diff --git a/.changeset/big-hands-peel.md b/.changeset/big-hands-peel.md
deleted file mode 100644
index 167166f06d..0000000000
--- a/.changeset/big-hands-peel.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-"@emdash-cms/plugin-cli": minor
-"@emdash-cms/registry-client": minor
----
-
-Adds `emdash-plugin update-package`, a CLI command for editing an already-published plugin's registry record (license, authors, security contacts, name, description, keywords) without cutting a new release. Without `--yes` it prints a diff and exits without writing; with `--yes` it writes the updated record to the publisher's PDS using atproto's `swapRecord` precondition (concurrent writes surface as `STALE_RECORD` instead of silently overwriting each other) and bumps `lastUpdated`. Optional fields use a "manifest absent = no change" policy: removing a key from the manifest doesn't wipe the published value, matching `publish` semantics. Renaming a plugin via the manifest now surfaces a "looks like a rename" message listing the publisher's existing packages instead of a generic not-found, so publishers don't accidentally orphan releases under the old slug.
-
-The publishing client (`@emdash-cms/registry-client`) gains a `swapRecord` parameter on `putRecord` and `unsafePutRecord` for callers needing optimistic-concurrency writes.
diff --git a/.changeset/bump-kumo-to-2.x.md b/.changeset/bump-kumo-to-2.x.md
deleted file mode 100644
index ff401d3208..0000000000
--- a/.changeset/bump-kumo-to-2.x.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-"@emdash-cms/admin": patch
-"@emdash-cms/blocks": patch
-"@emdash-cms/auth-atproto": patch
----
-
-Bumps `@cloudflare/kumo` from 1.16 to 2.3. Two internal call sites picked up breaking API changes from Kumo 2.0: `Collapsible` is now a compound component (`Collapsible.Root` / `.DefaultTrigger` / `.DefaultPanel` instead of `<Collapsible label=...>`), used by the accordion block; and `ChartPalette.color()` was renamed to `ChartPalette.categorical()` in the chart block. No public API changes -- consumers see identical behaviour. Tests in `@emdash-cms/admin` that asserted on `Button`'s native `title` attribute now read `aria-label` instead, because Kumo 2 wraps `<Button title>` in a Tooltip popup rather than setting the DOM attribute.
diff --git a/.changeset/bumpy-crabs-nail.md b/.changeset/bumpy-crabs-nail.md
deleted file mode 100644
index 797a77aa0a..0000000000
--- a/.changeset/bumpy-crabs-nail.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-"emdash": minor
-"@emdash-cms/cloudflare": patch
-"@emdash-cms/sandbox-workerd": minor
----
-
-Adds workerd-based plugin sandboxing for Node.js deployments.
-
-- **emdash**: Adds `isHealthy()` to `SandboxRunner` interface, `SandboxUnavailableError` class, `sandbox: false` config option, `mediaStorage` field on `SandboxOptions`, and exports `createHttpAccess`/`createUnrestrictedHttpAccess`/`PluginStorageRepository`/`UserRepository`/`OptionsRepository` for platform adapters.
-- **@emdash-cms/cloudflare**: Implements `isHealthy()` on `CloudflareSandboxRunner`. Fixes `storageQuery()` and `storageCount()` to honor `where`, `orderBy`, and `cursor` options (previously ignored, causing infinite pagination loops and incorrect filtered counts). Adds `storageConfig` to `PluginBridgeProps` so `PluginStorageRepository` can use declared indexes.
-- **@emdash-cms/sandbox-workerd**: New package. `WorkerdSandboxRunner` for production (workerd child process + capnp config + authenticated HTTP backing service) and `MiniflareDevRunner` for development.
diff --git a/.changeset/bylines-i18n.md b/.changeset/bylines-i18n.md
deleted file mode 100644
index 88c18c5bda..0000000000
--- a/.changeset/bylines-i18n.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-"emdash": minor
-"@emdash-cms/admin": minor
-"@emdash-cms/auth": minor
----
-
-Adds first-class i18n support for bylines, mirroring the row-per-locale model already used by menus and taxonomies (PR #916, migrations 036).
-
-## Schema (migration 040)
-
-`_emdash_bylines` gains two columns:
-
-- `locale` — `TEXT NOT NULL DEFAULT 'en'`. Every row now belongs to exactly one locale.
-- `translation_group` — `TEXT NOT NULL`. Shared across every locale variant of a single byline identity. The anchor row's `translation_group` equals its `id`; siblings inherit it.
-
-A partial unique index `idx_bylines_group_locale_unique` enforces one row per `(translation_group, locale)`. The pre-existing `(slug)` unique index becomes `(slug, locale)` to allow the same slug across locales.
-
-Existing rows are backfilled to the configured `defaultLocale` (or `'en'` if i18n isn't configured) with `translation_group = id`. Monolingual sites see no functional change; multilingual sites continue rendering the same byline data at the default locale until editors create translations.
-
-## Credit hydration: strict per-locale
-
-`_emdash_content_bylines.byline_id` now stores the byline's `translation_group`, not its row id. When an entry is rendered, credits are filtered by joining the junction against the byline sibling whose `locale` matches the entry's `locale`. If no sibling exists at the entry's locale, the credit hydrates as empty — there is **no fallback** to other locales' bios.
-
-Author-inferred bylines (where an entry has no explicit credits but its author is linked to a byline) still fall back per-locale and respect the strictness gate: an entry with explicit credits at any locale will not infer from the author even if the explicit credits don't resolve at the rendering locale.
-
-This is a deliberate behavior change for multilingual sites. The motivation is correctness: chain-walking credits across locales renders the wrong-language bio on translated entries.
-
-The "explicit credit suppresses author fallback" check reads `primary_byline_id` directly from the content row — set by `setContentBylines` iff junction rows exist, backfilled by migration 040 for pre-existing rows. No separate probe against `_emdash_content_bylines` is needed at hydration time; the column is folded into the single per-entry context fetch (`author_id` + `primary_byline_id` in one query). Both monolingual and multilingual sites get the same query count.
-
-## Identity lookups: chain-walk
-
-`getBylineBySlug(slug, { locale })` walks the configured fallback chain (`resolveLocaleChain`), like `getMenu` and `getTerm`. Author pages for un-translated bylines still render an identity rather than 404'ing. This is conceptually distinct from credit hydration and runs through `requestCached` for per-render dedupe.
-
-## Admin
-
-- **TranslationsPanel** in the bylines editor lists every configured locale with Edit / Translate buttons. The Translate action POSTs to the new `POST /_emdash/api/admin/bylines/:id/translations` endpoint.
-- **LocaleSwitcher** on `/bylines` filters the list strictly to one locale. Cross-locale navigation via TranslationsPanel routes through `/bylines?locale=…`.
-- The **byline picker** on the content editor is locale-pinned to the entry's locale. Editors only see bylines that will actually hydrate at the entry's locale.
-- The **byline credit empty state** on a locale with no bylines yet shows a CTA linking to `/bylines?locale=…` for inline creation.
-- Translating an entry (`POST /content/:collection` with `translationOf`) calls `copyContentBylines` to inherit the source's credits — these resolve at the new entry's locale via the strict-hydration model, so credits "follow" the content across translations once sibling bylines exist.
-
-## API additions
-
-- `GET /_emdash/api/admin/bylines/:id/translations` — list every sibling row sharing a translation_group.
-- `POST /_emdash/api/admin/bylines/:id/translations` — create a sibling at a target locale. Body defaults (slug, displayName, websiteUrl, avatar) inherit from the source.
-- `POST /_emdash/api/admin/bylines` accepts `translationOf` + `locale` to create a sibling in one call.
-- `GET /_emdash/api/admin/bylines?locale=…` filters strictly.
-- `BylineSummary` gains `locale: string` and `translationGroup: string | null` (additive — existing consumers ignore the new fields).
-
-## Permissions
-
-Two new entries on `@emdash-cms/auth`:
-
-- `bylines:read` — minimum `SUBSCRIBER`.
-- `bylines:manage` — minimum `EDITOR`.
-
-All byline routes (list, get, update, delete, translations) now check these instead of `content:read` / `Role.EDITOR`. Role thresholds are unchanged, so existing users see no permission differences. Custom RBAC configurations that bind to the old strings should add the new permission names.
-
-## Repository
-
-- `BylineRepository` is strict per-locale: `findMany`, `findBySlug`, `findById` accept an optional `locale` and return rows matching that locale (or all locales when omitted, for the manager view).
-- New methods: `listTranslations(id)`, `findByTranslationGroup(group)`, `copyContentBylines(collection, fromId, toId)`.
-- `setContentBylines` deduplicates by `translation_group` after resolving wire row ids, so passing two sibling row ids of the same identity collapses to one credit row.
-- `delete` is sibling-aware: removing one locale variant leaves siblings standing.
-
-## Notable trade-offs
-
-- **Strict hydration over chain-walking** for credits. Chain-walking would render mismatched-language bios on translated content. The honest answer is to show nothing rather than the wrong thing; the picker tells editors which bylines will resolve at the entry's locale, and the empty-state CTA makes creating a sibling a one-click flow.
-- **Schema is row-per-locale**, not a separate `byline_translations` side-table. Matches the existing content / menu / taxonomy convention so query patterns and indexes are consistent across the codebase.
diff --git a/.changeset/code-block-language-picker.md b/.changeset/code-block-language-picker.md
deleted file mode 100644
index 75dea7cc0b..0000000000
--- a/.changeset/code-block-language-picker.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@emdash-cms/admin": minor
-"emdash": minor
----
-
-Code blocks in the rich text editor now have an inline language picker. Hover over any code block to reveal a chip in the corner; click it to enter a language (free-form input with curated suggestions for ~30 common languages including TypeScript, Python, Bash, Rust, Astro, SQL, and more). Aliases resolve automatically -- typing `ts` stores `typescript`, `c++` stores `cpp`, etc. The existing markdown shortcut (typing ` ```html ` followed by a space or Enter) continues to pre-populate the language. The chosen language persists on the Portable Text `language` field and is emitted as a `language-{id}` class on the rendered `<pre>` so frontend syntax highlighters can pick it up. The visual (in-place) editor gets the same picker UI.
diff --git a/.changeset/fine-tables-mix.md b/.changeset/fine-tables-mix.md
deleted file mode 100644
index 994e577009..0000000000
--- a/.changeset/fine-tables-mix.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-"emdash": patch
-"@emdash-cms/auth": patch
-"@emdash-cms/cloudflare": patch
-"@emdash-cms/auth-atproto": patch
----
-
-Upgrades `kysely` to `^0.29.0` (was `^0.27.0`) to resolve three high-severity advisories fixed in `>=0.28.17`:
-
-- GHSA-wmrf-hv6w-mr66 – SQL injection via unsanitized JSON path keys
-- GHSA-pv5w-4p9q-p3v2 – JSON-path traversal injection via `JSONPathBuilder.key()` / `.at()`
-- GHSA-8cpq-38p9-67gx – MySQL SQL injection via `sql.lit(string)`
-
-Also updates import paths for `Migrator` and `Migration` types to `kysely/migration` to comply with kysely 0.29 export changes.
diff --git a/.changeset/fix-autosave-block-fields.md b/.changeset/fix-autosave-block-fields.md
deleted file mode 100644
index 1924985ea7..0000000000
--- a/.changeset/fix-autosave-block-fields.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@emdash-cms/admin": patch
----
-
-Fixes auto-save not detecting plugin block field changes. When editing an existing block's attributes via the Block Kit modal, the change now correctly triggers TipTap's `onUpdate` callback, propagating through to the auto-save dirty detection.
diff --git a/.changeset/registry-lifecycle.md b/.changeset/registry-lifecycle.md
deleted file mode 100644
index 082af0fa41..0000000000
--- a/.changeset/registry-lifecycle.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"@emdash-cms/admin": minor
-"emdash": minor
----
-
-Plugins installed from the experimental registry can now be uninstalled and updated from the admin, the same way marketplace plugins always could. The "uninstall is not yet available for registry plugins" placeholder is gone — registry plugin rows now show the same Uninstall and Update buttons.
-
-The Plugins page's "updates available" indicator now covers registry plugins too. If the registry aggregator is unreachable, marketplace updates still load (and vice versa).
-
-Updates that need newly-declared permissions, or that newly expose a public (unauthenticated) route, prompt for re-consent before installing the new version — matching the gate that marketplace updates already have.
diff --git a/.changeset/registry-release-picker.md b/.changeset/registry-release-picker.md
deleted file mode 100644
index 5c733e0eca..0000000000
--- a/.changeset/registry-release-picker.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-"@emdash-cms/admin": minor
-"emdash": minor
----
-
-Adds a version picker to the registry plugin detail page. Older releases of a registry-hosted plugin are now selectable from a dropdown next to the Install button, and the displayed version, indexed date, permissions, and source link swap to match the selected release. Pre-release versions (e.g. `1.0.0-alpha.1`) are flagged with a "Pre-release" badge so admins can spot them before installing. Versions still inside the configured minimum-release-age holdback remain visible in the dropdown but stay non-installable until they age into the window.
diff --git a/.changeset/slick-peaches-wear.md b/.changeset/slick-peaches-wear.md
deleted file mode 100644
index 7ecf95bb6b..0000000000
--- a/.changeset/slick-peaches-wear.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-"@emdash-cms/plugin-cli": patch
----
-
-Refactors the build pipeline's runtime validation of the probed plugin's
-default export to use a Zod schema. Error messages keep the same format
-(`hook "X" must be a function or { handler, ... }`, `hook "X" has
-invalid FIELD VALUE (...)`). Exotic-object entries (Date, RegExp,
-Promise, class instances) now produce the wrong-shape error instead of
-falling through to a misleading "missing handler" error. BigInt /
-cyclic-object / function / symbol field values are rendered safely in
-error messages instead of crashing with a TypeError.
diff --git a/.changeset/workerd-kysely-catalog.md b/.changeset/workerd-kysely-catalog.md
deleted file mode 100644
index b900634f8c..0000000000
--- a/.changeset/workerd-kysely-catalog.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@emdash-cms/sandbox-workerd": patch
----
-
-Aligns the `kysely` peer dependency with the rest of the monorepo (`>=0.29.0`) and switches the dev/peer references to the workspace catalog so all packages bump in lockstep going forward.
diff --git a/.changeset/workerd-typed-bridge.md b/.changeset/workerd-typed-bridge.md
deleted file mode 100644
index e4b52c6d07..0000000000
--- a/.changeset/workerd-typed-bridge.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-"@emdash-cms/sandbox-workerd": patch
----
-
-Tightens the workerd sandbox internals so the package now lints and type-checks cleanly.
-
-- Bridge call bodies are validated with predicate-backed `require*` / `optional*` helpers instead of unchecked `as` casts. A misbehaving plugin that sends a malformed JSON-RPC body now gets a clear "Parameter X must be Y" error rather than triggering a downstream type confusion.
-- Content table access (`ec_*` collections) is centralised behind a typed `asContentDb()` helper. Known tables (`users`, `media`, `_plugin_storage`) drop their `as keyof Database` casts entirely.
-- HTTP `init` marshalling validates each field at the bridge boundary, including form-data parts.
-- The backing service uses a typed `HttpError` class for status-bearing errors and validates incoming chunks/body shape defensively.
-- `getPluginStorageConfig()` returns the real `PluginStorageConfig` shape from the manifest instead of `Record<string, unknown>`.
-- `WorkerdSandboxedPlugin` now implements the correct `SandboxedPluginInstance` interface (the old `SandboxedPlugin` symbol did not exist).
-- Adds a `typecheck` script (`tsgo --noEmit`) so the package participates in `pnpm typecheck` going forward.
-
-No runtime behaviour changes.
diff --git a/fixtures/perf-site/CHANGELOG.md b/fixtures/perf-site/CHANGELOG.md
index 49a54e03cb..e7bb4c964f 100644
--- a/fixtures/perf-site/CHANGELOG.md
+++ b/fixtures/perf-site/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @emdash-cms/fixture-perf-site
 
+## 0.0.11
+
+### Patch Changes
+
+- Updated dependencies [[`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92)]:
+  - emdash@0.15.0
+  - @emdash-cms/cloudflare@0.15.0
+
 ## 0.0.10
 
 ### Patch Changes
diff --git a/fixtures/perf-site/package.json b/fixtures/perf-site/package.json
index ee4bf8cdd4..fd5df2a419 100644
--- a/fixtures/perf-site/package.json
+++ b/fixtures/perf-site/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/fixture-perf-site",
-	"version": "0.0.10",
+	"version": "0.0.11",
 	"private": true,
 	"type": "module",
 	"description": "Fixture site for query-count perf snapshots. Runs under sqlite+node or d1+cloudflare based on EMDASH_FIXTURE_TARGET.",
@@ -21,7 +21,7 @@
 		"astro": "catalog:",
 		"better-sqlite3": "catalog:",
 		"emdash": "workspace:*",
-    "kysely": "^0.29.0",
+		"kysely": "^0.29.0",
 		"react": "catalog:",
 		"react-dom": "catalog:"
 	},
diff --git a/infra/blog-demo/CHANGELOG.md b/infra/blog-demo/CHANGELOG.md
index 28c20027ae..1816b52874 100644
--- a/infra/blog-demo/CHANGELOG.md
+++ b/infra/blog-demo/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @emdash-cms/perf-demo-site
 
+## 0.0.11
+
+### Patch Changes
+
+- Updated dependencies [[`cf3c706`](https://github.com/emdash-cms/emdash/commit/cf3c706a65087696eb6cca5844b7668a50e4a090), [`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92), [`463c7a2`](https://github.com/emdash-cms/emdash/commit/463c7a23036d55fee3f5105c1a878c9abdee2e1f)]:
+  - @emdash-cms/plugin-cli@0.4.0
+  - emdash@0.15.0
+  - @emdash-cms/cloudflare@0.15.0
+  - @emdash-cms/plugin-webhook-notifier@0.2.0
+
 ## 0.0.10
 
 ### Patch Changes
diff --git a/infra/blog-demo/package.json b/infra/blog-demo/package.json
index 764d0564b4..7d806a0650 100644
--- a/infra/blog-demo/package.json
+++ b/infra/blog-demo/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/perf-demo-site",
-	"version": "0.0.10",
+	"version": "0.0.11",
 	"private": true,
 	"type": "module",
 	"scripts": {
diff --git a/infra/cache-demo/CHANGELOG.md b/infra/cache-demo/CHANGELOG.md
index 79fe28cab0..4d9debc581 100644
--- a/infra/cache-demo/CHANGELOG.md
+++ b/infra/cache-demo/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @emdash-cms/cache-demo-site
 
+## 0.0.11
+
+### Patch Changes
+
+- Updated dependencies [[`cf3c706`](https://github.com/emdash-cms/emdash/commit/cf3c706a65087696eb6cca5844b7668a50e4a090), [`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92), [`463c7a2`](https://github.com/emdash-cms/emdash/commit/463c7a23036d55fee3f5105c1a878c9abdee2e1f)]:
+  - @emdash-cms/plugin-cli@0.4.0
+  - emdash@0.15.0
+  - @emdash-cms/cloudflare@0.15.0
+  - @emdash-cms/plugin-webhook-notifier@0.2.0
+
 ## 0.0.10
 
 ### Patch Changes
diff --git a/infra/cache-demo/package.json b/infra/cache-demo/package.json
index 59cadef45a..671c06ab9f 100644
--- a/infra/cache-demo/package.json
+++ b/infra/cache-demo/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/cache-demo-site",
-	"version": "0.0.10",
+	"version": "0.0.11",
 	"private": true,
 	"type": "module",
 	"scripts": {
diff --git a/packages/admin/CHANGELOG.md b/packages/admin/CHANGELOG.md
index 0b83a07335..a223d89b3a 100644
--- a/packages/admin/CHANGELOG.md
+++ b/packages/admin/CHANGELOG.md
@@ -1,5 +1,87 @@
 # @emdash-cms/admin
 
+## 0.15.0
+
+### Minor Changes
+
+- [#1146](https://github.com/emdash-cms/emdash/pull/1146) [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b) Thanks [@MohamedH1998](https://github.com/MohamedH1998)! - Adds first-class i18n support for bylines, mirroring the row-per-locale model already used by menus and taxonomies (PR #916, migrations 036).
+
+  ## Schema (migration 040)
+
+  `_emdash_bylines` gains two columns:
+  - `locale` — `TEXT NOT NULL DEFAULT 'en'`. Every row now belongs to exactly one locale.
+  - `translation_group` — `TEXT NOT NULL`. Shared across every locale variant of a single byline identity. The anchor row's `translation_group` equals its `id`; siblings inherit it.
+
+  A partial unique index `idx_bylines_group_locale_unique` enforces one row per `(translation_group, locale)`. The pre-existing `(slug)` unique index becomes `(slug, locale)` to allow the same slug across locales.
+
+  Existing rows are backfilled to the configured `defaultLocale` (or `'en'` if i18n isn't configured) with `translation_group = id`. Monolingual sites see no functional change; multilingual sites continue rendering the same byline data at the default locale until editors create translations.
+
+  ## Credit hydration: strict per-locale
+
+  `_emdash_content_bylines.byline_id` now stores the byline's `translation_group`, not its row id. When an entry is rendered, credits are filtered by joining the junction against the byline sibling whose `locale` matches the entry's `locale`. If no sibling exists at the entry's locale, the credit hydrates as empty — there is **no fallback** to other locales' bios.
+
+  Author-inferred bylines (where an entry has no explicit credits but its author is linked to a byline) still fall back per-locale and respect the strictness gate: an entry with explicit credits at any locale will not infer from the author even if the explicit credits don't resolve at the rendering locale.
+
+  This is a deliberate behavior change for multilingual sites. The motivation is correctness: chain-walking credits across locales renders the wrong-language bio on translated entries.
+
+  The "explicit credit suppresses author fallback" check reads `primary_byline_id` directly from the content row — set by `setContentBylines` iff junction rows exist, backfilled by migration 040 for pre-existing rows. No separate probe against `_emdash_content_bylines` is needed at hydration time; the column is folded into the single per-entry context fetch (`author_id` + `primary_byline_id` in one query). Both monolingual and multilingual sites get the same query count.
+
+  ## Identity lookups: chain-walk
+
+  `getBylineBySlug(slug, { locale })` walks the configured fallback chain (`resolveLocaleChain`), like `getMenu` and `getTerm`. Author pages for un-translated bylines still render an identity rather than 404'ing. This is conceptually distinct from credit hydration and runs through `requestCached` for per-render dedupe.
+
+  ## Admin
+  - **TranslationsPanel** in the bylines editor lists every configured locale with Edit / Translate buttons. The Translate action POSTs to the new `POST /_emdash/api/admin/bylines/:id/translations` endpoint.
+  - **LocaleSwitcher** on `/bylines` filters the list strictly to one locale. Cross-locale navigation via TranslationsPanel routes through `/bylines?locale=…`.
+  - The **byline picker** on the content editor is locale-pinned to the entry's locale. Editors only see bylines that will actually hydrate at the entry's locale.
+  - The **byline credit empty state** on a locale with no bylines yet shows a CTA linking to `/bylines?locale=…` for inline creation.
+  - Translating an entry (`POST /content/:collection` with `translationOf`) calls `copyContentBylines` to inherit the source's credits — these resolve at the new entry's locale via the strict-hydration model, so credits "follow" the content across translations once sibling bylines exist.
+
+  ## API additions
+  - `GET /_emdash/api/admin/bylines/:id/translations` — list every sibling row sharing a translation_group.
+  - `POST /_emdash/api/admin/bylines/:id/translations` — create a sibling at a target locale. Body defaults (slug, displayName, websiteUrl, avatar) inherit from the source.
+  - `POST /_emdash/api/admin/bylines` accepts `translationOf` + `locale` to create a sibling in one call.
+  - `GET /_emdash/api/admin/bylines?locale=…` filters strictly.
+  - `BylineSummary` gains `locale: string` and `translationGroup: string | null` (additive — existing consumers ignore the new fields).
+
+  ## Permissions
+
+  Two new entries on `@emdash-cms/auth`:
+  - `bylines:read` — minimum `SUBSCRIBER`.
+  - `bylines:manage` — minimum `EDITOR`.
+
+  All byline routes (list, get, update, delete, translations) now check these instead of `content:read` / `Role.EDITOR`. Role thresholds are unchanged, so existing users see no permission differences. Custom RBAC configurations that bind to the old strings should add the new permission names.
+
+  ## Repository
+  - `BylineRepository` is strict per-locale: `findMany`, `findBySlug`, `findById` accept an optional `locale` and return rows matching that locale (or all locales when omitted, for the manager view).
+  - New methods: `listTranslations(id)`, `findByTranslationGroup(group)`, `copyContentBylines(collection, fromId, toId)`.
+  - `setContentBylines` deduplicates by `translation_group` after resolving wire row ids, so passing two sibling row ids of the same identity collapses to one credit row.
+  - `delete` is sibling-aware: removing one locale variant leaves siblings standing.
+
+  ## Notable trade-offs
+  - **Strict hydration over chain-walking** for credits. Chain-walking would render mismatched-language bios on translated content. The honest answer is to show nothing rather than the wrong thing; the picker tells editors which bylines will resolve at the entry's locale, and the empty-state CTA makes creating a sibling a one-click flow.
+  - **Schema is row-per-locale**, not a separate `byline_translations` side-table. Matches the existing content / menu / taxonomy convention so query patterns and indexes are consistent across the codebase.
+
+- [#1176](https://github.com/emdash-cms/emdash/pull/1176) [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c) Thanks [@ascorbic](https://github.com/ascorbic)! - Code blocks in the rich text editor now have an inline language picker. Hover over any code block to reveal a chip in the corner; click it to enter a language (free-form input with curated suggestions for ~30 common languages including TypeScript, Python, Bash, Rust, Astro, SQL, and more). Aliases resolve automatically -- typing `ts` stores `typescript`, `c++` stores `cpp`, etc. The existing markdown shortcut (typing ` ```html ` followed by a space or Enter) continues to pre-populate the language. The chosen language persists on the Portable Text `language` field and is emitted as a `language-{id}` class on the rendered `<pre>` so frontend syntax highlighters can pick it up. The visual (in-place) editor gets the same picker UI.
+
+- [#1114](https://github.com/emdash-cms/emdash/pull/1114) [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c) Thanks [@ascorbic](https://github.com/ascorbic)! - Plugins installed from the experimental registry can now be uninstalled and updated from the admin, the same way marketplace plugins always could. The "uninstall is not yet available for registry plugins" placeholder is gone — registry plugin rows now show the same Uninstall and Update buttons.
+
+  The Plugins page's "updates available" indicator now covers registry plugins too. If the registry aggregator is unreachable, marketplace updates still load (and vice versa).
+
+  Updates that need newly-declared permissions, or that newly expose a public (unauthenticated) route, prompt for re-consent before installing the new version — matching the gate that marketplace updates already have.
+
+- [#1125](https://github.com/emdash-cms/emdash/pull/1125) [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds a version picker to the registry plugin detail page. Older releases of a registry-hosted plugin are now selectable from a dropdown next to the Install button, and the displayed version, indexed date, permissions, and source link swap to match the selected release. Pre-release versions (e.g. `1.0.0-alpha.1`) are flagged with a "Pre-release" badge so admins can spot them before installing. Versions still inside the configured minimum-release-age holdback remain visible in the dropdown but stay non-installable until they age into the window.
+
+### Patch Changes
+
+- [#1177](https://github.com/emdash-cms/emdash/pull/1177) [`b9cc08e`](https://github.com/emdash-cms/emdash/commit/b9cc08e7556ccdbcbbcea6d3c06cae6abef18766) Thanks [@ascorbic](https://github.com/ascorbic)! - Bumps `@cloudflare/kumo` from 1.16 to 2.3. Two internal call sites picked up breaking API changes from Kumo 2.0: `Collapsible` is now a compound component (`Collapsible.Root` / `.DefaultTrigger` / `.DefaultPanel` instead of `<Collapsible label=...>`), used by the accordion block; and `ChartPalette.color()` was renamed to `ChartPalette.categorical()` in the chart block. No public API changes -- consumers see identical behaviour. Tests in `@emdash-cms/admin` that asserted on `Button`'s native `title` attribute now read `aria-label` instead, because Kumo 2 wraps `<Button title>` in a Tooltip popup rather than setting the DOM attribute.
+
+- [#1119](https://github.com/emdash-cms/emdash/pull/1119) [`393dd26`](https://github.com/emdash-cms/emdash/commit/393dd26fd4e6fc38ed2584cbb5f29d5f69fb1dad) Thanks [@adentdk](https://github.com/adentdk)! - Fixes auto-save not detecting plugin block field changes. When editing an existing block's attributes via the Block Kit modal, the change now correctly triggers TipTap's `onUpdate` callback, propagating through to the auto-save dirty detection.
+
+- Updated dependencies [[`cf3c706`](https://github.com/emdash-cms/emdash/commit/cf3c706a65087696eb6cca5844b7668a50e4a090), [`b9cc08e`](https://github.com/emdash-cms/emdash/commit/b9cc08e7556ccdbcbbcea6d3c06cae6abef18766)]:
+  - @emdash-cms/registry-client@0.2.0
+  - @emdash-cms/blocks@0.15.0
+
 ## 0.14.0
 
 ### Minor Changes
diff --git a/packages/admin/package.json b/packages/admin/package.json
index cb05fba718..738cd6af97 100644
--- a/packages/admin/package.json
+++ b/packages/admin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emdash-cms/admin",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Admin UI for EmDash CMS",
   "type": "module",
   "main": "dist/index.js",
diff --git a/packages/auth-atproto/CHANGELOG.md b/packages/auth-atproto/CHANGELOG.md
index fc8d6650a3..ca8a7659e7 100644
--- a/packages/auth-atproto/CHANGELOG.md
+++ b/packages/auth-atproto/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @emdash-cms/auth-atproto
 
+## 0.2.8
+
+### Patch Changes
+
+- [#1177](https://github.com/emdash-cms/emdash/pull/1177) [`b9cc08e`](https://github.com/emdash-cms/emdash/commit/b9cc08e7556ccdbcbbcea6d3c06cae6abef18766) Thanks [@ascorbic](https://github.com/ascorbic)! - Bumps `@cloudflare/kumo` from 1.16 to 2.3. Two internal call sites picked up breaking API changes from Kumo 2.0: `Collapsible` is now a compound component (`Collapsible.Root` / `.DefaultTrigger` / `.DefaultPanel` instead of `<Collapsible label=...>`), used by the accordion block; and `ChartPalette.color()` was renamed to `ChartPalette.categorical()` in the chart block. No public API changes -- consumers see identical behaviour. Tests in `@emdash-cms/admin` that asserted on `Button`'s native `title` attribute now read `aria-label` instead, because Kumo 2 wraps `<Button title>` in a Tooltip popup rather than setting the DOM attribute.
+
+- [#1139](https://github.com/emdash-cms/emdash/pull/1139) [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61) Thanks [@ask-bonk](https://github.com/apps/ask-bonk)! - Upgrades `kysely` to `^0.29.0` (was `^0.27.0`) to resolve three high-severity advisories fixed in `>=0.28.17`:
+  - GHSA-wmrf-hv6w-mr66 – SQL injection via unsanitized JSON path keys
+  - GHSA-pv5w-4p9q-p3v2 – JSON-path traversal injection via `JSONPathBuilder.key()` / `.at()`
+  - GHSA-8cpq-38p9-67gx – MySQL SQL injection via `sql.lit(string)`
+
+  Also updates import paths for `Migrator` and `Migration` types to `kysely/migration` to comply with kysely 0.29 export changes.
+
+- Updated dependencies [[`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92)]:
+  - emdash@0.15.0
+  - @emdash-cms/auth@0.15.0
+
 ## 0.2.7
 
 ### Patch Changes
diff --git a/packages/auth-atproto/package.json b/packages/auth-atproto/package.json
index db1b3f802a..a856a38ce2 100644
--- a/packages/auth-atproto/package.json
+++ b/packages/auth-atproto/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/auth-atproto",
-	"version": "0.2.7",
+	"version": "0.2.8",
 	"description": "AT Protocol / Atmosphere authentication provider for EmDash CMS",
 	"type": "module",
 	"main": "src/auth.ts",
@@ -26,7 +26,7 @@
 	"license": "MIT",
 	"peerDependencies": {
 		"astro": ">=5",
-		"emdash": "workspace:>=0.14.0",
+		"emdash": "workspace:>=0.15.0",
 		"react": ">=18"
 	},
 	"devDependencies": {
@@ -48,6 +48,6 @@
 		"@atcute/identity-resolver": "^1.2.2",
 		"@atcute/oauth-node-client": "^1.1.0",
 		"@emdash-cms/auth": "workspace:*",
-    "kysely": "catalog:"
+		"kysely": "catalog:"
 	}
 }
diff --git a/packages/auth/CHANGELOG.md b/packages/auth/CHANGELOG.md
index 5417b6edb1..623b390da4 100644
--- a/packages/auth/CHANGELOG.md
+++ b/packages/auth/CHANGELOG.md
@@ -1,5 +1,76 @@
 # @emdash-cms/auth
 
+## 0.15.0
+
+### Minor Changes
+
+- [#1146](https://github.com/emdash-cms/emdash/pull/1146) [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b) Thanks [@MohamedH1998](https://github.com/MohamedH1998)! - Adds first-class i18n support for bylines, mirroring the row-per-locale model already used by menus and taxonomies (PR #916, migrations 036).
+
+  ## Schema (migration 040)
+
+  `_emdash_bylines` gains two columns:
+  - `locale` — `TEXT NOT NULL DEFAULT 'en'`. Every row now belongs to exactly one locale.
+  - `translation_group` — `TEXT NOT NULL`. Shared across every locale variant of a single byline identity. The anchor row's `translation_group` equals its `id`; siblings inherit it.
+
+  A partial unique index `idx_bylines_group_locale_unique` enforces one row per `(translation_group, locale)`. The pre-existing `(slug)` unique index becomes `(slug, locale)` to allow the same slug across locales.
+
+  Existing rows are backfilled to the configured `defaultLocale` (or `'en'` if i18n isn't configured) with `translation_group = id`. Monolingual sites see no functional change; multilingual sites continue rendering the same byline data at the default locale until editors create translations.
+
+  ## Credit hydration: strict per-locale
+
+  `_emdash_content_bylines.byline_id` now stores the byline's `translation_group`, not its row id. When an entry is rendered, credits are filtered by joining the junction against the byline sibling whose `locale` matches the entry's `locale`. If no sibling exists at the entry's locale, the credit hydrates as empty — there is **no fallback** to other locales' bios.
+
+  Author-inferred bylines (where an entry has no explicit credits but its author is linked to a byline) still fall back per-locale and respect the strictness gate: an entry with explicit credits at any locale will not infer from the author even if the explicit credits don't resolve at the rendering locale.
+
+  This is a deliberate behavior change for multilingual sites. The motivation is correctness: chain-walking credits across locales renders the wrong-language bio on translated entries.
+
+  The "explicit credit suppresses author fallback" check reads `primary_byline_id` directly from the content row — set by `setContentBylines` iff junction rows exist, backfilled by migration 040 for pre-existing rows. No separate probe against `_emdash_content_bylines` is needed at hydration time; the column is folded into the single per-entry context fetch (`author_id` + `primary_byline_id` in one query). Both monolingual and multilingual sites get the same query count.
+
+  ## Identity lookups: chain-walk
+
+  `getBylineBySlug(slug, { locale })` walks the configured fallback chain (`resolveLocaleChain`), like `getMenu` and `getTerm`. Author pages for un-translated bylines still render an identity rather than 404'ing. This is conceptually distinct from credit hydration and runs through `requestCached` for per-render dedupe.
+
+  ## Admin
+  - **TranslationsPanel** in the bylines editor lists every configured locale with Edit / Translate buttons. The Translate action POSTs to the new `POST /_emdash/api/admin/bylines/:id/translations` endpoint.
+  - **LocaleSwitcher** on `/bylines` filters the list strictly to one locale. Cross-locale navigation via TranslationsPanel routes through `/bylines?locale=…`.
+  - The **byline picker** on the content editor is locale-pinned to the entry's locale. Editors only see bylines that will actually hydrate at the entry's locale.
+  - The **byline credit empty state** on a locale with no bylines yet shows a CTA linking to `/bylines?locale=…` for inline creation.
+  - Translating an entry (`POST /content/:collection` with `translationOf`) calls `copyContentBylines` to inherit the source's credits — these resolve at the new entry's locale via the strict-hydration model, so credits "follow" the content across translations once sibling bylines exist.
+
+  ## API additions
+  - `GET /_emdash/api/admin/bylines/:id/translations` — list every sibling row sharing a translation_group.
+  - `POST /_emdash/api/admin/bylines/:id/translations` — create a sibling at a target locale. Body defaults (slug, displayName, websiteUrl, avatar) inherit from the source.
+  - `POST /_emdash/api/admin/bylines` accepts `translationOf` + `locale` to create a sibling in one call.
+  - `GET /_emdash/api/admin/bylines?locale=…` filters strictly.
+  - `BylineSummary` gains `locale: string` and `translationGroup: string | null` (additive — existing consumers ignore the new fields).
+
+  ## Permissions
+
+  Two new entries on `@emdash-cms/auth`:
+  - `bylines:read` — minimum `SUBSCRIBER`.
+  - `bylines:manage` — minimum `EDITOR`.
+
+  All byline routes (list, get, update, delete, translations) now check these instead of `content:read` / `Role.EDITOR`. Role thresholds are unchanged, so existing users see no permission differences. Custom RBAC configurations that bind to the old strings should add the new permission names.
+
+  ## Repository
+  - `BylineRepository` is strict per-locale: `findMany`, `findBySlug`, `findById` accept an optional `locale` and return rows matching that locale (or all locales when omitted, for the manager view).
+  - New methods: `listTranslations(id)`, `findByTranslationGroup(group)`, `copyContentBylines(collection, fromId, toId)`.
+  - `setContentBylines` deduplicates by `translation_group` after resolving wire row ids, so passing two sibling row ids of the same identity collapses to one credit row.
+  - `delete` is sibling-aware: removing one locale variant leaves siblings standing.
+
+  ## Notable trade-offs
+  - **Strict hydration over chain-walking** for credits. Chain-walking would render mismatched-language bios on translated content. The honest answer is to show nothing rather than the wrong thing; the picker tells editors which bylines will resolve at the entry's locale, and the empty-state CTA makes creating a sibling a one-click flow.
+  - **Schema is row-per-locale**, not a separate `byline_translations` side-table. Matches the existing content / menu / taxonomy convention so query patterns and indexes are consistent across the codebase.
+
+### Patch Changes
+
+- [#1139](https://github.com/emdash-cms/emdash/pull/1139) [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61) Thanks [@ask-bonk](https://github.com/apps/ask-bonk)! - Upgrades `kysely` to `^0.29.0` (was `^0.27.0`) to resolve three high-severity advisories fixed in `>=0.28.17`:
+  - GHSA-wmrf-hv6w-mr66 – SQL injection via unsanitized JSON path keys
+  - GHSA-pv5w-4p9q-p3v2 – JSON-path traversal injection via `JSONPathBuilder.key()` / `.at()`
+  - GHSA-8cpq-38p9-67gx – MySQL SQL injection via `sql.lit(string)`
+
+  Also updates import paths for `Migrator` and `Migration` types to `kysely/migration` to comply with kysely 0.29 export changes.
+
 ## 0.14.0
 
 ## 0.13.0
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 610eb11cad..faeac2952c 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emdash-cms/auth",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Passkey-first authentication for EmDash",
   "type": "module",
   "main": "dist/index.mjs",
diff --git a/packages/blocks/CHANGELOG.md b/packages/blocks/CHANGELOG.md
index de665abdb6..1f5bedd21e 100644
--- a/packages/blocks/CHANGELOG.md
+++ b/packages/blocks/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @emdash-cms/blocks
 
+## 0.15.0
+
+### Patch Changes
+
+- [#1177](https://github.com/emdash-cms/emdash/pull/1177) [`b9cc08e`](https://github.com/emdash-cms/emdash/commit/b9cc08e7556ccdbcbbcea6d3c06cae6abef18766) Thanks [@ascorbic](https://github.com/ascorbic)! - Bumps `@cloudflare/kumo` from 1.16 to 2.3. Two internal call sites picked up breaking API changes from Kumo 2.0: `Collapsible` is now a compound component (`Collapsible.Root` / `.DefaultTrigger` / `.DefaultPanel` instead of `<Collapsible label=...>`), used by the accordion block; and `ChartPalette.color()` was renamed to `ChartPalette.categorical()` in the chart block. No public API changes -- consumers see identical behaviour. Tests in `@emdash-cms/admin` that asserted on `Button`'s native `title` attribute now read `aria-label` instead, because Kumo 2 wraps `<Button title>` in a Tooltip popup rather than setting the DOM attribute.
+
 ## 0.14.0
 
 ## 0.13.0
diff --git a/packages/blocks/package.json b/packages/blocks/package.json
index 0aa572aacb..a53f8cd167 100644
--- a/packages/blocks/package.json
+++ b/packages/blocks/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emdash-cms/blocks",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Declarative plugin UI blocks for EmDash CMS",
   "type": "module",
   "main": "dist/index.js",
diff --git a/packages/cloudflare/CHANGELOG.md b/packages/cloudflare/CHANGELOG.md
index ebc1bb1397..795b02740e 100644
--- a/packages/cloudflare/CHANGELOG.md
+++ b/packages/cloudflare/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @emdash-cms/cloudflare
 
+## 0.15.0
+
+### Patch Changes
+
+- [#426](https://github.com/emdash-cms/emdash/pull/426) [`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74) Thanks [@BenjaminPrice](https://github.com/BenjaminPrice)! - Adds workerd-based plugin sandboxing for Node.js deployments.
+  - **emdash**: Adds `isHealthy()` to `SandboxRunner` interface, `SandboxUnavailableError` class, `sandbox: false` config option, `mediaStorage` field on `SandboxOptions`, and exports `createHttpAccess`/`createUnrestrictedHttpAccess`/`PluginStorageRepository`/`UserRepository`/`OptionsRepository` for platform adapters.
+  - **@emdash-cms/cloudflare**: Implements `isHealthy()` on `CloudflareSandboxRunner`. Fixes `storageQuery()` and `storageCount()` to honor `where`, `orderBy`, and `cursor` options (previously ignored, causing infinite pagination loops and incorrect filtered counts). Adds `storageConfig` to `PluginBridgeProps` so `PluginStorageRepository` can use declared indexes.
+  - **@emdash-cms/sandbox-workerd**: New package. `WorkerdSandboxRunner` for production (workerd child process + capnp config + authenticated HTTP backing service) and `MiniflareDevRunner` for development.
+
+- [#1139](https://github.com/emdash-cms/emdash/pull/1139) [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61) Thanks [@ask-bonk](https://github.com/apps/ask-bonk)! - Upgrades `kysely` to `^0.29.0` (was `^0.27.0`) to resolve three high-severity advisories fixed in `>=0.28.17`:
+  - GHSA-wmrf-hv6w-mr66 – SQL injection via unsanitized JSON path keys
+  - GHSA-pv5w-4p9q-p3v2 – JSON-path traversal injection via `JSONPathBuilder.key()` / `.at()`
+  - GHSA-8cpq-38p9-67gx – MySQL SQL injection via `sql.lit(string)`
+
+  Also updates import paths for `Migrator` and `Migration` types to `kysely/migration` to comply with kysely 0.29 export changes.
+
+- Updated dependencies [[`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92)]:
+  - emdash@0.15.0
+
 ## 0.14.0
 
 ### Patch Changes
diff --git a/packages/cloudflare/package.json b/packages/cloudflare/package.json
index a52294fc4e..9f1c5da317 100644
--- a/packages/cloudflare/package.json
+++ b/packages/cloudflare/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emdash-cms/cloudflare",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Cloudflare adapters for EmDash - D1, R2, Access, and Worker Loader sandbox",
   "type": "module",
   "main": "dist/index.mjs",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 40a1c312cd..1314383b69 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,98 @@
 # emdash
 
+## 0.15.0
+
+### Minor Changes
+
+- [#426](https://github.com/emdash-cms/emdash/pull/426) [`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74) Thanks [@BenjaminPrice](https://github.com/BenjaminPrice)! - Adds workerd-based plugin sandboxing for Node.js deployments.
+  - **emdash**: Adds `isHealthy()` to `SandboxRunner` interface, `SandboxUnavailableError` class, `sandbox: false` config option, `mediaStorage` field on `SandboxOptions`, and exports `createHttpAccess`/`createUnrestrictedHttpAccess`/`PluginStorageRepository`/`UserRepository`/`OptionsRepository` for platform adapters.
+  - **@emdash-cms/cloudflare**: Implements `isHealthy()` on `CloudflareSandboxRunner`. Fixes `storageQuery()` and `storageCount()` to honor `where`, `orderBy`, and `cursor` options (previously ignored, causing infinite pagination loops and incorrect filtered counts). Adds `storageConfig` to `PluginBridgeProps` so `PluginStorageRepository` can use declared indexes.
+  - **@emdash-cms/sandbox-workerd**: New package. `WorkerdSandboxRunner` for production (workerd child process + capnp config + authenticated HTTP backing service) and `MiniflareDevRunner` for development.
+
+- [#1146](https://github.com/emdash-cms/emdash/pull/1146) [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b) Thanks [@MohamedH1998](https://github.com/MohamedH1998)! - Adds first-class i18n support for bylines, mirroring the row-per-locale model already used by menus and taxonomies (PR #916, migrations 036).
+
+  ## Schema (migration 040)
+
+  `_emdash_bylines` gains two columns:
+  - `locale` — `TEXT NOT NULL DEFAULT 'en'`. Every row now belongs to exactly one locale.
+  - `translation_group` — `TEXT NOT NULL`. Shared across every locale variant of a single byline identity. The anchor row's `translation_group` equals its `id`; siblings inherit it.
+
+  A partial unique index `idx_bylines_group_locale_unique` enforces one row per `(translation_group, locale)`. The pre-existing `(slug)` unique index becomes `(slug, locale)` to allow the same slug across locales.
+
+  Existing rows are backfilled to the configured `defaultLocale` (or `'en'` if i18n isn't configured) with `translation_group = id`. Monolingual sites see no functional change; multilingual sites continue rendering the same byline data at the default locale until editors create translations.
+
+  ## Credit hydration: strict per-locale
+
+  `_emdash_content_bylines.byline_id` now stores the byline's `translation_group`, not its row id. When an entry is rendered, credits are filtered by joining the junction against the byline sibling whose `locale` matches the entry's `locale`. If no sibling exists at the entry's locale, the credit hydrates as empty — there is **no fallback** to other locales' bios.
+
+  Author-inferred bylines (where an entry has no explicit credits but its author is linked to a byline) still fall back per-locale and respect the strictness gate: an entry with explicit credits at any locale will not infer from the author even if the explicit credits don't resolve at the rendering locale.
+
+  This is a deliberate behavior change for multilingual sites. The motivation is correctness: chain-walking credits across locales renders the wrong-language bio on translated entries.
+
+  The "explicit credit suppresses author fallback" check reads `primary_byline_id` directly from the content row — set by `setContentBylines` iff junction rows exist, backfilled by migration 040 for pre-existing rows. No separate probe against `_emdash_content_bylines` is needed at hydration time; the column is folded into the single per-entry context fetch (`author_id` + `primary_byline_id` in one query). Both monolingual and multilingual sites get the same query count.
+
+  ## Identity lookups: chain-walk
+
+  `getBylineBySlug(slug, { locale })` walks the configured fallback chain (`resolveLocaleChain`), like `getMenu` and `getTerm`. Author pages for un-translated bylines still render an identity rather than 404'ing. This is conceptually distinct from credit hydration and runs through `requestCached` for per-render dedupe.
+
+  ## Admin
+  - **TranslationsPanel** in the bylines editor lists every configured locale with Edit / Translate buttons. The Translate action POSTs to the new `POST /_emdash/api/admin/bylines/:id/translations` endpoint.
+  - **LocaleSwitcher** on `/bylines` filters the list strictly to one locale. Cross-locale navigation via TranslationsPanel routes through `/bylines?locale=…`.
+  - The **byline picker** on the content editor is locale-pinned to the entry's locale. Editors only see bylines that will actually hydrate at the entry's locale.
+  - The **byline credit empty state** on a locale with no bylines yet shows a CTA linking to `/bylines?locale=…` for inline creation.
+  - Translating an entry (`POST /content/:collection` with `translationOf`) calls `copyContentBylines` to inherit the source's credits — these resolve at the new entry's locale via the strict-hydration model, so credits "follow" the content across translations once sibling bylines exist.
+
+  ## API additions
+  - `GET /_emdash/api/admin/bylines/:id/translations` — list every sibling row sharing a translation_group.
+  - `POST /_emdash/api/admin/bylines/:id/translations` — create a sibling at a target locale. Body defaults (slug, displayName, websiteUrl, avatar) inherit from the source.
+  - `POST /_emdash/api/admin/bylines` accepts `translationOf` + `locale` to create a sibling in one call.
+  - `GET /_emdash/api/admin/bylines?locale=…` filters strictly.
+  - `BylineSummary` gains `locale: string` and `translationGroup: string | null` (additive — existing consumers ignore the new fields).
+
+  ## Permissions
+
+  Two new entries on `@emdash-cms/auth`:
+  - `bylines:read` — minimum `SUBSCRIBER`.
+  - `bylines:manage` — minimum `EDITOR`.
+
+  All byline routes (list, get, update, delete, translations) now check these instead of `content:read` / `Role.EDITOR`. Role thresholds are unchanged, so existing users see no permission differences. Custom RBAC configurations that bind to the old strings should add the new permission names.
+
+  ## Repository
+  - `BylineRepository` is strict per-locale: `findMany`, `findBySlug`, `findById` accept an optional `locale` and return rows matching that locale (or all locales when omitted, for the manager view).
+  - New methods: `listTranslations(id)`, `findByTranslationGroup(group)`, `copyContentBylines(collection, fromId, toId)`.
+  - `setContentBylines` deduplicates by `translation_group` after resolving wire row ids, so passing two sibling row ids of the same identity collapses to one credit row.
+  - `delete` is sibling-aware: removing one locale variant leaves siblings standing.
+
+  ## Notable trade-offs
+  - **Strict hydration over chain-walking** for credits. Chain-walking would render mismatched-language bios on translated content. The honest answer is to show nothing rather than the wrong thing; the picker tells editors which bylines will resolve at the entry's locale, and the empty-state CTA makes creating a sibling a one-click flow.
+  - **Schema is row-per-locale**, not a separate `byline_translations` side-table. Matches the existing content / menu / taxonomy convention so query patterns and indexes are consistent across the codebase.
+
+- [#1176](https://github.com/emdash-cms/emdash/pull/1176) [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c) Thanks [@ascorbic](https://github.com/ascorbic)! - Code blocks in the rich text editor now have an inline language picker. Hover over any code block to reveal a chip in the corner; click it to enter a language (free-form input with curated suggestions for ~30 common languages including TypeScript, Python, Bash, Rust, Astro, SQL, and more). Aliases resolve automatically -- typing `ts` stores `typescript`, `c++` stores `cpp`, etc. The existing markdown shortcut (typing ` ```html ` followed by a space or Enter) continues to pre-populate the language. The chosen language persists on the Portable Text `language` field and is emitted as a `language-{id}` class on the rendered `<pre>` so frontend syntax highlighters can pick it up. The visual (in-place) editor gets the same picker UI.
+
+- [#1114](https://github.com/emdash-cms/emdash/pull/1114) [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c) Thanks [@ascorbic](https://github.com/ascorbic)! - Plugins installed from the experimental registry can now be uninstalled and updated from the admin, the same way marketplace plugins always could. The "uninstall is not yet available for registry plugins" placeholder is gone — registry plugin rows now show the same Uninstall and Update buttons.
+
+  The Plugins page's "updates available" indicator now covers registry plugins too. If the registry aggregator is unreachable, marketplace updates still load (and vice versa).
+
+  Updates that need newly-declared permissions, or that newly expose a public (unauthenticated) route, prompt for re-consent before installing the new version — matching the gate that marketplace updates already have.
+
+- [#1125](https://github.com/emdash-cms/emdash/pull/1125) [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds a version picker to the registry plugin detail page. Older releases of a registry-hosted plugin are now selectable from a dropdown next to the Install button, and the displayed version, indexed date, permissions, and source link swap to match the selected release. Pre-release versions (e.g. `1.0.0-alpha.1`) are flagged with a "Pre-release" badge so admins can spot them before installing. Versions still inside the configured minimum-release-age holdback remain visible in the dropdown but stay non-installable until they age into the window.
+
+### Patch Changes
+
+- [#1139](https://github.com/emdash-cms/emdash/pull/1139) [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61) Thanks [@ask-bonk](https://github.com/apps/ask-bonk)! - Upgrades `kysely` to `^0.29.0` (was `^0.27.0`) to resolve three high-severity advisories fixed in `>=0.28.17`:
+  - GHSA-wmrf-hv6w-mr66 – SQL injection via unsanitized JSON path keys
+  - GHSA-pv5w-4p9q-p3v2 – JSON-path traversal injection via `JSONPathBuilder.key()` / `.at()`
+  - GHSA-8cpq-38p9-67gx – MySQL SQL injection via `sql.lit(string)`
+
+  Also updates import paths for `Migrator` and `Migration` types to `kysely/migration` to comply with kysely 0.29 export changes.
+
+- Updated dependencies [[`cf3c706`](https://github.com/emdash-cms/emdash/commit/cf3c706a65087696eb6cca5844b7668a50e4a090), [`b9cc08e`](https://github.com/emdash-cms/emdash/commit/b9cc08e7556ccdbcbbcea6d3c06cae6abef18766), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`393dd26`](https://github.com/emdash-cms/emdash/commit/393dd26fd4e6fc38ed2584cbb5f29d5f69fb1dad), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92)]:
+  - @emdash-cms/registry-client@0.2.0
+  - @emdash-cms/admin@0.15.0
+  - @emdash-cms/auth-atproto@0.2.8
+  - @emdash-cms/auth@0.15.0
+  - @emdash-cms/gutenberg-to-portable-text@0.15.0
+
 ## 0.14.0
 
 ### Patch Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index 9b0c9d83ac..83acfa9cd2 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "emdash",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Astro-native CMS with WordPress migration support",
   "type": "module",
   "main": "dist/index.mjs",
@@ -240,7 +240,7 @@
   },
   "peerDependencies": {
     "@astrojs/react": ">=5.0.0-beta.0",
-    "@emdash-cms/auth-atproto": "workspace:>=0.2.7",
+    "@emdash-cms/auth-atproto": "workspace:>=0.2.8",
     "astro": ">=6.0.0-beta.0",
     "react": ">=18.0.0",
     "react-dom": ">=18.0.0"
diff --git a/packages/create-emdash/CHANGELOG.md b/packages/create-emdash/CHANGELOG.md
index 91ff77a136..879e2e44bd 100644
--- a/packages/create-emdash/CHANGELOG.md
+++ b/packages/create-emdash/CHANGELOG.md
@@ -1,5 +1,7 @@
 # create-emdash
 
+## 0.15.0
+
 ## 0.14.0
 
 ### Patch Changes
diff --git a/packages/create-emdash/package.json b/packages/create-emdash/package.json
index 40c15f51b7..52a5e86dd6 100644
--- a/packages/create-emdash/package.json
+++ b/packages/create-emdash/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-emdash",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Create a new EmDash CMS project",
   "type": "module",
   "bin": "./dist/index.mjs",
diff --git a/packages/gutenberg-to-portable-text/CHANGELOG.md b/packages/gutenberg-to-portable-text/CHANGELOG.md
index 1f6f6d2c09..517801ccbe 100644
--- a/packages/gutenberg-to-portable-text/CHANGELOG.md
+++ b/packages/gutenberg-to-portable-text/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @emdash-cms/gutenberg-to-portable-text
 
+## 0.15.0
+
 ## 0.14.0
 
 ## 0.13.0
diff --git a/packages/gutenberg-to-portable-text/package.json b/packages/gutenberg-to-portable-text/package.json
index 137da27a62..e435791cd2 100644
--- a/packages/gutenberg-to-portable-text/package.json
+++ b/packages/gutenberg-to-portable-text/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emdash-cms/gutenberg-to-portable-text",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Convert WordPress Gutenberg blocks to Portable Text",
   "type": "module",
   "main": "dist/index.mjs",
diff --git a/packages/plugin-cli/CHANGELOG.md b/packages/plugin-cli/CHANGELOG.md
index 1943132dba..37aac216fb 100644
--- a/packages/plugin-cli/CHANGELOG.md
+++ b/packages/plugin-cli/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @emdash-cms/registry-cli
 
+## 0.4.0
+
+### Minor Changes
+
+- [#1126](https://github.com/emdash-cms/emdash/pull/1126) [`cf3c706`](https://github.com/emdash-cms/emdash/commit/cf3c706a65087696eb6cca5844b7668a50e4a090) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `emdash-plugin update-package`, a CLI command for editing an already-published plugin's registry record (license, authors, security contacts, name, description, keywords) without cutting a new release. Without `--yes` it prints a diff and exits without writing; with `--yes` it writes the updated record to the publisher's PDS using atproto's `swapRecord` precondition (concurrent writes surface as `STALE_RECORD` instead of silently overwriting each other) and bumps `lastUpdated`. Optional fields use a "manifest absent = no change" policy: removing a key from the manifest doesn't wipe the published value, matching `publish` semantics. Renaming a plugin via the manifest now surfaces a "looks like a rename" message listing the publisher's existing packages instead of a generic not-found, so publishers don't accidentally orphan releases under the old slug.
+
+  The publishing client (`@emdash-cms/registry-client`) gains a `swapRecord` parameter on `putRecord` and `unsafePutRecord` for callers needing optimistic-concurrency writes.
+
+### Patch Changes
+
+- [#1145](https://github.com/emdash-cms/emdash/pull/1145) [`463c7a2`](https://github.com/emdash-cms/emdash/commit/463c7a23036d55fee3f5105c1a878c9abdee2e1f) Thanks [@ascorbic](https://github.com/ascorbic)! - Refactors the build pipeline's runtime validation of the probed plugin's
+  default export to use a Zod schema. Error messages keep the same format
+  (`hook "X" must be a function or { handler, ... }`, `hook "X" has
+invalid FIELD VALUE (...)`). Exotic-object entries (Date, RegExp,
+  Promise, class instances) now produce the wrong-shape error instead of
+  falling through to a misleading "missing handler" error. BigInt /
+  cyclic-object / function / symbol field values are rendered safely in
+  error messages instead of crashing with a TypeError.
+- Updated dependencies [[`cf3c706`](https://github.com/emdash-cms/emdash/commit/cf3c706a65087696eb6cca5844b7668a50e4a090)]:
+  - @emdash-cms/registry-client@0.2.0
+
 ## 0.3.0
 
 ### Minor Changes
diff --git a/packages/plugin-cli/package.json b/packages/plugin-cli/package.json
index f0da2eaeca..5b60a7fc01 100644
--- a/packages/plugin-cli/package.json
+++ b/packages/plugin-cli/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/plugin-cli",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "CLI for authoring, building, and publishing EmDash plugins. Covers init / build / dev / bundle / publish plus registry search and identity. Atproto OAuth, FAIR-shaped records, sandboxed-plugin-only.",
 	"type": "module",
 	"main": "dist/api.mjs",
diff --git a/packages/plugins/api-test/package.json b/packages/plugins/api-test/package.json
index 581d556957..b2f66b7a12 100644
--- a/packages/plugins/api-test/package.json
+++ b/packages/plugins/api-test/package.json
@@ -22,7 +22,7 @@
 	"author": "Matt Kane",
 	"license": "MIT",
 	"peerDependencies": {
-		"emdash": "workspace:>=0.14.0",
+		"emdash": "workspace:>=0.15.0",
 		"react": "^18.0.0 || ^19.0.0",
 		"@phosphor-icons/react": "^2.1.10"
 	},
diff --git a/packages/plugins/atproto/package.json b/packages/plugins/atproto/package.json
index a7396f67ed..83b5369893 100644
--- a/packages/plugins/atproto/package.json
+++ b/packages/plugins/atproto/package.json
@@ -28,7 +28,7 @@
 	"author": "Matt Kane",
 	"license": "MIT",
 	"peerDependencies": {
-		"emdash": "workspace:>=0.14.0"
+		"emdash": "workspace:>=0.15.0"
 	},
 	"devDependencies": {
 		"@emdash-cms/plugin-cli": "workspace:*",
diff --git a/packages/plugins/audit-log/package.json b/packages/plugins/audit-log/package.json
index 03535f9011..b2443b2d5f 100644
--- a/packages/plugins/audit-log/package.json
+++ b/packages/plugins/audit-log/package.json
@@ -26,7 +26,7 @@
 	"author": "Matt Kane",
 	"license": "MIT",
 	"peerDependencies": {
-		"emdash": "workspace:>=0.14.0"
+		"emdash": "workspace:>=0.15.0"
 	},
 	"devDependencies": {
 		"@emdash-cms/plugin-cli": "workspace:*",
diff --git a/packages/plugins/embeds/CHANGELOG.md b/packages/plugins/embeds/CHANGELOG.md
index 71dfd9a86d..02bae8d002 100644
--- a/packages/plugins/embeds/CHANGELOG.md
+++ b/packages/plugins/embeds/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @emdash-cms/plugin-embeds
 
+## 0.1.16
+
+### Patch Changes
+
+- Updated dependencies [[`b9cc08e`](https://github.com/emdash-cms/emdash/commit/b9cc08e7556ccdbcbbcea6d3c06cae6abef18766), [`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92)]:
+  - @emdash-cms/blocks@0.15.0
+  - emdash@0.15.0
+
 ## 0.1.15
 
 ### Patch Changes
diff --git a/packages/plugins/embeds/package.json b/packages/plugins/embeds/package.json
index 8b1673adbd..4b36140e0a 100644
--- a/packages/plugins/embeds/package.json
+++ b/packages/plugins/embeds/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/plugin-embeds",
-	"version": "0.1.15",
+	"version": "0.1.16",
 	"description": "Embed blocks for EmDash CMS - YouTube, Vimeo, Twitter, Bluesky, Mastodon, and more",
 	"type": "module",
 	"main": "src/index.ts",
@@ -25,7 +25,7 @@
 	"license": "MIT",
 	"peerDependencies": {
 		"astro": ">=6.0.0-beta.0",
-		"emdash": "workspace:>=0.14.0"
+		"emdash": "workspace:>=0.15.0"
 	},
 	"dependencies": {
 		"@emdash-cms/blocks": "workspace:*",
diff --git a/packages/plugins/webhook-notifier/package.json b/packages/plugins/webhook-notifier/package.json
index eb90c8205a..55f58da4d3 100644
--- a/packages/plugins/webhook-notifier/package.json
+++ b/packages/plugins/webhook-notifier/package.json
@@ -26,7 +26,7 @@
 	"author": "Matt Kane",
 	"license": "MIT",
 	"peerDependencies": {
-		"emdash": "workspace:>=0.14.0"
+		"emdash": "workspace:>=0.15.0"
 	},
 	"devDependencies": {
 		"@emdash-cms/plugin-cli": "workspace:*",
diff --git a/packages/registry-client/CHANGELOG.md b/packages/registry-client/CHANGELOG.md
index e4894ef18d..f9b02eb37f 100644
--- a/packages/registry-client/CHANGELOG.md
+++ b/packages/registry-client/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @emdash-cms/registry-client
 
+## 0.2.0
+
+### Minor Changes
+
+- [#1126](https://github.com/emdash-cms/emdash/pull/1126) [`cf3c706`](https://github.com/emdash-cms/emdash/commit/cf3c706a65087696eb6cca5844b7668a50e4a090) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `emdash-plugin update-package`, a CLI command for editing an already-published plugin's registry record (license, authors, security contacts, name, description, keywords) without cutting a new release. Without `--yes` it prints a diff and exits without writing; with `--yes` it writes the updated record to the publisher's PDS using atproto's `swapRecord` precondition (concurrent writes surface as `STALE_RECORD` instead of silently overwriting each other) and bumps `lastUpdated`. Optional fields use a "manifest absent = no change" policy: removing a key from the manifest doesn't wipe the published value, matching `publish` semantics. Renaming a plugin via the manifest now surfaces a "looks like a rename" message listing the publisher's existing packages instead of a generic not-found, so publishers don't accidentally orphan releases under the old slug.
+
+  The publishing client (`@emdash-cms/registry-client`) gains a `swapRecord` parameter on `putRecord` and `unsafePutRecord` for callers needing optimistic-concurrency writes.
+
 ## 0.1.0
 
 ### Minor Changes
diff --git a/packages/registry-client/package.json b/packages/registry-client/package.json
index a826284ec3..a618bac31d 100644
--- a/packages/registry-client/package.json
+++ b/packages/registry-client/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/registry-client",
-	"version": "0.1.0",
+	"version": "0.2.0",
 	"description": "Atproto-aware client for the EmDash plugin registry: credential storage, publisher repo operations, and discovery against an aggregator.",
 	"type": "module",
 	"main": "dist/index.js",
diff --git a/packages/workerd/CHANGELOG.md b/packages/workerd/CHANGELOG.md
new file mode 100644
index 0000000000..6b6579911d
--- /dev/null
+++ b/packages/workerd/CHANGELOG.md
@@ -0,0 +1,28 @@
+# @emdash-cms/sandbox-workerd
+
+## 0.1.0
+
+### Minor Changes
+
+- [#426](https://github.com/emdash-cms/emdash/pull/426) [`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74) Thanks [@BenjaminPrice](https://github.com/BenjaminPrice)! - Adds workerd-based plugin sandboxing for Node.js deployments.
+  - **emdash**: Adds `isHealthy()` to `SandboxRunner` interface, `SandboxUnavailableError` class, `sandbox: false` config option, `mediaStorage` field on `SandboxOptions`, and exports `createHttpAccess`/`createUnrestrictedHttpAccess`/`PluginStorageRepository`/`UserRepository`/`OptionsRepository` for platform adapters.
+  - **@emdash-cms/cloudflare**: Implements `isHealthy()` on `CloudflareSandboxRunner`. Fixes `storageQuery()` and `storageCount()` to honor `where`, `orderBy`, and `cursor` options (previously ignored, causing infinite pagination loops and incorrect filtered counts). Adds `storageConfig` to `PluginBridgeProps` so `PluginStorageRepository` can use declared indexes.
+  - **@emdash-cms/sandbox-workerd**: New package. `WorkerdSandboxRunner` for production (workerd child process + capnp config + authenticated HTTP backing service) and `MiniflareDevRunner` for development.
+
+### Patch Changes
+
+- [#1144](https://github.com/emdash-cms/emdash/pull/1144) [`c50c3b2`](https://github.com/emdash-cms/emdash/commit/c50c3b2fa8a53d12f90d76f009ef82bfd4a47fcd) Thanks [@ascorbic](https://github.com/ascorbic)! - Aligns the `kysely` peer dependency with the rest of the monorepo (`>=0.29.0`) and switches the dev/peer references to the workspace catalog so all packages bump in lockstep going forward.
+
+- [#1147](https://github.com/emdash-cms/emdash/pull/1147) [`20c87fe`](https://github.com/emdash-cms/emdash/commit/20c87fe9248caa276a2083d50b996302deebb0c5) Thanks [@ascorbic](https://github.com/ascorbic)! - Tightens the workerd sandbox internals so the package now lints and type-checks cleanly.
+  - Bridge call bodies are validated with predicate-backed `require*` / `optional*` helpers instead of unchecked `as` casts. A misbehaving plugin that sends a malformed JSON-RPC body now gets a clear "Parameter X must be Y" error rather than triggering a downstream type confusion.
+  - Content table access (`ec_*` collections) is centralised behind a typed `asContentDb()` helper. Known tables (`users`, `media`, `_plugin_storage`) drop their `as keyof Database` casts entirely.
+  - HTTP `init` marshalling validates each field at the bridge boundary, including form-data parts.
+  - The backing service uses a typed `HttpError` class for status-bearing errors and validates incoming chunks/body shape defensively.
+  - `getPluginStorageConfig()` returns the real `PluginStorageConfig` shape from the manifest instead of `Record<string, unknown>`.
+  - `WorkerdSandboxedPlugin` now implements the correct `SandboxedPluginInstance` interface (the old `SandboxedPlugin` symbol did not exist).
+  - Adds a `typecheck` script (`tsgo --noEmit`) so the package participates in `pnpm typecheck` going forward.
+
+  No runtime behaviour changes.
+
+- Updated dependencies [[`02ed8ba`](https://github.com/emdash-cms/emdash/commit/02ed8ba32ef1f4301d84465b934430eee08eef74), [`11b3001`](https://github.com/emdash-cms/emdash/commit/11b300100e066c6b3463070a9b65fba868f37e9b), [`fae97ee`](https://github.com/emdash-cms/emdash/commit/fae97ee5465934365864557e9fa3ee8754cfd49c), [`88f544d`](https://github.com/emdash-cms/emdash/commit/88f544db4b8e2f30060a3b4d670ff72aa8760d61), [`9a30607`](https://github.com/emdash-cms/emdash/commit/9a30607791a2f27473b1d2fe7700291e0be1ea1c), [`d0ff94b`](https://github.com/emdash-cms/emdash/commit/d0ff94bd476e7fd4b5d18c94904cfb5c071fea92)]:
+  - emdash@0.15.0
diff --git a/packages/workerd/package.json b/packages/workerd/package.json
index d21f78f552..7d540a7b1e 100644
--- a/packages/workerd/package.json
+++ b/packages/workerd/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/sandbox-workerd",
-	"version": "0.0.1",
+	"version": "0.1.0",
 	"description": "workerd-based plugin sandbox for EmDash on Node.js",
 	"type": "module",
 	"main": "dist/index.mjs",
diff --git a/packages/x402/CHANGELOG.md b/packages/x402/CHANGELOG.md
index c11989511f..20de0a4933 100644
--- a/packages/x402/CHANGELOG.md
+++ b/packages/x402/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @emdash-cms/x402
 
+## 0.15.0
+
 ## 0.14.0
 
 ## 0.13.0
diff --git a/packages/x402/package.json b/packages/x402/package.json
index 0b64f07f80..63ad101734 100644
--- a/packages/x402/package.json
+++ b/packages/x402/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@emdash-cms/x402",
-	"version": "0.14.0",
+	"version": "0.15.0",
 	"description": "x402 payment protocol integration for Astro sites",
 	"license": "MIT",
 	"repository": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7f17a7cb01..d628278665 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1181,7 +1181,7 @@ importers:
         specifier: '>=5'
         version: 6.1.3(@types/node@24.10.13)(jiti@2.6.1)(lightningcss@1.32.0)(rollup@4.55.2)(typescript@6.0.0-beta)(yaml@2.8.2)
       emdash:
-        specifier: workspace:>=0.14.0
+        specifier: workspace:>=0.15.0
         version: link:../core
       kysely:
         specifier: 'catalog:'
@@ -1387,7 +1387,7 @@ importers:
         specifier: workspace:*
         version: link:../auth
       '@emdash-cms/auth-atproto':
-        specifier: workspace:>=0.2.7
+        specifier: workspace:>=0.2.8
         version: link:../auth-atproto
       '@emdash-cms/gutenberg-to-portable-text':
         specifier: workspace:*
@@ -1781,7 +1781,7 @@ importers:
         specifier: ^2.1.10
         version: 2.1.10(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       emdash:
-        specifier: workspace:>=0.14.0
+        specifier: workspace:>=0.15.0
         version: link:../../core
       react:
         specifier: ^18.0.0 || ^19.0.0
@@ -1790,7 +1790,7 @@ importers:
   packages/plugins/atproto:
     dependencies:
       emdash:
-        specifier: workspace:>=0.14.0
+        specifier: workspace:>=0.15.0
         version: link:../../core
     devDependencies:
       '@emdash-cms/plugin-cli':
@@ -1812,7 +1812,7 @@ importers:
   packages/plugins/audit-log:
     dependencies:
       emdash:
-        specifier: workspace:>=0.14.0
+        specifier: workspace:>=0.15.0
         version: link:../../core
     devDependencies:
       '@emdash-cms/plugin-cli':
@@ -1850,7 +1850,7 @@ importers:
         specifier: ^0.12.0
         version: 0.12.0(astro@6.0.1(@types/node@24.10.13)(jiti@2.6.1)(lightningcss@1.32.0)(rollup@4.55.2)(typescript@6.0.0-beta)(yaml@2.8.2))
       emdash:
-        specifier: workspace:>=0.14.0
+        specifier: workspace:>=0.15.0
         version: link:../../core
 
   packages/plugins/field-kit:
@@ -1950,7 +1950,7 @@ importers:
   packages/plugins/webhook-notifier:
     dependencies:
       emdash:
-        specifier: workspace:>=0.14.0
+        specifier: workspace:>=0.15.0
         version: link:../../core
     devDependencies:
       '@emdash-cms/plugin-cli':
@@ -14526,7 +14526,7 @@ snapshots:
   '@testing-library/dom@10.4.1':
     dependencies:
       '@babel/code-frame': 7.29.0
-      '@babel/runtime': 7.28.6
+      '@babel/runtime': 7.29.7
       '@types/aria-query': 5.0.4
       aria-query: 5.3.0
       dom-accessibility-api: 0.5.16