emdash 0.1.0 → 0.2.0

package/dist/{search-DG603UrT.mjs → search-BsYMed12.mjs}

@@ -1,17 +1,17 @@
 import { o as jsonExtractExpr } from "./dialect-helpers-B9uSp2GJ.mjs";
 import { n as validateJsonFieldName, r as validatePluginIdentifier, t as validateIdentifier } from "./validate-CqRJb_xU.mjs";
-import { i as slugify, r as RevisionRepository, t as ContentRepository } from "./content-D6C2WsZC.mjs";
+import { i as slugify, r as RevisionRepository, t as ContentRepository } from "./content-BmXndhdi.mjs";
 import { r as encodeBase64, t as decodeBase64 } from "./base64-MBPo9ozB.mjs";
 import { n as decodeCursor, r as encodeCursor, t as EmDashValidationError } from "./types-CMMN0pNg.mjs";
 import { t as MediaRepository } from "./media-DqHVh136.mjs";
-import { a as stripCredentialHeaders, i as ssrfSafeFetch, o as validateExternalUrl, r as SsrfError, u as OptionsRepository } from "./apply-Bjfq_b4-.mjs";
-import { a as withTransaction, i as FTSManager, n as SchemaRegistry } from "./registry-D_w5HW4G.mjs";
+import { a as stripCredentialHeaders, f as OptionsRepository, i as ssrfSafeFetch, o as validateExternalUrl, r as SsrfError } from "./apply-wmVEOSbR.mjs";
+import { a as withTransaction, i as FTSManager, n as SchemaRegistry } from "./registry-1EvbAfsC.mjs";
 import { t as RedirectRepository } from "./redirect-DIfIni3r.mjs";
-import { t as BylineRepository } from "./byline-CL847F26.mjs";
-import { i as isI18nEnabled } from "./config-CKE8p9xM.mjs";
-import { n as getDb } from "./loader-fz8Q_3EO.mjs";
-import { i as pluginManifestSchema } from "./manifest-schema-Dcl0R6nM.mjs";
-import { t as generatePreviewToken } from "./tokens-DpgrkrXK.mjs";
+import { n as SQL_BATCH_SIZE, r as chunks, t as BylineRepository } from "./byline-1WQPlISL.mjs";
+import { r as isI18nEnabled } from "./config-Cq8H0SfX.mjs";
+import { n as getDb } from "./loader-CHb2v0jm.mjs";
+import { i as pluginManifestSchema } from "./manifest-schema-CuMio1A9.mjs";
+import { t as generatePreviewToken } from "./tokens-DrB-W6Q-.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 import { z } from "astro/zod";
@@ -323,20 +323,24 @@ var CommentRepository = class CommentRepository {
 	}
 	/**
 	* Count comments grouped by status (for inbox badges)
+	*
+	* Uses four parallel COUNT queries with WHERE filters to leverage partial indexes
+	* (idx_comments_pending, idx_comments_approved, idx_comments_spam, idx_comments_trash)
+	* instead of a full table GROUP BY scan.
 	*/
 	async countByStatus() {
-		const rows = await this.db.selectFrom("_emdash_comments").select(["status"]).select((eb) => eb.fn.count("id").as("count")).groupBy("status").execute();
-		const counts = {
-			pending: 0,
-			approved: 0,
-			spam: 0,
-			trash: 0
+		const [pending, approved, spam, trash] = await Promise.all([
+			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "pending").executeTakeFirst(),
+			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "approved").executeTakeFirst(),
+			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "spam").executeTakeFirst(),
+			this.db.selectFrom("_emdash_comments").select((eb) => eb.fn.count("id").as("count")).where("status", "=", "trash").executeTakeFirst()
+		]);
+		return {
+			pending: Number(pending?.count ?? 0),
+			approved: Number(approved?.count ?? 0),
+			spam: Number(spam?.count ?? 0),
+			trash: Number(trash?.count ?? 0)
 		};
-		for (const row of rows) {
-			const status = row.status;
-			if (status in counts) counts[status] = Number(row.count);
-		}
-		return counts;
 	}
 	/**
 	* Count approved comments from a given email address.
@@ -823,6 +827,13 @@ var SeoRepository = class {
 		this.db = db;
 	}
 	/**
+	* Check whether a collection has SEO enabled (`has_seo = 1`).
+	* Returns `false` if the collection does not exist.
+	*/
+	async isEnabled(collection) {
+		return (await this.db.selectFrom("_emdash_collections").select("has_seo").where("slug", "=", collection).executeTakeFirst())?.has_seo === 1;
+	}
+	/**
 	* Get SEO data for a content item. Returns null defaults if no row exists.
 	*/
 	async get(collection, contentId) {
@@ -837,24 +848,27 @@ var SeoRepository = class {
 		};
 	}
 	/**
-	* Get SEO data for multiple content items in a single query.
+	* Get SEO data for multiple content items.
 	* Returns a Map keyed by content_id. Items without SEO rows get defaults.
+	*
+	* Chunks the `content_id IN (…)` clause so the total bound-parameter count
+	* per statement (ids + the `collection = ?` filter) stays within Cloudflare
+	* D1's 100-variable limit regardless of how many content items are passed.
 	*/
 	async getMany(collection, contentIds) {
 		const result = /* @__PURE__ */ new Map();
 		if (contentIds.length === 0) return result;
-		const rows = await this.db.selectFrom("_emdash_seo").selectAll().where("collection", "=", collection).where("content_id", "in", contentIds).execute();
-		const rowMap = new Map(rows.map((r) => [r.content_id, r]));
-		for (const id of contentIds) {
-			const row = rowMap.get(id);
-			if (row) result.set(id, {
+		for (const id of contentIds) result.set(id, { ...SEO_DEFAULTS$1 });
+		const uniqueContentIds = [...new Set(contentIds)];
+		for (const chunk of chunks(uniqueContentIds, SQL_BATCH_SIZE)) {
+			const rows = await this.db.selectFrom("_emdash_seo").selectAll().where("collection", "=", collection).where("content_id", "in", chunk).execute();
+			for (const row of rows) result.set(row.content_id, {
 				title: row.seo_title ?? null,
 				description: row.seo_description ?? null,
 				image: row.seo_image ?? null,
 				canonical: row.seo_canonical ?? null,
 				noIndex: row.seo_no_index === 1
 			});
-			else result.set(id, { ...SEO_DEFAULTS$1 });
 		}
 		return result;
 	}
@@ -1216,7 +1230,9 @@ async function handleContentCreate(db, collection, body) {
 				status: body.status || "draft",
 				authorId: body.authorId,
 				locale: body.locale,
-				translationOf: body.translationOf
+				translationOf: body.translationOf,
+				createdAt: body.createdAt,
+				publishedAt: body.publishedAt
 			});
 			if (body.bylines !== void 0) {
 				await bylineRepo.setContentBylines(collection, created.id, body.bylines);
@@ -1450,6 +1466,7 @@ async function handleContentPermanentDelete(db, collection, id) {
 			if (wasDeleted) {
 				await new SeoRepository(trx).delete(collection, resolvedId);
 				await new CommentRepository(trx).deleteByContent(collection, resolvedId);
+				await new RevisionRepository(trx).deleteByEntry(collection, resolvedId);
 			}
 			return wasDeleted;
 		})) return {
@@ -2625,7 +2642,7 @@ const contentListQuery = cursorPaginationQuery.extend({
 const contentCreateBody = z$1.object({
 	data: z$1.record(z$1.string(), z$1.unknown()),
 	slug: z$1.string().nullish(),
-	status: z$1.string().optional(),
+	status: z$1.enum(["draft"]).optional(),
 	bylines: z$1.array(contentBylineInputSchema).optional(),
 	locale: localeCode.optional(),
 	translationOf: z$1.string().optional(),
@@ -2634,7 +2651,7 @@ const contentCreateBody = z$1.object({
 const contentUpdateBody = z$1.object({
 	data: z$1.record(z$1.string(), z$1.unknown()).optional(),
 	slug: z$1.string().nullish(),
-	status: z$1.string().optional(),
+	status: z$1.enum(["draft"]).optional(),
 	authorId: z$1.string().nullish(),
 	bylines: z$1.array(contentBylineInputSchema).optional(),
 	_rev: z$1.string().optional().meta({ description: "Opaque revision token for optimistic concurrency" }),
@@ -2821,8 +2838,24 @@ const fieldTypeValues = z$1.enum([
 	"file",
 	"reference",
 	"json",
-	"slug"
+	"slug",
+	"repeater"
 ]);
+const repeaterSubFieldSchema = z$1.object({
+	slug: z$1.string().min(1).max(63).regex(slugPattern, "Invalid slug format"),
+	type: z$1.enum([
+		"string",
+		"text",
+		"number",
+		"integer",
+		"boolean",
+		"datetime",
+		"select"
+	]),
+	label: z$1.string().min(1),
+	required: z$1.boolean().optional(),
+	options: z$1.array(z$1.string()).optional()
+});
 const fieldValidation = z$1.object({
 	required: z$1.boolean().optional(),
 	min: z$1.number().optional(),
@@ -2830,7 +2863,10 @@ const fieldValidation = z$1.object({
 	minLength: z$1.number().int().min(0).optional(),
 	maxLength: z$1.number().int().min(0).optional(),
 	pattern: z$1.string().optional(),
-	options: z$1.array(z$1.string()).optional()
+	options: z$1.array(z$1.string()).optional(),
+	subFields: z$1.array(repeaterSubFieldSchema).min(1).optional(),
+	minItems: z$1.number().int().min(0).optional(),
+	maxItems: z$1.number().int().min(1).optional()
 }).optional();
 const fieldWidgetOptions = z$1.record(z$1.string(), z$1.unknown()).optional();
 const createCollectionBody = z$1.object({
@@ -3088,9 +3124,58 @@ const passkeyRegisterVerifyBody = z$1.object({
 const passkeyRenameBody = z$1.object({ name: z$1.string().min(1) }).meta({ id: "PasskeyRenameBody" });
 const authMeActionBody = z$1.object({ action: z$1.string().min(1) }).meta({ id: "AuthMeActionBody" });
 
+//#endregion
+//#region src/utils/url.ts
+/**
+* URL scheme validation utilities
+*
+* Prevents XSS via dangerous URL schemes (javascript:, data:, vbscript:, etc.)
+* by allowlisting known-safe schemes before rendering into href attributes.
+*/
+/**
+* Matches URLs that are safe to render in href attributes.
+*
+* Allowed:
+* - http:// and https://
+* - mailto: and tel:
+* - Relative paths (starting with /)
+* - Fragment links (starting with #)
+* - Protocol-relative URLs are NOT allowed (starting with //) as they can
+*   redirect to attacker-controlled hosts.
+*/
+const SAFE_URL_SCHEME_RE = /^(https?:|mailto:|tel:|\/(?!\/)|#)/i;
+/**
+* Returns the URL unchanged if it uses a safe scheme, otherwise returns "#".
+*
+* Use this at the render layer as the primary defense against XSS via
+* dangerous URL schemes like `javascript:`, `data:`, or `vbscript:`.
+*
+* @example
+* ```ts
+* sanitizeHref("https://example.com")        // "https://example.com"
+* sanitizeHref("/about")                      // "/about"
+* sanitizeHref("#section")                    // "#section"
+* sanitizeHref("mailto:a@b.com")              // "mailto:a@b.com"
+* sanitizeHref("javascript:alert(1)")         // "#"
+* sanitizeHref("data:text/html,<script>")     // "#"
+* sanitizeHref("")                            // "#"
+* ```
+*/
+function sanitizeHref(url) {
+	if (!url) return "#";
+	return SAFE_URL_SCHEME_RE.test(url) ? url : "#";
+}
+/**
+* Returns true if the URL uses a safe scheme for rendering in href attributes.
+*/
+function isSafeHref(url) {
+	return SAFE_URL_SCHEME_RE.test(url);
+}
+
 //#endregion
 //#region src/api/schemas/menus.ts
 const menuItemType = z$1.string().min(1);
+const safeHref = z$1.string().trim().refine(isSafeHref, "URL must use http, https, mailto, tel, a relative path, or a fragment identifier");
 const createMenuBody = z$1.object({
 	name: z$1.string().min(1),
 	label: z$1.string().min(1)
@@ -3101,7 +3186,7 @@ const createMenuItemBody = z$1.object({
 	label: z$1.string().min(1),
 	referenceCollection: z$1.string().optional(),
 	referenceId: z$1.string().optional(),
-	customUrl: z$1.string().optional(),
+	customUrl: safeHref.optional(),
 	target: z$1.string().optional(),
 	titleAttr: z$1.string().optional(),
 	cssClasses: z$1.string().optional(),
@@ -3110,7 +3195,7 @@ const createMenuItemBody = z$1.object({
 }).meta({ id: "CreateMenuItemBody" });
 const updateMenuItemBody = z$1.object({
 	label: z$1.string().min(1).optional(),
-	customUrl: z$1.string().optional(),
+	customUrl: safeHref.optional(),
 	target: z$1.string().optional(),
 	titleAttr: z$1.string().optional(),
 	cssClasses: z$1.string().optional(),
@@ -3895,10 +3980,13 @@ function isTextBlock(block) {
 	return block._type === "block";
 }
 /**
-* Type guard for image blocks
+* Type guard for image blocks.
+* Checks both `_type` and that `asset` is a valid object — image blocks
+* without an `asset` wrapper (e.g. `{ _type: "image", url: "..." }`) are
+* malformed and should not be cast to `PortableTextImageBlock`.
 */
 function isImageBlock(block) {
-	return block._type === "image";
+	return block._type === "image" && "asset" in block && typeof block.asset === "object" && block.asset !== null;
 }
 /**
 * Type guard for code blocks
@@ -3912,6 +4000,7 @@ function isCodeBlock(block) {
 function convertBlock(block) {
 	if (isTextBlock(block)) return convertTextBlock(block);
 	if (isImageBlock(block)) return convertImage(block);
+	if (block._type === "image") return convertMalformedImage(block);
 	if (isCodeBlock(block)) return convertCodeBlock(block);
 	if (block._type === "break") return { type: "horizontalRule" };
 	return {
@@ -4096,6 +4185,27 @@ function convertImage(block) {
 	};
 }
 /**
+* Convert a malformed image block (missing `asset` wrapper) to ProseMirror.
+* Handles blocks like `{ _type: "image", url: "...", alt: "..." }` that may
+* originate from migrations or third-party imports.
+*/
+function convertMalformedImage(block) {
+	return {
+		type: "image",
+		attrs: {
+			src: "url" in block && typeof block.url === "string" ? block.url : "",
+			alt: "alt" in block && typeof block.alt === "string" ? block.alt : "",
+			title: "caption" in block && typeof block.caption === "string" ? block.caption : "",
+			mediaId: void 0,
+			provider: void 0,
+			width: "width" in block && typeof block.width === "number" ? block.width : void 0,
+			height: "height" in block && typeof block.height === "number" ? block.height : void 0,
+			displayWidth: "displayWidth" in block && typeof block.displayWidth === "number" ? block.displayWidth : void 0,
+			displayHeight: "displayHeight" in block && typeof block.displayHeight === "number" ? block.displayHeight : void 0
+		}
+	};
+}
+/**
 * Convert code block to ProseMirror
 */
 function convertCodeBlock(block) {
@@ -4109,54 +4219,6 @@ function convertCodeBlock(block) {
 	};
 }
 
-//#endregion
-//#region src/utils/url.ts
-/**
-* URL scheme validation utilities
-*
-* Prevents XSS via dangerous URL schemes (javascript:, data:, vbscript:, etc.)
-* by allowlisting known-safe schemes before rendering into href attributes.
-*/
-/**
-* Matches URLs that are safe to render in href attributes.
-*
-* Allowed:
-* - http:// and https://
-* - mailto: and tel:
-* - Relative paths (starting with /)
-* - Fragment links (starting with #)
-* - Protocol-relative URLs are NOT allowed (starting with //) as they can
-*   redirect to attacker-controlled hosts.
-*/
-const SAFE_URL_SCHEME_RE = /^(https?:|mailto:|tel:|\/(?!\/)|#)/i;
-/**
-* Returns the URL unchanged if it uses a safe scheme, otherwise returns "#".
-*
-* Use this at the render layer as the primary defense against XSS via
-* dangerous URL schemes like `javascript:`, `data:`, or `vbscript:`.
-*
-* @example
-* ```ts
-* sanitizeHref("https://example.com")        // "https://example.com"
-* sanitizeHref("/about")                      // "/about"
-* sanitizeHref("#section")                    // "#section"
-* sanitizeHref("mailto:a@b.com")              // "mailto:a@b.com"
-* sanitizeHref("javascript:alert(1)")         // "#"
-* sanitizeHref("data:text/html,<script>")     // "#"
-* sanitizeHref("")                            // "#"
-* ```
-*/
-function sanitizeHref(url) {
-	if (!url) return "#";
-	return SAFE_URL_SCHEME_RE.test(url) ? url : "#";
-}
-/**
-* Returns true if the URL uses a safe scheme for rendering in href attributes.
-*/
-function isSafeHref(url) {
-	return SAFE_URL_SCHEME_RE.test(url);
-}
-
 //#endregion
 //#region src/cli/wxr/parser.ts
 const PHP_SERIALIZED_STRING_PATTERN = /s:\d+:"([^"]+)"/g;
@@ -5304,21 +5366,45 @@ function createStorageAccess(db, pluginId, storageConfig) {
 	return storage;
 }
 /**
+* Extract `seo` from a plugin-supplied content write input and return both
+* parts. Mutates nothing — returns a new field map without the `seo` key.
+*/
+function splitSeoFromInput(input) {
+	const { seo, ...fields } = input;
+	if (seo !== void 0 && (seo === null || typeof seo !== "object" || Array.isArray(seo))) throw new Error("content.seo must be an object");
+	return {
+		fields,
+		seo
+	};
+}
+/**
+* Reject writing SEO to a collection that does not have it enabled.
+* Matches the REST API behavior (VALIDATION_ERROR).
+*/
+async function assertSeoEnabled(seoRepo, collection, seo) {
+	const hasSeo = await seoRepo.isEnabled(collection);
+	if (seo !== void 0 && !hasSeo) throw new Error(`Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`);
+	return hasSeo;
+}
+/**
 * Create read-only content access
 */
 function createContentAccess(db) {
 	const contentRepo = new ContentRepository(db);
+	const seoRepo = new SeoRepository(db);
 	return {
 		async get(collection, id) {
 			const item = await contentRepo.findById(collection, id);
 			if (!item) return null;
-			return {
+			const result = {
 				id: item.id,
 				type: item.type,
 				data: item.data,
 				createdAt: item.createdAt,
 				updatedAt: item.updatedAt
 			};
+			if (await seoRepo.isEnabled(collection)) result.seo = await seoRepo.get(collection, item.id);
+			return result;
 		},
 		async list(collection, options) {
 			let orderBy;
@@ -5334,14 +5420,22 @@ function createContentAccess(db) {
 				cursor: options?.cursor,
 				orderBy
 			});
+			const items = result.items.map((item) => ({
+				id: item.id,
+				type: item.type,
+				data: item.data,
+				createdAt: item.createdAt,
+				updatedAt: item.updatedAt
+			}));
+			if (items.length > 0 && await seoRepo.isEnabled(collection)) {
+				const seoMap = await seoRepo.getMany(collection, items.map((i) => i.id));
+				for (const item of items) {
+					const seo = seoMap.get(item.id);
+					if (seo) item.seo = seo;
+				}
+			}
 			return {
-				items: result.items.map((item) => ({
-					id: item.id,
-					type: item.type,
-					data: item.data,
-					createdAt: item.createdAt,
-					updatedAt: item.updatedAt
-				})),
+				items,
 				cursor: result.nextCursor,
 				hasMore: !!result.nextCursor
 			};
@@ -5349,37 +5443,62 @@ function createContentAccess(db) {
 	};
 }
 /**
-* Create full content access with write operations
+* Create full content access with write operations.
+*
+* `create` and `update` accept a reserved `seo` key in their `data`
+* argument. When present, it is routed to the core SEO panel
+* (`_emdash_seo`) via `SeoRepository.upsert`, in the same transaction as
+* the content write. The returned `ContentItem.seo` reflects the resulting
+* SEO state for SEO-enabled collections.
 */
 function createContentAccessWithWrite(db) {
-	const contentRepo = new ContentRepository(db);
 	return {
 		...createContentAccess(db),
 		async create(collection, data) {
-			const item = await contentRepo.create({
-				type: collection,
-				data
+			const { fields, seo } = splitSeoFromInput(data);
+			return withTransaction(db, async (trx) => {
+				const trxContentRepo = new ContentRepository(trx);
+				const trxSeoRepo = new SeoRepository(trx);
+				const hasSeo = await assertSeoEnabled(trxSeoRepo, collection, seo);
+				const item = await trxContentRepo.create({
+					type: collection,
+					data: fields
+				});
+				const result = {
+					id: item.id,
+					type: item.type,
+					data: item.data,
+					createdAt: item.createdAt,
+					updatedAt: item.updatedAt
+				};
+				if (hasSeo) result.seo = seo !== void 0 ? await trxSeoRepo.upsert(collection, item.id, seo) : await trxSeoRepo.get(collection, item.id);
+				return result;
 			});
-			return {
-				id: item.id,
-				type: item.type,
-				data: item.data,
-				createdAt: item.createdAt,
-				updatedAt: item.updatedAt
-			};
 		},
 		async update(collection, id, data) {
-			const item = await contentRepo.update(collection, id, { data });
-			return {
-				id: item.id,
-				type: item.type,
-				data: item.data,
-				createdAt: item.createdAt,
-				updatedAt: item.updatedAt
-			};
+			const { fields, seo } = splitSeoFromInput(data);
+			return withTransaction(db, async (trx) => {
+				const trxContentRepo = new ContentRepository(trx);
+				const trxSeoRepo = new SeoRepository(trx);
+				const hasSeo = await assertSeoEnabled(trxSeoRepo, collection, seo);
+				const item = Object.keys(fields).length > 0 ? await trxContentRepo.update(collection, id, { data: fields }) : await (async () => {
+					const existing = await trxContentRepo.findById(collection, id);
+					if (!existing) throw new Error("Content not found");
+					return existing;
+				})();
+				const result = {
+					id: item.id,
+					type: item.type,
+					data: item.data,
+					createdAt: item.createdAt,
+					updatedAt: item.updatedAt
+				};
+				if (hasSeo) result.seo = seo !== void 0 ? await trxSeoRepo.upsert(collection, item.id, seo) : await trxSeoRepo.get(collection, item.id);
+				return result;
+			});
 		},
 		async delete(collection, id) {
-			return contentRepo.delete(collection, id);
+			return new ContentRepository(db).delete(collection, id);
 		}
 	};
 }
@@ -5471,6 +5590,7 @@ function createMediaAccessWithWrite(db, getUploadUrlFn, storage) {
 const MAX_PLUGIN_REDIRECTS = 5;
 function isHostAllowed(host, allowedHosts) {
 	return allowedHosts.some((pattern) => {
+		if (pattern === "*") return true;
 		if (pattern.startsWith("*.")) {
 			const suffix = pattern.slice(1);
 			return host.endsWith(suffix) || host === pattern.slice(2);
@@ -5792,6 +5912,8 @@ var HookPipeline = class HookPipeline {
 			this.registerPluginHook(plugin, "content:afterSave");
 			this.registerPluginHook(plugin, "content:beforeDelete");
 			this.registerPluginHook(plugin, "content:afterDelete");
+			this.registerPluginHook(plugin, "content:afterPublish");
+			this.registerPluginHook(plugin, "content:afterUnpublish");
 			this.registerPluginHook(plugin, "media:beforeUpload");
 			this.registerPluginHook(plugin, "media:afterUpload");
 			this.registerPluginHook(plugin, "cron");
@@ -5822,6 +5944,8 @@ var HookPipeline = class HookPipeline {
 		["content:afterSave", "read:content"],
 		["content:beforeDelete", "read:content"],
 		["content:afterDelete", "read:content"],
+		["content:afterPublish", "read:content"],
+		["content:afterUnpublish", "read:content"],
 		["media:beforeUpload", "write:media"],
 		["media:afterUpload", "read:media"],
 		["comment:beforeCreate", "read:users"],
@@ -6100,6 +6224,72 @@ var HookPipeline = class HookPipeline {
 		return results;
 	}
 	/**
+	* Run content:afterPublish hooks (fire-and-forget).
+	*/
+	async runContentAfterPublish(content, collection) {
+		const hooks = this.getTypedHooks("content:afterPublish");
+		const results = [];
+		for (const hook of hooks) {
+			const { handler } = hook;
+			const event = {
+				content,
+				collection
+			};
+			const ctx = this.getContext(hook.pluginId);
+			const start = Date.now();
+			try {
+				await this.executeWithTimeout(() => handler(event, ctx), hook.timeout);
+				results.push({
+					success: true,
+					pluginId: hook.pluginId,
+					duration: Date.now() - start
+				});
+			} catch (error) {
+				results.push({
+					success: false,
+					error: error instanceof Error ? error : new Error(String(error)),
+					pluginId: hook.pluginId,
+					duration: Date.now() - start
+				});
+				if (hook.errorPolicy === "abort") throw error;
+			}
+		}
+		return results;
+	}
+	/**
+	* Run content:afterUnpublish hooks (fire-and-forget).
+	*/
+	async runContentAfterUnpublish(content, collection) {
+		const hooks = this.getTypedHooks("content:afterUnpublish");
+		const results = [];
+		for (const hook of hooks) {
+			const { handler } = hook;
+			const event = {
+				content,
+				collection
+			};
+			const ctx = this.getContext(hook.pluginId);
+			const start = Date.now();
+			try {
+				await this.executeWithTimeout(() => handler(event, ctx), hook.timeout);
+				results.push({
+					success: true,
+					pluginId: hook.pluginId,
+					duration: Date.now() - start
+				});
+			} catch (error) {
+				results.push({
+					success: false,
+					error: error instanceof Error ? error : new Error(String(error)),
+					pluginId: hook.pluginId,
+					duration: Date.now() - start
+				});
+				if (hook.errorPolicy === "abort") throw error;
+			}
+		}
+		return results;
+	}
+	/**
 	* Run media:beforeUpload hooks
 	*/
 	async runMediaBeforeUpload(file) {
@@ -6942,6 +7132,14 @@ var PluginManager = class {
 		};
 	}
 	/**
+	* Set the email pipeline used when creating plugin contexts.
+	* Reinitializes routes/hooks if already initialized so ctx.email is available immediately.
+	*/
+	setEmailPipeline(pipeline) {
+		this.factoryOptions.emailPipeline = pipeline;
+		if (this.initialized) this.reinitialize();
+	}
+	/**
 	* Register a plugin definition
 	* This resolves the definition and adds it to the manager, but doesn't install it
 	*/
@@ -7064,6 +7262,20 @@ var PluginManager = class {
 		return this.hookPipeline.runContentAfterDelete(id, collection);
 	}
 	/**
+	* Run content:afterPublish hooks across all active plugins
+	*/
+	async runContentAfterPublish(content, collection) {
+		this.ensureInitialized();
+		return this.hookPipeline.runContentAfterPublish(content, collection);
+	}
+	/**
+	* Run content:afterUnpublish hooks across all active plugins
+	*/
+	async runContentAfterUnpublish(content, collection) {
+		this.ensureInitialized();
+		return this.hookPipeline.runContentAfterUnpublish(content, collection);
+	}
+	/**
 	* Run media:beforeUpload hooks across all active plugins
 	*/
 	async runMediaBeforeUpload(file) {
@@ -7848,8 +8060,8 @@ function wxrPostToNormalizedItem(post, attachmentMap) {
 		title: post.title || "Untitled",
 		content,
 		excerpt: post.excerpt,
-		date: post.postDate ? new Date(post.postDate) : /* @__PURE__ */ new Date(),
-		modified: post.postModified ? new Date(post.postModified) : void 0,
+		date: parseWxrDate(post.postDateGmt, post.pubDate, post.postDate) ?? /* @__PURE__ */ new Date(),
+		modified: parseWxrDate(post.postModifiedGmt, void 0, post.postModified),
 		author: post.creator,
 		categories: post.categories,
 		tags: post.tags,
@@ -7860,6 +8072,31 @@ function wxrPostToNormalizedItem(post, attachmentMap) {
 		customTaxonomies
 	};
 }
+/**
+* WordPress uses "0000-00-00 00:00:00" as a sentinel for missing GMT dates
+* (e.g. unpublished drafts). This must be treated as absent.
+*/
+const WXR_ZERO_DATE = "0000-00-00 00:00:00";
+/**
+* Parse a WXR date with the correct fallback chain:
+* 1. GMT date (always UTC, most reliable)
+* 2. pubDate (RFC 2822, includes timezone offset)
+* 3. Site-local date (MySQL datetime without timezone, imprecise but best available)
+*
+* Returns undefined when none of the inputs yield a valid date.
+* Callers that need a guaranteed Date should use `?? new Date()`.
+*/
+function parseWxrDate(gmtDate, pubDate, localDate) {
+	if (gmtDate && gmtDate !== WXR_ZERO_DATE) return /* @__PURE__ */ new Date(gmtDate.replace(" ", "T") + "Z");
+	if (pubDate) {
+		const d = new Date(pubDate);
+		if (!isNaN(d.getTime())) return d;
+	}
+	if (localDate) {
+		const d = new Date(localDate.replace(" ", "T"));
+		if (!isNaN(d.getTime())) return d;
+	}
+}
 
 //#endregion
 //#region src/import/sources/wordpress-rest.ts
@@ -8499,7 +8736,7 @@ async function resolveMenuItem(item, db, urlPatterns) {
 	return {
 		id: item.id,
 		label: item.label,
-		url,
+		url: sanitizeHref(url),
 		target: item.target || void 0,
 		titleAttr: item.title_attr || void 0,
 		cssClasses: item.css_classes || void 0,
@@ -8699,7 +8936,7 @@ async function getTermsForEntries(collection, entryIds, taxonomyName) {
 * Get entries by term (wraps getEmDashCollection)
 */
 async function getEntriesByTerm(collection, taxonomyName, termSlug) {
-	const { getEmDashCollection } = await import("./query-CS_iSj34.mjs").then((n) => n.a);
+	const { getEmDashCollection } = await import("./query-5Hcv_5ER.mjs").then((n) => n.a);
 	const { entries } = await getEmDashCollection(collection, { where: { [taxonomyName]: termSlug } });
 	return entries;
 }
@@ -9207,5 +9444,5 @@ function extractSearchableFields(entry, fields) {
 }
 
 //#endregion
-export { definePlugin as $, getFileSources as A, handleContentGetIncludingTrashed as At, PluginManager as B, handleContentUpdate as Bt, isPreviewRequest as C, handleContentCountScheduled as Ct, wxrSource as D, handleContentDiscardDraft as Dt, wordpressRestSource as E, handleContentDelete as Et, importReusableBlocksAsSections as F, handleContentRestore as Ft, devConsoleEmailDeliver as G, PluginRouteError as H, portableText as Ht, isStandardPluginDefinition as I, handleContentSchedule as It, createHookPipeline as J, EmailPipeline as K, NoopSandboxRunner as L, handleContentTranslations as Lt, getUrlSources as M, handleContentListTrashed as Mt, probeUrl as N, handleContentPermanentDelete as Nt, clearSources as O, handleContentDuplicate as Ot, registerSource as P, handleContentPublish as Pt, sanitizeHeadersForSandbox as Q, SandboxNotAvailableError as R, handleContentUnpublish as Rt, getPreviewToken as S, handleContentCompare as St, getPreviewUrl as T, handleContentCreate as Tt, PluginRouteRegistry as U, reference as Ut, createPluginManager as V, validateRev as Vt, DEV_CONSOLE_EMAIL_PLUGIN_ID as W, image as Wt, CronExecutor as X, resolveExclusiveHooks as Y, extractRequestMeta as Z, getTermsForEntries as _, handleRevisionList as _t, search as a, prosemirrorToPortableText as at, getCommentCount as b, computeContentHash as bt, getWidgetArea as c, getSections as ct, getEntriesByTerm as d, handleMediaCreate as dt, parseWxr as et, getEntryTerms as f, handleMediaDelete as ft, getTerm as g, handleRevisionGet as gt, getTaxonomyTerms as h, handleMediaUpdate as ht, getSuggestions as i, portableTextToProsemirror as it, getSource as j, handleContentList as jt, getAllSources as k, handleContentGet as kt, getWidgetAreas as l, PluginStateRepository as lt, getTaxonomyDefs as m, handleMediaList as mt, extractSearchableFields as n, isSafeHref as nt, searchCollection as o, loadBundleFromR2 as ot, getTaxonomyDef as p, handleMediaGet as pt, HookPipeline as q, getSearchStats as r, sanitizeHref as rt, searchWithDb as s, getSection as st, extractPlainText as t, parseWxrString as tt, getWidgetComponents as u, getCollectionInfo as ut, getMenu as v, handleRevisionRestore as vt, buildPreviewUrl as w, handleContentCountTrashed as wt, getComments as x, hashString as xt, getMenus as y, generateManifest as yt, createNoopSandboxRunner as z, handleContentUnschedule as zt };
-//# sourceMappingURL=search-DG603UrT.mjs.map
+export { sanitizeHeadersForSandbox as $, getAllSources as A, handleContentGet as At, createNoopSandboxRunner as B, handleContentUnschedule as Bt, isPreviewRequest as C, handleContentCompare as Ct, parseWxrDate as D, handleContentDelete as Dt, wordpressRestSource as E, handleContentCreate as Et, registerSource as F, handleContentPublish as Ft, DEV_CONSOLE_EMAIL_PLUGIN_ID as G, image as Gt, createPluginManager as H, validateRev as Ht, importReusableBlocksAsSections as I, handleContentRestore as It, HookPipeline as J, devConsoleEmailDeliver as K, isStandardPluginDefinition as L, handleContentSchedule as Lt, getSource as M, handleContentList as Mt, getUrlSources as N, handleContentListTrashed as Nt, wxrSource as O, handleContentDiscardDraft as Ot, probeUrl as P, handleContentPermanentDelete as Pt, extractRequestMeta as Q, NoopSandboxRunner as R, handleContentTranslations as Rt, getPreviewToken as S, hashString as St, getPreviewUrl as T, handleContentCountTrashed as Tt, PluginRouteError as U, portableText as Ut, PluginManager as V, handleContentUpdate as Vt, PluginRouteRegistry as W, reference as Wt, resolveExclusiveHooks as X, createHookPipeline as Y, CronExecutor as Z, getTermsForEntries as _, handleRevisionGet as _t, search as a, isSafeHref as at, getCommentCount as b, generateManifest as bt, getWidgetArea as c, getSection as ct, getEntriesByTerm as d, getCollectionInfo as dt, definePlugin as et, getEntryTerms as f, handleMediaCreate as ft, getTerm as g, handleMediaUpdate as gt, getTaxonomyTerms as h, handleMediaList as ht, getSuggestions as i, prosemirrorToPortableText as it, getFileSources as j, handleContentGetIncludingTrashed as jt, clearSources as k, handleContentDuplicate as kt, getWidgetAreas as l, getSections as lt, getTaxonomyDefs as m, handleMediaGet as mt, extractSearchableFields as n, parseWxrString as nt, searchCollection as o, sanitizeHref as ot, getTaxonomyDef as p, handleMediaDelete as pt, EmailPipeline as q, getSearchStats as r, portableTextToProsemirror as rt, searchWithDb as s, loadBundleFromR2 as st, extractPlainText as t, parseWxr as tt, getWidgetComponents as u, PluginStateRepository as ut, getMenu as v, handleRevisionList as vt, buildPreviewUrl as w, handleContentCountScheduled as wt, getComments as x, computeContentHash as xt, getMenus as y, handleRevisionRestore as yt, SandboxNotAvailableError as z, handleContentUnpublish as zt };
+//# sourceMappingURL=search-BsYMed12.mjs.map