
+		});
+		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
+		return {
+			success: true,
+			data: {
+				pluginId,
+				oldVersion,
+				newVersion,
+				capabilityChanges,
+				routeVisibilityChanges: hasNewPublicRoutes ? routeVisibilityChanges : void 0
+			}
+		};
+	} catch (err) {
+		if (err instanceof MarketplaceUnavailableError) return {
+			success: false,
+			error: {
+				code: "MARKETPLACE_UNAVAILABLE",
+				message: "Marketplace is unavailable"
+			}
+		};
+		if (err instanceof MarketplaceError) return {
+			success: false,
+			error: {
+				code: err.code ?? "MARKETPLACE_ERROR",
+				message: err.message
+			}
+		};
+		console.error("Failed to update marketplace plugin:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_FAILED",
+				message: "Failed to update plugin"
+			}
+		};
+	}
+}
+async function handleMarketplaceUninstall(db, storage, pluginId, opts) {
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "marketplace") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No marketplace plugin found: ${pluginId}`
+			}
+		};
+		const version = existing.marketplaceVersion ?? existing.version;
+		await opts?.beforeDelete?.();
+		let dataDeleted = false;
+		if (opts?.deleteData) try {
+			await db.deleteFrom("_plugin_storage").where("plugin_id", "=", pluginId).execute();
+			dataDeleted = true;
+		} catch {}
+		try {
+			await removeAllPluginIndexes(db, pluginId);
+		} catch {}
+		await stateRepo.delete(pluginId);
+		if (storage) await deleteBundleFromR2(storage, pluginId, version);
+		return {
+			success: true,
+			data: {
+				pluginId,
+				dataDeleted
+			}
+		};
+	} catch (err) {
+		console.error("Failed to uninstall marketplace plugin:", err);
+		return {
+			success: false,
+			error: {
+				code: "UNINSTALL_FAILED",
+				message: "Failed to uninstall plugin"
+			}
+		};
+	}
+}
+async function handleMarketplaceUpdateCheck(db, marketplaceUrl) {
+	const client = getClient(marketplaceUrl);
+	if (!client) return {
+		success: false,
+		error: {
+			code: "MARKETPLACE_NOT_CONFIGURED",
+			message: "Marketplace is not configured"
+		}
+	};
+	try {
+		const marketplacePlugins = await new PluginStateRepository(db).getMarketplacePlugins();
+		const items = [];
+		for (const plugin of marketplacePlugins) try {
+			const detail = await client.getPlugin(plugin.pluginId);
+			const latest = detail.latestVersion?.version;
+			const installed = plugin.marketplaceVersion ?? plugin.version;
+			if (!latest) continue;
+			const hasUpdate = latest !== installed;
+			let capabilityChanges;
+			let hasCapabilityChanges = false;
+			if (hasUpdate && detail.latestVersion) {
+				capabilityChanges = diffCapabilities(detail.capabilities ?? [], detail.latestVersion.capabilities ?? []);
+				hasCapabilityChanges = capabilityChanges.added.length > 0 || capabilityChanges.removed.length > 0;
+			}
+			items.push({
+				pluginId: plugin.pluginId,
+				installed,
+				latest: latest ?? installed,
+				hasUpdate,
+				hasCapabilityChanges,
+				capabilityChanges: hasCapabilityChanges ? capabilityChanges : void 0,
+				hasRouteVisibilityChanges: false
+			});
+		} catch (err) {
+			console.warn(`Failed to check updates for ${plugin.pluginId}:`, err);
+		}
+		return {
+			success: true,
+			data: { items }
+		};
+	} catch (err) {
+		if (err instanceof MarketplaceUnavailableError) return {
+			success: false,
+			error: {
+				code: "MARKETPLACE_UNAVAILABLE",
+				message: "Marketplace is unavailable"
+			}
+		};
+		console.error("Failed to check marketplace updates:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_CHECK_FAILED",
+				message: "Failed to check for updates"
+			}
+		};
+	}
+}
+async function handleMarketplaceSearch(marketplaceUrl, query, opts) {
+	const client = getClient(marketplaceUrl);
+	if (!client) return {
+		success: false,
+		error: {
+			code: "MARKETPLACE_NOT_CONFIGURED",
+			message: "Marketplace is not configured"
+		}
+	};
+	try {
+		return {
+			success: true,
+			data: await client.search(query, opts)
+		};
+	} catch (err) {
+		if (err instanceof MarketplaceUnavailableError) return {
+			success: false,
+			error: {
+				code: "MARKETPLACE_UNAVAILABLE",
+				message: "Marketplace is unavailable"
+			}
+		};
+		console.error("Failed to search marketplace:", err);
+		return {
+			success: false,
+			error: {
+				code: "SEARCH_FAILED",
+				message: "Failed to search marketplace"
+			}
+		};
+	}
+}
+async function handleMarketplaceGetPlugin(marketplaceUrl, pluginId) {
+	const client = getClient(marketplaceUrl);
+	if (!client) return {
+		success: false,
+		error: {
+			code: "MARKETPLACE_NOT_CONFIGURED",
+			message: "Marketplace is not configured"
+		}
+	};
+	try {
+		return {
+			success: true,
+			data: await client.getPlugin(pluginId)
+		};
+	} catch (err) {
+		if (err instanceof MarketplaceError && err.status === 404) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Plugin not found: ${pluginId}`
+			}
+		};
+		if (err instanceof MarketplaceUnavailableError) return {
+			success: false,
+			error: {
+				code: "MARKETPLACE_UNAVAILABLE",
+				message: "Marketplace is unavailable"
+			}
+		};
+		console.error("Failed to get marketplace plugin:", err);
+		return {
+			success: false,
+			error: {
+				code: "GET_PLUGIN_FAILED",
+				message: "Failed to get plugin details"
+			}
+		};
+	}
+}
+async function handleThemeSearch(marketplaceUrl, query, opts) {
+	const client = getClient(marketplaceUrl);
+	if (!client) return {
+		success: false,
+		error: {
+			code: "MARKETPLACE_NOT_CONFIGURED",
+			message: "Marketplace is not configured"
+		}
+	};
+	try {
+		return {
+			success: true,
+			data: await client.searchThemes(query, opts)
+		};
+	} catch (err) {
+		if (err instanceof MarketplaceUnavailableError) return {
+			success: false,
+			error: {
+				code: "MARKETPLACE_UNAVAILABLE",
+				message: "Marketplace is unavailable"
+			}
+		};
+		console.error("Failed to search themes:", err);
+		return {
+			success: false,
+			error: {
+				code: "THEME_SEARCH_FAILED",
+				message: "Failed to search themes"
+			}
+		};
+	}
+}
+async function handleThemeGetDetail(marketplaceUrl, themeId) {
+	const client = getClient(marketplaceUrl);
+	if (!client) return {
+		success: false,
+		error: {
+			code: "MARKETPLACE_NOT_CONFIGURED",
+			message: "Marketplace is not configured"
+		}
+	};
+	try {
+		return {
+			success: true,
+			data: await client.getTheme(themeId)
+		};
+	} catch (err) {
+		if (err instanceof MarketplaceError && err.status === 404) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Theme not found: ${themeId}`
+			}
+		};
+		if (err instanceof MarketplaceUnavailableError) return {
+			success: false,
+			error: {
+				code: "MARKETPLACE_UNAVAILABLE",
+				message: "Marketplace is unavailable"
+			}
+		};
+		console.error("Failed to get marketplace theme:", err);
+		return {
+			success: false,
+			error: {
+				code: "GET_THEME_FAILED",
+				message: "Failed to get theme details"
+			}
+		};
+	}
+}
+
+//#endregion
+//#region ../registry-verification/dist/bundle.js
+/** Maximum accepted gzip payload size. */
+const MAX_BUNDLE_COMPRESSED_BYTES = 384 * 1024;
+/** Maximum aggregate size of regular-file contents. */
+const MAX_BUNDLE_SIZE = 256 * 1024;
+/** Maximum size of one regular file. */
+const MAX_BUNDLE_FILE_BYTES = 128 * 1024;
+/** Maximum number of regular files. */
+const MAX_BUNDLE_FILE_COUNT = 20;
+/** Maximum total tar entries, including harmless directory entries. */
+const MAX_BUNDLE_TAR_ENTRY_COUNT = 32;
+/**
+* Maximum tar stream size after decompression. This includes USTAR headers,
+* file padding, and the end marker in addition to the regular-file contents.
+*/
+const MAX_BUNDLE_DECOMPRESSED_BYTES = MAX_BUNDLE_SIZE + MAX_BUNDLE_TAR_ENTRY_COUNT * 512 + MAX_BUNDLE_FILE_COUNT * 511 + 2 * 512;
+const TAR_BLOCK_BYTES = 512;
+const TAR_END_BYTES = TAR_BLOCK_BYTES * 2;
+const OCTAL_PATTERN = /^[0-7]+$/;
+const WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:/;
+const decoder = new TextDecoder("utf-8", {
+	fatal: true,
+	ignoreBOM: false
+});
+async function validatePluginBundle(compressed, options = {}) {
+	if (compressed.byteLength > MAX_BUNDLE_COMPRESSED_BYTES) return verificationError("BUNDLE_COMPRESSED_SIZE_EXCEEDED", "The compressed plugin bundle exceeds the size limit.");
+	const decompressed = await decompressBundle(compressed);
+	if (!decompressed.success) return decompressed;
+	const files = parseTar(decompressed.value);
+	if (!files.success) return files;
+	const manifestFile = files.value.get("manifest.json");
+	if (!manifestFile) return verificationError("BUNDLE_MISSING_MANIFEST", "The plugin bundle is missing manifest.json.");
+	const backend = files.value.get("backend.js");
+	if (!backend) return verificationError("BUNDLE_MISSING_BACKEND", "The plugin bundle is missing backend.js.");
+	let parsed;
+	try {
+		parsed = JSON.parse(decoder.decode(manifestFile.data));
+	} catch {
+		return verificationError("BUNDLE_INVALID_MANIFEST", "The plugin bundle manifest is not valid JSON.");
+	}
+	const validated = pluginManifestSchema.safeParse(parsed);
+	if (!validated.success) return verificationError("BUNDLE_INVALID_MANIFEST", "The plugin bundle manifest failed schema validation.");
+	const manifest = reconcileManifestAccess(validated.data);
+	if (options.expectedSlug !== void 0 && manifest.id !== options.expectedSlug) return verificationError("BUNDLE_ID_MISMATCH", "The plugin bundle manifest id does not match the expected plugin.");
+	if (options.expectedVersion !== void 0 && manifest.version !== options.expectedVersion) return verificationError("BUNDLE_VERSION_MISMATCH", "The plugin bundle manifest version does not match the expected version.");
+	const result = {
+		manifest,
+		declaredAccess: manifest.declaredAccess ?? {},
+		backend: backend.data
+	};
+	const admin = files.value.get("admin.js");
+	if (admin) result.admin = admin.data;
+	return {
+		success: true,
+		value: result
+	};
+}
+async function decompressBundle(bytes) {
+	const source = new ReadableStream({ start(controller) {
+		controller.enqueue(bytes);
+		controller.close();
+	} });
+	let reader;
+	try {
+		reader = source.pipeThrough(createGzipDecoder()).getReader();
+	} catch {
+		return verificationError("BUNDLE_INVALID_ARCHIVE", "The plugin bundle is not valid gzip data.");
+	}
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			total += value.byteLength;
+			if (total > MAX_BUNDLE_DECOMPRESSED_BYTES) {
+				await reader.cancel().catch(() => void 0);
+				return verificationError("BUNDLE_DECOMPRESSED_SIZE_EXCEEDED", "The decompressed plugin bundle exceeds the size limit.");
+			}
+			chunks.push(value);
+		}
+	} catch {
+		return verificationError("BUNDLE_INVALID_ARCHIVE", "The plugin bundle is not valid gzip data.");
+	}
+	const output = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return {
+		success: true,
+		value: output
+	};
+}
+function parseTar(bytes) {
+	if (bytes.byteLength < TAR_END_BYTES || bytes.byteLength % TAR_BLOCK_BYTES !== 0) return invalidArchive();
+	const files = /* @__PURE__ */ new Map();
+	const rawPaths = /* @__PURE__ */ new Set();
+	const normalizedPaths = /* @__PURE__ */ new Set();
+	let offset = 0;
+	let fileCount = 0;
+	let entryCount = 0;
+	let totalFileBytes = 0;
+	let ended = false;
+	while (offset + TAR_BLOCK_BYTES <= bytes.byteLength) {
+		const header = bytes.subarray(offset, offset + TAR_BLOCK_BYTES);
+		if (isZeroBlock(header)) {
+			if (!isZeroBlock(bytes.subarray(offset + TAR_BLOCK_BYTES, offset + TAR_END_BYTES))) return invalidArchive();
+			if (bytes.subarray(offset + TAR_END_BYTES).some((byte) => byte !== 0)) return invalidArchive();
+			ended = true;
+			break;
+		}
+		if (!validChecksum(header)) return invalidArchive();
+		entryCount += 1;
+		if (entryCount > MAX_BUNDLE_TAR_ENTRY_COUNT) return verificationError("BUNDLE_FILE_COUNT_EXCEEDED", "The plugin bundle contains too many archive entries.");
+		const rawName = readTarPath(header);
+		if (!rawName.success) return rawName;
+		const typeFlag = header[156];
+		const type = typeFlag === 0 ? "file" : String.fromCharCode(typeFlag ?? 0);
+		const isDirectory = type === "5";
+		const normalized = normalizePath(rawName.value, isDirectory);
+		if (!normalized.success) return normalized;
+		if (rawPaths.has(rawName.value) || normalizedPaths.has(normalized.value)) return verificationError("BUNDLE_PATH_COLLISION", "The plugin bundle contains duplicate or ambiguous paths.");
+		rawPaths.add(rawName.value);
+		normalizedPaths.add(normalized.value);
+		const size = readOctal(header.subarray(124, 136));
+		if (size === null || !Number.isSafeInteger(size)) return invalidArchive();
+		const bodyStart = offset + TAR_BLOCK_BYTES;
+		const nextOffset = bodyStart + Math.ceil(size / TAR_BLOCK_BYTES) * TAR_BLOCK_BYTES;
+		if (nextOffset > bytes.byteLength) return invalidArchive();
+		if (isDirectory) {
+			if (size !== 0) return invalidArchive();
+		} else if (type === "file" || type === "0") {
+			fileCount += 1;
+			if (fileCount > MAX_BUNDLE_FILE_COUNT) return verificationError("BUNDLE_FILE_COUNT_EXCEEDED", "The plugin bundle contains too many files.");
+			if (size > MAX_BUNDLE_FILE_BYTES) return verificationError("BUNDLE_FILE_SIZE_EXCEEDED", "A file in the plugin bundle exceeds the per-file size limit.");
+			totalFileBytes += size;
+			if (totalFileBytes > MAX_BUNDLE_SIZE) return verificationError("BUNDLE_DECOMPRESSED_SIZE_EXCEEDED", "The plugin bundle file contents exceed the size limit.");
+			files.set(normalized.value, {
+				name: normalized.value,
+				data: bytes.slice(bodyStart, bodyStart + size)
+			});
+		} else return verificationError("BUNDLE_UNSUPPORTED_ENTRY", "The plugin bundle contains an unsupported archive entry type.");
+		offset = nextOffset;
+	}
+	if (!ended) return invalidArchive();
+	return {
+		success: true,
+		value: files
+	};
+}
+function readTarPath(header) {
+	const name = readTarString(header.subarray(0, 100));
+	const prefix = readTarString(header.subarray(345, 500));
+	if (name === null || prefix === null || name.length === 0) return verificationError("BUNDLE_INVALID_PATH", "The plugin bundle contains a malformed path.");
+	return {
+		success: true,
+		value: prefix ? `${prefix}/${name}` : name
+	};
+}
+function readTarString(field) {
+	const terminator = field.indexOf(0);
+	const end = terminator === -1 ? field.length : terminator;
+	if (terminator !== -1 && field.subarray(terminator + 1).some((byte) => byte !== 0)) return null;
+	try {
+		return decoder.decode(field.subarray(0, end));
+	} catch {
+		return null;
+	}
+}
+function normalizePath(raw, isDirectory) {
+	if (raw.includes("\\") || raw.startsWith("/") || WINDOWS_DRIVE_PATTERN.test(raw) || hasControlCharacter(raw) || raw.endsWith("/") !== isDirectory) return verificationError("BUNDLE_INVALID_PATH", "The plugin bundle contains an unsafe path.");
+	const parts = raw.split("/");
+	if (isDirectory) parts.pop();
+	const normalized = [];
+	for (const part of parts) {
+		if (part === ".") continue;
+		if (part === "" || part === "..") return verificationError("BUNDLE_INVALID_PATH", "The plugin bundle contains an unsafe path.");
+		normalized.push(part.normalize("NFC"));
+	}
+	if (normalized.length === 0) return verificationError("BUNDLE_INVALID_PATH", "The plugin bundle contains a malformed path.");
+	return {
+		success: true,
+		value: normalized.join("/")
+	};
+}
+function hasControlCharacter(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0);
+		if (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return true;
+	}
+	return false;
+}
+function readOctal(field) {
+	const text = new TextDecoder().decode(field).replaceAll("\0", "").trim();
+	if (!OCTAL_PATTERN.test(text)) return null;
+	const value = Number.parseInt(text, 8);
+	return Number.isSafeInteger(value) ? value : null;
+}
+function validChecksum(header) {
+	const expected = readOctal(header.subarray(148, 156));
+	if (expected === null) return false;
+	let actual = 0;
+	for (let index = 0; index < header.length; index += 1) actual += index >= 148 && index < 156 ? 32 : header[index] ?? 0;
+	return actual === expected;
+}
+function isZeroBlock(block) {
+	return block.byteLength === TAR_BLOCK_BYTES && block.every((byte) => byte === 0);
+}
+function invalidArchive() {
+	return verificationError("BUNDLE_INVALID_ARCHIVE", "The plugin bundle is not a valid tar archive.");
+}
+
+//#endregion
+//#region src/registry/artifact-verification.ts
+const bundleDecoder = new TextDecoder("utf-8", { fatal: true });
+async function validateRegistryArtifact(bytes, checksum, slug, version) {
+	const checksumReport = await verifyMultihash(bytes, checksum);
+	if (!checksumReport.success) return checksumReport;
+	const [artifactDigest, ...artifactDigests] = await computeArtifactDigestCandidates(bytes);
+	const bundleReport = await validatePluginBundle(bytes, {
+		expectedSlug: slug,
+		expectedVersion: version
+	});
+	if (!bundleReport.success) return bundleReport;
+	const manifest = pluginManifestSchema$1.safeParse(bundleReport.value.manifest);
+	if (!manifest.success) return {
+		success: false,
+		error: {
+			code: "BUNDLE_RUNTIME_UNSUPPORTED",
+			message: "The plugin bundle uses manifest features unsupported by this EmDash version."
+		}
+	};
+	try {
+		return {
+			success: true,
+			value: {
+				bundle: {
+					manifest: reconcileManifestAccess$1(manifest.data),
+					backendCode: bundleDecoder.decode(bundleReport.value.backend),
+					adminCode: bundleReport.value.admin === void 0 ? void 0 : bundleDecoder.decode(bundleReport.value.admin),
+					checksum
+				},
+				artifactDigest,
+				artifactDigests
+			}
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: "BUNDLE_INVALID_CODE_ENCODING",
+				message: "Plugin bundle code must be valid UTF-8."
+			}
+		};
+	}
+}
+
+//#endregion
+//#region src/registry/plugin-id.ts
+/**
+* Plugin identifier helpers for the experimental decentralized plugin
+* registry.
+*
+* Registry plugins are addressed by `(publisher_did, slug)`, but the
+* EmDash runtime threads a single `pluginId: string` through every
+* install primitive (R2 storage keys, `PluginStateRepository`,
+* `syncMarketplacePlugins`, sandbox cache keys). Rather than refactor
+* everything to carry a composite identifier, we normalize the registry
+* tuple to an opaque content-addressed id that satisfies the existing
+* `validatePluginIdentifier` shape (`/^[a-z][a-z0-9_-]*$/`).
+*
+* The normalized id is:
+*
+*   `r_` + base32-encoded SHA-256(publisher_did + "\n" + slug), truncated.
+*
+* Properties:
+*
+*   - Deterministic. The same `(publisher, slug)` always produces the
+*     same id, so re-resolving an installed plugin's metadata against
+*     the aggregator is a straightforward lookup keyed by the columns
+*     stored alongside `plugin_id` in `plugin_states`.
+*   - Collision-resistant. 80 bits of truncated hash; a 50% birthday
+*     collision happens around 2^40 distinct plugins, well beyond what
+*     this registry will ever index.
+*   - R2-safe. Lowercase alphanumerics + underscore (no hyphens), no
+*     `:` or `/`. Existing sandbox cache keys (`${pluginId}:${version}`)
+*     keep working because the id contains no `:`.
+*   - Syntactically distinct from typical marketplace plugin ids: the
+*     `r_` prefix plus exactly 16 base32 characters is unlikely to be
+*     chosen as a marketplace id. Not formally guaranteed by the
+*     validator -- marketplace ids may begin with `r_` and contain
+*     hyphens -- so the install handler also performs an explicit
+*     pre-existing-row check at the derived id and rejects any cross-
+*     source collision (`PLUGIN_ID_COLLISION`).
+*
+* Reverse lookup (id → publisher + slug) requires the `plugin_states`
+* row -- the hash is one-way. That's intentional: any code path that
+* needs the human-meaningful pair already has the state row in hand.
+*/
+/** Length (in base32 characters) of the truncated hash portion of the id. */
+const HASH_LENGTH = 16;
+/** Total expected length of a registry plugin id. */
+const REGISTRY_PLUGIN_ID_LENGTH = 2 + HASH_LENGTH;
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+/**
+* RFC 4648 base32 encoding without padding, lowercase. Implemented inline
+* rather than depending on a multibase library because (a) we only need
+* lowercase base32 here, (b) we need it to run identically in workerd,
+* Node, and the browser, and (c) the implementation is fewer lines than
+* the import statement would be.
+*/
+function base32Encode(bytes) {
+	let bits = 0;
+	let value = 0;
+	let out = "";
+	for (const byte of bytes) {
+		value = value << 8 | byte;
+		bits += 8;
+		while (bits >= 5) {
+			bits -= 5;
+			out += BASE32_ALPHABET[value >>> bits & 31];
+		}
+	}
+	if (bits > 0) out += BASE32_ALPHABET[value << 5 - bits & 31];
+	return out;
+}
+/**
+* Derive the normalized plugin id for a registry-published plugin.
+*
+* Throws if either input is empty or whitespace-only -- a missing DID
+* or slug is always a programming error in the install path, not a
+* recoverable runtime condition.
+*/
+async function makeRegistryPluginId(publisherDid, slug) {
+	const did = publisherDid.trim();
+	const s = slug.trim();
+	if (!did) throw new Error("makeRegistryPluginId: publisherDid is required");
+	if (!s) throw new Error("makeRegistryPluginId: slug is required");
+	const input = `${did}\n${s}`;
+	const hashBuffer = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+	return `r_${base32Encode(new Uint8Array(hashBuffer)).slice(0, HASH_LENGTH)}`;
+}
+
+//#endregion
+//#region src/registry/record-labels.ts
+function hasCurrentRecordLabel(labels, value, record, now = Date.now()) {
+	return labels.some((label) => {
+		if (label.val !== value || label.uri !== record.uri || label.cid !== record.cid || label.neg === true) return false;
+		if (label.exp === void 0) return true;
+		const expiresAt = Date.parse(label.exp);
+		return Number.isFinite(expiresAt) && expiresAt > now;
+	});
+}
+
+//#endregion
+//#region src/api/handlers/registry.ts
+/**
+* Registry installs use aggregator results only for discovery and moderation
+* metadata. The handler reads profile and release records from the publisher's
+* PDS, verifies their repository proofs, then validates the bundle checksum,
+* manifest, policy, and consent before storing or activating executable code.
+* Applicable labels can block installation but cannot supply any verified
+* record, checksum, permission, or executable byte.
+*/
+function verifiedAccessEqual(a, b) {
+	return JSON.stringify(a) === JSON.stringify(canonicalizeDeclaredAccess(b));
+}
+function registryArtifactError(code, message, operation) {
+	let apiCode;
+	switch (code) {
+		case "BUNDLE_ID_MISMATCH":
+			apiCode = operation === "install" ? "MANIFEST_ID_MISMATCH" : "BUNDLE_IDENTITY_MISMATCH";
+			break;
+		case "BUNDLE_VERSION_MISMATCH":
+			apiCode = operation === "install" ? "MANIFEST_VERSION_MISMATCH" : code;
+			break;
+		case "CHECKSUM_MISMATCH":
+		case "INVALID_MULTIHASH":
+		case "UNSUPPORTED_MULTIHASH":
+			apiCode = "CHECKSUM_MISMATCH";
+			break;
+		case "FETCH_FAILED":
+		case "HOST_REJECTED":
+		case "REDIRECT_LIMIT_EXCEEDED":
+		case "REDIRECT_LOCATION_MISSING":
+		case "RESOURCE_STATUS_ERROR":
+		case "RESOURCE_TIMEOUT":
+			apiCode = operation === "install" ? "INSTALL_FAILED" : "UPDATE_FAILED";
+			break;
+		default: apiCode = "INVALID_BUNDLE";
+	}
+	return {
+		success: false,
+		error: {
+			code: apiCode,
+			message,
+			details: { verificationCode: code }
+		}
+	};
+}
+function registryRecordError(code, message) {
+	return {
+		success: false,
+		error: {
+			code: "RECORD_VERIFICATION_FAILED",
+			message,
+			details: { verificationCode: code }
+		}
+	};
+}
+function recordConsentError(input, records) {
+	if (!input.profileCid || !input.releaseCid) return {
+		success: false,
+		error: {
+			code: "RECORD_CONSENT_REQUIRED",
+			message: "Verify the signed package records before confirming this action."
+		}
+	};
+	if (input.profileCid !== records.profile.cid || input.releaseCid !== records.release.cid) return {
+		success: false,
+		error: {
+			code: "RECORD_VERIFICATION_DRIFT",
+			message: "The signed package records changed after review. Verify them again."
+		}
+	};
+	return null;
+}
+function recordVerificationSummary(records, report) {
+	return {
+		profileCid: records.profile.cid,
+		releaseCid: records.release.cid,
+		provenance: report.provenance.status,
+		policy: report.value.policy
+	};
+}
+/**
+* Bytes-per-artifact cap on the gzipped tarball we'll download before
+* decompression. RFC 0001 caps a sandboxed plugin bundle at 256 KiB
+* decompressed (see `MAX_BUNDLE_SIZE` in @emdash-cms/plugin-cli);
+* gzip on a mix of JSON manifest + JS code typically gives 0.3-0.6
+* ratio, so compressed bundles are well under 200 KiB in practice.
+* 512 KiB leaves margin for unusual file mixes that compress poorly
+* while still rejecting anything that's obviously not a legitimate
+* plugin bundle.
+*/
+const MAX_ARTIFACT_BYTES = 512 * 1024;
+/**
+* Maximum number of HTTP redirects followed during artifact download.
+* Each hop is independently URL-validated, so a malicious server cannot
+* redirect through a series of allowed-looking origins to reach a
+* forbidden one.
+*/
+const MAX_REDIRECTS = 5;
+/**
+* Wall-clock cap on any single artifact fetch attempt (per URL).
+* Defends against slow-loris artifact sources that accept the connection but
+* never finish sending headers or body.
+*/
+const ARTIFACT_FETCH_TIMEOUT_MS = 15e3;
+/**
+* Total wall-clock budget for the artifact-download phase across all
+* advertised caches, the publisher PDS, and the declared URL. Even with the
+* per-URL timeout, unavailable sources could otherwise tie up the install request for
+* minutes; this caps total time at a budget interactive admins can
+* tolerate. Tuned so a fast happy path takes <1s of budget per
+* attempt and a worst case still completes in under a minute.
+*/
+const ARTIFACT_TOTAL_BUDGET_MS = 45e3;
+/**
+* Per-request timeout applied to every aggregator XRPC call
+* (`resolvePackage`, `getLatestRelease`, `listReleases`). Matches the
+* per-URL artifact-fetch cap. Without this, a slow-loris aggregator
+* can stall the install before the artifact phase even starts.
+*/
+const AGGREGATOR_REQUEST_TIMEOUT_MS = 15e3;
+/**
+* Total wall-clock budget for the aggregator-discovery phase
+* (resolve + selected-release lookup). Mirrors the artifact-download
+* budget. Worst case with the pinned-version path's 20-page cap is
+* 20 + 1 calls; capping the total ensures any one stalled call
+* still bounds the whole phase.
+*/
+const AGGREGATOR_TOTAL_BUDGET_MS = 3e4;
+var RegistryArtifactFetchError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "RegistryArtifactFetchError";
+	}
+};
+/** Build a fetch function that enforces a per-request and per-budget timeout. */
+function timedFetch(totalDeadline) {
+	return (input, init) => {
+		const now = Date.now();
+		const remaining = Math.max(0, totalDeadline - now);
+		if (remaining === 0) return Promise.reject(/* @__PURE__ */ new Error("Aggregator request budget exhausted"));
+		const timeout = Math.min(AGGREGATOR_REQUEST_TIMEOUT_MS, remaining);
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeout);
+		const callerSignal = init?.signal;
+		if (callerSignal) if (callerSignal.aborted) controller.abort(callerSignal.reason);
+		else callerSignal.addEventListener("abort", () => controller.abort(callerSignal.reason));
+		return fetch(input, {
+			...init,
+			signal: controller.signal
+		}).finally(() => {
+			clearTimeout(timer);
+		});
+	};
+}
+async function fetchArtifact(artifactCaches, artifact, record, auth) {
+	const result = await fetchReleaseArtifact({
+		artifact,
+		record,
+		artifactCaches,
+		...auth === void 0 ? {} : { auth }
+	}, {
+		fetch: async (url, init) => {
+			if (!init.signal) throw new Error("Registry artifact fetch requires an abort signal");
+			return fetchRegistryArtifactUrl(url.href, {
+				signal: init.signal,
+				maxResponseBytes: MAX_ARTIFACT_BYTES
+			});
+		},
+		resolveHostname: async (hostname) => (await resolveAndValidateExternalUrlTarget(`https://${hostname}`)).addresses,
+		allowHttpLocalhost: import.meta.env.DEV,
+		headerTimeoutMs: ARTIFACT_FETCH_TIMEOUT_MS,
+		totalTimeoutMs: ARTIFACT_TOTAL_BUDGET_MS,
+		maxBytes: MAX_ARTIFACT_BYTES,
+		maxRedirects: MAX_REDIRECTS
+	});
+	if (!result.success) throw new RegistryArtifactFetchError(result.error.code, result.error.message);
+	return result.value.bytes;
+}
+/**
+* Returns an error when the release is younger than `policy.minimumReleaseAge`,
+* unless its publisher or package is in `minimumReleaseAgeExclude` or it is a
+* proven first release.
+*
+* `releaseView.indexedAt` is aggregator operational data, not part of the
+* signed release. The release schema has no publication timestamp, so minimum
+* age remains a local discovery holdback rather than a cryptographic property.
+* A missing or malformed timestamp fails closed.
+*/
+function checkMinimumReleaseAge(registryConfig, publisherDid, slug, packageView, releaseView) {
+	const minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;
+	let minimumReleaseAgeSeconds = 0;
+	if (minimumReleaseAge !== void 0) try {
+		minimumReleaseAgeSeconds = parseDurationSeconds(minimumReleaseAge);
+	} catch (err) {
+		return {
+			success: false,
+			error: {
+				code: "REGISTRY_POLICY_INVALID",
+				message: err instanceof Error ? err.message : "Invalid minimumReleaseAge value in registry config"
+			}
+		};
+	}
+	if (minimumReleaseAgeSeconds > 0) {
+		const exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) => e.trim().toLowerCase());
+		if (!(releaseExemptFromMinimumAge(exclude, publisherDid, slug) || isProvenFirstRelease(packageView))) {
+			const indexedAt = Date.parse(releaseView.indexedAt);
+			if (!Number.isFinite(indexedAt)) return {
+				success: false,
+				error: {
+					code: "RELEASE_TIMESTAMP_INVALID",
+					message: "Release record is missing a valid indexed-at timestamp; cannot evaluate minimum release age policy."
+				}
+			};
+			const ageSeconds = (Date.now() - indexedAt) / 1e3;
+			if (ageSeconds < minimumReleaseAgeSeconds) {
+				const remaining = Math.ceil(minimumReleaseAgeSeconds - ageSeconds);
+				return {
+					success: false,
+					error: {
+						code: "RELEASE_TOO_NEW",
+						message: `This release does not meet the configured minimum release age of ${minimumReleaseAgeSeconds}s. It will be installable in ~${remaining}s.`
+					}
+				};
+			}
+		}
+	}
+	return null;
+}
+/**
+* Gate a release's `requires` constraints against the running host
+* environment. `requires` is the lexicon-`unknown` value off the signed
+* release record — never trust its shape; `checkEnvCompatibility` guards it.
+*
+* Returns `null` when every advertised constraint is satisfied (or there are
+* none), or a structured `ENV_INCOMPATIBLE` error naming the unsatisfied
+* constraints and the host versions. The error carries the guarded `requires`
+* and `host` maps so the admin can render the same mismatch the UI gate shows.
+*/
+function assertEnvCompatible(requires, hostEnv) {
+	for (const skipped of findSkippedEnvConstraints(requires, hostEnv)) console.warn(`[registry] env compatibility constraint skipped: ${skipped.key} requires ${skipped.required} but host version is ${skipped.reason}`);
+	const mismatches = checkEnvCompatibility(requires, hostEnv);
+	if (mismatches.length === 0) return null;
+	const guarded = {};
+	for (const m of mismatches) guarded[m.key] = m.required;
+	return {
+		code: "ENV_INCOMPATIBLE",
+		message: `This release is not compatible with the current environment: ${mismatches.map((m) => `${m.key} requires ${m.required} but host is ${m.host}`).join("; ")}.`,
+		details: {
+			requires: guarded,
+			host: hostEnv
+		}
+	};
+}
+async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigInput, input, opts) {
+	const registryConfig = coerceRegistryConfig(registryConfigInput);
+	if (!registryConfig) return {
+		success: false,
+		error: {
+			code: "REGISTRY_NOT_CONFIGURED",
+			message: "Registry is not configured"
+		}
+	};
+	if (!storage) return {
+		success: false,
+		error: {
+			code: "STORAGE_NOT_CONFIGURED",
+			message: "Storage is required for registry plugin installation"
+		}
+	};
+	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+		success: false,
+		error: {
+			code: "SANDBOX_NOT_AVAILABLE",
+			message: withUnavailableReason("Sandbox runner is required for registry plugins", sandboxRunner)
+		}
+	};
+	try {
+		validateAggregatorUrl(registryConfig.aggregatorUrl);
+	} catch (err) {
+		return {
+			success: false,
+			error: {
+				code: "REGISTRY_NOT_CONFIGURED",
+				message: err instanceof Error ? err.message : "Invalid aggregator URL"
+			}
+		};
+	}
+	const { did, slug, version: requestedVersion } = input;
+	const { DiscoveryClient, registryLabelerPolicy } = await import("@emdash-cms/registry-client/discovery");
+	const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
+	const discovery = new DiscoveryClient({
+		aggregatorUrl: registryConfig.aggregatorUrl,
+		acceptLabelers: registryConfig.acceptLabelers,
+		labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
+		fetch: timedFetch(aggregatorDeadline)
+	});
+	if (!did.startsWith("did:") || did.split(":").length < 3) return {
+		success: false,
+		error: {
+			code: "INVALID_DID",
+			message: "DID must be a valid atproto DID (e.g. did:plc:abc123)"
+		}
+	};
+	try {
+		const publisherDid = did;
+		const packageView = await discovery.getPackage({
+			did: publisherDid,
+			slug
+		});
+		const MAX_LIST_PAGES = 20;
+		const releaseView = await (async () => {
+			if (!requestedVersion) return discovery.getLatestRelease({
+				did: publisherDid,
+				package: slug
+			});
+			let cursor;
+			const seenCursors = /* @__PURE__ */ new Set();
+			for (let page = 0; page < MAX_LIST_PAGES; page++) {
+				if (cursor !== void 0) {
+					if (seenCursors.has(cursor)) break;
+					seenCursors.add(cursor);
+				}
+				const result = await discovery.listReleases({
+					did: publisherDid,
+					package: slug,
+					cursor,
+					limit: 50
+				});
+				for (const r of result.releases) if (r.version === requestedVersion) return r;
+				if (!result.cursor) break;
+				cursor = result.cursor;
+			}
+		})();
+		if (!releaseView) return {
+			success: false,
+			error: {
+				code: "NO_RELEASE",
+				message: requestedVersion ? `Version ${requestedVersion} not found for ${publisherDid}/${slug}` : `No installable release found for ${publisherDid}/${slug}`
+			}
+		};
+		if (packageView.did !== publisherDid || packageView.slug !== slug) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_IDENTITY_MISMATCH",
+				message: "Aggregator returned a package view for a different publisher or slug."
+			}
+		};
+		if (releaseView.did !== publisherDid || releaseView.package !== slug || requestedVersion !== void 0 && releaseView.version !== requestedVersion) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_IDENTITY_MISMATCH",
+				message: "Aggregator returned a release view that does not match the requested package or version."
+			}
+		};
+		const version = releaseView.version;
+		if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) return {
+			success: false,
+			error: {
+				code: "RELEASE_YANKED",
+				message: "This release has been withdrawn"
+			}
+		};
+		const authoritative = await (opts?.readAuthoritativeRecords ?? readAuthoritativePackageRelease)(publisherDid, slug, version, opts?.authoritativeRecords);
+		if (!authoritative.success) return registryRecordError(authoritative.error.code, authoritative.error.message);
+		const records = authoritative.value;
+		const { profile, release } = records.inspection.value;
+		if (packageView.uri !== records.profile.uri || packageView.cid !== records.profile.cid || releaseView.uri !== records.release.uri || releaseView.cid !== records.release.cid) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RECORD_MISMATCH",
+				message: "Aggregator metadata does not match the publisher's signed records."
+			}
+		};
+		if (!opts?.verifyOnly) {
+			const consentError = recordConsentError({
+				profileCid: input.acknowledgedProfileCid,
+				releaseCid: input.acknowledgedReleaseCid
+			}, records);
+			if (consentError) return consentError;
+		}
+		if (hasCurrentRecordLabel(packageView.labels ?? [], "security:yanked", records.profile) || hasCurrentRecordLabel(packageView.labels ?? [], "security-yanked", records.profile)) return {
+			success: false,
+			error: {
+				code: "RELEASE_YANKED",
+				message: "This release has been withdrawn"
+			}
+		};
+		if (opts?.hostEnv) {
+			const envError = assertEnvCompatible(release.requires, opts.hostEnv);
+			if (envError) return {
+				success: false,
+				error: envError
+			};
+		}
+		const releaseAgeError = checkMinimumReleaseAge(registryConfig, publisherDid, slug, packageView, releaseView);
+		if (releaseAgeError) return releaseAgeError;
+		const pluginId = await makeRegistryPluginId(publisherDid, slug);
+		if (opts?.configuredPluginIds?.has(pluginId)) return {
+			success: false,
+			error: {
+				code: "PLUGIN_ID_CONFLICT",
+				message: "A configured plugin with the same derived id already exists"
+			}
+		};
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (existing) {
+			if (existing.source === "registry") return {
+				success: false,
+				error: {
+					code: "ALREADY_INSTALLED",
+					message: `Plugin ${publisherDid}/${slug} is already installed`
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: "PLUGIN_ID_COLLISION",
+					message: `A non-registry plugin already exists at the derived id ${pluginId}. Uninstall it before installing this registry plugin.`
+				}
+			};
+		}
+		const packageArtifact = release.artifacts.package;
+		const declaredChecksum = release.artifacts.package.checksum;
+		if (!packageArtifact || !declaredChecksum) return {
+			success: false,
+			error: {
+				code: "INVALID_RELEASE",
+				message: "Release record is missing its package artifact or checksum"
+			}
+		};
+		let artifactBytes;
+		try {
+			artifactBytes = await fetchArtifact(releaseView.artifactCaches ?? [], packageArtifact, {
+				did: publisherDid,
+				collection: NSID.packageRelease,
+				rkey: `${slug}:${version}`,
+				cid: releaseView.cid
+			}, release.auth);
+		} catch (error) {
+			if (error instanceof RegistryArtifactFetchError) return registryArtifactError(error.code, error.message, "install");
+			throw error;
+		}
+		const artifactReport = await validateRegistryArtifact(artifactBytes, declaredChecksum, slug, version);
+		if (!artifactReport.success) return registryArtifactError(artifactReport.error.code, artifactReport.error.message, "install");
+		const { bundle, artifactDigest, artifactDigests } = artifactReport.value;
+		const recordReport = await verifyAuthoritativePackageRelease(records, artifactDigest, {
+			...opts?.authoritativeRecords,
+			artifactDigests
+		});
+		if (!recordReport.success) return registryRecordError(recordReport.code, recordReport.reasons[0]?.message ?? "The release provenance is invalid.");
+		const verification = recordVerificationSummary(records, recordReport);
+		bundle.manifest = {
+			...bundle.manifest,
+			id: pluginId
+		};
+		if (!verifiedAccessEqual(recordReport.value.declaredAccess, bundle.manifest.declaredAccess ?? {})) return {
+			success: false,
+			error: {
+				code: "DECLARED_ACCESS_DRIFT",
+				message: "The plugin bundle declares different permissions than its published record. Installation refused."
+			}
+		};
+		const actualCapabilities = canonicalCapabilitiesForDriftCheck(bundle.manifest.capabilities);
+		if (!opts?.verifyOnly && actualCapabilities.length > 0) {
+			if (input.acknowledgedDeclaredAccess === void 0) return {
+				success: false,
+				error: {
+					code: "DECLARED_ACCESS_REQUIRED",
+					message: "This plugin declares capabilities that require consent. Re-open the install dialog to review and acknowledge them."
+				}
+			};
+			const acknowledged = canonicalCapabilitiesForDriftCheck(input.acknowledgedDeclaredAccess);
+			if (acknowledged.length !== actualCapabilities.length || acknowledged.some((cap, i) => cap !== actualCapabilities[i])) return {
+				success: false,
+				error: {
+					code: "DECLARED_ACCESS_DRIFT",
+					message: "Plugin manifest has changed since you consented. Re-open the install dialog to review the new permissions."
+				}
+			};
+		}
+		const actualMcpTools = (bundle.manifest.mcp?.tools ?? []).map(({ inputSchema: _, outputSchema: __, ...tool }) => tool);
+		const publicRoutes = diffRouteVisibility(void 0, bundle.manifest).newlyPublic.toSorted();
+		if (!opts?.verifyOnly && publicRoutes.length > 0) {
+			const acknowledgedPublicRoutes = Array.isArray(input.acknowledgedPublicRoutes) ? input.acknowledgedPublicRoutes.filter((route) => typeof route === "string").toSorted() : [];
+			if (JSON.stringify(acknowledgedPublicRoutes) !== JSON.stringify(publicRoutes)) return {
+				success: false,
+				error: {
+					code: "ROUTE_VISIBILITY_ESCALATION",
+					message: "Plugin install exposes public (unauthenticated) routes",
+					details: {
+						routeVisibilityChanges: { newlyPublic: publicRoutes },
+						mcpTools: actualMcpTools,
+						verification
+					}
+				}
+			};
+		}
+		if (!opts?.verifyOnly && actualMcpTools.length > 0) {
+			if (JSON.stringify(input.acknowledgedMcpTools) !== JSON.stringify(actualMcpTools)) return {
+				success: false,
+				error: {
+					code: "MCP_TOOL_CONSENT_REQUIRED",
+					message: "Plugin MCP tools require explicit consent",
+					details: {
+						mcpTools: actualMcpTools,
+						routeVisibilityChanges: publicRoutes.length > 0 ? { newlyPublic: publicRoutes } : void 0,
+						verification
+					}
+				}
+			};
+		}
+		const result = {
+			pluginId,
+			publisherDid,
+			slug,
+			version,
+			capabilities: bundle.manifest.capabilities,
+			declaredAccess: recordReport.value.releaseExtension.declaredAccess,
+			mcpTools: actualMcpTools,
+			publicRoutes,
+			verification
+		};
+		if (opts?.verifyOnly) return {
+			success: true,
+			data: result
+		};
+		await storeBundleInR2(storage, pluginId, version, bundle, "registry");
+		try {
+			await stateRepo.upsert(pluginId, version, "active", {
+				source: "registry",
+				displayName: profile.name ?? slug,
+				description: profile.description ?? void 0,
+				registryPublisherDid: publisherDid,
+				registrySlug: slug
+			});
+		} catch (stateErr) {
+			let lostRace = false;
+			try {
+				const winner = await stateRepo.get(pluginId);
+				lostRace = winner !== void 0 && winner !== null;
+			} catch (probeErr) {
+				console.warn(`[registry-install] Failed to probe state row for ${pluginId} after state-write failure; treating as orphan:`, probeErr);
+			}
+			if (!lostRace) try {
+				await deleteBundleFromR2(storage, pluginId, version, "registry");
+			} catch (cleanupErr) {
+				console.warn(`[registry-install] Failed to clean up R2 bundle for ${pluginId}@${version} after state-row write failure:`, cleanupErr);
+			}
+			throw stateErr;
+		}
+		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
+		return {
+			success: true,
+			data: result
+		};
+	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) {
+			if (err.error === "ListingUnavailable") return {
+				success: false,
+				error: {
+					code: "LISTING_UNAVAILABLE",
+					message: "This plugin is unavailable under the active registry policy"
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+					message: `Aggregator returned ${err.status}: ${err.error}`
+				}
+			};
+		}
+		if (err instanceof EmDashStorageError) return {
+			success: false,
+			error: {
+				code: err.code ?? "STORAGE_ERROR",
+				message: "Storage error while installing plugin"
+			}
+		};
+		console.error("[registry-install] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "INSTALL_FAILED",
+				message: err instanceof Error ? err.message : "Failed to install plugin from registry"
+			}
+		};
+	}
+}
+/**
+* Uninstall a registry-source plugin. Deletes the R2 bundle under
+* `registry/<pluginId>/<version>/`, optionally drops the plugin's
+* `_plugin_storage` rows, and removes the `_plugin_state` row. The
+* sandbox runtime is reconciled by the route's `syncRegistryPlugins`
+* call after this returns.
+*
+* Refuses to uninstall plugins whose `source` is not `"registry"` to
+* avoid trashing a marketplace/config plugin that happens to share the
+* pluginId namespace.
+*/
+async function handleRegistryUninstall(db, storage, pluginId, opts) {
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "registry") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No registry plugin found: ${pluginId}`
+			}
+		};
+		const version = existing.version;
+		await opts?.beforeDelete?.();
+		let dataDeleted = false;
+		if (opts?.deleteData) {
+			await db.deleteFrom("_plugin_storage").where("plugin_id", "=", pluginId).execute();
+			dataDeleted = true;
+		}
+		try {
+			await removeAllPluginIndexes(db, pluginId);
+		} catch {}
+		await stateRepo.delete(pluginId);
+		if (storage) await deleteBundleFromR2(storage, pluginId, version, "registry");
+		return {
+			success: true,
+			data: {
+				pluginId,
+				dataDeleted
+			}
+		};
+	} catch (err) {
+		console.error("[registry-uninstall] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UNINSTALL_FAILED",
+				message: "Failed to uninstall plugin"
+			}
+		};
+	}
+}
+/**
+* Update a registry-source plugin to a newer release. Mirrors
+* `handleMarketplaceUpdate`: resolves the target version via the aggregator,
+* re-runs the artifact fetch / checksum / extract pipeline, diffs capabilities
+* and route visibility against the currently installed bundle, and gates
+* escalations behind `confirmCapabilityChanges` and an exact
+* `acknowledgedPublicRoutes` match so the admin re-consents to widened permissions.
+*
+* Refuses non-registry sources. Refuses when the stored state row is missing
+* the `(publisherDid, slug)` it needs to resolve against the aggregator.
+*/
+async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigInput, pluginId, opts) {
+	const registryConfig = coerceRegistryConfig(registryConfigInput);
+	if (!registryConfig) return {
+		success: false,
+		error: {
+			code: "REGISTRY_NOT_CONFIGURED",
+			message: "Registry is not configured"
+		}
+	};
+	if (!storage) return {
+		success: false,
+		error: {
+			code: "STORAGE_NOT_CONFIGURED",
+			message: "Storage is required for registry plugin updates"
+		}
+	};
+	if (!sandboxRunner || !sandboxRunner.isAvailable()) return {
+		success: false,
+		error: {
+			code: "SANDBOX_NOT_AVAILABLE",
+			message: withUnavailableReason("Sandbox runner is required", sandboxRunner)
+		}
+	};
+	try {
+		validateAggregatorUrl(registryConfig.aggregatorUrl);
+	} catch (err) {
+		return {
+			success: false,
+			error: {
+				code: "REGISTRY_NOT_CONFIGURED",
+				message: err instanceof Error ? err.message : "Invalid aggregator URL"
+			}
+		};
+	}
+	try {
+		const stateRepo = new PluginStateRepository(db);
+		const existing = await stateRepo.get(pluginId);
+		if (!existing || existing.source !== "registry") return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `No registry plugin found: ${pluginId}`
+			}
+		};
+		if (!existing.registryPublisherDid || !existing.registrySlug) return {
+			success: false,
+			error: {
+				code: "INVALID_STATE",
+				message: `Registry plugin ${pluginId} is missing publisher DID or slug in state`
+			}
+		};
+		const oldVersion = existing.version;
+		const publisherDid = existing.registryPublisherDid;
+		const slug = existing.registrySlug;
+		const { DiscoveryClient, registryLabelerPolicy } = await import("@emdash-cms/registry-client/discovery");
+		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
+		const discovery = new DiscoveryClient({
+			aggregatorUrl: registryConfig.aggregatorUrl,
+			acceptLabelers: registryConfig.acceptLabelers,
+			labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
+			fetch: timedFetch(aggregatorDeadline)
+		});
+		const MAX_LIST_PAGES = 20;
+		const releaseView = await (async () => {
+			if (!opts?.version) return discovery.getLatestRelease({
+				did: publisherDid,
+				package: slug
+			});
+			let cursor;
+			const seenCursors = /* @__PURE__ */ new Set();
+			for (let page = 0; page < MAX_LIST_PAGES; page++) {
+				if (cursor !== void 0) {
+					if (seenCursors.has(cursor)) break;
+					seenCursors.add(cursor);
+				}
+				const result = await discovery.listReleases({
+					did: publisherDid,
+					package: slug,
+					cursor,
+					limit: 50
+				});
+				for (const r of result.releases) if (r.version === opts.version) return r;
+				if (!result.cursor) break;
+				cursor = result.cursor;
+			}
+		})();
+		if (!releaseView) return {
+			success: false,
+			error: {
+				code: "NO_VERSION",
+				message: opts?.version ? `Version ${opts.version} not found for ${publisherDid}/${slug}` : `No installable release found for ${publisherDid}/${slug}`
+			}
+		};
+		if (releaseView.did !== publisherDid || releaseView.package !== slug || opts?.version !== void 0 && releaseView.version !== opts.version) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_IDENTITY_MISMATCH",
+				message: "Aggregator returned a release view that does not match the requested package or version."
+			}
+		};
+		const packageView = await discovery.getPackage({
+			did: publisherDid,
+			slug
+		});
+		if (!packageView || packageView.did !== publisherDid || packageView.slug !== slug) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_IDENTITY_MISMATCH",
+				message: "Aggregator returned a package view that does not match the installed plugin."
+			}
+		};
+		const newVersion = releaseView.version;
+		if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) return {
+			success: false,
+			error: {
+				code: "YANKED",
+				message: "Release has been withdrawn"
+			}
+		};
+		if (newVersion === oldVersion) return {
+			success: false,
+			error: {
+				code: "ALREADY_UP_TO_DATE",
+				message: "Plugin is already at the requested version"
+			}
+		};
+		if (opts?.version !== void 0) {
+			const order = compareVersions(newVersion, oldVersion);
+			if (order === null) return {
+				success: false,
+				error: {
+					code: "INVALID_VERSION",
+					message: "Installed or requested version is not valid semver"
+				}
+			};
+			if (order < 0) return {
+				success: false,
+				error: {
+					code: "DOWNGRADE_NOT_ALLOWED",
+					message: "An update cannot target a version older than the installed one"
+				}
+			};
+		}
+		const releaseAgeError = checkMinimumReleaseAge(registryConfig, publisherDid, slug, packageView, releaseView);
+		if (releaseAgeError) return releaseAgeError;
+		const authoritative = await (opts?.readAuthoritativeRecords ?? readAuthoritativePackageRelease)(publisherDid, slug, newVersion, opts?.authoritativeRecords);
+		if (!authoritative.success) return registryRecordError(authoritative.error.code, authoritative.error.message);
+		const records = authoritative.value;
+		const { profile, release } = records.inspection.value;
+		if (packageView.uri !== records.profile.uri || packageView.cid !== records.profile.cid || releaseView.uri !== records.release.uri || releaseView.cid !== records.release.cid) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RECORD_MISMATCH",
+				message: "Aggregator metadata does not match the publisher's signed records."
+			}
+		};
+		if (hasCurrentRecordLabel(packageView.labels ?? [], "security:yanked", records.profile) || hasCurrentRecordLabel(packageView.labels ?? [], "security-yanked", records.profile)) return {
+			success: false,
+			error: {
+				code: "YANKED",
+				message: "Package has been withdrawn"
+			}
+		};
+		if (opts?.confirmCapabilityChanges || (opts?.acknowledgedPublicRoutes?.length ?? 0) > 0 || opts?.confirmMcpTools) {
+			const consentError = recordConsentError({
+				profileCid: opts?.acknowledgedProfileCid,
+				releaseCid: opts?.acknowledgedReleaseCid
+			}, records);
+			if (consentError) return consentError;
+		}
+		if (opts?.hostEnv) {
+			const envError = assertEnvCompatible(release.requires, opts.hostEnv);
+			if (envError) return {
+				success: false,
+				error: envError
+			};
+		}
+		const packageArtifact = release.artifacts.package;
+		const declaredChecksum = packageArtifact?.checksum;
+		if (!packageArtifact || !declaredChecksum) return {
+			success: false,
+			error: {
+				code: "INVALID_RELEASE",
+				message: "Release record is missing its package artifact or checksum"
+			}
+		};
+		let artifactBytes;
+		try {
+			artifactBytes = await fetchArtifact(releaseView.artifactCaches ?? [], packageArtifact, {
+				did: publisherDid,
+				collection: NSID.packageRelease,
+				rkey: `${slug}:${newVersion}`,
+				cid: releaseView.cid
+			}, release.auth);
+		} catch (error) {
+			if (error instanceof RegistryArtifactFetchError) return registryArtifactError(error.code, error.message, "update");
+			throw error;
+		}
+		const artifactReport = await validateRegistryArtifact(artifactBytes, declaredChecksum, slug, newVersion);
+		if (!artifactReport.success) return registryArtifactError(artifactReport.error.code, artifactReport.error.message, "update");
+		const { bundle, artifactDigest, artifactDigests } = artifactReport.value;
+		const recordReport = await verifyAuthoritativePackageRelease(records, artifactDigest, {
+			...opts?.authoritativeRecords,
+			artifactDigests
+		});
+		if (!recordReport.success) return registryRecordError(recordReport.code, recordReport.reasons[0]?.message ?? "The release provenance is invalid.");
+		const verification = recordVerificationSummary(records, recordReport);
+		bundle.manifest = {
+			...bundle.manifest,
+			id: pluginId
+		};
+		if (!verifiedAccessEqual(recordReport.value.declaredAccess, bundle.manifest.declaredAccess ?? {})) return {
+			success: false,
+			error: {
+				code: "DECLARED_ACCESS_DRIFT",
+				message: "The plugin bundle declares different permissions than its published record. Update refused."
+			}
+		};
+		const oldBundle = await loadBundleFromR2(storage, pluginId, oldVersion, "registry");
+		const capabilityChanges = diffCapabilities(oldBundle?.manifest.capabilities ?? [], bundle.manifest.capabilities);
+		if (capabilityChanges.added.length > 0 && !opts?.confirmCapabilityChanges) return {
+			success: false,
+			error: {
+				code: "CAPABILITY_ESCALATION",
+				message: "Plugin update requires new capabilities",
+				details: {
+					capabilityChanges,
+					verification
+				}
+			}
+		};
+		const newlyPublicRoutes = diffRouteVisibility(oldBundle?.manifest, bundle.manifest).newlyPublic.toSorted();
+		const acknowledgedPublicRoutes = (opts?.acknowledgedPublicRoutes ?? []).filter((route) => typeof route === "string").toSorted();
+		if (newlyPublicRoutes.length > 0 && JSON.stringify(acknowledgedPublicRoutes) !== JSON.stringify(newlyPublicRoutes)) return {
+			success: false,
+			error: {
+				code: "ROUTE_VISIBILITY_ESCALATION",
+				message: "Plugin update exposes new public (unauthenticated) routes",
+				details: {
+					routeVisibilityChanges: { newlyPublic: newlyPublicRoutes },
+					capabilityChanges,
+					verification
+				}
+			}
+		};
+		const oldMcpTools = [...oldBundle?.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		const newMcpTools = [...bundle.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		if (JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools) && !opts?.confirmMcpTools) return {
+			success: false,
+			error: {
+				code: "MCP_TOOL_CONSENT_REQUIRED",
+				message: "Plugin update changes its MCP tools",
+				details: {
+					mcpTools: newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool),
+					verification
+				}
+			}
+		};
+		await storeBundleInR2(storage, pluginId, newVersion, bundle, "registry");
+		await stateRepo.upsert(pluginId, newVersion, "active", {
+			source: "registry",
+			registryPublisherDid: publisherDid,
+			registrySlug: slug,
+			displayName: profile.name ?? slug,
+			description: profile.description ?? void 0,
+			mcpToolsEnabled: false,
+			mcpToolsConsent: null
+		});
+		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
+		return {
+			success: true,
+			data: {
+				pluginId,
+				oldVersion,
+				newVersion,
+				capabilityChanges,
+				routeVisibilityChanges: newlyPublicRoutes.length > 0 ? { newlyPublic: newlyPublicRoutes } : void 0,
+				verification
+			}
+		};
+	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) {
+			if (err.error === "ListingUnavailable") return {
+				success: false,
+				error: {
+					code: "LISTING_UNAVAILABLE",
+					message: "This plugin is unavailable under the active registry policy"
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+					message: `Aggregator returned ${err.status}: ${err.error}`
+				}
+			};
+		}
+		if (err instanceof EmDashStorageError) return {
+			success: false,
+			error: {
+				code: err.code ?? "STORAGE_ERROR",
+				message: "Storage error while updating plugin"
+			}
+		};
+		console.error("[registry-update] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_FAILED",
+				message: err instanceof Error ? err.message : "Failed to update plugin"
+			}
+		};
+	}
+}
+/**
+* Bulk update check across every installed registry plugin. Queries the
+* aggregator for each plugin's latest release and reports `hasUpdate`
+* based on the version comparison. Plugins whose aggregator lookup fails
+* (unreachable, delisted, malformed) are skipped silently — one bad
+* publisher must not blank the whole admin Updates list.
+*/
+async function handleRegistryUpdateCheck(db, registryConfigInput) {
+	const registryConfig = coerceRegistryConfig(registryConfigInput);
+	if (!registryConfig) return {
+		success: false,
+		error: {
+			code: "REGISTRY_NOT_CONFIGURED",
+			message: "Registry is not configured"
+		}
+	};
+	try {
+		const registryPlugins = await new PluginStateRepository(db).getRegistryPlugins();
+		if (registryPlugins.length === 0) return {
+			success: true,
+			data: { items: [] }
+		};
+		const { DiscoveryClient, registryLabelerPolicy } = await import("@emdash-cms/registry-client/discovery");
+		const aggregatorDeadline = Date.now() + AGGREGATOR_TOTAL_BUDGET_MS;
+		const discovery = new DiscoveryClient({
+			aggregatorUrl: registryConfig.aggregatorUrl,
+			acceptLabelers: registryConfig.acceptLabelers,
+			labelerPolicy: registryLabelerPolicy(registryConfig.acceptLabelers),
+			fetch: timedFetch(aggregatorDeadline)
+		});
+		const items = [];
+		for (const plugin of registryPlugins) {
+			if (!plugin.registryPublisherDid || !plugin.registrySlug) continue;
+			try {
+				const releaseView = await discovery.getLatestRelease({
+					did: plugin.registryPublisherDid,
+					package: plugin.registrySlug
+				});
+				if (evaluateRegistryReleaseWithdrawal(releaseView, discovery.labelerPolicy).withdrawn) continue;
+				const latest = releaseView.version;
+				if (!latest) continue;
+				const installed = plugin.version;
+				items.push({
+					pluginId: plugin.pluginId,
+					installed,
+					latest,
+					hasUpdate: latest !== installed,
+					hasCapabilityChanges: false,
+					hasRouteVisibilityChanges: false
+				});
+			} catch (err) {
+				console.warn(`[registry-update-check] Skipped ${plugin.pluginId}:`, err);
+			}
+		}
+		return {
+			success: true,
+			data: { items }
+		};
+	} catch (err) {
+		if (err instanceof ClientValidationError) return {
+			success: false,
+			error: {
+				code: "AGGREGATOR_RESPONSE_INVALID",
+				message: `Aggregator returned a response that does not conform to its lexicon (${err.target})`
+			}
+		};
+		if (err instanceof ClientResponseError) return {
+			success: false,
+			error: {
+				code: err.status === 404 ? "AGGREGATOR_NOT_FOUND" : "AGGREGATOR_HTTP_ERROR",
+				message: `Aggregator returned ${err.status}: ${err.error}`
+			}
+		};
+		console.error("[registry-update-check] Failed:", err);
+		return {
+			success: false,
+			error: {
+				code: "UPDATE_CHECK_FAILED",
+				message: "Failed to check for registry updates"
+			}
+		};
+	}
+}
+
+//#endregion
+export { handleContentDelete as A, handleContentSchedule as B, generateManifest as C, handleContentCountScheduled as D, handleContentCompare as E, handleContentList as F, handleScheduledPolicyRejection as G, handleContentUnpublish as H, handleContentListTrashed as I, validateRev as J, storagelessDataKeyError as K, handleContentPermanentDelete as L, handleContentDuplicate as M, handleContentGet as N, handleContentCountTrashed as O, handleContentGetIncludingTrashed as P, handleContentPublish as R, buildManifestCollections as S, handleContentAuthors as T, handleContentUnschedule as U, handleContentTranslations as V, handleContentUpdate as W, handlePluginSettingsGet as _, handleMarketplaceGetPlugin as a, handleRevisionList as b, handleMarketplaceUninstall as c, handleThemeGetDetail as d, handleThemeSearch as f, getPluginSettingsSchema as g, syncDeclaredStorageIndexes as h, handleRegistryUpdateCheck as i, handleContentDiscardDraft as j, handleContentCreate as k, handleMarketplaceUpdate as l, rollbackPluginUpdate as m, handleRegistryUninstall as n, handleMarketplaceInstall as o, loadBundleFromR2 as p, liveReferenceSelection as q, handleRegistryUpdate as r, handleMarketplaceSearch as s, handleRegistryInstall as t, handleMarketplaceUpdateCheck as u, handlePluginSettingsUpdate as v, changedStoragelessDataKeys as w, handleRevisionRestore as x, handleRevisionGet as y, handleContentRestore as z };
+//# sourceMappingURL=api-CFQn8VLR.mjs.map