emdash 0.28.1 → 0.30.0

package/dist/astro/middleware.mjs

@@ -1,80 +1,90 @@
-import { i as runMigrations, t as MIGRATION_RACE_WAIT_MS } from "../runner-K8XK101B.mjs";
+import { a as runMigrations, n as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "../runner-DfnZ5eUr.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
-import { o as isSqlite } from "../dialect-helpers-DRI5pyY3.mjs";
+import { s as isSqlite } from "../dialect-helpers-HxEQGl_1.mjs";
 import { i as setI18nConfig } from "../config-CVssduLe.mjs";
-import { _ as resolveExclusiveHooks, g as createHookPipeline, m as EmailPipeline, p as PluginRouteRegistry, t as getMenu, v as definePlugin } from "../menus-b2T4clbO.mjs";
+import { E as AuditRepository, _ as createHookPipeline, h as EmailPipeline, m as buildRouteMeta, p as PluginRouteRegistry, t as getMenu, v as resolveExclusiveHooks, y as definePlugin } from "../menus-BcyElFtI.mjs";
 import { t as after } from "../after-B1IIdH3Y.mjs";
 import { createRequestMetrics, getRequestContext, runWithContext } from "../request-context.mjs";
 import "../object-cache-Bok5j2ae.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "../content-DhgEth4k.mjs";
-import "../base64-CmWvODNW.mjs";
-import "../types-CuW0zWDA.mjs";
-import { t as MediaRepository } from "../media-BrXIaMFN.mjs";
-import "../user-BjAOvU3Z.mjs";
-import "../taxonomy-BxGxZZdu.mjs";
-import "../comment-CzeatwBV.mjs";
-import { t as OptionsRepository } from "../options-DTTML-Tx.mjs";
-import "../context-BRIpHARC.mjs";
-import "../menus-Cfivc2Ad.mjs";
-import "../redirect-IyfNirgS.mjs";
-import { i as setRequestCacheEntry, r as requestCached } from "../request-cache-KCNHp_RJ.mjs";
-import "../byline-registry-BOjqDOim.mjs";
-import { n as initWithLock, t as createInitLock } from "../init-lock-6b309ZrF.mjs";
-import "../field-defs-cache-WUI88LX5.mjs";
-import "../byline-Bm8ZgUP9.mjs";
-import { n as normalizeMediaValue } from "../normalize-CeglrBT9.mjs";
-import "../enrich-BQ0mxJRs.mjs";
-import "../seo-DXu2UQnC.mjs";
-import { n as isMissingTableError } from "../db-errors-CK46D-ly.mjs";
-import { $ as handleContentGet, B as handleMediaUpdate, G as handleContentAuthors, H as handleRevisionList, I as handleMediaCreate, J as handleContentCountTrashed, K as handleContentCompare, L as handleMediaDelete, Q as handleContentDuplicate, R as handleMediaGet, S as PluginStateRepository, U as handleRevisionRestore, V as handleRevisionGet, X as handleContentDelete, Y as handleContentCreate, Z as handleContentDiscardDraft, _ as loadBundleFromR2, at as handleContentRestore, ct as handleContentUnpublish, dt as validateRev, et as handleContentGetIncludingTrashed, it as handleContentPublish, lt as handleContentUnschedule, nt as handleContentListTrashed, ot as handleContentSchedule, q as handleContentCountScheduled, rt as handleContentPermanentDelete, s as normalizeRegistryConfig, st as handleContentTranslations, tt as handleContentList, ut as handleContentUpdate, z as handleMediaList } from "../api-DxFSorgk.mjs";
-import "../dashboard-EvEKF5en.mjs";
-import { n as hashString } from "../hash-DrvzIXcz.mjs";
-import { i as markContentMediaUsageCollectionStale, o as refreshContentMediaUsageAfterWrite, r as findNonTranslatableSiblingContentIds, t as deleteContentMediaUsage } from "../content-refresh-Br4gMzh8.mjs";
-import { t as FTSManager } from "../fts-manager-BbFaF_V8.mjs";
-import { n as SchemaRegistry } from "../registry-B57vp_X9.mjs";
+import { r as RevisionRepository, t as ContentRepository } from "../content-Ci04z2z-.mjs";
+import { n as isMissingTableError } from "../db-errors-CcWLaRiR.mjs";
+import "../base64-B-PsqheR.mjs";
+import "../types-D1iJ3DpO.mjs";
+import { t as MediaRepository } from "../media-BjhhENaJ.mjs";
+import "../user-Bh-L1qo6.mjs";
+import "../taxonomy-DfVooU4W.mjs";
+import "../comment-DPT0WKyd.mjs";
+import { t as OptionsRepository } from "../options-BlmBHTvX.mjs";
+import { r as createSiteInfo } from "../context-B6hc7zJL.mjs";
+import "../menus-CZyG6rvx.mjs";
+import "../redirect-CgLPYflR.mjs";
+import { i as setRequestCacheEntry, r as requestCached } from "../request-cache-BSUptuJR.mjs";
+import "../byline-registry-BCuOp4UF.mjs";
+import { n as initWithLock, t as createInitLock } from "../init-lock-DJkX6Hto.mjs";
+import "../field-defs-cache-DvmlgP-D.mjs";
+import "../byline-XEjchwzZ.mjs";
+import "../relation-9M9j_UWo.mjs";
+import { n as normalizeMediaValue } from "../normalize-C-SHXmra.mjs";
+import "../enrich-CFJJgxs_.mjs";
+import "../seo-2cmFHZns.mjs";
+import { t as FTSManager } from "../fts-manager-DzqIBrrW.mjs";
+import "../resolve-Cd9dzclN.mjs";
 import { createRecorder, flushRecorder, isInstrumentationEnabled, kyselyLogOption } from "../database/instrumentation.mjs";
-import { a as getDb } from "../loader-CB6YHeul.mjs";
-import "../schema-CX9cfNkZ.mjs";
-import "../zod-generator-CacrR-i8.mjs";
-import "../seo-89-53DDs.mjs";
-import "../sections-CpF5SaGr.mjs";
-import { r as singleFlightCached, t as createSingleFlightCache } from "../single-flight-cache-BG3B_GhN.mjs";
-import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-zhmdKyJQ.mjs";
-import "../settings-rZyHEcNT.mjs";
-import "../resolve-DR3wqMTy.mjs";
-import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-kH9ABDUF.mjs";
-import "../taxonomies-Bs13SN-F.mjs";
-import { r as normalizeManifestRoute } from "../manifest-schema-BHlgZM1W.mjs";
-import "../types-DROWRxYV.mjs";
-import "../ssrf-1g7usGBg.mjs";
-import "../error-CkAseSqZ.mjs";
-import "../parse-GmjecGct.mjs";
-import "../redirects-DXEXBAII.mjs";
-import "../byline-fields-2Lp5Hbgf.mjs";
-import "../status-CqJQX1QN.mjs";
-import { a as invalidateUrlPatternCache } from "../query-1Cp6U9oo.mjs";
-import "../import-fYLf14Co.mjs";
-import { t as getTrustedProxyHeaders } from "../trusted-proxy-VTPRiX2s.mjs";
-import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DbvXaAvU.mjs";
-import "../ssrf-CmuGgCq3.mjs";
-import { n as CronExecutor } from "../cron-v4FTEFR_.mjs";
-import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-CIf4Lfvv.mjs";
-import "../utils-BJXElxdw.mjs";
-import "../tokens-BGT0TUUo.mjs";
-import "../preview-SSXNVPAC.mjs";
-import "../comment-reaction-Cj9QJY7I.mjs";
-import "../bylines-CAZxGSrm.mjs";
-import { n as getWidgetAreas } from "../widgets-hWcIicX8.mjs";
-import "../apply-CDJqIjPU.mjs";
-import "../load-Djn3HWQS.mjs";
-import "../search-DZN2HZ-V.mjs";
+import { a as getDb } from "../loader-Be3ouI5L.mjs";
+import { a as getTaxonomyDefs, o as getTaxonomyTerms } from "../taxonomies-DjSKBZpq.mjs";
+import { $ as handleContentDiscardDraft, B as handleMediaGet, G as handleRevisionRestore, H as handleMediaUpdate, J as handleContentCompare, Q as handleContentDelete, R as handleMediaCreate, U as handleRevisionGet, V as handleMediaList, W as handleRevisionList, X as handleContentCountTrashed, Y as handleContentCountScheduled, Z as handleContentCreate, _ as loadBundleFromR2, at as handleContentPermanentDelete, ct as handleContentSchedule, dt as handleContentUnschedule, et as handleContentDuplicate, ft as handleContentUpdate, it as handleContentListTrashed, lt as handleContentTranslations, nt as handleContentGetIncludingTrashed, ot as handleContentPublish, pt as validateRev, q as handleContentAuthors, rt as handleContentList, s as normalizeRegistryConfig, st as handleContentRestore, tt as handleContentGet, ut as handleContentUnpublish, z as handleMediaDelete } from "../api-b8WIiGU4.mjs";
+import "../dashboard-C5NkXFbi.mjs";
+import { n as hashString } from "../hash-DFFrkivP.mjs";
+import { a as findNonTranslatableSiblingContentIds, c as refreshContentMediaUsageAfterWrite, o as markContentMediaUsageCollectionStale, r as deleteContentMediaUsage } from "../content-refresh-D4khvC0R.mjs";
+import "../media-usage-CljdO1mc.mjs";
+import { n as SchemaRegistry } from "../registry-FV15nLge.mjs";
+import "../query-Di7DOmPV.mjs";
+import "../zod-generator-B5prQ5M4.mjs";
+import "../schema-BXxlHeAf.mjs";
+import "../seo-C3GDfT0V.mjs";
+import { t as PluginStateRepository } from "../state-xxv6ZTMv.mjs";
+import "../sections-CwW4s1al.mjs";
+import { r as singleFlightCached, t as createSingleFlightCache } from "../single-flight-cache-C2exrGAi.mjs";
+import { i as getSiteSettings, o as invalidateSiteSettingsCache } from "../settings-CpA4lQFt.mjs";
+import "../settings-C4s8hFQm.mjs";
+import "../taxonomies-Ce49uIzY.mjs";
+import { r as normalizeManifestRoute } from "../manifest-schema-bCq54i7F.mjs";
+import "../types-CK0LxPUQ.mjs";
+import "../ssrf-CviKqWmq.mjs";
+import "../error-CEGF6UZb.mjs";
+import "../parse-C_-6klII.mjs";
+import "../media-kIV1IxFf.mjs";
+import "../redirects-BBq3n2Rj.mjs";
+import "../relations-5_avdrN_.mjs";
+import "../status-COfycGIU.mjs";
+import { a as invalidateUrlPatternCache } from "../query-DR73ZNfm.mjs";
+import "../import-Dmkm8S1W.mjs";
+import { t as getTrustedProxyHeaders } from "../trusted-proxy-CwjQj0YG.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "../request-meta-DzXYYI-n.mjs";
+import "../ssrf-BB__xfNM.mjs";
+import { n as CronExecutor } from "../cron-BlKIMD_e.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "../email-console-C-9Ng8DM.mjs";
+import "../utils-BbUgmeZG.mjs";
+import "../tokens-DVltpO2D.mjs";
+import "../preview-D4Jnbfx7.mjs";
+import "../hreflang-db2Tpb2o.mjs";
+import "../comment-reaction-C65MldIB.mjs";
+import "../bylines-czseViYo.mjs";
+import { n as getWidgetAreas } from "../widgets-DGv1Z04V.mjs";
+import "../apply-CmIJK9j8.mjs";
+import "../load-Cx27ki1l.mjs";
+import "../search-Bff-7jFt.mjs";
 import "../index.mjs";
-import { n as VERSION, t as COMMIT } from "../version-qmeO1XZY.mjs";
-import { t as getAuthMode } from "../mode-BM9QgEmt.mjs";
-import { t as cleanupExpiredChallenges } from "../challenge-store-anhwVER0.mjs";
-import { a as validateEncryptionKeyAtStartup } from "../secrets-kp760LlD.mjs";
-import { t as resolveSessionUser } from "../session-user-Cascbax7.mjs";
+import { n as VERSION, t as COMMIT } from "../version-907opKac.mjs";
+import { t as getAuthMode } from "../mode-fiXRMfeA.mjs";
+import "../snapshot-BdpUJKD-.mjs";
+import { u as maybeRunScheduledBackup } from "../backup-S8kFWtwD.mjs";
+import { t as cleanupExpiredChallenges } from "../challenge-store-BFzgFRog.mjs";
+import { a as validateEncryptionKeyAtStartup } from "../secrets-CSwQIl4q.mjs";
+import { t as resolveSessionUser } from "../session-user-DbHqKDKe.mjs";
 import { Kysely, sql } from "kysely";
+import { z } from "zod";
+import { Permissions } from "@emdash-cms/auth";
 import { defineMiddleware } from "astro:middleware";
 import virtualConfig from "virtual:emdash/config";
 import { createCoalescingDialect, createDialect, createRequestScopedDb } from "virtual:emdash/dialect";
@@ -86,6 +96,19 @@ import { createScheduler } from "virtual:emdash/scheduler";
 import { createStorage } from "virtual:emdash/storage";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 
+//#region src/plugins/sandbox/runner-options.ts
+/**
+* Build platform sandbox options with the same normalized site context used
+* by trusted plugin hooks and routes.
+*/
+function createSandboxRunnerOptions(options, siteInfo) {
+	return {
+		...options,
+		siteInfo: createSiteInfo(siteInfo ?? {})
+	};
+}
+
+//#endregion
 //#region src/cleanup.ts
 /**
 * System cleanup
@@ -272,6 +295,14 @@ async function publishDueContent(db, options = {}) {
 
 //#endregion
 //#region src/emdash-runtime.ts
+/**
+* EmDashRuntime - Core runtime for EmDash CMS
+*
+* Manages database, storage, plugins (trusted + sandboxed), hooks, and
+* provides handlers for content/media operations.
+*
+* Created once per worker lifetime, cached and reused across requests.
+*/
 const LEADING_SLASH_PATTERN = /^\//;
 /**
 * Parse a JSON column expected to contain an array of strings.
@@ -369,13 +400,22 @@ function getDbHolder() {
 	if (!holder) {
 		holder = {
 			cache: /* @__PURE__ */ new Map(),
-			lock: createInitLock()
+			lock: createInitLock(),
+			failures: /* @__PURE__ */ new Map()
 		};
 		globalSymbolStore[DB_HOLDER_KEY] = holder;
 	}
+	holder.failures ??= /* @__PURE__ */ new Map();
 	return holder;
 }
 /**
+* After a database init fails (migrations threw), skip re-attempting for
+* this long. Cold isolates still get one attempt each, so a transient
+* failure heals on its own; a persistently failing migration is retried at
+* most once per backoff window per isolate instead of on every request.
+*/
+const DB_INIT_FAILURE_BACKOFF_MS = 3e4;
+/**
 * Auto-seed runs at most once per isolate per database. Its lock + "done" set
 * live on globalThis (same bundler-duplication reasoning as the db cache) so a
 * reclaimed-and-rerun `create()` can't seed a second time concurrently. The
@@ -565,6 +605,7 @@ var EmDashRuntime = class EmDashRuntime {
 		} catch (error) {
 			console.error("[cleanup] System cleanup failed:", error);
 		}
+		await maybeRunScheduledBackup(this.db, this.storage ?? void 0);
 		return { published };
 	}
 	/**
@@ -605,10 +646,7 @@ var EmDashRuntime = class EmDashRuntime {
 		const newPipeline = createHookPipeline(this.allPipelinePlugins.filter((p) => this.enabledPlugins.has(p.id)), this.pipelineFactoryOptions);
 		await EmDashRuntime.resolveExclusiveHooks(newPipeline, this.db, this.runtimeDeps);
 		if (this.email) newPipeline.setContextFactory({ emailPipeline: this.email });
-		if (this.cronScheduler) {
-			const scheduler = this.cronScheduler;
-			newPipeline.setContextFactory({ cronReschedule: () => scheduler.reschedule() });
-		}
+		newPipeline.setContextFactory({ cronReschedule: () => this.cronScheduler?.reschedule() });
 		if (this.email) this.email.setPipeline(newPipeline);
 		this.pipelineRef.current = newPipeline;
 		this._hooks = newPipeline;
@@ -710,13 +748,14 @@ var EmDashRuntime = class EmDashRuntime {
 				marketplaceManifestCache.set(pluginId, {
 					id: bundle.manifest.id,
 					version: bundle.manifest.version,
-					admin: bundle.manifest.admin
+					admin: bundle.manifest.admin,
+					mcp: bundle.manifest.mcp
 				});
 				if (bundle.manifest.routes.length > 0) {
 					const routeMetaMap = /* @__PURE__ */ new Map();
 					for (const entry of bundle.manifest.routes) {
 						const normalized = normalizeManifestRoute(entry);
-						routeMetaMap.set(normalized.name, { public: normalized.public === true });
+						routeMetaMap.set(normalized.name, buildRouteMeta(normalized));
 					}
 					sandboxedRouteMetaCache.set(pluginId, routeMetaMap);
 				} else sandboxedRouteMetaCache.delete(pluginId);
@@ -794,13 +833,14 @@ var EmDashRuntime = class EmDashRuntime {
 				marketplaceManifestCache.set(pluginId, {
 					id: bundle.manifest.id,
 					version: bundle.manifest.version,
-					admin: bundle.manifest.admin
+					admin: bundle.manifest.admin,
+					mcp: bundle.manifest.mcp
 				});
 				if (bundle.manifest.routes.length > 0) {
 					const routeMetaMap = /* @__PURE__ */ new Map();
 					for (const entry of bundle.manifest.routes) {
 						const normalized = normalizeManifestRoute(entry);
-						routeMetaMap.set(normalized.name, { public: normalized.public === true });
+						routeMetaMap.set(normalized.name, buildRouteMeta(normalized));
 					}
 					sandboxedRouteMetaCache.set(pluginId, routeMetaMap);
 				} else sandboxedRouteMetaCache.delete(pluginId);
@@ -821,7 +861,8 @@ var EmDashRuntime = class EmDashRuntime {
 							id: w.id,
 							title: w.title,
 							size: w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0
-						}))
+						})),
+						settingsSchema: bundle.manifest.admin?.settingsSchema
 					});
 					newPlugins.push(adapted);
 					this.allPipelinePlugins.push(adapted);
@@ -891,7 +932,8 @@ var EmDashRuntime = class EmDashRuntime {
 			return {
 				siteName: siteOpts.get("emdash:site_title") ?? void 0,
 				siteUrl: siteOpts.get("emdash:site_url") ?? void 0,
-				locale: siteOpts.get("emdash:locale") ?? void 0
+				locale: siteOpts.get("emdash:locale") ?? void 0,
+				trailingSlash: virtualConfig?.trailingSlash
 			};
 		};
 		const coldStartReads = [phase("rt.plugins", "Plugin states", async () => {
@@ -926,9 +968,9 @@ var EmDashRuntime = class EmDashRuntime {
 			const seedHolder = getSeedHolder();
 			try {
 				await initWithLock(seedHolder.lock, () => seedHolder.done.has(seedKey) ? true : void 0, async () => {
-					const { applySeed } = await import("../apply-CDJqIjPU.mjs").then((n) => n.n);
-					const { loadSeed } = await import("../load-Djn3HWQS.mjs").then((n) => n.r);
-					const { validateSeed } = await import("../validate-CWSnKVIJ.mjs").then((n) => n.n);
+					const { applySeed } = await import("../apply-CmIJK9j8.mjs").then((n) => n.n);
+					const { loadSeed } = await import("../load-Cx27ki1l.mjs").then((n) => n.r);
+					const { validateSeed } = await import("../validate-V9nCwq_-.mjs").then((n) => n.n);
 					const seed = await loadSeed();
 					if (validateSeed(seed).valid) {
 						await applySeed(db, seed, { onConflict: "skip" });
@@ -1013,10 +1055,10 @@ var EmDashRuntime = class EmDashRuntime {
 			siteInfo
 		};
 		const pipeline = createHookPipeline(enabledPluginList, pipelineFactoryOptions);
-		const sandboxedPlugins = await phase("rt.sandbox", "Sandboxed plugins", () => EmDashRuntime.loadSandboxedPlugins(deps, db, storage));
+		const sandboxedPlugins = await phase("rt.sandbox", "Sandboxed plugins", () => EmDashRuntime.loadSandboxedPlugins(deps, db, storage, siteInfo));
 		const installedTierPhases = [];
-		if (deps.config.marketplace && storage && !deps.sandboxBypassed) installedTierPhases.push(phase("rt.market", "Marketplace plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("marketplace", db, storage, deps, sandboxedPlugins)));
-		if (deps.config.experimental?.registry && storage) installedTierPhases.push(phase("rt.registry", "Registry plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("registry", db, storage, deps, sandboxedPlugins)));
+		if (deps.config.marketplace && storage && !deps.sandboxBypassed) installedTierPhases.push(phase("rt.market", "Marketplace plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("marketplace", db, storage, deps, sandboxedPlugins, siteInfo)));
+		if (deps.config.experimental?.registry && storage) installedTierPhases.push(phase("rt.registry", "Registry plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("registry", db, storage, deps, sandboxedPlugins, siteInfo)));
 		if (installedTierPhases.length > 0) await Promise.all(installedTierPhases);
 		const mediaProviders = /* @__PURE__ */ new Map();
 		const mediaProviderEntries = deps.mediaProviderEntries ?? [];
@@ -1046,6 +1088,7 @@ var EmDashRuntime = class EmDashRuntime {
 		await phase("rt.cron", "Cron init (recovery deferred post-response)", async () => {
 			try {
 				cronExecutor = new CronExecutor(resolveDb, invokeCronHook);
+				pipeline.setContextFactory({ cronReschedule: () => cronScheduler?.reschedule() });
 				const executorForRecovery = cronExecutor;
 				after(async () => {
 					try {
@@ -1070,8 +1113,8 @@ var EmDashRuntime = class EmDashRuntime {
 						} catch (error) {
 							console.error("[cleanup] System cleanup failed:", error);
 						}
+						await maybeRunScheduledBackup(db, storage ?? void 0);
 					});
-					pipeline.setContextFactory({ cronReschedule: () => cronScheduler?.reschedule() });
 					scheduler.start();
 				}
 			} catch (error) {
@@ -1132,12 +1175,30 @@ var EmDashRuntime = class EmDashRuntime {
 		}
 		const cacheKey = dbConfig.entrypoint;
 		const holder = getDbHolder();
+		const throwIfBackingOff = () => {
+			const failure = holder.failures.get(cacheKey);
+			if (!failure) return;
+			if (Date.now() - failure.at < DB_INIT_FAILURE_BACKOFF_MS) throw new Error(`Database initialization is backing off after a recent migration failure: ${failure.message}`);
+			holder.failures.delete(cacheKey);
+		};
+		throwIfBackingOff();
 		return initWithLock(holder.lock, () => holder.cache.get(cacheKey), async (isCurrentClaim) => {
+			throwIfBackingOff();
 			const db = new Kysely({
 				dialect: deps.createDialect(dbConfig.config),
 				log: kyselyLogOption()
 			});
-			await runMigrations(db);
+			try {
+				await runMigrations(db);
+			} catch (error) {
+				if (!(error instanceof ConcurrentMigrationTimeoutError)) holder.failures.set(cacheKey, {
+					at: Date.now(),
+					message: error instanceof Error ? error.message : String(error)
+				});
+				await db.destroy().catch(() => {});
+				throw error;
+			}
+			holder.failures.delete(cacheKey);
 			if (isCurrentClaim()) holder.cache.set(cacheKey, db);
 			return db;
 		}, {
@@ -1194,6 +1255,7 @@ var EmDashRuntime = class EmDashRuntime {
 				storage: entry.storage,
 				adminPages,
 				adminWidgets,
+				settingsSchema: entry.settingsSchema,
 				portableTextBlocks: entry.portableTextBlocks,
 				fieldWidgets: entry.fieldWidgets
 			});
@@ -1207,10 +1269,10 @@ var EmDashRuntime = class EmDashRuntime {
 	/**
 	* Load sandboxed plugins using SandboxRunner
 	*/
-	static async loadSandboxedPlugins(deps, db, mediaStorage) {
+	static async loadSandboxedPlugins(deps, db, mediaStorage, siteInfo) {
 		if (sandboxedPluginCache.size > 0) return sandboxedPluginCache;
 		if (!deps.sandboxEnabled) return sandboxedPluginCache;
-		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner({
+		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner(createSandboxRunnerOptions({
 			db,
 			mediaStorage: mediaStorage ? {
 				upload: (opts) => mediaStorage.upload({
@@ -1220,7 +1282,7 @@ var EmDashRuntime = class EmDashRuntime {
 				}),
 				delete: (key) => mediaStorage.delete(key)
 			} : void 0
-		});
+		}, siteInfo));
 		if (!sandboxRunner) return sandboxedPluginCache;
 		if (!sandboxRunner.isAvailable()) {
 			console.warn("EmDash: Plugin sandbox is configured but not available on this platform. Sandboxed plugins will not be loaded. If using @emdash-cms/sandbox-workerd/sandbox, ensure workerd is installed.");
@@ -1240,7 +1302,8 @@ var EmDashRuntime = class EmDashRuntime {
 					storage: entry.storage ?? {},
 					hooks: [],
 					routes: [],
-					admin: {}
+					admin: {},
+					mcp: entry.mcp
 				};
 				const plugin = await sandboxRunner.load(manifest, entry.code);
 				sandboxedPluginCache.set(pluginKey, plugin);
@@ -1265,8 +1328,8 @@ var EmDashRuntime = class EmDashRuntime {
 	* creation, before request traffic arrives; the sync method runs on
 	* demand after install / update / uninstall handlers.
 	*/
-	static async loadInstalledSandboxedPlugins(source, db, storage, deps, cache) {
-		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner({
+	static async loadInstalledSandboxedPlugins(source, db, storage, deps, cache, siteInfo) {
+		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner(createSandboxRunnerOptions({
 			db,
 			mediaStorage: {
 				upload: (opts) => storage.upload({
@@ -1276,7 +1339,7 @@ var EmDashRuntime = class EmDashRuntime {
 				}),
 				delete: (key) => storage.delete(key)
 			}
-		});
+		}, siteInfo));
 		if (deps.sandboxBypassed) return;
 		if (!sandboxRunner || !sandboxRunner.isAvailable()) return;
 		const keySet = source === "marketplace" ? marketplacePluginKeys : registryPluginKeys;
@@ -1300,13 +1363,14 @@ var EmDashRuntime = class EmDashRuntime {
 					marketplaceManifestCache.set(plugin.pluginId, {
 						id: bundle.manifest.id,
 						version: bundle.manifest.version,
-						admin: bundle.manifest.admin
+						admin: bundle.manifest.admin,
+						mcp: bundle.manifest.mcp
 					});
 					if (bundle.manifest.routes.length > 0) {
 						const routeMeta = /* @__PURE__ */ new Map();
 						for (const entry of bundle.manifest.routes) {
 							const normalized = normalizeManifestRoute(entry);
-							routeMeta.set(normalized.name, { public: normalized.public === true });
+							routeMeta.set(normalized.name, buildRouteMeta(normalized));
 						}
 						sandboxedRouteMetaCache.set(plugin.pluginId, routeMeta);
 					}
@@ -1349,13 +1413,14 @@ var EmDashRuntime = class EmDashRuntime {
 					marketplaceManifestCache.set(plugin.pluginId, {
 						id: bundle.manifest.id,
 						version: bundle.manifest.version,
-						admin: bundle.manifest.admin
+						admin: bundle.manifest.admin,
+						mcp: bundle.manifest.mcp
 					});
 					if (bundle.manifest.routes.length > 0) {
 						const routeMeta = /* @__PURE__ */ new Map();
 						for (const entry of bundle.manifest.routes) {
 							const normalized = normalizeManifestRoute(entry);
-							routeMeta.set(normalized.name, { public: normalized.public === true });
+							routeMeta.set(normalized.name, buildRouteMeta(normalized));
 						}
 						sandboxedRouteMetaCache.set(plugin.pluginId, routeMeta);
 					}
@@ -1372,7 +1437,8 @@ var EmDashRuntime = class EmDashRuntime {
 							id: w.id,
 							title: w.title,
 							size: w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0
-						}))
+						})),
+						settingsSchema: bundle.manifest.admin?.settingsSchema
 					});
 					resolved.push(adapted);
 					console.log(`EmDash: Loaded marketplace plugin ${plugin.pluginId}@${version} in-process (sandbox bypassed)`);
@@ -1664,7 +1730,7 @@ var EmDashRuntime = class EmDashRuntime {
 		if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(body.data, collection, true)).content;
 		processedData = await this.runSandboxedBeforeSave(processedData, collection, true);
 		processedData = await this.normalizeMediaFields(collection, processedData);
-		const { validateContentData } = await import("../validation-0l8-RYj4.mjs");
+		const { validateContentData } = await import("../validation-BsVUJfsP.mjs");
 		const validation = await validateContentData(this.db, collection, processedData, { partial: false });
 		if (!validation.ok) return {
 			success: false,
@@ -1681,7 +1747,7 @@ var EmDashRuntime = class EmDashRuntime {
 		return result;
 	}
 	async handleContentUpdate(collection, id, body) {
-		const { ContentRepository } = await import("../content-DhgEth4k.mjs").then((n) => n.n);
+		const { ContentRepository } = await import("../content-Ci04z2z-.mjs").then((n) => n.n);
 		const repo = new ContentRepository(this.db);
 		const resolvedItem = await repo.findByIdOrSlug(collection, id, body.locale);
 		const resolvedId = resolvedItem?.id ?? id;
@@ -1708,7 +1774,7 @@ var EmDashRuntime = class EmDashRuntime {
 			if (this.hooks.hasHooks("content:beforeSave")) processedData = (await this.hooks.runContentBeforeSave(bodyWithoutRev.data, collection, false)).content;
 			processedData = await this.runSandboxedBeforeSave(processedData, collection, false);
 			processedData = await this.normalizeMediaFields(collection, processedData);
-			const { validateContentData } = await import("../validation-0l8-RYj4.mjs");
+			const { validateContentData } = await import("../validation-BsVUJfsP.mjs");
 			const validation = await validateContentData(this.db, collection, processedData, { partial: true });
 			if (!validation.ok) return {
 				success: false,
@@ -1745,8 +1811,7 @@ var EmDashRuntime = class EmDashRuntime {
 						const tableName = `ec_${collection}`;
 						await sql`
 								UPDATE ${sql.ref(tableName)}
-								SET draft_revision_id = ${revision.id},
-									updated_at = ${(/* @__PURE__ */ new Date()).toISOString()}
+								SET draft_revision_id = ${revision.id}
 								WHERE id = ${resolvedId}
 							`.execute(this.db);
 						draftStorageChanged = true;
@@ -1946,8 +2011,7 @@ var EmDashRuntime = class EmDashRuntime {
 			const tableName = `ec_${revision.collection}`;
 			await sql`
 				UPDATE ${sql.ref(tableName)}
-				SET draft_revision_id = ${newDraft.id},
-					updated_at = ${(/* @__PURE__ */ new Date()).toISOString()}
+				SET draft_revision_id = ${newDraft.id}
 				WHERE id = ${revision.entryId}
 			`.execute(this.db);
 			revisionRepo.pruneOldRevisions(revision.collection, revision.entryId, 50).catch(() => {});
@@ -1993,7 +2057,7 @@ var EmDashRuntime = class EmDashRuntime {
 		if (trustedPlugin) {
 			const route = trustedPlugin.routes[routeKey];
 			if (!route) return null;
-			return { public: route.public === true };
+			return buildRouteMeta(route);
 		}
 		const meta = sandboxedRouteMetaCache.get(pluginId);
 		if (meta) {
@@ -2009,6 +2073,17 @@ var EmDashRuntime = class EmDashRuntime {
 		if (this.findSandboxedPlugin(pluginId)) return { public: false };
 		return null;
 	}
+	/**
+	* Resolve the settings schema for a runtime-installed (marketplace or
+	* registry) plugin from its cached manifest. Returns `{}` for a known
+	* plugin without a schema and `null` for unknown plugins, matching the
+	* contract of `getPluginSettingsSchema` for build-time plugins.
+	*/
+	getRuntimePluginSettingsSchema(pluginId) {
+		const meta = marketplaceManifestCache.get(pluginId);
+		if (!meta) return null;
+		return meta.admin?.settingsSchema ?? {};
+	}
 	async handlePluginApiRoute(pluginId, _method, path, request) {
 		if (!this.isPluginEnabled(pluginId)) return {
 			success: false,
@@ -2020,9 +2095,9 @@ var EmDashRuntime = class EmDashRuntime {
 		const trustedPlugin = this.configuredPlugins.find((p) => p.id === pluginId);
 		if (trustedPlugin && this.enabledPlugins.has(trustedPlugin.id)) {
 			const routeRegistry = new PluginRouteRegistry({
-				db: this.db,
-				storage: this.storage ?? void 0,
+				...this.pipelineFactoryOptions,
 				emailPipeline: this.email ?? void 0,
+				cronReschedule: () => this.cronScheduler?.reschedule(),
 				trustedProxyHeaders: getTrustedProxyHeaders(this.config)
 			});
 			routeRegistry.register(trustedPlugin);
@@ -2046,6 +2121,116 @@ var EmDashRuntime = class EmDashRuntime {
 			}
 		};
 	}
+	async getPluginMcpTools(pluginId) {
+		const tools = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const plugin of this.configuredPlugins) {
+			if (pluginId && plugin.id !== pluginId) continue;
+			for (const [name, tool] of Object.entries(plugin.mcp?.tools ?? {})) {
+				const route = plugin.routes[tool.route];
+				if (!route || route.public || !route.permission || !(route.permission in Permissions)) continue;
+				const key = `${plugin.id}__${name}`;
+				if (seen.has(key)) continue;
+				seen.add(key);
+				tools.push({
+					pluginId: plugin.id,
+					name,
+					description: tool.description,
+					route: tool.route,
+					permission: route.permission,
+					destructive: tool.destructive ?? false,
+					inputSchema: tool.input,
+					outputSchema: tool.output
+				});
+			}
+		}
+		const addManifestTools = (id, mcp) => {
+			if (pluginId && id !== pluginId) return;
+			for (const tool of mcp?.tools ?? []) {
+				const key = `${id}__${tool.name}`;
+				const routeMeta = this.getPluginRouteMeta(id, tool.route);
+				if (seen.has(key) || !routeMeta || routeMeta.public || routeMeta.permission !== tool.permission || !(tool.permission in Permissions)) continue;
+				seen.add(key);
+				tools.push({
+					pluginId: id,
+					name: tool.name,
+					description: tool.description,
+					route: tool.route,
+					permission: tool.permission,
+					destructive: tool.destructive,
+					inputSchema: z.fromJSONSchema({ ...tool.inputSchema }),
+					outputSchema: tool.outputSchema ? z.fromJSONSchema({ ...tool.outputSchema }) : void 0
+				});
+			}
+		};
+		for (const entry of this.sandboxedPluginEntries) addManifestTools(entry.id, entry.mcp);
+		for (const [id, manifest] of marketplaceManifestCache) addManifestTools(id, manifest.mcp);
+		return tools;
+	}
+	async getEnabledPluginMcpTools() {
+		const [tools, states] = await Promise.all([this.getPluginMcpTools(), new PluginStateRepository(this.db).getAll()]);
+		const stateByPlugin = new Map(states.map((state) => [state.pluginId, state]));
+		return tools.filter((tool) => {
+			const state = stateByPlugin.get(tool.pluginId);
+			if (!state?.mcpToolsEnabled || state.status !== "active" || !this.isPluginEnabled(tool.pluginId)) return false;
+			return state.mcpToolsConsent === this.serializePluginMcpConsent(tools, tool.pluginId);
+		});
+	}
+	serializePluginMcpConsent(tools, pluginId) {
+		return JSON.stringify(tools.filter((tool) => tool.pluginId === pluginId).map((tool) => ({
+			name: tool.name,
+			description: tool.description,
+			route: tool.route,
+			permission: tool.permission,
+			destructive: tool.destructive,
+			inputSchema: z.toJSONSchema(tool.inputSchema, { target: "draft-7" }),
+			...tool.outputSchema ? { outputSchema: z.toJSONSchema(tool.outputSchema, { target: "draft-7" }) } : {}
+		})).toSorted((a, b) => a.name.localeCompare(b.name)));
+	}
+	async handlePluginMcpTool(pluginId, toolName, route, input, actorId, request) {
+		const requestMeta = extractRequestMeta(request, getTrustedProxyHeaders(this.config));
+		const audit = new AuditRepository(this.db);
+		const headers = new Headers(request.headers);
+		headers.delete("content-length");
+		headers.delete("content-encoding");
+		const internalRequest = new Request(request.url, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(input)
+		});
+		const result = await this.handlePluginApiRoute(pluginId, "POST", route, internalRequest);
+		await audit.log({
+			actorId,
+			actorIp: requestMeta.ip ?? void 0,
+			action: "plugin_tool_invoke",
+			resourceType: "plugin_mcp_tool",
+			resourceId: `${pluginId}__${toolName}`,
+			details: {
+				pluginId,
+				tool: toolName,
+				route
+			},
+			status: result.success ? "success" : "failure"
+		});
+		return result;
+	}
+	async handlePluginMcpDenied(pluginId, toolName, route, actorId, request, reason) {
+		const requestMeta = extractRequestMeta(request, getTrustedProxyHeaders(this.config));
+		await new AuditRepository(this.db).log({
+			actorId,
+			actorIp: requestMeta.ip ?? void 0,
+			action: "plugin_tool_invoke",
+			resourceType: "plugin_mcp_tool",
+			resourceId: `${pluginId}__${toolName}`,
+			details: {
+				pluginId,
+				tool: toolName,
+				route,
+				reason
+			},
+			status: "denied"
+		});
+	}
 	findSandboxedPlugin(pluginId) {
 		for (const [key, plugin] of this.sandboxedPlugins) if (key.startsWith(pluginId + ":")) return plugin;
 	}
@@ -2595,6 +2780,16 @@ function createPublicPluginApiRouteHandler(runtime) {
 */
 const RUNTIME_INIT_DEADLINE_MS = DB_INIT_DEADLINE_MS + 15e3;
 /**
+* Throttle for the anonymous-path runtime-init failure log. While a site is
+* stuck (e.g. a failing migration in its backoff window, #1744) every
+* anonymous request lands in that catch; one line per interval per isolate
+* keeps the failure visible without flooding logs on a busy site. Plain
+* module state (not globalThis): a duplicated SSR chunk just means an extra
+* log line, which is harmless.
+*/
+const RUNTIME_INIT_ERROR_LOG_INTERVAL_MS = 3e4;
+let lastRuntimeInitErrorLogAt = 0;
+/**
 * Whether we've verified the database has been set up.
 * On a fresh deployment the first request may hit a public page, bypassing
 * runtime init. Without this check, template helpers like getSiteSettings()
@@ -2718,6 +2913,63 @@ async function getRuntime(config, initTimings) {
 async function runScheduledTasks(options = {}) {
 	const config = getConfig();
 	if (!config) return { published: [] };
+	return runOutsideRequest(config, (runtime) => runtime.runScheduledTasks(options));
+}
+/**
+* Run a callback against the EmDash runtime outside any HTTP request — from a
+* Cloudflare Queue consumer, a `scheduled()` handler, or any other
+* platform-event handler that has no request and therefore no `locals.emdash`.
+*
+* Resolves the same cached runtime singleton request handlers use, so hooks,
+* plugin state, and storage all behave exactly as they do during a request.
+* A typical queue consumer finishes a job by calling back into a plugin route:
+*
+* ```ts
+* import { withEmDashRuntime } from "emdash/middleware";
+*
+* async function queue(batch: MessageBatch) {
+* 	await withEmDashRuntime(async (runtime) => {
+* 		for (const message of batch.messages) {
+* 			await runtime.handlePluginApiRoute(
+* 				"my-plugin",
+* 				"POST",
+* 				"/finishJob",
+* 				new Request("https://internal/", {
+* 					method: "POST",
+* 					body: JSON.stringify(message.body),
+* 				}),
+* 			);
+* 		}
+* 	});
+* }
+* ```
+*
+* Server-only and fully trusted: the callback gets the raw runtime with no
+* auth or CSRF checks, same trust level as plugin cron. Never expose it to
+* user input without validating that input yourself.
+*
+* Throws when EmDash is not configured (no `emdash()` Astro integration).
+*/
+async function withEmDashRuntime(run) {
+	const config = getConfig();
+	if (!config) throw new Error("EmDash is not configured — withEmDashRuntime() requires the emdash() Astro integration.");
+	return runOutsideRequest(config, async (runtime) => run(runtime));
+}
+/**
+* Shared plumbing for request-free entry points (`runScheduledTasks`,
+* `withEmDashRuntime`): resolve the runtime singleton, then run the callback
+* under an event-scoped db connection when the adapter needs one.
+*
+* Connection-backed adapters (e.g. Postgres over Hyperdrive) cannot reuse
+* the per-isolate singleton from a platform event: its socket belongs to the
+* request that opened it, and workerd rejects cross-event I/O. Open an
+* event-scoped connection and run the callback under it in ALS — the
+* runtime's db getter, the cron executor, and plugin contexts all resolve
+* the connection from ALS — then close it. Gated on the adapter being
+* connection-backed (it exposes `close()`); stateless adapters (D1, Node
+* SQLite) return null or a close-less scope and keep using the singleton.
+*/
+async function runOutsideRequest(config, fn) {
 	const runtime = await getRuntime(config);
 	const scoped = createRequestScopedDb$1({
 		config: config.database?.config,
@@ -2726,7 +2978,7 @@ async function runScheduledTasks(options = {}) {
 		cookies: NOOP_COOKIE_JAR,
 		url: CRON_EVENT_URL
 	});
-	if (!scoped?.close) return runtime.runScheduledTasks(options);
+	if (!scoped?.close) return fn(runtime);
 	const parent = getRequestContext();
 	const ctx = parent ? {
 		...parent,
@@ -2737,17 +2989,17 @@ async function runScheduledTasks(options = {}) {
 		metrics: createRequestMetrics(performance.now())
 	};
 	try {
-		return await runWithContext(ctx, () => runtime.runScheduledTasks(options));
+		return await runWithContext(ctx, () => fn(runtime));
 	} finally {
 		try {
 			scoped.commit();
 		} catch (error) {
-			console.error("[scheduled] request-scoped db commit failed:", error);
+			console.error("[emdash] event-scoped db commit failed:", error);
 		}
 		try {
 			scoped.close();
 		} catch (error) {
-			console.error("[scheduled] request-scoped db close failed:", error);
+			console.error("[emdash] event-scoped db close failed:", error);
 		}
 	}
 }
@@ -2871,7 +3123,7 @@ const onRequest = defineMiddleware(async (context, next) => {
 				if (!isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
-						const { getDb } = await import("../loader-CB6YHeul.mjs").then((n) => n.o);
+						const { getDb } = await import("../loader-Be3ouI5L.mjs").then((n) => n.o);
 						await (await getDb()).selectFrom("_emdash_migrations").selectAll().limit(1).execute();
 						markSetupVerified();
 					} catch (error) {
@@ -2898,7 +3150,12 @@ const onRequest = defineMiddleware(async (context, next) => {
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
 							storage: runtime.storage
 						};
-					} catch {}
+					} catch (error) {
+						if (Date.now() - lastRuntimeInitErrorLogAt >= RUNTIME_INIT_ERROR_LOG_INTERVAL_MS) {
+							lastRuntimeInitErrorLogAt = Date.now();
+							console.error("[emdash] runtime init failed (page renders without CMS data):", error);
+						}
+					}
 					timings.push({
 						name: "rt",
 						dur: performance.now() - t0,
@@ -2999,6 +3256,11 @@ const onRequest = defineMiddleware(async (context, next) => {
 					handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
 					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
+					getPluginMcpTools: runtime.getPluginMcpTools.bind(runtime),
+					getEnabledPluginMcpTools: runtime.getEnabledPluginMcpTools.bind(runtime),
+					serializePluginMcpConsent: runtime.serializePluginMcpConsent.bind(runtime),
+					handlePluginMcpTool: runtime.handlePluginMcpTool.bind(runtime),
+					handlePluginMcpDenied: runtime.handlePluginMcpDenied.bind(runtime),
 					getMediaProvider: runtime.getMediaProvider.bind(runtime),
 					getMediaProviderList: runtime.getMediaProviderList.bind(runtime),
 					collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
@@ -3090,5 +3352,5 @@ const onRequest = defineMiddleware(async (context, next) => {
 });
 
 //#endregion
-export { onRequest as default, onRequest, runScheduledTasks };
+export { onRequest as default, onRequest, runScheduledTasks, withEmDashRuntime };
 //# sourceMappingURL=middleware.mjs.map