emdash 0.14.0 → 0.16.0

package/dist/astro/middleware.mjs

@@ -1,75 +1,75 @@
-import { r as runMigrations } from "../runner-DdnQIwz_.mjs";
-import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
-import { createRecorder, flushRecorder, isInstrumentationEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
-import "../connection-2igzM-AT.mjs";
+import { r as runMigrations } from "../runner-Drnvs96u.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { o as isSqlite } from "../dialect-helpers-BKCvISIQ.mjs";
 import { i as setI18nConfig } from "../config-CVssduLe.mjs";
-import { _ as after, d as PluginRouteRegistry, f as EmailPipeline, g as definePlugin, h as resolveExclusiveHooks, m as createHookPipeline } from "../menus-X4Z-eBA1.mjs";
-import { r as RevisionRepository } from "../content-D6YG26WG.mjs";
+import { _ as definePlugin, f as PluginRouteRegistry, g as resolveExclusiveHooks, h as createHookPipeline, p as EmailPipeline, v as after } from "../menus-C-nWT5Tu.mjs";
+import { r as RevisionRepository } from "../content-8voQNTXX.mjs";
 import "../base64-CqR-7kqF.mjs";
-import "../types-CwXMEPRr.mjs";
-import { t as MediaRepository } from "../media-Dg7he9uK.mjs";
-import "../user-Dr1bOCqS.mjs";
-import "../taxonomy-wPfusMK9.mjs";
-import "../comment-Dd9MI82-.mjs";
+import "../types-B0bmgwMG.mjs";
+import { t as MediaRepository } from "../media-CKQd8AYU.mjs";
+import "../user-hUSOaIJy.mjs";
+import "../taxonomy-zqGQUqgu.mjs";
+import "../comment-C76G-9tz.mjs";
 import { t as OptionsRepository } from "../options-BL4X94qY.mjs";
-import "../context-qF8d3IPR.mjs";
-import "../menus-DOzIecHi.mjs";
-import "../redirect-DkaDxq8e.mjs";
-import "../byline-D09BaS4j.mjs";
+import "../context-B7qiYrz2.mjs";
+import "../menus-arUNspyU.mjs";
+import "../redirect-CjfDGrTd.mjs";
+import "../byline-BDylH_m4.mjs";
 import { t as normalizeMediaValue } from "../normalize-CN5kRSMC.mjs";
 import "../placeholder-LqmHqvBw.mjs";
-import "../seo-DRq9-EPP.mjs";
-import { $ as handleContentSchedule, A as handleMediaCreate, B as handleContentCountScheduled, F as handleRevisionGet, G as handleContentDuplicate, H as handleContentCreate, I as handleRevisionList, J as handleContentList, K as handleContentGet, L as handleRevisionRestore, M as handleMediaGet, N as handleMediaList, P as handleMediaUpdate, Q as handleContentRestore, U as handleContentDelete, V as handleContentCountTrashed, W as handleContentDiscardDraft, X as handleContentPermanentDelete, Y as handleContentListTrashed, Z as handleContentPublish, d as loadBundleFromR2, et as handleContentTranslations, g as PluginStateRepository, it as validateRev, j as handleMediaDelete, n as normalizeRegistryConfig, nt as handleContentUnschedule, q as handleContentGetIncludingTrashed, rt as handleContentUpdate, tt as handleContentUnpublish, z as handleContentCompare } from "../api-BMLZuwM4.mjs";
+import "../seo-BGCyDlkb.mjs";
+import { $ as handleContentGetIncludingTrashed, B as handleMediaUpdate, G as handleContentCompare, H as handleRevisionList, I as handleMediaCreate, J as handleContentCreate, K as handleContentCountScheduled, L as handleMediaDelete, Q as handleContentGet, R as handleMediaGet, S as PluginStateRepository, U as handleRevisionRestore, V as handleRevisionGet, X as handleContentDiscardDraft, Y as handleContentDelete, Z as handleContentDuplicate, _ as loadBundleFromR2, at as handleContentSchedule, ct as handleContentUnschedule, et as handleContentList, it as handleContentRestore, lt as handleContentUpdate, nt as handleContentPermanentDelete, ot as handleContentTranslations, q as handleContentCountTrashed, rt as handleContentPublish, s as normalizeRegistryConfig, st as handleContentUnpublish, tt as handleContentListTrashed, ut as validateRev, z as handleMediaList } from "../api-BNKqxyFX.mjs";
+import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
 import { n as requestCached } from "../request-cache-dzCt8TZB.mjs";
-import "../dashboard-BmWSIUwY.mjs";
+import "../dashboard-BeaFSPpx.mjs";
 import { n as hashString } from "../hash-DlUxGhQS.mjs";
-import { t as FTSManager } from "../fts-manager-B633C-kQ.mjs";
-import { n as SchemaRegistry } from "../registry-BnCeHYsf.mjs";
-import { r as getDb } from "../loader-Cs6-Bqe6.mjs";
-import "../schema-BmqagCwG.mjs";
-import "../zod-generator-DSyz01KE.mjs";
-import "../seo-BoR4wCUh.mjs";
-import "../sections-Cm-zb-gZ.mjs";
-import { o as invalidateSiteSettingsCache } from "../settings-xQKsWnzQ.mjs";
-import "../settings-CBBj7HUd.mjs";
-import "../taxonomies-Cn9UpaR2.mjs";
-import "../taxonomies-Dc0mzlms.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-HCtSh4Jq.mjs";
-import "../types-Db67HHlU.mjs";
-import "../ssrf-DzFN_qV-.mjs";
-import "../error-tSQWIl5U.mjs";
-import "../parse-BFTPon-J.mjs";
-import "../redirects-Dmj6KRU3.mjs";
-import "../setup-BGAJ2uXs.mjs";
-import { a as invalidateUrlPatternCache } from "../query-axZmO6Tn.mjs";
-import "../import-CNfLOgDE.mjs";
-import { t as getTrustedProxyHeaders } from "../trusted-proxy-CJhQIk65.mjs";
-import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-CLCwSQOS.mjs";
-import "../ssrf-CTul4uQi.mjs";
-import { n as CronExecutor } from "../cron-H8eJ46dv.mjs";
-import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-Dmp5Q-P2.mjs";
-import "../utils-_F-rWBTN.mjs";
-import "../tokens-DILYNZMi.mjs";
-import "../preview-C1LOEbWZ.mjs";
-import "../bylines-BTM2xtP8.mjs";
-import "../widgets-B9j_yzlk.mjs";
-import "../apply-v4DBgjPw.mjs";
-import "../load-QzYRpVN3.mjs";
-import "../search-CPrvO5u8.mjs";
+import { t as FTSManager } from "../fts-manager-C_b-4x8u.mjs";
+import { n as SchemaRegistry } from "../registry-Cyp-dx6J.mjs";
+import { createRecorder, flushRecorder, isInstrumentationEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
+import { r as getDb } from "../loader-D-vIJjfY.mjs";
+import "../schema-CI9mYPX3.mjs";
+import "../zod-generator-B80aap1J.mjs";
+import "../seo-Dq707mNQ.mjs";
+import "../sections-DBbCDIAT.mjs";
+import { o as invalidateSiteSettingsCache } from "../settings-BSXRtTzk.mjs";
+import "../settings-DfwNyQkf.mjs";
+import "../resolve-D6sM-SgF.mjs";
+import "../taxonomies-CcvrMLbR.mjs";
+import "../taxonomies-4vx0nmMr.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-Czqf0TLu.mjs";
+import "../types-1NNkmTIn.mjs";
+import "../ssrf-MZ-zrG6-.mjs";
+import "../error-ChfADBuu.mjs";
+import "../parse-DHbXfvxO.mjs";
+import "../redirects-COMLwsV5.mjs";
+import "../setup-Cf_TyOv5.mjs";
+import { a as invalidateUrlPatternCache } from "../query-7m6-l0f_.mjs";
+import "../import-DG80rC_I.mjs";
+import { t as getTrustedProxyHeaders } from "../trusted-proxy-97pajC2f.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-C_Cjii-T.mjs";
+import "../ssrf-BIcd-aXW.mjs";
+import { n as CronExecutor } from "../cron-Bd3b3iuj.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-CubRll9q.mjs";
+import "../utils-C3wTAP-P.mjs";
+import "../tokens-N8otWMmj.mjs";
+import "../preview-D4z0WONU.mjs";
+import "../bylines-n6nykUyI.mjs";
+import "../widgets-yHQa4c6c.mjs";
+import "../apply-BOPaD-s9.mjs";
+import "../load-CLFRjk9r.mjs";
+import "../search-DKz_mGBP.mjs";
 import "../index.mjs";
-import { n as VERSION, t as COMMIT } from "../version-DNmQakZO.mjs";
-import { t as getAuthMode } from "../mode-DPRPvJYm.mjs";
-import { t as cleanupExpiredChallenges } from "../challenge-store-CJ0OOHOr.mjs";
-import { a as validateEncryptionKeyAtStartup } from "../secrets-6pgZyq0K.mjs";
+import { n as VERSION, t as COMMIT } from "../version-BTc87L3L.mjs";
+import { t as getAuthMode } from "../mode-CaaiebZI.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-Dng1SxKT.mjs";
+import { a as validateEncryptionKeyAtStartup } from "../secrets-rPdhEBkD.mjs";
 import { Kysely, sql } from "kysely";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";
 import { createDialect, createRequestScopedDb } from "virtual:emdash/dialect";
 import { mediaProviders } from "virtual:emdash/media-providers";
 import { plugins } from "virtual:emdash/plugins";
-import { createSandboxRunner, sandboxEnabled } from "virtual:emdash/sandbox-runner";
+import * as virtualSandboxRunnerModule from "virtual:emdash/sandbox-runner";
 import { sandboxedPlugins } from "virtual:emdash/sandboxed-plugins";
 import { createStorage } from "virtual:emdash/storage";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
@@ -484,6 +484,15 @@ var EmDashRuntime = class EmDashRuntime {
 		return sandboxRunner;
 	}
 	/**
+	* Whether the sandbox bypass mode (sandbox: false) is active.
+	* Marketplace install/update handlers use this to skip the
+	* SANDBOX_NOT_AVAILABLE gate, since the bypass path loads
+	* marketplace plugins in-process via syncMarketplacePlugins().
+	*/
+	isSandboxBypassed() {
+		return this.runtimeDeps.sandboxBypassed === true;
+	}
+	/**
 	* Tick the cron system from request context (piggyback mode).
 	* Call this from middleware on each request to ensure cron tasks
 	* execute even when no dedicated scheduler is available.
@@ -548,6 +557,10 @@ var EmDashRuntime = class EmDashRuntime {
 	*/
 	async syncMarketplacePlugins() {
 		if (!this.config.marketplace) return;
+		if (this.runtimeDeps.sandboxBypassed) {
+			await this.syncMarketplacePluginsBypassed();
+			return;
+		}
 		await this.syncSandboxedSourcePlugins("marketplace");
 	}
 	/**
@@ -564,8 +577,8 @@ var EmDashRuntime = class EmDashRuntime {
 	/**
 	* Internal: reconcile in-memory sandboxed-plugin state with the
 	* `_plugin_state` table for the given source tier. Shared
-	* implementation behind `syncMarketplacePlugins` and
-	* `syncRegistryPlugins`.
+	* implementation behind {@link syncMarketplacePlugins} and
+	* {@link syncRegistryPlugins}.
 	*
 	* Each source tier has its own key set in `${source}PluginKeys` so a
 	* sync for one tier doesn't invalidate the other.
@@ -649,6 +662,117 @@ var EmDashRuntime = class EmDashRuntime {
 		}
 	}
 	/**
+	* Remove a plugin from the in-memory pipeline lists by ID.
+	* Mutates allPipelinePlugins and configuredPlugins in place.
+	*/
+	removePluginFromLists(pluginId) {
+		const allIdx = this.allPipelinePlugins.findIndex((p) => p.id === pluginId);
+		if (allIdx !== -1) this.allPipelinePlugins.splice(allIdx, 1);
+		const configIdx = this.configuredPlugins.findIndex((p) => p.id === pluginId);
+		if (configIdx !== -1) this.configuredPlugins.splice(configIdx, 1);
+	}
+	/**
+	* Sync marketplace plugin metadata in sandbox: false bypass mode.
+	*
+	* In bypass mode the noop runner can't load plugins, but admin pages,
+	* widgets, and route metadata still need to refresh in-process when an
+	* admin installs/updates/uninstalls a marketplace plugin. Otherwise the
+	* admin UI shows stale data until the server restarts.
+	*
+	* Hooks and routes still won't execute under bypass (matches the
+	* cold-start bypass behavior in loadMarketplacePluginsBypassed).
+	*
+	* Known limitation: bypass plugins are loaded via `import(dataUrl)`,
+	* which Node's ESM cache keys on the full URL. Updates create fresh
+	* module objects, but old ones remain cached for the worker's lifetime.
+	* In practice this is a few KB per update — only matters for sites with
+	* very frequent marketplace updates running long-lived processes. The
+	* fix would be vm.SourceTextModule for explicit lifecycle management.
+	*/
+	async syncMarketplacePluginsBypassed() {
+		if (!this.storage) return;
+		try {
+			const marketplaceStates = await new PluginStateRepository(this.db).getMarketplacePlugins();
+			const desired = /* @__PURE__ */ new Map();
+			for (const state of marketplaceStates) {
+				this.pluginStates.set(state.pluginId, state.status);
+				if (state.status === "active") this.enabledPlugins.add(state.pluginId);
+				else this.enabledPlugins.delete(state.pluginId);
+				if (state.status !== "active") continue;
+				desired.set(state.pluginId, state.marketplaceVersion ?? state.version);
+			}
+			const toRemove = [];
+			for (const pluginId of marketplaceManifestCache.keys()) if (!desired.has(pluginId)) toRemove.push(pluginId);
+			for (const pluginId of toRemove) {
+				const resolved = this.allPipelinePlugins.find((p) => p.id === pluginId);
+				if (resolved) try {
+					const deactivateHook = resolved.hooks?.["plugin:deactivate"];
+					if (deactivateHook) {
+						const handler = typeof deactivateHook === "function" ? deactivateHook : deactivateHook.handler;
+						if (typeof handler === "function") await handler({ pluginId }, {});
+					}
+				} catch (err) {
+					console.warn(`[emdash] plugin:deactivate hook failed for ${pluginId}:`, err);
+				}
+				marketplaceManifestCache.delete(pluginId);
+				sandboxedRouteMetaCache.delete(pluginId);
+				this.removePluginFromLists(pluginId);
+				this.enabledPlugins.delete(pluginId);
+			}
+			const { adaptSandboxEntry } = await import("../plugins/adapt-sandbox-entry.mjs");
+			const newPlugins = [];
+			for (const [pluginId, version] of desired) {
+				const bundle = await loadBundleFromR2(this.storage, pluginId, version);
+				if (!bundle) {
+					console.warn(`EmDash: Marketplace plugin ${pluginId}@${version} not found in R2`);
+					continue;
+				}
+				marketplaceManifestCache.set(pluginId, {
+					id: bundle.manifest.id,
+					version: bundle.manifest.version,
+					admin: bundle.manifest.admin
+				});
+				if (bundle.manifest.routes.length > 0) {
+					const routeMetaMap = /* @__PURE__ */ new Map();
+					for (const entry of bundle.manifest.routes) {
+						const normalized = normalizeManifestRoute(entry);
+						routeMetaMap.set(normalized.name, { public: normalized.public === true });
+					}
+					sandboxedRouteMetaCache.set(pluginId, routeMetaMap);
+				} else sandboxedRouteMetaCache.delete(pluginId);
+				const existing = this.allPipelinePlugins.find((p) => p.id === pluginId);
+				if (existing && existing.version === bundle.manifest.version) continue;
+				if (existing) this.removePluginFromLists(pluginId);
+				try {
+					const pluginModule = await import(`data:text/javascript;base64,${Buffer.from(bundle.backendCode).toString("base64")}`);
+					const adapted = adaptSandboxEntry(pluginModule.default ?? pluginModule, {
+						id: bundle.manifest.id,
+						version: bundle.manifest.version,
+						entrypoint: "",
+						capabilities: bundle.manifest.capabilities ?? [],
+						allowedHosts: bundle.manifest.allowedHosts ?? [],
+						storage: bundle.manifest.storage ?? {},
+						adminPages: bundle.manifest.admin?.pages,
+						adminWidgets: bundle.manifest.admin?.widgets?.map((w) => ({
+							id: w.id,
+							title: w.title,
+							size: w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0
+						}))
+					});
+					newPlugins.push(adapted);
+					this.allPipelinePlugins.push(adapted);
+					this.configuredPlugins.push(adapted);
+					this.enabledPlugins.add(adapted.id);
+				} catch (error) {
+					console.error(`EmDash: Failed to load marketplace plugin ${pluginId}@${version} in-process:`, error);
+				}
+			}
+			if (toRemove.length > 0 || newPlugins.length > 0) await this.rebuildHookPipeline();
+		} catch (error) {
+			console.error("EmDash: Failed to sync marketplace plugins (bypass):", error);
+		}
+	}
+	/**
 	* Create and initialize the runtime
 	*/
 	static async create(deps, timings) {
@@ -696,6 +820,7 @@ var EmDashRuntime = class EmDashRuntime {
 			} catch {}
 		});
 		const allPipelinePlugins = [...deps.plugins];
+		const bypassedPluginsList = [];
 		if (import.meta.env.DEV) try {
 			const devConsolePlugin = definePlugin({
 				id: DEV_CONSOLE_EMAIL_PLUGIN_ID,
@@ -726,6 +851,26 @@ var EmDashRuntime = class EmDashRuntime {
 		} catch (error) {
 			console.warn("[comments] Failed to register default moderator:", error);
 		}
+		if (deps.sandboxBypassed && deps.sandboxedPluginEntries.length > 0) {
+			if (typeof navigator !== "undefined" && typeof navigator.userAgent === "string" && navigator.userAgent.includes("Cloudflare-Workers")) throw new Error("sandbox: false is not supported in Cloudflare Workers. Remove the sandbox: false option or use the Cloudflare sandbox runner.");
+			console.info("EmDash: Sandbox disabled (sandbox: false). Sandboxed plugins will run in-process without isolation.");
+			const bypassedPlugins = await EmDashRuntime.loadBypassedPlugins(deps.sandboxedPluginEntries);
+			for (const plugin of bypassedPlugins) {
+				allPipelinePlugins.push(plugin);
+				bypassedPluginsList.push(plugin);
+				const status = pluginStates.get(plugin.id);
+				if (status === void 0 || status === "active") enabledPlugins.add(plugin.id);
+			}
+		}
+		if (deps.sandboxBypassed && deps.config.marketplace && storage) {
+			const marketplaceBypassed = await EmDashRuntime.loadMarketplacePluginsBypassed(db, storage);
+			for (const plugin of marketplaceBypassed) {
+				allPipelinePlugins.push(plugin);
+				bypassedPluginsList.push(plugin);
+				const status = pluginStates.get(plugin.id);
+				if (status === void 0 || status === "active") enabledPlugins.add(plugin.id);
+			}
+		}
 		const enabledPluginList = allPipelinePlugins.filter((p) => enabledPlugins.has(p.id));
 		const pipelineFactoryOptions = {
 			db,
@@ -733,8 +878,8 @@ var EmDashRuntime = class EmDashRuntime {
 			siteInfo
 		};
 		const pipeline = createHookPipeline(enabledPluginList, pipelineFactoryOptions);
-		const sandboxedPlugins = await phase("rt.sandbox", "Sandboxed plugins", () => EmDashRuntime.loadSandboxedPlugins(deps, db));
-		if (deps.config.marketplace && storage) await phase("rt.market", "Marketplace plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("marketplace", db, storage, deps, sandboxedPlugins));
+		const sandboxedPlugins = await phase("rt.sandbox", "Sandboxed plugins", () => EmDashRuntime.loadSandboxedPlugins(deps, db, storage));
+		if (deps.config.marketplace && storage && !deps.sandboxBypassed) await phase("rt.market", "Marketplace plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("marketplace", db, storage, deps, sandboxedPlugins));
 		if (deps.config.experimental?.registry && storage) await phase("rt.registry", "Registry plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("registry", db, storage, deps, sandboxedPlugins));
 		const mediaProviders = /* @__PURE__ */ new Map();
 		const mediaProviderEntries = deps.mediaProviderEntries ?? [];
@@ -792,7 +937,7 @@ var EmDashRuntime = class EmDashRuntime {
 		return new EmDashRuntime({
 			db,
 			storage,
-			configuredPlugins: deps.plugins,
+			configuredPlugins: [...deps.plugins, ...bypassedPluginsList],
 			sandboxedPlugins,
 			sandboxedPluginEntries: deps.sandboxedPluginEntries,
 			hooks: pipeline,
@@ -859,9 +1004,9 @@ var EmDashRuntime = class EmDashRuntime {
 					}
 				})();
 				if (collectionCount.count === 0 && !setupDone) {
-					const { applySeed } = await import("../apply-v4DBgjPw.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-QzYRpVN3.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-DlFxcVVK.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-BOPaD-s9.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-CLFRjk9r.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-IGltez8n.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -892,17 +1037,73 @@ var EmDashRuntime = class EmDashRuntime {
 		return storage;
 	}
 	/**
+	* Load sandboxed plugin entries as trusted in-process plugins.
+	* Used by the sandbox: false debugging escape hatch.
+	*
+	* Imports each plugin's bundled ESM code via a data URL, adapts it
+	* with adaptSandboxEntry, and returns ResolvedPlugin objects ready
+	* to be merged into the pipeline plugin list.
+	*/
+	static async loadBypassedPlugins(entries) {
+		const { adaptSandboxEntry } = await import("../plugins/adapt-sandbox-entry.mjs");
+		const plugins = [];
+		for (const entry of entries) try {
+			const pluginModule = await import(`data:text/javascript;base64,${Buffer.from(entry.code).toString("base64")}`);
+			const pluginDef = pluginModule.default ?? pluginModule;
+			const adminPages = entry.adminPages?.map((p) => ({
+				path: p.path,
+				label: p.label ?? p.path,
+				icon: p.icon
+			}));
+			const adminWidgets = entry.adminWidgets?.map((w) => {
+				const size = w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0;
+				return {
+					id: w.id,
+					title: w.title,
+					size
+				};
+			});
+			const resolved = adaptSandboxEntry(pluginDef, {
+				id: entry.id,
+				version: entry.version,
+				entrypoint: "",
+				capabilities: entry.capabilities,
+				allowedHosts: entry.allowedHosts,
+				storage: entry.storage,
+				adminPages,
+				adminWidgets
+			});
+			plugins.push(resolved);
+			console.log(`EmDash: Loaded plugin ${entry.id}:${entry.version} in-process (sandbox bypassed)`);
+		} catch (error) {
+			console.error(`EmDash: Failed to load sandboxed plugin ${entry.id} in-process:`, error);
+		}
+		return plugins;
+	}
+	/**
 	* Load sandboxed plugins using SandboxRunner
 	*/
-	static async loadSandboxedPlugins(deps, db) {
+	static async loadSandboxedPlugins(deps, db, mediaStorage) {
 		if (sandboxedPluginCache.size > 0) return sandboxedPluginCache;
-		if (!deps.sandboxEnabled || deps.sandboxedPluginEntries.length === 0) return sandboxedPluginCache;
-		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner({ db });
+		if (!deps.sandboxEnabled) return sandboxedPluginCache;
+		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner({
+			db,
+			mediaStorage: mediaStorage ? {
+				upload: (opts) => mediaStorage.upload({
+					key: opts.key,
+					body: opts.body,
+					contentType: opts.contentType
+				}),
+				delete: (key) => mediaStorage.delete(key)
+			} : void 0
+		});
 		if (!sandboxRunner) return sandboxedPluginCache;
 		if (!sandboxRunner.isAvailable()) {
-			console.debug("EmDash: Sandbox runner not available (missing bindings), skipping sandbox");
+			console.warn("EmDash: Plugin sandbox is configured but not available on this platform. Sandboxed plugins will not be loaded. If using @emdash-cms/sandbox-workerd/sandbox, ensure workerd is installed.");
 			return sandboxedPluginCache;
 		}
+		if (deps.sandboxedPluginEntries.length === 0) return sandboxedPluginCache;
+		if (deps.sandboxBypassed) return sandboxedPluginCache;
 		for (const entry of deps.sandboxedPluginEntries) {
 			const pluginKey = `${entry.id}:${entry.version}`;
 			if (sandboxedPluginCache.has(pluginKey)) continue;
@@ -941,7 +1142,18 @@ var EmDashRuntime = class EmDashRuntime {
 	* demand after install / update / uninstall handlers.
 	*/
 	static async loadInstalledSandboxedPlugins(source, db, storage, deps, cache) {
-		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner({ db });
+		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner({
+			db,
+			mediaStorage: {
+				upload: (opts) => storage.upload({
+					key: opts.key,
+					body: opts.body,
+					contentType: opts.contentType
+				}),
+				delete: (key) => storage.delete(key)
+			}
+		});
+		if (deps.sandboxBypassed) return;
 		if (!sandboxRunner || !sandboxRunner.isAvailable()) return;
 		const keySet = source === "marketplace" ? marketplacePluginKeys : registryPluginKeys;
 		try {
@@ -982,6 +1194,72 @@ var EmDashRuntime = class EmDashRuntime {
 		} catch {}
 	}
 	/**
+	* Cold-start: load marketplace plugins in bypass mode (sandbox: false).
+	*
+	* Each active marketplace bundle is read, evaluated via data URL, adapted
+	* with adaptSandboxEntry, and returned as a ResolvedPlugin. The caller is
+	* responsible for merging these into allPipelinePlugins / configuredPlugins
+	* BEFORE the hook pipeline is created, so hooks and routes register in
+	* the trusted pipeline.
+	*
+	* Also caches manifest and route metadata so admin UI / getManifest() work.
+	*
+	* Returns ResolvedPlugins to be merged into the pipeline.
+	*/
+	static async loadMarketplacePluginsBypassed(db, storage) {
+		const resolved = [];
+		try {
+			const marketplacePlugins = await new PluginStateRepository(db).getMarketplacePlugins();
+			if (marketplacePlugins.length === 0) return resolved;
+			console.info("EmDash: Sandbox disabled (sandbox: false). Marketplace plugins will run in-process without isolation.");
+			const { adaptSandboxEntry } = await import("../plugins/adapt-sandbox-entry.mjs");
+			for (const plugin of marketplacePlugins) {
+				if (plugin.status !== "active") continue;
+				const version = plugin.marketplaceVersion ?? plugin.version;
+				try {
+					const bundle = await loadBundleFromR2(storage, plugin.pluginId, version);
+					if (!bundle) {
+						console.warn(`EmDash: Marketplace plugin ${plugin.pluginId}@${version} not found in R2`);
+						continue;
+					}
+					marketplaceManifestCache.set(plugin.pluginId, {
+						id: bundle.manifest.id,
+						version: bundle.manifest.version,
+						admin: bundle.manifest.admin
+					});
+					if (bundle.manifest.routes.length > 0) {
+						const routeMeta = /* @__PURE__ */ new Map();
+						for (const entry of bundle.manifest.routes) {
+							const normalized = normalizeManifestRoute(entry);
+							routeMeta.set(normalized.name, { public: normalized.public === true });
+						}
+						sandboxedRouteMetaCache.set(plugin.pluginId, routeMeta);
+					}
+					const pluginModule = await import(`data:text/javascript;base64,${Buffer.from(bundle.backendCode).toString("base64")}`);
+					const adapted = adaptSandboxEntry(pluginModule.default ?? pluginModule, {
+						id: bundle.manifest.id,
+						version: bundle.manifest.version,
+						entrypoint: "",
+						capabilities: bundle.manifest.capabilities ?? [],
+						allowedHosts: bundle.manifest.allowedHosts ?? [],
+						storage: bundle.manifest.storage ?? {},
+						adminPages: bundle.manifest.admin?.pages,
+						adminWidgets: bundle.manifest.admin?.widgets?.map((w) => ({
+							id: w.id,
+							title: w.title,
+							size: w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0
+						}))
+					});
+					resolved.push(adapted);
+					console.log(`EmDash: Loaded marketplace plugin ${plugin.pluginId}@${version} in-process (sandbox bypassed)`);
+				} catch (error) {
+					console.error(`EmDash: Failed to load marketplace plugin ${plugin.pluginId} in-process:`, error);
+				}
+			}
+		} catch {}
+		return resolved;
+	}
+	/**
 	* Resolve exclusive hook selections on startup.
 	*
 	* Delegates to the shared resolveExclusiveHooks() in hooks.ts.
@@ -1147,6 +1425,7 @@ var EmDashRuntime = class EmDashRuntime {
 		return {
 			version: VERSION,
 			commit: COMMIT,
+			astroVersion: this.config.astroVersion,
 			hash: manifestHash,
 			collections: manifestCollections,
 			plugins: manifestPlugins,
@@ -1259,7 +1538,7 @@ var EmDashRuntime = class EmDashRuntime {
 		if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(body.data, collection, true)).content;
 		processedData = await this.runSandboxedBeforeSave(processedData, collection, true);
 		processedData = await this.normalizeMediaFields(collection, processedData);
-		const { validateContentData } = await import("../validation-BiFJqUp5.mjs");
+		const { validateContentData } = await import("../validation-Bmymau7y.mjs");
 		const validation = await validateContentData(this.db, collection, processedData, { partial: false });
 		if (!validation.ok) return {
 			success: false,
@@ -1275,7 +1554,7 @@ var EmDashRuntime = class EmDashRuntime {
 		return result;
 	}
 	async handleContentUpdate(collection, id, body) {
-		const { ContentRepository } = await import("../content-D6YG26WG.mjs").then((n) => n.n);
+		const { ContentRepository } = await import("../content-8voQNTXX.mjs").then((n) => n.n);
 		const repo = new ContentRepository(this.db);
 		const resolvedItem = await repo.findByIdOrSlug(collection, id);
 		const resolvedId = resolvedItem?.id ?? id;
@@ -1302,7 +1581,7 @@ var EmDashRuntime = class EmDashRuntime {
 			if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(bodyWithoutRev.data, collection, false)).content;
 			processedData = await this.runSandboxedBeforeSave(processedData, collection, false);
 			processedData = await this.normalizeMediaFields(collection, processedData);
-			const { validateContentData } = await import("../validation-BiFJqUp5.mjs");
+			const { validateContentData } = await import("../validation-Bmymau7y.mjs");
 			const validation = await validateContentData(this.db, collection, processedData, { partial: true });
 			if (!validation.ok) return {
 				success: false,
@@ -1842,6 +2121,24 @@ function createPublicMediaUrlResolver(storage) {
 	return (key) => resolvePublicMediaUrl(storage, key);
 }
 
+//#endregion
+//#region src/astro/public-plugin-api-routes.ts
+function pluginRouteNotFound() {
+	return {
+		success: false,
+		error: {
+			code: "NOT_FOUND",
+			message: "Plugin route not found"
+		}
+	};
+}
+function createPublicPluginApiRouteHandler(runtime) {
+	return async (pluginId, method, path, request) => {
+		if (runtime.getPluginRouteMeta(pluginId, path)?.public !== true) return pluginRouteNotFound();
+		return runtime.handlePluginApiRoute(pluginId, method, path, request);
+	};
+}
+
 //#endregion
 //#region src/astro/middleware.ts
 /**
@@ -1888,14 +2185,16 @@ function getPlugins() {
 * Build runtime dependencies from virtual modules
 */
 function buildDependencies(config) {
+	const sandboxModule = virtualSandboxRunnerModule;
 	return {
 		config,
 		plugins: getPlugins(),
 		createDialect,
 		createStorage,
-		sandboxEnabled,
+		sandboxEnabled: sandboxModule.sandboxEnabled,
+		sandboxBypassed: sandboxModule.sandboxBypassed ?? false,
 		sandboxedPluginEntries: sandboxedPlugins || [],
-		createSandboxRunner,
+		createSandboxRunner: sandboxModule.createSandboxRunner,
 		mediaProviderEntries: mediaProviders || []
 	};
 }
@@ -2027,7 +2326,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 				if (!setupVerified) {
 					const t0 = performance.now();
 					try {
-						const { getDb } = await import("../loader-Cs6-Bqe6.mjs").then((n) => n.i);
+						const { getDb } = await import("../loader-D-vIJjfY.mjs").then((n) => n.i);
 						await (await getDb()).selectFrom("_emdash_migrations").selectAll().limit(1).execute();
 						setupVerified = true;
 					} catch {
@@ -2047,6 +2346,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 						const runtime = await getRuntime(config, initSubTimings);
 						setupVerified = true;
 						locals.emdash = {
+							handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage)
@@ -2148,6 +2448,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 					handleRevisionGet: runtime.handleRevisionGet.bind(runtime),
 					handleRevisionRestore: runtime.handleRevisionRestore.bind(runtime),
 					handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
+					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
 					getMediaProvider: runtime.getMediaProvider.bind(runtime),
 					getMediaProviderList: runtime.getMediaProviderList.bind(runtime),
@@ -2164,6 +2465,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 					getManifest: runtime.getManifest.bind(runtime),
 					invalidateUrlPatternCache,
 					getSandboxRunner: runtime.getSandboxRunner.bind(runtime),
+					isSandboxBypassed: runtime.isSandboxBypassed.bind(runtime),
 					syncMarketplacePlugins: runtime.syncMarketplacePlugins.bind(runtime),
 					syncRegistryPlugins: runtime.syncRegistryPlugins.bind(runtime),
 					setPluginStatus: runtime.setPluginStatus.bind(runtime)