Plugin registry labelling service

.changeset/aggregator-get-publisher.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-lexicons": minor
+---
+
+Adds an aggregator `getPublisher` query and `publisherView` definition, returning a publisher's signed profile (display name, description, and identity-level contact channels) by DID alongside any hydrated labels — the publisher counterpart to the existing `getPackage` read.

.changeset/aggregator-publisher-verification-read.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-lexicons": minor
+---
+
+Adds the `com.emdashcms.experimental.aggregator.getPublisherVerification` query and its `publisherVerificationView` / `verificationClaimView` definitions: read the verification claims an aggregator has indexed for a publisher DID.

.changeset/core-ssrf-doh-export.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Adds a `emdash/security/ssrf` subpath export exposing the `cloudflareDohResolver` DNS-over-HTTPS resolver and the SSRF URL/address validation helpers for reuse in Workers that fetch untrusted URLs.

.changeset/discovery-empty-accept-labelers.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-client": patch
+---
+
+Sends an explicitly empty `atproto-accept-labelers` header when `DiscoveryClient` is configured with `acceptLabelers: ""`, so "accept no labelers" is honored instead of being dropped and letting the aggregator apply its trusted defaults. Omitting the option entirely still sends no header.

.changeset/lucky-labelers-admin-moderation.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/admin": patch
+---
+
+The registry browser now shows moderation state: blocked releases are visibly blocked with an explanation, warning-labelled releases ask for confirmation before install, and the plugin manager flags blocked or warned updates.

.changeset/lucky-labelers-contract.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-lexicons": patch
+---
+
+Adds experimental labeler assessment and policy query contracts.

.changeset/lucky-labelers-search-description.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-lexicons": patch
+---
+
+Updates the `searchPackages` description to the canonical moderation vocabulary.

.changeset/quiet-labels-moderate.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-client": patch
+---
+
+Adds release moderation evaluation over hydrated aggregator labels and exposes the atproto-content-labelers response header.

.changeset/registry-moderation-stack-initial.md

@@ -0,0 +1,9 @@
+---
+"@emdash-cms/registry-moderation": minor
+"@emdash-cms/registry-verification": minor
+---
+
+Initial release of the plugin-registry moderation stack.
+
+- `@emdash-cms/registry-moderation`: ATProto signed-label parsing, encoding, and public-key verification; release moderation evaluation over both signed and aggregator-hydrated labels (package and publisher cascades, CID-bound labels, negation and expiry); the shared hard-block and warning label vocabularies; the `atproto-accept-labelers` / `atproto-content-labelers` negotiation headers; and `isModerationBlocking`, the canonical blocking predicate for enforcement consumers.
+- `@emdash-cms/registry-verification`: runtime-neutral primitives (Node and workerd) for verifying plugin release artifacts — multihash checksums, SSRF-guarded artifact fetch, canonical tarball and bundle structure validation with a validated file inventory, and Sigstore build-provenance verification.

.changeset/tidy-labels-enforce.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Registry install and update now evaluate the full moderation label set (package and publisher cascades, CID-bound labels, negation and expiry) instead of a single yanked-label string match. The update-check and artifact proxy endpoints also gate on this evaluation.

.changeset/tidy-plugins-eligible.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/plugin-cli": patch
+---
+
+Search and info now show moderation eligibility for registry packages instead of raw label values.

.github/workflows/ci.yml

@@ -124,6 +124,9 @@ jobs:
       - run: pnpm test:unit
         env:
           EMDASH_TEST_PG: postgres://postgres:test@localhost:5432/emdash_test
+      - run: pnpm --filter @emdash-cms/labeler build
+      - run: pnpm --filter @emdash-cms/labeler typecheck
+      - run: pnpm --filter @emdash-cms/labeler test
       # Render tests use the Astro Vite plugin (vitest.repro.config.ts);
       # they can't run under the plain-node config in test:unit.
       - run: pnpm --filter emdash exec vitest run --config vitest.repro.config.ts

.gitignore

@@ -75,6 +75,10 @@ examples/wp-theme-unit-test/
 # pattern so we can re-include the agents subdirectory.
 .opencode/*
 !.opencode/agents/
+!.opencode/plans/
+.opencode/plans/*
+!.opencode/plans/plugin-registry-labelling-service/
+!.opencode/plans/plugin-registry-labelling-service/**
 
 # .claude is local-only EXCEPT for the symlinks pointing at AGENTS.md and skills/
 .claude/*