dineway 0.1.49 → 0.2.1

package/dist/astro/middleware.mjs

@@ -1,81 +1,96 @@
-import { i as runMigrations } from "../runner-DzIpHGND.mjs";
+import { i as runMigrations } from "../runner-BgmttQmD.mjs";
 import "../connection-CiJWiWya.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { s as isSqlite } from "../dialect-helpers-fk43GbDb.mjs";
 import { i as setI18nConfig } from "../config-CVssduLe.mjs";
-import { d as EmailPipeline, g as after, h as definePlugin, m as resolveExclusiveHooks, p as createHookPipeline, u as PluginRouteRegistry } from "../plugins-DzfqRREq.mjs";
+import { _ as DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES, d as EmailPipeline, g as definePlugin, h as runPluginMigrations, m as resolveExclusiveHooks, p as createHookPipeline, u as PluginRouteRegistry, v as readBoundedPluginRouteBody } from "../plugins-CPA2PtfY.mjs";
 import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
 import { createRecorder, flushRecorder, formatServerTimingHeader, isInstrumentationEnabled, isServerTimingEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
 import "../base64-F8-DUraK.mjs";
-import "../types-CSgR9nQB.mjs";
-import { a as isMissingTableError, r as getDb } from "../loader--GOYux8M.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "../content-CBxYGWfL.mjs";
-import { t as MediaRepository } from "../media-CbKyYukG.mjs";
-import "../user-DTLoZs16.mjs";
-import "../taxonomy-B169Nm6B.mjs";
-import "../comment-Beue8-15.mjs";
-import { t as OptionsRepository } from "../options-LsPjZlqD.mjs";
-import "../audit-BeNsSyfU.mjs";
-import "../site-activity-DONFrMBJ.mjs";
-import "../review-requests-BW2NxY-l.mjs";
-import "../entity-aliases-4y93Yjuc.mjs";
-import "../context-CQVNZaR8.mjs";
-import "../menus-BZbXf-ej.mjs";
-import "../redirect-CEACczxo.mjs";
-import { r as requestCached } from "../request-cache-ho99schz.mjs";
-import "../byline-registry-4v6tXMNX.mjs";
-import "../byline-BVC1lV6G.mjs";
-import { n as normalizeMediaValue } from "../normalize-ByemhhfW.mjs";
-import "../placeholder-d54Qr_7n.mjs";
-import "../seo-CLj8lS7Q.mjs";
-import { $ as handleContentUpdate, A as handleRevisionGet, B as handleContentDiscardDraft, D as handleMediaGet, E as handleMediaDelete, F as handleContentCompare, G as handleContentListTrashed, H as handleContentGet, I as handleContentCountScheduled, J as handleContentRestore, K as handleContentPermanentDelete, L as handleContentCountTrashed, M as handleRevisionRestore, O as handleMediaList, P as handleContentAuthors, Q as handleContentUnschedule, R as handleContentCreate, T as handleMediaCreate, U as handleContentGetIncludingTrashed, V as handleContentDuplicate, W as handleContentList, X as handleContentTranslations, Y as handleContentSchedule, Z as handleContentUnpublish, d as createPluginBundleStore, et as validateRev, j as handleRevisionList, k as handleMediaUpdate, q as handleContentPublish, z as handleContentDelete } from "../api-BMIxRIEN.mjs";
-import "../dashboard-B7ZUNuyF.mjs";
-import { u as PluginStateRepository } from "../briefing-CkTee1ex.mjs";
-import "../context-types-r8oFvyOq.mjs";
-import { t as FTSManager } from "../fts-manager-B5l_qwrA.mjs";
-import { n as SchemaRegistry } from "../registry-D7HACema.mjs";
-import { c as createPublicMediaUrlResolver } from "../settings-CUXOxzsT.mjs";
-import "../briefing-DJX6irto.mjs";
-import "../review-requests-Qum4713s.mjs";
-import { n as hashString } from "../hash-BPmX6P8I.mjs";
-import { n as VERSION, t as COMMIT } from "../version-C4gfn0PJ.mjs";
-import "../query-CZ3TH_Uu.mjs";
-import "../zod-generator-K91-g665.mjs";
-import "../schema-Bsi-VpYv.mjs";
-import "../seo-5lJOtB5J.mjs";
-import "../bylines-LN9XISRo.mjs";
-import "../byline-fields-Cj39WhXC.mjs";
-import "../sections-BOjU13Y-.mjs";
-import "../settings-DlBsT2VS.mjs";
-import "../resolve-DTuDyYKs.mjs";
-import "../taxonomies-CZ-_DitR.mjs";
-import "../taxonomies-D9Sw4wWM.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-qh2P7RDX.mjs";
-import "../parse-CneSgl7-.mjs";
-import "../redirects-ocRJmQHP.mjs";
-import "../byline-fields-cNrLJVRs.mjs";
-import { a as invalidateUrlPatternCache } from "../query-Ds0EnMFX.mjs";
-import "../preview-C-3YTX2U.mjs";
-import "../parser-DxfsARXL.mjs";
-import { t as getTrustedProxyHeaders } from "../trusted-proxy-BgIIcbsN.mjs";
-import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DAb6xaP9.mjs";
-import "../ssrf-DiKqWd3N.mjs";
-import { n as CronExecutor } from "../cron-DxCAU_Sn.mjs";
-import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-BOVqIYpB.mjs";
-import "../import-4YBXbDkI.mjs";
-import "../utils-B8hBJ9Oz.mjs";
-import "../tokens-SLmgowfd.mjs";
-import "../menus-C7F0sCrC.mjs";
-import "../bylines-DwokOFj6.mjs";
-import "../widgets-BpJ8EpPd.mjs";
-import "../apply-D_RlTYtC.mjs";
-import "../load-D9OiGr2m.mjs";
-import "../search-Gdrqj582.mjs";
+import "../types-ChxYDRvx.mjs";
+import { o as isMissingTableError, r as getDb } from "../loader-aWkkc1_o.mjs";
+import { t as after } from "../after-BfniwgIf.mjs";
+import "../object-cache-D51qOseS.mjs";
+import { r as RevisionRepository, t as ContentRepository } from "../content-DJcAYFhz.mjs";
+import { t as MediaRepository } from "../media-CVMOoywq.mjs";
+import "../user-BH-n01y3.mjs";
+import "../taxonomy-0k_vRVsD.mjs";
+import "../comment-DFALgsJD.mjs";
+import { t as OptionsRepository } from "../options-DQPTH5n0.mjs";
+import "../audit-B2pRxZ20.mjs";
+import "../site-activity-h8smOlYI.mjs";
+import "../review-requests-CTWGnWUt.mjs";
+import { n as PublicationAuthorizationService, t as PublicationAuthorizationError } from "../publication-authorization-RKiHXKtq.mjs";
+import "../site-context-B8T1kpUP.mjs";
+import { t as PluginContextFactory } from "../context-fSCYLL3c.mjs";
+import "../menus-CmyIkRG5.mjs";
+import "../redirect-ubhEqQCQ.mjs";
+import { r as requestCached } from "../request-cache-CBFjCwSt.mjs";
+import "../byline-registry-Ba54M74c.mjs";
+import { a as initWithLock, i as createInitLock, r as processCachedAsync, t as createProcessCache } from "../process-cache-CCDgti7j.mjs";
+import "../field-defs-cache-DL-T2XVS.mjs";
+import "../byline-7xR185Ly.mjs";
+import { n as normalizeMediaValue } from "../normalize-Cyt7JdF7.mjs";
+import "../enrich-Ck9tfMqe.mjs";
+import "../seo-BU8MLCS9.mjs";
+import { $ as handleContentUpdate, A as handleRevisionGet, B as handleContentDiscardDraft, D as handleMediaGet, E as handleMediaDelete, F as handleContentCompare, G as handleContentListTrashed, H as handleContentGet, I as handleContentCountScheduled, J as handleContentRestore, K as handleContentPermanentDelete, L as handleContentCountTrashed, M as handleRevisionRestore, O as handleMediaList, P as handleContentAuthors, Q as handleContentUnschedule, R as handleContentCreate, T as handleMediaCreate, U as handleContentGetIncludingTrashed, V as handleContentDuplicate, W as handleContentList, X as handleContentTranslations, Y as handleContentSchedule, Z as handleContentUnpublish, d as createPluginBundleStore, et as validateRev, j as handleRevisionList, k as handleMediaUpdate, q as handleContentPublish, z as handleContentDelete } from "../api-B4PHIF4V.mjs";
+import "../dashboard-D0nj5oWg.mjs";
+import { u as PluginStateRepository } from "../briefing-0rf-su3-.mjs";
+import "../context-types-eBuMDAg-.mjs";
+import { i as markContentMediaUsageCollectionStale, o as refreshContentMediaUsageAfterWrite, r as findNonTranslatableSiblingContentIds, t as deleteContentMediaUsage } from "../content-refresh-B4ZCmxgd.mjs";
+import { n as hashString } from "../hash-mxxx2oPW.mjs";
+import { t as FTSManager } from "../fts-manager-ewTGohf4.mjs";
+import { n as SchemaRegistry } from "../registry-BYYyb2tF.mjs";
+import { r as createPublicMediaUrlResolver } from "../url-guoXQQcV.mjs";
+import "../settings-BECcAIRH.mjs";
+import "../briefing-kRhegBoF.mjs";
+import "../review-requests-D42VEP1l.mjs";
+import { n as VERSION, t as COMMIT } from "../version-C3iVRuaF.mjs";
+import "../query-C2U5u5_p.mjs";
+import "../zod-generator-C7AsLpSB.mjs";
+import "../schema-DUtnZxjZ.mjs";
+import "../seo-BLszyJxd.mjs";
+import "../bylines-C-EL6dh3.mjs";
+import "../byline-fields-BKzA0fJU.mjs";
+import "../sections-DvFgsnda.mjs";
+import "../settings-EzADu-dd.mjs";
+import "../resolve-DE71WcL9.mjs";
+import "../taxonomies-DSnY5nOa.mjs";
+import "../taxonomies-BiM9NtgW.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-uA6pRFXi.mjs";
+import "../parse-i15EFSAE.mjs";
+import "../redirects-Bhpm8bRe.mjs";
+import "../byline-fields-WN7RQT4q.mjs";
+import "../status-NqWOSFAD.mjs";
+import { t as getTrustedProxyHeaders } from "../trusted-proxy-Dm7Mxvt6.mjs";
+import "../rate-limit-DglsAJSw.mjs";
+import { a as invalidateUrlPatternCache } from "../query-DEv5x6yB.mjs";
+import "../preview-BjedZm8G.mjs";
+import "../parser-06LLLL4E.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-CFe1tW2M.mjs";
+import "../ssrf-FJqwQzj4.mjs";
+import { n as CronExecutor } from "../cron-B1SL_lsb.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-Bp0r68iF.mjs";
+import { o as validateEncryptionKeyAtStartup } from "../secrets-ZV5rd8yV.mjs";
+import "../api-tokens-Ypaly90d.mjs";
+import { n as createActivePluginMcpRegistry } from "../mcp-reviewed-executor-Dn52L_yY.mjs";
+import "../activity-DUaz_w7p.mjs";
+import "../activity-events-CJDvE2uc.mjs";
+import { i as experimentalSiteContextWorkflowsEnabled } from "../experimental-workflows-GVhUgzEs.mjs";
+import "../utils-D1SrKGtP.mjs";
+import "../search-DUKgZUlm.mjs";
+import "../import-CXXL5pip.mjs";
+import "../tokens-BDQU29Vd.mjs";
+import "../comment-reaction-C37bf99u.mjs";
+import "../menus-CCG2z5um.mjs";
+import "../bylines-CmZFCMr0.mjs";
+import "../widgets-BZrLrNgS.mjs";
+import "../apply-DjTqq6Ae.mjs";
+import "../load-CFtJRT3c.mjs";
 import "../index.mjs";
-import { t as getAuthMode } from "../mode-CZqCF9dZ.mjs";
-import { i as experimentalSiteContextWorkflowsEnabled } from "../experimental-workflows-CSMffP6q.mjs";
-import { t as cleanupExpiredChallenges } from "../challenge-store-DFxX0_15.mjs";
-import { a as validateEncryptionKeyAtStartup } from "../secrets-CeGpBFV2.mjs";
+import { t as getAuthMode } from "../mode-C8yZnIlR.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-D5pSY2S1.mjs";
+import { t as resolveSessionUser } from "../session-user-Ct6GBLvn.mjs";
 import { Kysely, sql } from "kysely";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:dineway/config";
@@ -348,6 +363,10 @@ const SCHEDULED_PUBLISH_BATCH_LIMIT = 100;
 async function publishDueContent(db, options = {}) {
 	const { publish, onPublished, limit = SCHEDULED_PUBLISH_BATCH_LIMIT } = options;
 	const published = [];
+	if (!publish) {
+		console.error("[scheduled-publish] Authorized publication callback is required");
+		return published;
+	}
 	let collections;
 	try {
 		collections = await new SchemaRegistry(db).listCollections();
@@ -356,22 +375,27 @@ async function publishDueContent(db, options = {}) {
 		return published;
 	}
 	const repo = new ContentRepository(db);
-	const doPublish = publish ?? ((collection, id, opts) => handleContentPublish(db, collection, id, opts));
 	const batchLimit = limit > 0 ? limit : void 0;
 	for (const collection of collections) try {
 		const due = await repo.findReadyToPublish(collection.slug, batchLimit);
 		const batch = [];
 		for (const item of due) {
+			if (!item.scheduledAt) continue;
 			const publishedAt = item.publishedAt == null ? item.scheduledAt ?? void 0 : void 0;
-			const result = await doPublish(collection.slug, item.id, {
-				publishedAt,
-				requireScheduledDue: true
-			});
-			if (result.success) batch.push({
-				collection: collection.slug,
-				id: item.id
-			});
-			else if (result.error?.code !== "NOT_DUE") console.error(`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`, result.error);
+			try {
+				const result = await publish(collection.slug, item.id, {
+					publishedAt,
+					requireScheduledDue: true,
+					scheduledAt: item.scheduledAt
+				});
+				if (result.success) batch.push({
+					collection: collection.slug,
+					id: item.id
+				});
+				else if (result.error?.code !== "NOT_DUE") console.error(`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`, result.error);
+			} catch (error) {
+				console.error(`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`, error);
+			}
 		}
 		if (batch.length > 0) {
 			published.push(...batch);
@@ -387,47 +411,6 @@ async function publishDueContent(db, options = {}) {
 	return published;
 }
 
-//#endregion
-//#region src/utils/init-lock.ts
-const DEFAULT_DEADLINE_MS = 15e3;
-const DEFAULT_POLL_MS = 50;
-const MAX_WAIT_HEADROOM_MS = 15e3;
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function createInitLock() {
-	return {
-		ownerStartedAt: null,
-		generation: 0
-	};
-}
-async function initWithLock(lock, getCached, init, options) {
-	const deadlineMs = options?.deadlineMs ?? DEFAULT_DEADLINE_MS;
-	const pollMs = options?.pollMs ?? DEFAULT_POLL_MS;
-	const maxWaitMs = options?.maxWaitMs ?? deadlineMs + MAX_WAIT_HEADROOM_MS;
-	const waitStart = Date.now();
-	for (;;) {
-		const cached = getCached();
-		if (cached !== null && cached !== void 0) return cached;
-		const ownerStartedAt = lock.ownerStartedAt;
-		if (ownerStartedAt === null || Date.now() - ownerStartedAt > deadlineMs) {
-			lock.generation += 1;
-			const claim = lock.generation;
-			lock.ownerStartedAt = Date.now();
-			try {
-				const isCurrentClaim = () => lock.generation === claim;
-				const initPromise = Promise.resolve().then(() => init(isCurrentClaim));
-				options?.anchor?.(initPromise.then(() => void 0, () => void 0));
-				return await initPromise;
-			} finally {
-				if (lock.generation === claim) lock.ownerStartedAt = null;
-			}
-		}
-		if (Date.now() - waitStart > maxWaitMs) throw new Error(`initWithLock: timed out after ${maxWaitMs}ms waiting for initialization`);
-		await sleep(pollMs);
-	}
-}
-
 //#endregion
 //#region src/dineway-runtime.ts
 const LEADING_SLASH_PATTERN = /^\//;
@@ -553,7 +536,6 @@ var DinewayRuntime = class DinewayRuntime {
 	configuredPlugins;
 	sandboxedPlugins;
 	sandboxedPluginEntries;
-	schemaRegistry;
 	_hooks;
 	config;
 	mediaProviders;
@@ -576,10 +558,8 @@ var DinewayRuntime = class DinewayRuntime {
 	runtimeDeps;
 	/** Mutable ref for the cron invokeCronHook closure to read the current pipeline */
 	pipelineRef;
-	/** Tracks whether FTS health has already been checked for this runtime instance. */
-	_searchHealthChecked = false;
-	/** Shared in-flight FTS health verification promise. */
-	_searchHealthPromise = null;
+	/** Process-lifetime FTS health check cache that never stores an in-flight promise. */
+	_searchHealthCache = createProcessCache();
 	/**
 	* Get the database instance for the current request.
 	*
@@ -599,7 +579,6 @@ var DinewayRuntime = class DinewayRuntime {
 		this.configuredPlugins = configuredPlugins;
 		this.sandboxedPlugins = sandboxedPlugins;
 		this.sandboxedPluginEntries = sandboxedPluginEntries;
-		this.schemaRegistry = new SchemaRegistry(db);
 		this._hooks = hooks;
 		this.enabledPlugins = enabledPlugins;
 		this.pluginStates = pluginStates;
@@ -620,12 +599,53 @@ var DinewayRuntime = class DinewayRuntime {
 	getSandboxRunner() {
 		return sandboxRunner;
 	}
+	get schemaRegistry() {
+		return new SchemaRegistry(this.db);
+	}
+	/**
+	* Resolve native MCP contributions from the current active plugin set.
+	* The registry is derived per request so activate/deactivate changes cannot
+	* leave a stateless MCP server with a stale contribution snapshot.
+	*/
+	getPluginMcpRegistry() {
+		return createActivePluginMcpRegistry(this.configuredPlugins, this.enabledPlugins);
+	}
+	/**
+	* Resolve the outbound HTTP capability for an active native plugin.
+	* MCP handlers use this instead of reaching for global fetch, so the same
+	* capability and SSRF rules apply to routes, hooks, and MCP contributions.
+	*/
+	getPluginHttpAccess(pluginId) {
+		if (!this.enabledPlugins.has(pluginId)) return void 0;
+		const plugin = this.configuredPlugins.find((candidate) => candidate.id === pluginId);
+		if (!plugin) return void 0;
+		return new PluginContextFactory({
+			...this.pipelineFactoryOptions,
+			emailPipeline: this.email ?? void 0,
+			cronReschedule: this.cronScheduler ? () => this.cronScheduler?.reschedule() : void 0
+		}).createContext(plugin).http;
+	}
 	/**
 	* Publish any content whose scheduled time has passed.
 	* Routes through the runtime wrapper so after-publish hooks still fire.
 	*/
 	async publishScheduled() {
-		return publishDueContent(this.db, { publish: (collection, id, options) => this.handleContentPublish(collection, id, options) });
+		return publishDueContent(this.db, { publish: this.publishAuthorizedDueContent.bind(this) });
+	}
+	async publishAuthorizedDueContent(collection, id, options) {
+		try {
+			return (await this.createPublicationAuthorizationService().publishAuthorizedDueContent({
+				collection,
+				id,
+				scheduledAt: options.scheduledAt,
+				publishedAt: options.publishedAt
+			})).result;
+		} catch (error) {
+			return {
+				success: false,
+				error: { code: error instanceof PublicationAuthorizationError ? error.code : "SCHEDULED_PUBLISH_ERROR" }
+			};
+		}
 	}
 	/**
 	* Run all scheduled maintenance work from a heartbeat driver.
@@ -646,7 +666,7 @@ var DinewayRuntime = class DinewayRuntime {
 		let published = [];
 		try {
 			published = await publishDueContent(this.db, {
-				publish: (collection, id, opts) => this.handleContentPublish(collection, id, opts),
+				publish: this.publishAuthorizedDueContent.bind(this),
 				onPublished: options.onPublished
 			});
 		} catch (error) {
@@ -679,26 +699,29 @@ var DinewayRuntime = class DinewayRuntime {
 	*
 	* Search health is deferred off the runtime cold-start path so ordinary
 	* page loads do not pay the index verification cost. Concurrent callers
-	* share a single in-flight check, and once it has completed the result is
-	* treated as healthy for the lifetime of this runtime instance.
+	* coalesce without sharing an in-flight promise, and once it has completed
+	* the result is treated as healthy for the lifetime of this runtime instance.
 	*/
 	async ensureSearchHealthy() {
-		if (this._searchHealthChecked) return;
-		if (this._searchHealthPromise) return this._searchHealthPromise;
-		if (!isSqlite(this.db)) {
-			this._searchHealthChecked = true;
-			return;
-		}
-		this._searchHealthPromise = (async () => {
+		const requestDb = getRequestContextDatabase();
+		const db = requestDb ?? this._db;
+		if (!isSqlite(db)) return;
+		const verify = async () => {
 			try {
-				const repaired = await new FTSManager(this.db).verifyAndRepairAll();
+				const repaired = await new FTSManager(db).verifyAndRepairAll();
 				if (repaired > 0) console.log(`Repaired ${repaired} corrupted FTS index(es)`);
-			} catch {} finally {
-				this._searchHealthChecked = true;
-				this._searchHealthPromise = null;
-			}
-		})();
-		return this._searchHealthPromise;
+			} catch {}
+		};
+		if (requestDb) {
+			await verify();
+			return;
+		}
+		try {
+			await processCachedAsync(this._searchHealthCache, verify, {
+				anchor: (promise) => after(() => promise),
+				ownerTimeoutMs: 3e4
+			});
+		} catch {}
 	}
 	/**
 	* Update in-memory plugin status and rebuild the hook pipeline.
@@ -731,10 +754,7 @@ var DinewayRuntime = class DinewayRuntime {
 	async rebuildHookPipeline() {
 		const newPipeline = createHookPipeline(this.allPipelinePlugins.filter((p) => this.enabledPlugins.has(p.id)), this.pipelineFactoryOptions);
 		await DinewayRuntime.resolveExclusiveHooks(newPipeline, this.db, this.runtimeDeps);
-		if (this.email) newPipeline.setContextFactory({
-			db: this.db,
-			emailPipeline: this.email
-		});
+		if (this.email) newPipeline.setContextFactory({ emailPipeline: this.email });
 		if (this.cronScheduler) {
 			const scheduler = this.cronScheduler;
 			newPipeline.setContextFactory({ cronReschedule: () => scheduler.reschedule() });
@@ -816,7 +836,10 @@ var DinewayRuntime = class DinewayRuntime {
 					const routeMetaMap = /* @__PURE__ */ new Map();
 					for (const entry of bundle.manifest.routes) {
 						const normalized = normalizeManifestRoute(entry);
-						routeMetaMap.set(normalized.name, { public: normalized.public === true });
+						routeMetaMap.set(normalized.name, {
+							public: normalized.public === true,
+							body: "json"
+						});
 					}
 					sandboxedRouteMetaCache.set(pluginId, routeMetaMap);
 				} else sandboxedRouteMetaCache.delete(pluginId);
@@ -843,6 +866,8 @@ var DinewayRuntime = class DinewayRuntime {
 			}
 		};
 		const db = await phase("rt.db", "DB init + migrations", () => DinewayRuntime.getDatabase(deps));
+		const resolveDb = () => getRequestContextDatabase() ?? db;
+		await phase("rt.plugin-migrations", "Trusted plugin migrations", () => runPluginMigrations(db, deps.plugins));
 		await phase("rt.secrets", "Validate encryption key", () => validateEncryptionKeyAtStartup());
 		const storage = DinewayRuntime.getStorage(deps);
 		let pluginStates = /* @__PURE__ */ new Map();
@@ -906,6 +931,7 @@ var DinewayRuntime = class DinewayRuntime {
 		const trustedProxyHeaders = getTrustedProxyHeaders(deps.config);
 		const pipelineFactoryOptions = {
 			db,
+			getDb: resolveDb,
 			storage: storage ?? void 0,
 			siteInfo,
 			trustedProxyHeaders
@@ -924,6 +950,7 @@ var DinewayRuntime = class DinewayRuntime {
 		const mediaProviderEntries = deps.mediaProviderEntries ?? [];
 		const providerContext = {
 			db,
+			getDb: resolveDb,
 			storage
 		};
 		for (const entry of mediaProviderEntries) try {
@@ -940,15 +967,12 @@ var DinewayRuntime = class DinewayRuntime {
 			const result = await pipelineRef.current.invokeCronHook(pluginId, event);
 			if (!result.success && result.error) throw result.error;
 		};
-		pipeline.setContextFactory({
-			db,
-			emailPipeline
-		});
+		pipeline.setContextFactory({ emailPipeline });
 		let cronExecutor = null;
 		const runtimeRef = { current: null };
 		await phase("rt.cron", "Cron init (recovery deferred post-response)", async () => {
 			try {
-				cronExecutor = new CronExecutor(db, invokeCronHook);
+				cronExecutor = new CronExecutor(resolveDb, invokeCronHook);
 				const executorForRecovery = cronExecutor;
 				after(async () => {
 					try {
@@ -963,7 +987,7 @@ var DinewayRuntime = class DinewayRuntime {
 				cronScheduler.setSystemCleanup(async () => {
 					try {
 						const runtime = runtimeRef.current;
-						await publishDueContent(db, { publish: runtime ? (collection, id, options) => runtime.handleContentPublish(collection, id, options) : void 0 });
+						await publishDueContent(db, { publish: runtime ? runtime.publishAuthorizedDueContent.bind(runtime) : void 0 });
 					} catch (error) {
 						console.error("[scheduled-publish] Sweep failed:", error);
 					}
@@ -979,6 +1003,18 @@ var DinewayRuntime = class DinewayRuntime {
 				console.warn("[cron] Failed to initialize cron system:", error);
 			}
 		});
+		await phase("rt.pluginLifecycle", "Configured plugin first-start lifecycle", async () => {
+			const stateRepository = new PluginStateRepository(db);
+			for (const plugin of deps.plugins) {
+				if (pluginStates.has(plugin.id)) continue;
+				const installFailure = (await pipeline.runPluginInstall(plugin.id)).find((result) => !result.success);
+				if (installFailure) throw new Error(`Plugin install failed for "${plugin.id}": ${installFailure.error?.message ?? "Unknown error"}`);
+				const activateFailure = (await pipeline.runPluginActivate(plugin.id)).find((result) => !result.success);
+				if (activateFailure) throw new Error(`Plugin activation failed for "${plugin.id}": ${activateFailure.error?.message ?? "Unknown error"}`);
+				await stateRepository.enable(plugin.id, plugin.version);
+				pluginStates.set(plugin.id, "active");
+			}
+		});
 		const runtime = new DinewayRuntime(db, storage, deps.plugins, sandboxedPlugins, deps.sandboxedPluginEntries, pipeline, enabledPlugins, pluginStates, deps.config, mediaProviders, mediaProviderEntries, cronExecutor, cronScheduler, emailPipeline, allPipelinePlugins, pipelineFactoryOptions, deps, pipelineRef);
 		runtimeRef.current = runtime;
 		return runtime;
@@ -1030,9 +1066,9 @@ var DinewayRuntime = class DinewayRuntime {
 					}
 				})();
 				if (collectionCount.count === 0 && !setupDone) {
-					const { applySeed } = await import("../apply-D_RlTYtC.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-D9OiGr2m.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-DWmPO6oj.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-DjTqq6Ae.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-CFtJRT3c.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-D1HL-oLR.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -1130,7 +1166,10 @@ var DinewayRuntime = class DinewayRuntime {
 						const routeMeta = /* @__PURE__ */ new Map();
 						for (const entry of bundle.manifest.routes) {
 							const normalized = normalizeManifestRoute(entry);
-							routeMeta.set(normalized.name, { public: normalized.public === true });
+							routeMeta.set(normalized.name, {
+								public: normalized.public === true,
+								body: "json"
+							});
 						}
 						sandboxedRouteMetaCache.set(plugin.pluginId, routeMeta);
 					}
@@ -1238,7 +1277,9 @@ var DinewayRuntime = class DinewayRuntime {
 				sandboxed: true,
 				adminMode: hasAdminPages || hasWidgets ? "blocks" : "none",
 				adminPages: entry.adminPages ?? [],
-				dashboardWidgets: entry.adminWidgets ?? []
+				dashboardWidgets: entry.adminWidgets ?? [],
+				portableTextBlocks: entry.portableTextBlocks,
+				fieldWidgets: entry.fieldWidgets
 			};
 		}
 		for (const [pluginId, meta] of marketplaceManifestCache) {
@@ -1318,11 +1359,13 @@ var DinewayRuntime = class DinewayRuntime {
 			authorId: body.authorId,
 			bylines: body.bylines
 		});
-		if (result.success && result.data) this.runAfterSaveHooks(contentItemToRecord(result.data.item), collection, true);
+		if (result.success && result.data) {
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+			this.runAfterSaveHooks(contentItemToRecord(result.data.item), collection, true);
+		}
 		return result;
 	}
 	async handleContentUpdate(collection, id, body) {
-		const { ContentRepository } = await import("../content-CBxYGWfL.mjs").then((n) => n.n);
 		const repo = new ContentRepository(this.db);
 		const resolvedItem = await repo.findByIdOrSlug(collection, id, body.locale);
 		const resolvedId = resolvedItem?.id ?? id;
@@ -1393,7 +1436,21 @@ var DinewayRuntime = class DinewayRuntime {
 			authorId: bodyWithoutRev.authorId,
 			bylines: bodyWithoutRev.bylines
 		});
-		if (result.success && result.data) this.runAfterSaveHooks(contentItemToRecord(result.data.item), collection, false);
+		if (result.success && result.data) {
+			const contentIdsToRefresh = [resolvedId];
+			if (!usesDraftRevisions && processedData) try {
+				contentIdsToRefresh.push(...await findNonTranslatableSiblingContentIds(this.db, collection, resolvedId, result.data.item.translationGroup, processedData));
+			} catch (error) {
+				console.error(`[media-usage] Failed to discover synced i18n siblings for ${collection}/${resolvedId}:`, error);
+				try {
+					await markContentMediaUsageCollectionStale(this.db, collection, "CONTENT_USAGE_REFRESH_ERROR");
+				} catch (staleError) {
+					console.error(`[media-usage] Failed to mark ${collection} stale:`, staleError);
+				}
+			}
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, contentIdsToRefresh);
+			this.runAfterSaveHooks(contentItemToRecord(result.data.item), collection, false);
+		}
 		return result;
 	}
 	async handleContentDelete(collection, id) {
@@ -1414,48 +1471,95 @@ var DinewayRuntime = class DinewayRuntime {
 				message: "Delete blocked by sandboxed plugin hook"
 			}
 		};
+		const contentId = await this.resolveContentId(collection, id, false);
 		const result = await handleContentDelete(this.db, collection, id);
-		if (result.success) this.runAfterDeleteHooks(id, collection, false);
+		if (result.success) {
+			if (contentId) await this.refreshContentUsageAfterSuccessfulWrite(collection, [contentId]);
+			this.runAfterDeleteHooks(id, collection, false);
+		}
 		return result;
 	}
 	async handleContentListTrashed(collection, params = {}) {
 		return handleContentListTrashed(this.db, collection, params);
 	}
 	async handleContentRestore(collection, id) {
-		return handleContentRestore(this.db, collection, id);
+		const result = await handleContentRestore(this.db, collection, id);
+		if (result.success) {
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+			this.runAfterRestoreHooks(contentItemToRecord(result.data.item), collection);
+		}
+		return result;
 	}
 	async handleContentPermanentDelete(collection, id) {
+		const contentId = await this.resolveContentId(collection, id, true);
 		const result = await handleContentPermanentDelete(this.db, collection, id);
-		if (result.success) this.runAfterDeleteHooks(id, collection, true);
+		if (result.success) {
+			if (contentId) await this.deleteContentUsageAfterSuccessfulPermanentDelete(collection, contentId);
+			this.runAfterDeleteHooks(id, collection, true);
+		}
 		return result;
 	}
 	async handleContentCountTrashed(collection) {
 		return handleContentCountTrashed(this.db, collection);
 	}
 	async handleContentDuplicate(collection, id, authorId) {
-		return handleContentDuplicate(this.db, collection, id, authorId);
+		const result = await handleContentDuplicate(this.db, collection, id, authorId);
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		return result;
+	}
+	createPublicationAuthorizationService() {
+		const policies = this.configuredPlugins.filter((plugin) => this.enabledPlugins.has(plugin.id)).flatMap((plugin) => plugin.publicationReleasePolicies ?? []);
+		return new PublicationAuthorizationService({
+			db: this.db,
+			policies,
+			handlers: {
+				handleContentGet: this.handleContentGet.bind(this),
+				handleContentCompare: this.handleContentCompare.bind(this),
+				handleContentPublish: this.handleContentPublish.bind(this),
+				handleContentSchedule: this.handleContentSchedule.bind(this),
+				handleContentUnschedule: this.handleContentUnschedule.bind(this)
+			}
+		});
 	}
 	async handleContentPublish(collection, id, options = {}) {
 		const result = await handleContentPublish(this.db, collection, id, options);
-		if (result.success && result.data) this.runAfterPublishHooks(contentItemToRecord(result.data.item), collection);
+		if (result.success && result.data) {
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+			this.runAfterPublishHooks(contentItemToRecord(result.data.item), collection);
+		}
 		return result;
 	}
 	async handleContentUnpublish(collection, id) {
 		const result = await handleContentUnpublish(this.db, collection, id);
-		if (result.success && result.data) this.runAfterUnpublishHooks(contentItemToRecord(result.data.item), collection);
+		if (result.success && result.data) {
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+			this.runAfterUnpublishHooks(contentItemToRecord(result.data.item), collection);
+		}
 		return result;
 	}
 	async handleContentSchedule(collection, id, scheduledAt) {
-		return handleContentSchedule(this.db, collection, id, scheduledAt);
+		const result = await handleContentSchedule(this.db, collection, id, scheduledAt);
+		if (result.success && result.data) {
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+			this.runAfterScheduleHooks(contentItemToRecord(result.data.item), collection);
+		}
+		return result;
 	}
 	async handleContentUnschedule(collection, id) {
-		return handleContentUnschedule(this.db, collection, id);
+		const result = await handleContentUnschedule(this.db, collection, id);
+		if (result.success && result.data) {
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+			this.runAfterUnscheduleHooks(contentItemToRecord(result.data.item), collection);
+		}
+		return result;
 	}
 	async handleContentCountScheduled(collection) {
 		return handleContentCountScheduled(this.db, collection);
 	}
 	async handleContentDiscardDraft(collection, id) {
-		return handleContentDiscardDraft(this.db, collection, id);
+		const result = await handleContentDiscardDraft(this.db, collection, id);
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		return result;
 	}
 	async handleContentCompare(collection, id) {
 		return handleContentCompare(this.db, collection, id);
@@ -1463,6 +1567,25 @@ var DinewayRuntime = class DinewayRuntime {
 	async handleContentTranslations(collection, id) {
 		return handleContentTranslations(this.db, collection, id);
 	}
+	async refreshContentUsageAfterSuccessfulWrite(collection, contentIds) {
+		for (const contentId of new Set(contentIds)) try {
+			await refreshContentMediaUsageAfterWrite(this.db, collection, contentId);
+		} catch (error) {
+			console.error(`[media-usage] Failed after content write ${collection}/${contentId}:`, error);
+		}
+	}
+	async deleteContentUsageAfterSuccessfulPermanentDelete(collection, contentId) {
+		try {
+			const result = await deleteContentMediaUsage(this.db, collection, contentId);
+			if (!result.success) console.error(`[media-usage] Usage delete for ${collection}/${contentId} finished with ${result.errorCode}`);
+		} catch (error) {
+			console.error(`[media-usage] Failed after permanent content delete ${collection}/${contentId}:`, error);
+		}
+	}
+	async resolveContentId(collection, id, includeTrashed) {
+		const repo = new ContentRepository(this.db);
+		return (includeTrashed ? await repo.findByIdOrSlugIncludingTrashed(collection, id) : await repo.findByIdOrSlug(collection, id))?.id ?? null;
+	}
 	async handleMediaList(params) {
 		return handleMediaList(this.db, params);
 	}
@@ -1526,7 +1649,13 @@ var DinewayRuntime = class DinewayRuntime {
 		if (trustedPlugin) {
 			const route = trustedPlugin.routes[routeKey];
 			if (!route) return null;
-			return { public: route.public === true };
+			return {
+				public: route.public === true,
+				body: route.body ?? "json",
+				...route.body === "raw" ? { maxBodyBytes: route.maxBodyBytes ?? DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES } : {},
+				authorization: route.authorization,
+				apiTokenPolicy: route.apiTokenPolicy
+			};
 		}
 		const meta = sandboxedRouteMetaCache.get(pluginId);
 		if (meta) {
@@ -1535,14 +1664,23 @@ var DinewayRuntime = class DinewayRuntime {
 		}
 		if (routeKey === "admin") {
 			const manifestMeta = marketplaceManifestCache.get(pluginId);
-			if (manifestMeta?.admin?.pages?.length || manifestMeta?.admin?.widgets?.length) return { public: false };
+			if (manifestMeta?.admin?.pages?.length || manifestMeta?.admin?.widgets?.length) return {
+				public: false,
+				body: "json"
+			};
 			const entry = this.sandboxedPluginEntries.find((e) => e.id === pluginId);
-			if (entry?.adminPages?.length || entry?.adminWidgets?.length) return { public: false };
+			if (entry?.adminPages?.length || entry?.adminWidgets?.length) return {
+				public: false,
+				body: "json"
+			};
 		}
-		if (this.findSandboxedPlugin(pluginId)) return { public: false };
+		if (this.findSandboxedPlugin(pluginId)) return {
+			public: false,
+			body: "json"
+		};
 		return null;
 	}
-	async handlePluginApiRoute(pluginId, _method, path, request) {
+	async handlePluginApiRoute(pluginId, _method, path, request, invocation) {
 		if (!this.isPluginEnabled(pluginId)) return {
 			success: false,
 			error: {
@@ -1555,22 +1693,41 @@ var DinewayRuntime = class DinewayRuntime {
 			const routeRegistry = new PluginRouteRegistry({
 				...this.pipelineFactoryOptions,
 				db: this.db,
+				storage: this.storage ?? void 0,
 				emailPipeline: this.email ?? void 0,
 				trustedProxyHeaders: getTrustedProxyHeaders(this.config)
 			});
 			routeRegistry.register(trustedPlugin);
 			const routeKey = path.replace(LEADING_SLASH_PATTERN, "");
+			const trustedRoute = trustedPlugin.routes[routeKey];
+			if ((trustedRoute?.body ?? "json") === "raw") {
+				const bodyResult = await readBoundedPluginRouteBody(request, trustedRoute?.maxBodyBytes ?? DEFAULT_PLUGIN_RAW_BODY_LIMIT_BYTES);
+				if (!bodyResult.ok) return {
+					success: false,
+					error: {
+						code: "PAYLOAD_TOO_LARGE",
+						message: `Plugin route request body exceeds ${bodyResult.limit} bytes`
+					},
+					status: 413
+				};
+				return routeRegistry.invoke(pluginId, routeKey, {
+					request,
+					rawBody: bodyResult.bytes,
+					actor: invocation?.actor
+				});
+			}
 			let body = void 0;
 			try {
 				body = await request.json();
 			} catch {}
 			return routeRegistry.invoke(pluginId, routeKey, {
 				request,
-				body
+				body,
+				actor: invocation?.actor
 			});
 		}
 		const sandboxedPlugin = this.findSandboxedPlugin(pluginId);
-		if (sandboxedPlugin) return this.handleSandboxedRoute(sandboxedPlugin, path, request);
+		if (sandboxedPlugin) return this.handleSandboxedRoute(sandboxedPlugin, path, request, invocation?.actor);
 		return {
 			success: false,
 			error: {
@@ -1685,11 +1842,42 @@ var DinewayRuntime = class DinewayRuntime {
 		}
 	}
 	runAfterPublishHooks(content, collection) {
+		this.runDeferredContentHook("content:afterPublish", content, collection);
+	}
+	runAfterUnpublishHooks(content, collection) {
+		this.runDeferredContentHook("content:afterUnpublish", content, collection);
+	}
+	runAfterRestoreHooks(content, collection) {
+		this.runDeferredContentHook("content:afterRestore", content, collection);
+	}
+	runAfterScheduleHooks(content, collection) {
+		this.runDeferredContentHook("content:afterSchedule", content, collection);
+	}
+	runAfterUnscheduleHooks(content, collection) {
+		this.runDeferredContentHook("content:afterUnschedule", content, collection);
+	}
+	runDeferredContentHook(name, content, collection) {
 		after(async () => {
-			if (this.hooks.hasHooks("content:afterPublish")) try {
-				await this.hooks.runContentAfterPublish(content, collection);
+			if (this.hooks.hasHooks(name)) try {
+				switch (name) {
+					case "content:afterPublish":
+						await this.hooks.runContentAfterPublish(content, collection);
+						break;
+					case "content:afterUnpublish":
+						await this.hooks.runContentAfterUnpublish(content, collection);
+						break;
+					case "content:afterRestore":
+						await this.hooks.runContentAfterRestore(content, collection);
+						break;
+					case "content:afterSchedule":
+						await this.hooks.runContentAfterSchedule(content, collection);
+						break;
+					case "content:afterUnschedule":
+						await this.hooks.runContentAfterUnschedule(content, collection);
+						break;
+				}
 			} catch (err) {
-				console.error("Dineway afterPublish hook error:", err);
+				console.error(`Dineway ${name} hook error:`, err);
 			}
 			const tasks = [];
 			for (const [pluginKey, plugin] of this.sandboxedPlugins) {
@@ -1697,30 +1885,19 @@ var DinewayRuntime = class DinewayRuntime {
 				if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
 				tasks.push((async () => {
 					try {
-						await plugin.invokeHook("content:afterPublish", {
+						await plugin.invokeHook(name, {
 							content,
 							collection
 						});
 					} catch (err) {
-						console.error(`Dineway: Sandboxed plugin ${pluginId} afterPublish error:`, err);
+						console.error(`Dineway: Sandboxed plugin ${pluginId} ${name} error:`, err);
 					}
 				})());
 			}
 			await Promise.allSettled(tasks);
 		});
 	}
-	runAfterUnpublishHooks(content, collection) {
-		if (this.hooks.hasHooks("content:afterUnpublish")) this.hooks.runContentAfterUnpublish(content, collection).catch((err) => console.error("Dineway afterUnpublish hook error:", err));
-		for (const [pluginKey, plugin] of this.sandboxedPlugins) {
-			const [pluginId] = pluginKey.split(":");
-			if (!pluginId || !this.isPluginEnabled(pluginId)) continue;
-			plugin.invokeHook("content:afterUnpublish", {
-				content,
-				collection
-			}).catch((err) => console.error(`Dineway: Sandboxed plugin ${pluginId} afterUnpublish error:`, err));
-		}
-	}
-	async handleSandboxedRoute(plugin, path, request) {
+	async handleSandboxedRoute(plugin, path, request, actor) {
 		const routeName = path.replace(LEADING_SLASH_PATTERN, "");
 		let body = void 0;
 		try {
@@ -1735,7 +1912,8 @@ var DinewayRuntime = class DinewayRuntime {
 					url: request.url,
 					method: request.method,
 					headers,
-					meta
+					meta,
+					actor: actor ?? null
 				})
 			};
 		} catch (error) {
@@ -1982,9 +2160,9 @@ function setBaselineSecurityHeaders(response, pathname, serverTimings) {
 	const res = new Response(response.body, response);
 	const astroCookies = Reflect.get(response, ASTRO_COOKIES_SYMBOL);
 	if (astroCookies !== void 0) Reflect.set(res, ASTRO_COOKIES_SYMBOL, astroCookies);
-	res.headers.set("X-Content-Type-Options", "nosniff");
-	res.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-	res.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()");
+	if (!res.headers.has("X-Content-Type-Options")) res.headers.set("X-Content-Type-Options", "nosniff");
+	if (!res.headers.has("Referrer-Policy")) res.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	if (!res.headers.has("Permissions-Policy")) res.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()");
 	const shouldSetFrameOptions = !import.meta.env.DEV || pathname.startsWith("/_dineway");
 	if (!res.headers.has("Content-Security-Policy") && shouldSetFrameOptions) res.headers.set("X-Frame-Options", "SAMEORIGIN");
 	if (serverTimings && serverTimings.length > 0) res.headers.set("Server-Timing", formatServerTimingHeader(serverTimings));
@@ -2059,11 +2237,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 		const requestDb = locals.__dinewayRequestDb;
 		if (!isDinewayRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
 			const hasSessionCookie = cookies.get("astro-session") !== void 0;
-			if (!(context.isPrerendered || !hasSessionCookie ? null : await context.session?.get("user")) && !requestDb) {
-				if (!isSetupVerified()) {
+			if (!(context.isPrerendered || !hasSessionCookie ? null : await resolveSessionUser(context.session)) && !requestDb) {
+				if (!isSetupVerified() && !context.isPrerendered) {
 					const setupStart = startServerTiming(serverTimings);
 					try {
-						const { getDb } = await import("../loader--GOYux8M.mjs").then((n) => n.i);
+						const { getDb } = await import("../loader-aWkkc1_o.mjs").then((n) => n.i);
 						await (await getDb()).selectFrom("_dineway_migrations").selectAll().limit(1).execute();
 						markSetupVerified();
 					} catch (error) {
@@ -2117,6 +2295,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 				locals.dineway = {
 					handleContentList: runtime.handleContentList.bind(runtime),
 					handleContentGet: runtime.handleContentGet.bind(runtime),
+					handleContentAuthors: runtime.handleContentAuthors.bind(runtime),
 					handleContentCreate: runtime.handleContentCreate.bind(runtime),
 					handleContentUpdate: runtime.handleContentUpdate.bind(runtime),
 					handleContentDelete: runtime.handleContentDelete.bind(runtime),
@@ -2145,6 +2324,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 					handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
 					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
+					getPluginHttpAccess: runtime.getPluginHttpAccess.bind(runtime),
 					getMediaProvider: runtime.getMediaProvider.bind(runtime),
 					getMediaProviderList: runtime.getMediaProviderList.bind(runtime),
 					collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
@@ -2156,6 +2336,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 					hooks: runtime.hooks,
 					email: runtime.email,
 					configuredPlugins: runtime.configuredPlugins,
+					sandboxedPluginEntries: runtime.sandboxedPluginEntries,
 					config,
 					getManifest: runtime.getManifest.bind(runtime),
 					invalidateManifest: runtime.invalidateManifest.bind(runtime),
@@ -2179,10 +2360,12 @@ const onRequest = defineMiddleware(async (context, next) => {
 			return runWithContext(parentContext ? {
 				...parentContext,
 				editMode,
-				db: requestDb
+				db: requestDb,
+				dbIsIsolated: true
 			} : {
 				editMode,
-				db: requestDb
+				db: requestDb,
+				dbIsIsolated: true
 			}, doInit);
 		}
 		return doInit();