@@ -121,10 +136,11 @@ export function RegistryBrowse({ config, installedRegistryUris = new Set() }: Re
{/* Grid */}
{packages && packages.length > 0 ? (
- {packages.map((pkg) => (
+ {packages.map(({ pkg, accepted }) => (
))}
@@ -150,10 +166,12 @@ export function RegistryBrowse({ config, installedRegistryUris = new Set() }: Re
interface RegistryPackageCardProps {
pkg: RegistryPackageView;
+ /** Accepted labeler policy resolved from the search response that returned `pkg`. */
+ accepted: AcceptedLabelerPolicy[];
installed: boolean;
}
-function RegistryPackageCard({ pkg, installed }: RegistryPackageCardProps) {
+function RegistryPackageCard({ pkg, accepted, installed }: RegistryPackageCardProps) {
const { t } = useLingui();
const handleResult = usePublisherHandle(pkg.did, pkg.handle);
// Always link by handle when we have one (cleaner URL), DID
@@ -166,6 +184,10 @@ function RegistryPackageCard({ pkg, installed }: RegistryPackageCardProps) {
const description = pkg.profile?.description;
const license = pkg.profile?.license;
const verified = (pkg.labels ?? []).some((l: { val?: string }) => l.val === "verified");
+ // Package/publisher-scope moderation only -- no release is in view yet on
+ // a browse card. `verified` above is unrelated: that shield is out of
+ // moderation scope pending its own ratification.
+ const blocked = isModerationBlocking(evaluatePackageModeration(pkg, accepted));
return (
{description}
) : null}
{license ?
{license}
: null}
- {installed ? (
-
-
{t`Installed`}
+ {installed || blocked ? (
+
+ {installed ? {t`Installed`} : null}
+ {blocked ? (
+
+
+
+ {t`Blocked`}
+
+
+ ) : null}
) : null}
diff --git a/packages/admin/src/components/RegistryPluginDetail.tsx b/packages/admin/src/components/RegistryPluginDetail.tsx
index 53269b23dc..82db2efaa7 100644
--- a/packages/admin/src/components/RegistryPluginDetail.tsx
+++ b/packages/admin/src/components/RegistryPluginDetail.tsx
@@ -17,10 +17,11 @@ import { Badge, Button, LinkButton, Select, Tabs, Tooltip } from "@cloudflare/ku
import type { TabsItem } from "@cloudflare/kumo";
import { declaredAccessToCapabilities, type DeclaredAccess } from "@emdash-cms/plugin-types";
import { checkEnvCompatibility } from "@emdash-cms/registry-client/env";
+import { i18n } from "@lingui/core";
import type { MessageDescriptor } from "@lingui/core";
-import { msg } from "@lingui/core/macro";
+import { msg, plural } from "@lingui/core/macro";
import { useLingui } from "@lingui/react/macro";
-import { ShieldCheck, Warning } from "@phosphor-icons/react";
+import { ShieldCheck, ShieldWarning, Warning } from "@phosphor-icons/react";
import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
import { Link } from "@tanstack/react-router";
import * as React from "react";
@@ -29,23 +30,30 @@ import { fetchManifest } from "../lib/api/client.js";
import {
artifactProxyUrl,
canonicalCapabilitiesForDriftCheck,
+ describeModerationLabel,
+ describeRegistryModerationError,
+ evaluateReleaseViews,
extractMediaArtifacts,
extractSbom,
getRegistryPackage,
hostEnvFromManifest,
installRegistryPlugin,
+ isModerationBlocking,
listRegistryReleases,
presentSections,
releasePassesPolicy,
+ resolveAcceptedPolicy,
+ unionAcceptedPolicies,
resolveRegistryPackage,
sbomDownloadHref,
+ type ReleaseModeration,
type RegistryClientConfig,
type RegistryReleaseView,
type SectionKey,
} from "../lib/api/registry.js";
import { renderMarkdown } from "../lib/markdown.js";
import { ArrowPrev } from "./ArrowIcons.js";
-import { CapabilityConsentDialog } from "./CapabilityConsentDialog.js";
+import { CapabilityConsentDialog, type ModerationLabelEntry } from "./CapabilityConsentDialog.js";
import { getMutationError } from "./DialogError.js";
import { PublisherHandle, usePublisherHandle } from "./PublisherHandle.js";
@@ -98,7 +106,15 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
// When linked by DID, go straight to `getPackage(did, slug)`. Either
// way we end up with the same `RegistryPackageView` shape.
const { data: pkg, isLoading: isLoadingPkg } = useQuery({
- queryKey: ["registry", "package", config.aggregatorUrl, publisher, slug, isDid],
+ queryKey: [
+ "registry",
+ "package",
+ config.aggregatorUrl,
+ config.acceptLabelers,
+ publisher,
+ slug,
+ isDid,
+ ],
queryFn: () =>
isDid
? getRegistryPackage(config, publisher, slug)
@@ -112,13 +128,13 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
// DID, because that's an impersonation risk).
const handleResult = usePublisherHandle(pkg?.did ?? "", pkg?.handle);
- // `listReleases` returns releases in descending semver order. The aggregator
- // strips yanked releases server-side when `acceptLabelers` includes a labeler
- // applying the `security:yanked` label, but sites with no labeler config
- // receive yanked releases interleaved by version. Filter them out client-side
- // as defense in depth so the picker never offers an actively-yanked install.
- // Lexicon-invalid records (`release === null`) are also filtered: they carry
- // no actionable metadata and can't be installed.
+ // `listReleases` returns releases in descending semver order. Every
+ // release renders in the picker, including a moderation-blocked one
+ // (`security-yanked`, `!takedown`, etc.) -- blocking is surfaced via the
+ // moderation panel and a disabled Install button below, not by hiding the
+ // release from the list. Only lexicon-invalid records (`release ===
+ // null`) are filtered here: they carry no actionable metadata and can't
+ // be installed regardless of moderation state.
// `limit: 100` is the lexicon ceiling; one page covers the long tail of
// real packages without needing cursor follow-up. Packages with more than
// 100 releases would still lose access to the oldest, but that's far past
@@ -130,11 +146,50 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
});
const releases = React.useMemo
(
- () => (releasesData?.releases ?? []).filter((r) => r.release !== null && !isYanked(r)),
+ () => (releasesData?.releases ?? []).filter((r) => r.release !== null),
[releasesData],
);
const hasFilteredAllReleases = (releasesData?.releases.length ?? 0) > 0 && releases.length === 0;
+ // Moderation, evaluated per release against the accepted policy that
+ // actually produced each response's labels -- the aggregator reports what
+ // it applied per request via `atproto-content-labelers`, and package-scope
+ // labels ride on the package response while release-scope labels ride on
+ // the releases response. Both header-derived policies are unioned (a
+ // labeler either response honored is honored here) so a package/publisher
+ // block filtered out of the releases policy is still surfaced; a union can
+ // only add applicable labels' sources, never drop a real block.
+ const acceptedForReleases = React.useMemo(
+ () =>
+ unionAcceptedPolicies(
+ resolveAcceptedPolicy({
+ configuredAcceptLabelers: config.acceptLabelers,
+ contentLabelersHeader: pkg?.contentLabelers,
+ }),
+ resolveAcceptedPolicy({
+ configuredAcceptLabelers: config.acceptLabelers,
+ contentLabelersHeader: releasesData?.contentLabelers,
+ }),
+ ),
+ [config.acceptLabelers, pkg?.contentLabelers, releasesData?.contentLabelers],
+ );
+ const moderationByVersion = React.useMemo(() => {
+ const map = new Map();
+ if (!pkg) return map;
+ for (const r of releases) {
+ map.set(
+ r.version,
+ evaluateReleaseViews({
+ packageView: pkg,
+ releaseView: r,
+ publisherDid: pkg.did,
+ accepted: acceptedForReleases,
+ }),
+ );
+ }
+ return map;
+ }, [pkg, releases, acceptedForReleases]);
+
// Default to the highest semver that passes the policy holdback. When every
// release is still inside the holdback window, fall back to the highest
// listed version — installation stays disabled (with the holdback banner)
@@ -178,6 +233,31 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
);
const isPreRelease = release ? isPreReleaseVersion(release.version) : false;
+ // Moderation state of the selected release. Consumers must key off
+ // `isModerationBlocking(...)` / `warningLabels`, never `eligibility`
+ // directly -- see the JSDoc on `RegistryUpdateCheck.moderation` in
+ // packages/core's registry handler for why.
+ const selectedModeration = release ? moderationByVersion.get(release.version) : undefined;
+ const isModerationBlocked = selectedModeration ? isModerationBlocking(selectedModeration) : false;
+ const moderationWarningEntries = React.useMemo(() => {
+ if (!selectedModeration) return [];
+ return selectedModeration.applicableLabels
+ .filter((l) => selectedModeration.warningLabels.includes(l.val))
+ .map((l) => {
+ const { name, description } = describeModerationLabel(l.val);
+ return { value: l.val, name, description, issuerDid: l.src };
+ });
+ }, [selectedModeration]);
+ const moderationBlockingEntries = React.useMemo(() => {
+ if (!selectedModeration) return [];
+ return selectedModeration.applicableLabels
+ .filter((l) => selectedModeration.blockingLabels.includes(l.val))
+ .map((l) => {
+ const { name, description } = describeModerationLabel(l.val);
+ return { value: l.val, name, description, issuerDid: l.src };
+ });
+ }, [selectedModeration]);
+
// `release.extensions[com.emdashcms.experimental.package.releaseExtension]`
// carries the structured `declaredAccess` -- the trust contract. The sandbox
// enforces the legacy `capabilities: string[]` shape, so we derive that list
@@ -512,6 +592,10 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
{ did: pkg.did, slug },
config.policy,
);
+ const releaseModeration = moderationByVersion.get(r.version);
+ const moderationBlocked = releaseModeration
+ ? isModerationBlocking(releaseModeration)
+ : false;
return (
@@ -522,6 +606,9 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
{policyBlocked ? (
{t`(too new)`}
) : null}
+ {moderationBlocked ? (
+ {t`(blocked)`}
+ ) : null}
);
@@ -535,7 +622,13 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
) : (
) : null}
- {/* All releases withdrawn or malformed — the aggregator returned
- records but none survived the yanked + lexicon-validity filter. */}
+ {/* All releases malformed — the aggregator returned records but none
+ survived the lexicon-validity filter. */}
{hasFilteredAllReleases ? (
) : null}
+ {/* Moderation panel for the selected release. Distinguishes a hard
+ block (error styling, install disabled -- already enforced above)
+ from warning-only labels (which stay installable behind the
+ consent dialog's warnings section). `suppressedLabels` / override
+ display is deferred until overrides exist. */}
+ {release && selectedModeration && isModerationBlocked ? (
+
+
+
+
{t`This release is blocked`}
+
+ {t`A moderation label prevents this release from being installed.`}
+
+
+ {moderationBlockingEntries.map((entry) => (
+
+ ))}
+
+
+
+ ) : null}
+
+ {release &&
+ selectedModeration &&
+ !isModerationBlocked &&
+ moderationWarningEntries.length > 0 ? (
+
+
+
+
{t`This release has moderation warnings`}
+
{t`Review these before installing.`}
+
+ {moderationWarningEntries.map((entry) => (
+
+ ))}
+
+
+
+ ) : null}
+
{/* Description */}
{description ?
{description}
: null}
@@ -773,8 +912,12 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
mode="install"
pluginName={displayName ?? slug}
capabilities={capabilities}
+ moderationWarnings={moderationWarningEntries}
isPending={installMutation.isPending}
- error={getMutationError(installMutation.error)}
+ error={
+ describeRegistryModerationError(installMutation.error) ??
+ getMutationError(installMutation.error)
+ }
onConfirm={() => installMutation.mutate()}
onCancel={() => {
setShowConsent(false);
@@ -794,6 +937,36 @@ const SECTION_LABELS: Record
= {
security: msg`Security`,
};
+/**
+ * One row in the moderation panel: label name, description, and a tooltip
+ * trigger naming the issuing labeler DID -- the same icon-plus-tooltip
+ * pattern the verified-publisher shield uses above, so the admin can judge
+ * who issued the label, not just that some labeler did.
+ */
+function ModerationLabelRow({ entry }: { entry: ModerationLabelEntry }) {
+ const { t } = useLingui();
+ return (
+
+
+
+
+ }
+ />
+
+
{entry.name}
+ {entry.description ?
{entry.description}
: null}
+