emdash 0.33.0 → 0.35.0

package/dist/cli/index.mjs

@@ -1,59 +1,62 @@
 #!/usr/bin/env node
-import { a as runMigrations, o as __exportAll, r as getMigrationStatus } from "../runner-BFTrkYhu.mjs";
+import { a as getMigrationStatus, c as __exportAll, s as runMigrations } from "../runner-C1T11CfC.mjs";
 import { t as EmDashDatabaseError } from "../errors-9P_FDrJ_.mjs";
 import { t as validateIdentifier } from "../validate-BpwoDOgt.mjs";
 import { u as listTablesLike } from "../dialect-helpers-BSbfaO3F.mjs";
-import { n as getI18nConfig, r as isI18nEnabled } from "../config-DyF3OKg_.mjs";
+import { i as isI18nEnabled, r as getI18nConfig } from "../config-C3EBstHi.mjs";
 import "../after-CBU2vkoO.mjs";
 import "../object-cache-71tPfV4A.mjs";
-import { t as ContentRepository } from "../content-CJ94NEx5.mjs";
-import { n as isMissingTableError } from "../db-errors-CcWLaRiR.mjs";
-import { n as slugify } from "../slugify-C_tqlU4G.mjs";
-import { a as encodeBase64url } from "../base64-B-PsqheR.mjs";
-import "../types-Cd8iuS1J.mjs";
-import { t as MediaRepository } from "../media-BP7S-nHT.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-pOrB2kZe.mjs";
+import { t as ContentRepository } from "../content-ZHCc1ngN.mjs";
+import { n as isMissingTableError } from "../db-errors-Cl-sKYTm.mjs";
+import { n as slugify } from "../slugify-B994zkXC.mjs";
+import { a as encodeBase64url } from "../base64-CvLhUKQv.mjs";
+import "../types-CQPWhPxE.mjs";
+import { t as MediaRepository } from "../media-CzhAn2--.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-BqCZ1TdU.mjs";
 import { t as OptionsRepository } from "../options-CBXIHUoT.mjs";
-import "../redirect-DIJxXKOG.mjs";
+import "../redirect-COsS6SWJ.mjs";
 import "../request-cache-BSUptuJR.mjs";
-import "../byline-registry-ZkPKqEwC.mjs";
-import "../field-defs-cache-WD82dMQq.mjs";
-import { t as BylineRepository } from "../byline-Cp6csL84.mjs";
-import "../fts-manager-BITakW_R.mjs";
+import "../byline-registry-DDun8sxh.mjs";
+import "../field-defs-cache-BzwBlJrR.mjs";
+import { t as BylineRepository } from "../byline-yjvWq4ip.mjs";
+import "../dist-D_6CKR8z.mjs";
+import "../fts-manager-DyZEohZC.mjs";
 import { kyselyLogOption } from "../database/instrumentation.mjs";
-import "../loader-CGugY7Zl.mjs";
-import "../hash-Cg0TXJPV.mjs";
-import "../content-refresh-Xw7aKmou.mjs";
-import { n as SchemaRegistry } from "../registry-Dbodb4Uo.mjs";
-import "../settings-kJhGiQ4z.mjs";
-import { i as pluginManifestSchema } from "../manifest-schema-Da7kj23y.mjs";
-import { i as isDeprecatedCapability, n as capabilitiesToDeclaredAccess, t as CAPABILITY_RENAMES } from "../types-DKuWPYV5.mjs";
-import "../ssrf-CTa6v21i.mjs";
-import "../ssrf-Cj568Dgs.mjs";
-import { t as validateSeed } from "../validate-mKo3RxBM.mjs";
-import { t as applySeed } from "../apply-kwNEJW2l.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-DLd8RXee.mjs";
+import "../loader-CdG_Ci3H.mjs";
+import "../content-refresh-B_8SJzuU.mjs";
+import "../collection-deletion-DQPvMD8R.mjs";
+import { n as SchemaRegistry } from "../registry-Cqa2I749.mjs";
+import "../settings-xRdoUZr0.mjs";
+import { i as pluginManifestSchema } from "../manifest-schema-BXbUAHod.mjs";
+import { i as isDeprecatedCapability, t as CAPABILITY_RENAMES } from "../types-CP1CflWf.mjs";
+import "../ssrf-Cpvg_n3A.mjs";
+import "../ssrf-DpXgKsna.mjs";
+import { t as validateSeed } from "../validate-BMLBvxOC.mjs";
+import { t as applySeed } from "../apply-kUDt80-G.mjs";
+import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-B252yQUf.mjs";
+import "../identity-Ys6Dlc9C.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-BEgsAQEU.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { t as convertDataForRead } from "../portable-text-B_kqBmXB.mjs";
+import { t as convertDataForRead } from "../portable-text-imBW5cHK.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
 import { EmDashClient } from "../client/index.mjs";
+import { r as fileExists$4, t as bundleCommand } from "../bundle-vn56sLos.mjs";
+import { createRequire } from "node:module";
 import { Kysely, SqliteDialect, sql } from "kysely";
-import { imageSize } from "image-size";
-import { z } from "zod";
 import { createGzipDecoder, unpackTar } from "modern-tar";
-import { createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, extname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { access, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import BetterSqlite3 from "better-sqlite3";
-import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
 import { defineCommand, runCommand, runMain } from "citty";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
-import { createHash } from "node:crypto";
-import { pipeline } from "node:stream/promises";
-import { packTar } from "modern-tar/fs";
+import { parse as parse$1, printParseErrorCode } from "jsonc-parser";
+import { parse as parse$2 } from "smol-toml";
+import { createInterface } from "node:readline/promises";
 
 //#region src/cli/commands/auth.ts
 /**
@@ -132,7 +135,7 @@ function resolveCredentialKey(baseUrl) {
 	try {
 		const url = new URL(baseUrl);
 		if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
-			const projectPath = findProjectRoot(process.cwd());
+			const projectPath = findProjectRoot$1(process.cwd());
 			if (projectPath) return `path:${projectPath}`;
 			return url.origin;
 		}
@@ -144,7 +147,7 @@ function resolveCredentialKey(baseUrl) {
 /**
 * Walk up from cwd to find the project root (directory containing astro.config.*).
 */
-function findProjectRoot(from) {
+function findProjectRoot$1(from) {
 	let dir = resolve(from);
 	const root = resolve("/");
 	while (dir !== root) {
@@ -919,7 +922,7 @@ async function readPackageJson$2(cwd) {
 		return null;
 	}
 }
-async function fileExists$4(path) {
+async function fileExists$3(path) {
 	try {
 		await access(path);
 		return true;
@@ -971,7 +974,7 @@ const devCommand = defineCommand({
 			process.exit(1);
 		}
 		const dbPath = resolve(cwd, args.database);
-		if (!await fileExists$4(dbPath)) consola.start("Database not found, initializing...");
+		if (!await fileExists$3(dbPath)) consola.start("Database not found, initializing...");
 		const db = createDatabase({ url: `file:${dbPath}` });
 		try {
 			consola.start("Checking database migrations...");
@@ -1010,8 +1013,8 @@ const devCommand = defineCommand({
 			"--port",
 			args.port
 		];
-		const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));
-		const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));
+		const pnpmLockExists = await fileExists$3(resolve(cwd, "pnpm-lock.yaml"));
+		const yarnLockExists = await fileExists$3(resolve(cwd, "yarn.lock"));
 		let cmd;
 		let cmdArgs;
 		if (pnpmLockExists) {
@@ -1053,9 +1056,28 @@ const devCommand = defineCommand({
 /**
 * emdash doctor
 *
-* Diagnose database health: connection, migrations, schema integrity.
+* Diagnose database health (connection, migrations, schema integrity) and
+* Cloudflare Worker scheduler wiring (Cron Trigger + scheduled() handler).
 */
-async function fileExists$3(path) {
+const WRANGLER_CONFIG_FILES = [
+	"wrangler.jsonc",
+	"wrangler.json",
+	"wrangler.toml"
+];
+const CLOUDFLARE_WORKER_MODULE = "@emdash-cms/cloudflare/worker";
+const WORKER_FIX = `export { default, PluginBridge } from "${CLOUDFLARE_WORKER_MODULE}";`;
+const MAIN_FIX_JSONC = `"main": "./src/worker.ts"`;
+const MAIN_FIX_TOML = `main = "./src/worker.ts"`;
+const TRIGGER_FIX_JSONC = `"triggers": { "crons": ["* * * * *"] }`;
+const TRIGGER_FIX_TOML = `[triggers]\ncrons = ["* * * * *"]`;
+const SCHEDULED_HANDLER_PATTERN = /\bscheduled\s*:\s*createScheduledHandler\s*\(/m;
+function triggerFix(configPath) {
+	return configPath.endsWith(".toml") ? TRIGGER_FIX_TOML : TRIGGER_FIX_JSONC;
+}
+function mainFix(configPath) {
+	return configPath.endsWith(".toml") ? MAIN_FIX_TOML : MAIN_FIX_JSONC;
+}
+async function fileExists$2(path) {
 	try {
 		await access(path);
 		return true;
@@ -1063,12 +1085,115 @@ async function fileExists$3(path) {
 		return false;
 	}
 }
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sourcePosition(source, offset) {
+	const prefix = source.slice(0, offset);
+	return {
+		line: prefix.split("\n").length,
+		column: offset - prefix.lastIndexOf("\n")
+	};
+}
+async function findWranglerConfig(cwd) {
+	for (const filename of WRANGLER_CONFIG_FILES) {
+		const path = resolve(cwd, filename);
+		if (await fileExists$2(path)) return path;
+	}
+	return null;
+}
+function workerExportsScheduledMaintenance(source) {
+	const modulePattern = CLOUDFLARE_WORKER_MODULE.replaceAll("/", "\\/");
+	const reExportsWorker = new RegExp(`export\\s*\\{[^}]*\\bdefault\\b[^}]*\\}\\s*from\\s*["']${modulePattern}["']`, "m");
+	const importsFactory = new RegExp(`import\\s+[^;]*\\{[^}]*\\bcreateScheduledHandler\\b[^}]*\\}\\s*from\\s*["']${modulePattern}["']`, "m");
+	return reExportsWorker.test(source) || importsFactory.test(source) && SCHEDULED_HANDLER_PATTERN.test(source);
+}
+async function checkSchedulerWiringAtPath(cwd, configPath) {
+	const configSource = await readFile(configPath, "utf8");
+	let parsed;
+	if (configPath.endsWith(".toml")) try {
+		parsed = parse$2(configSource);
+	} catch (error) {
+		return [{
+			name: "scheduler config",
+			status: "fail",
+			message: `could not parse ${configPath}: ${error instanceof Error ? error.message : "invalid TOML"} — fix the Wrangler configuration syntax`
+		}];
+	}
+	else {
+		const parseErrors = [];
+		parsed = parse$1(configSource, parseErrors, {
+			allowTrailingComma: true,
+			disallowComments: false
+		});
+		if (parseErrors.length > 0) {
+			const error = parseErrors[0];
+			const { line, column } = sourcePosition(configSource, error.offset);
+			return [{
+				name: "scheduler config",
+				status: "fail",
+				message: `could not parse ${configPath}: ${printParseErrorCode(error.error)} at line ${line}, column ${column} — fix the Wrangler configuration syntax`
+			}];
+		}
+	}
+	if (!isRecord$2(parsed)) return [{
+		name: "scheduler config",
+		status: "fail",
+		message: `could not parse ${configPath}: expected an object — fix the Wrangler configuration syntax`
+	}];
+	const triggers = isRecord$2(parsed.triggers) ? parsed.triggers : null;
+	const hasCronTrigger = Array.isArray(triggers?.crons) && triggers.crons.some((cron) => typeof cron === "string" && cron.trim().length > 0);
+	const main = typeof parsed.main === "string" && parsed.main.trim() ? parsed.main : null;
+	if (!main) return [{
+		name: "scheduler handler",
+		status: "fail",
+		message: `Wrangler configuration has no Worker entry to inspect — add ${mainFix(configPath)}, then export: ${WORKER_FIX}`
+	}];
+	const workerPath = resolve(cwd, main);
+	let hasScheduledHandler = false;
+	try {
+		hasScheduledHandler = workerExportsScheduledMaintenance(await readFile(workerPath, "utf8"));
+	} catch (error) {
+		if ((isRecord$2(error) && typeof error.code === "string" ? error.code : null) !== "ENOENT") return [{
+			name: "scheduler handler",
+			status: "fail",
+			message: `could not read Worker entry ${workerPath}: ${error instanceof Error ? error.message : "unknown I/O error"} — check the file path and permissions`
+		}];
+		return [{
+			name: "scheduler handler",
+			status: "fail",
+			message: `Worker entry not found at ${workerPath} — create it with: ${WORKER_FIX}`
+		}];
+	}
+	if (hasCronTrigger && !hasScheduledHandler) return [{
+		name: "scheduler handler",
+		status: "fail",
+		message: `Cron Trigger is configured, but ${main} does not export EmDash scheduled() maintenance — replace its Worker export with: ${WORKER_FIX}`
+	}];
+	if (hasScheduledHandler && !hasCronTrigger) return [{
+		name: "scheduler trigger",
+		status: "fail",
+		message: `EmDash scheduled() handler is exported, but no Cron Trigger is configured — add this to ${configPath}: ${triggerFix(configPath)}`
+	}];
+	if (!hasCronTrigger && !hasScheduledHandler) return [];
+	return [{
+		name: "scheduler wiring",
+		status: "pass",
+		message: `Cron Trigger and scheduled() handler found (${main})`
+	}];
+}
+async function checkDoctor(cwd, dbPath) {
+	const results = await checkDatabase(dbPath);
+	const configPath = await findWranglerConfig(cwd);
+	if (configPath) results.push(...await checkSchedulerWiringAtPath(cwd, configPath));
+	return results;
+}
 function printResult(result) {
 	(result.status === "pass" ? consola.success : result.status === "warn" ? consola.warn : consola.error)(`${result.name}: ${result.message}`);
 }
 async function checkDatabase(dbPath) {
 	const results = [];
-	if (!await fileExists$3(dbPath)) {
+	if (!await fileExists$2(dbPath)) {
 		results.push({
 			name: "database",
 			status: "fail",
@@ -1149,7 +1274,7 @@ async function checkDatabase(dbPath) {
 const doctorCommand = defineCommand({
 	meta: {
 		name: "doctor",
-		description: "Check database health and diagnose issues"
+		description: "Check database health, scheduler wiring, and diagnose issues"
 	},
 	args: {
 		database: {
@@ -1170,14 +1295,16 @@ const doctorCommand = defineCommand({
 		}
 	},
 	async run({ args }) {
-		const results = await checkDatabase(resolve(resolve(args.cwd), args.database));
+		const cwd = resolve(args.cwd);
+		const results = await checkDoctor(cwd, resolve(cwd, args.database));
+		const fails = results.filter((result) => result.status === "fail");
 		if (args.json) {
 			process.stdout.write(JSON.stringify(results, null, 2) + "\n");
+			if (fails.length > 0) process.exitCode = 1;
 			return;
 		}
 		consola.start("EmDash Doctor\n");
 		for (const result of results) printResult(result);
-		const fails = results.filter((r) => r.status === "fail");
 		const warns = results.filter((r) => r.status === "warn");
 		consola.log("");
 		if (fails.length === 0 && warns.length === 0) consola.success("All checks passed");
@@ -1392,8 +1519,10 @@ async function exportCollections(db) {
 			labelSingular: collection.labelSingular || void 0,
 			description: collection.description || void 0,
 			icon: collection.icon || void 0,
+			admin: collection.admin,
 			supports: collection.supports.length > 0 ? collection.supports : void 0,
 			urlPattern: collection.urlPattern || void 0,
+			routable: collection.routable === false ? false : void 0,
 			hidden: collection.hidden || void 0,
 			sortOrder: collection.sortOrder,
 			fields: fields.map((field) => ({
@@ -1403,6 +1532,7 @@ async function exportCollections(db) {
 				required: field.required || void 0,
 				unique: field.unique || void 0,
 				searchable: field.searchable || void 0,
+				indexed: field.indexed || void 0,
 				defaultValue: field.defaultValue,
 				validation: field.validation ? { ...field.validation } : void 0,
 				widget: field.widget || void 0,
@@ -1633,7 +1763,7 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 				const processedData = processDataForExport(item.data, collection.fields, mediaMap);
 				const entry = {
 					id: seedId,
-					slug: item.slug || item.id,
+					slug: item.slug?.trim() ? item.slug : collection.routable === false ? void 0 : item.id,
 					status: item.status === "published" || item.status === "draft" ? item.status : void 0,
 					data: processedData
 				};
@@ -1735,7 +1865,7 @@ async function getTaxonomyAssignments(taxonomyRepo, collection, entryId) {
 *
 * Initialize database from template config in package.json
 */
-async function fileExists$2(path) {
+async function fileExists$1(path) {
 	try {
 		await access(path);
 		return true;
@@ -1826,7 +1956,7 @@ const initCommand = defineCommand({
 		if (alreadyInitialized && args.force) consola.warn("Re-initializing (--force)...");
 		if (config?.schema) {
 			const schemaPath = resolve(cwd, config.schema);
-			if (await fileExists$2(schemaPath)) {
+			if (await fileExists$1(schemaPath)) {
 				consola.start(`Running schema: ${config.schema}`);
 				try {
 					await runSqlFile(db, schemaPath);
@@ -2475,77 +2605,20 @@ const menuCommand = defineCommand({
 });
 
 //#endregion
-//#region src/cli/commands/bundle-utils.ts
-/**
-* Bundle utility functions
-*
-* Shared logic extracted from the bundle command so it can be tested
-* without the CLI harness and tsdown dependency.
-*/
-const MAX_BUNDLE_SIZE = 256 * 1024;
-const MAX_FILE_SIZE = 128 * 1024;
-const MAX_FILE_COUNT = 20;
-const MAX_SCREENSHOTS = 5;
-const MAX_SCREENSHOT_WIDTH = 1920;
-const MAX_SCREENSHOT_HEIGHT = 1080;
-const ICON_SIZE = 256;
-const MCP_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
-/**
-* Matches Node.js built-in imports in bundled output:
-* - require("node:xxx") / require("xxx")
-* - import("node:xxx") / import("xxx")
-* - import X from "node:xxx" / import { X } from "node:xxx"
-* - import * as X from "node:xxx"
-* - export { X } from "node:xxx"
-* Captures the base module name (e.g. "fs" from "node:fs/promises").
-*/
-const NODE_BUILTIN_IMPORT_RE = /(?:import|export|require)\s*(?:\(|[^(]*?\bfrom\s+)["'](?:node:)?([a-z_]+)(?:\/[^"']*)?\s*["']\)?/g;
-const LEADING_DOT_SLASH_RE = /^\.\//;
-const DIST_PREFIX_RE = /^dist\//;
-const MJS_EXT_RE = /\.m?js$/;
-const TS_TO_TSX_RE = /\.ts$/;
-/** Node.js built-in modules that shouldn't appear in sandbox code */
-const NODE_BUILTINS = new Set([
-	"assert",
-	"buffer",
-	"child_process",
-	"cluster",
-	"crypto",
-	"dgram",
-	"dns",
-	"domain",
-	"events",
-	"fs",
-	"http",
-	"http2",
-	"https",
-	"inspector",
-	"module",
-	"net",
-	"os",
-	"path",
-	"perf_hooks",
-	"process",
-	"punycode",
-	"querystring",
-	"readline",
-	"repl",
-	"stream",
-	"string_decoder",
-	"sys",
-	"timers",
-	"tls",
-	"trace_events",
-	"tty",
-	"url",
-	"util",
-	"v8",
-	"vm",
-	"wasi",
-	"worker_threads",
-	"zlib"
-]);
-async function fileExists$1(path) {
+//#region src/migrations/config-loader.ts
+const ASTRO_CONFIG_FILENAMES = [
+	"astro.config.mjs",
+	"astro.config.js",
+	"astro.config.ts",
+	"astro.config.mts"
+];
+var MigrationConfigLoaderError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "MigrationConfigLoaderError";
+	}
+};
+async function isAccessible(path) {
 	try {
 		await access(path);
 		return true;
@@ -2553,571 +2626,497 @@ async function fileExists$1(path) {
 		return false;
 	}
 }
-/** Convert an absolute build artifact path into a portable ESM import specifier. */
-function toFileImportSpecifier(path) {
-	return pathToFileURL(path).href;
+async function findAstroConfigFile(projectRoot, configFile) {
+	const root = resolve(projectRoot);
+	if (configFile) {
+		const explicitPath = isAbsolute(configFile) ? configFile : resolve(root, configFile);
+		if (await isAccessible(explicitPath)) return explicitPath;
+		throw new MigrationConfigLoaderError(`Astro config file not found: ${explicitPath}`);
+	}
+	for (const filename of ASTRO_CONFIG_FILENAMES) {
+		const candidate = resolve(root, filename);
+		if (await isAccessible(candidate)) return candidate;
+	}
+	throw new MigrationConfigLoaderError(`No Astro config file found in ${root}`);
 }
-/**
-* Read image dimensions from a buffer.
-* Returns [width, height] or null if the format is unrecognized.
-*/
-function readImageDimensions(buf) {
+function projectRequire(projectRoot) {
+	return createRequire(resolve(projectRoot, "package.json"));
+}
+async function importModule(path) {
+	return import(pathToFileURL(path).href);
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function moduleExport$1(module, name) {
+	if (!isRecord$1(module)) return void 0;
+	const direct = module[name];
+	if (direct !== void 0) return direct;
+	const defaultExport = module.default;
+	return isRecord$1(defaultExport) ? defaultExport[name] : void 0;
+}
+function isCoreMigrationIdentity(value) {
+	return isRecord$1(value) && typeof value.emdashVersion === "string" && Array.isArray(value.names) && value.names.every((name) => typeof name === "string") && typeof value.fingerprint === "string";
+}
+async function loadProjectConfig(projectRoot, configFile) {
+	let viteEntrypoint;
 	try {
-		const result = imageSize(buf);
-		if (result.width != null && result.height != null) return [result.width, result.height];
-		return null;
-	} catch {
-		return null;
+		viteEntrypoint = createRequire(projectRequire(projectRoot).resolve("astro")).resolve("vite");
+	} catch (error) {
+		throw new MigrationConfigLoaderError("Could not resolve Vite through the project's Astro installation", { cause: error });
 	}
+	const loadConfigFromFile = moduleExport$1(await importModule(viteEntrypoint), "loadConfigFromFile");
+	if (typeof loadConfigFromFile !== "function") throw new MigrationConfigLoaderError("The Vite installation used by project-local Astro does not export loadConfigFromFile");
+	const loaded = await Reflect.apply(loadConfigFromFile, void 0, [
+		{
+			command: "build",
+			mode: "production"
+		},
+		configFile,
+		projectRoot,
+		"silent"
+	]);
+	if (!isRecord$1(loaded) || !Object.hasOwn(loaded, "config")) throw new MigrationConfigLoaderError(`Vite could not load Astro config: ${configFile}`);
+	return loaded.config;
 }
-/**
-* Extract manifest metadata from a ResolvedPlugin.
-* Strips functions (hooks, route handlers) and keeps only serializable metadata.
-*/
-function extractManifest(plugin) {
-	const hooks = [];
-	for (const [name, resolved] of Object.entries(plugin.hooks)) {
-		if (!resolved) continue;
-		if (resolved.exclusive || resolved.priority !== 100 || resolved.timeout !== 5e3) {
-			const entry = { name };
-			if (resolved.exclusive) entry.exclusive = true;
-			if (resolved.priority !== 100) entry.priority = resolved.priority;
-			if (resolved.timeout !== 5e3) entry.timeout = resolved.timeout;
-			hooks.push(entry);
-		} else hooks.push(name);
+async function loadProjectIdentity(projectRoot) {
+	let identityEntrypoint;
+	try {
+		identityEntrypoint = projectRequire(projectRoot).resolve("emdash/migrations");
+	} catch (error) {
+		throw new MigrationConfigLoaderError("Could not resolve emdash/migrations from the project", { cause: error });
 	}
-	const routes = Object.entries(plugin.routes).map(([name, route]) => {
-		if (route.public === void 0 && route.permission === void 0 && route.cacheControl === void 0) return name;
-		const entry = { name };
-		if (route.public !== void 0) entry.public = route.public;
-		if (route.permission !== void 0) entry.permission = route.permission;
-		if (route.cacheControl !== void 0) entry.cacheControl = route.cacheControl;
-		return entry;
-	});
-	const tools = Object.entries(plugin.mcp?.tools ?? {}).map(([name, tool]) => {
-		if (!MCP_TOOL_NAME_PATTERN.test(name)) throw new Error(`Invalid MCP tool name "${name}"`);
-		const route = plugin.routes[tool.route];
-		if (!route?.permission || route.public) throw new Error(`MCP tool "${name}" must reference a private route with a permission`);
-		return {
-			name,
-			description: tool.description,
-			route: tool.route,
-			permission: route.permission,
-			destructive: tool.destructive ?? false,
-			inputSchema: z.toJSONSchema(tool.input, { target: "draft-7" }),
-			...tool.output ? { outputSchema: z.toJSONSchema(tool.output, { target: "draft-7" }) } : {}
-		};
+	const getIdentity = moduleExport$1(await importModule(identityEntrypoint), "getCoreMigrationIdentity");
+	if (typeof getIdentity !== "function") throw new MigrationConfigLoaderError("The project-local emdash/migrations module does not export getCoreMigrationIdentity");
+	const identity = await Reflect.apply(getIdentity, void 0, []);
+	if (!isCoreMigrationIdentity(identity)) throw new MigrationConfigLoaderError("The project-local emdash/migrations module returned an invalid migration identity");
+	return identity;
+}
+const defaultDependencies$1 = {
+	findConfigFile: findAstroConfigFile,
+	loadConfig: loadProjectConfig,
+	loadIdentity: loadProjectIdentity
+};
+function asAstroConfig(value) {
+	if (typeof value !== "object" || value === null) throw new MigrationConfigLoaderError("Astro config must export an object");
+	return value;
+}
+async function buildMigrationManifestFromConfig(options, dependencies = defaultDependencies$1) {
+	const projectRoot = resolve(options.projectRoot);
+	const configFile = await dependencies.findConfigFile(projectRoot, options.configFile);
+	const config = asAstroConfig(await dependencies.loadConfig(projectRoot, configFile));
+	const matchingIntegrations = (Array.isArray(config.integrations) ? config.integrations : []).filter((integration) => getMigrationIntegrationMetadata(integration) !== void 0);
+	if (matchingIntegrations.length !== 1) throw new MigrationConfigLoaderError(`Expected exactly one EmDash integration with migration metadata (${String(MIGRATION_CONFIG_SYMBOL)}), found ${matchingIntegrations.length}`);
+	const metadata = getMigrationIntegrationMetadata(matchingIntegrations[0]);
+	if (!metadata?.database) throw new MigrationConfigLoaderError("The EmDash integration does not provide database migration metadata");
+	return buildMigrationManifest({
+		identity: await dependencies.loadIdentity(projectRoot),
+		i18n: normalizeAstroI18n(config.i18n),
+		database: metadata.database
 	});
+}
+
+//#endregion
+//#region src/cli/commands/migrate.ts
+const FINGERPRINT_PATTERN = /^[0-9a-f]{64}$/;
+const SAFE_TARGET_KIND_PATTERN = /^[a-z][a-z0-9_-]*$/;
+const SAFE_MIGRATION_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const CREDENTIAL_URL_PATTERN = /:\/\/[^/\s]+@/;
+const CREDENTIAL_QUERY_PATTERN = /[?&](?:auth|credential|key|password|secret|signature|token)=/i;
+const MIGRATE_EXIT_CODES = Object.freeze({
+	success: 0,
+	error: 1,
+	pending: 2,
+	unknownApplied: 3,
+	confirmation: 4,
+	interrupted: 130
+});
+var MigrateCommandError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "MigrateCommandError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function moduleExport(module, name) {
+	if (!isRecord(module)) return void 0;
+	const direct = Reflect.get(module, name);
+	if (direct !== void 0) return direct;
+	const defaultExport = Reflect.get(module, "default");
+	return isRecord(defaultExport) ? Reflect.get(defaultExport, name) : void 0;
+}
+async function importProjectModule(projectRoot, specifier) {
+	let resolvedEntrypoint;
+	try {
+		resolvedEntrypoint = createRequire(resolve(projectRoot, "package.json")).resolve(specifier);
+	} catch {
+		throw new MigrateCommandError(`Could not resolve ${specifier} from the project.`);
+	}
+	return import(pathToFileURL(resolvedEntrypoint).href);
+}
+function validateIdentity(value) {
+	if (!isRecord(value) || typeof value.emdashVersion !== "string" || !Array.isArray(value.names) || !value.names.every((name) => typeof name === "string") || typeof value.fingerprint !== "string" || !FINGERPRINT_PATTERN.test(value.fingerprint)) throw new MigrateCommandError("The project-local emdash/migrations module returned an invalid migration identity.");
 	return {
-		id: plugin.id,
-		version: plugin.version,
-		declaredAccess: capabilitiesToDeclaredAccess(plugin.capabilities, plugin.allowedHosts),
-		capabilities: plugin.capabilities,
-		allowedHosts: plugin.allowedHosts,
-		storage: plugin.storage,
-		hooks,
-		routes,
-		...tools.length > 0 ? { mcp: { tools } } : {},
-		admin: {
-			settingsSchema: plugin.admin.settingsSchema,
-			pages: plugin.admin.pages,
-			widgets: plugin.admin.widgets
-		}
+		emdashVersion: value.emdashVersion,
+		names: [...value.names],
+		fingerprint: value.fingerprint
 	};
 }
-/**
-* Scan bundled code for Node.js built-in imports.
-* Matches require("node:xxx"), require("xxx"), import("node:xxx") — the patterns
-* that appear in bundled ESM/CJS output (not source-level named imports).
-* Returns deduplicated array of built-in module names found.
-*/
-function findNodeBuiltinImports(code) {
-	const found = [];
-	NODE_BUILTIN_IMPORT_RE.lastIndex = 0;
-	let match;
-	while ((match = NODE_BUILTIN_IMPORT_RE.exec(code)) !== null) {
-		const mod = match[1];
-		if (NODE_BUILTINS.has(mod)) found.push(mod);
-	}
-	return [...new Set(found)];
+async function loadProjectMigrationIdentity(projectRoot) {
+	const getIdentity = moduleExport(await importProjectModule(projectRoot, "emdash/migrations"), "getCoreMigrationIdentity");
+	if (typeof getIdentity !== "function") throw new MigrateCommandError("The project-local emdash/migrations module does not export getCoreMigrationIdentity.");
+	return validateIdentity(await Reflect.apply(getIdentity, void 0, []));
 }
-/**
-* Find a build output file by base name, checking common extensions.
-* tsdown may output .mjs, .js, or .cjs depending on format and config.
-*/
-async function findBuildOutput(dir, baseName) {
-	for (const ext of [
-		".mjs",
-		".js",
-		".cjs"
-	]) {
-		const candidate = join(dir, `${baseName}${ext}`);
-		if (await fileExists$1(candidate)) return candidate;
+async function loadProjectMigrationExecutor(projectRoot, entrypoint) {
+	const factory = moduleExport(await importProjectModule(projectRoot, entrypoint), "createMigrationExecutor");
+	if (typeof factory !== "function") throw new MigrateCommandError(`The project-local ${entrypoint} module does not export createMigrationExecutor.`);
+	return (manifestConfig, context) => Reflect.apply(factory, void 0, [manifestConfig, context]);
+}
+async function findProjectRoot(start) {
+	let current = resolve(start);
+	const filesystemRoot = parse(current).root;
+	for (;;) {
+		try {
+			await readFile(resolve(current, "package.json"), "utf8");
+			return current;
+		} catch (error) {
+			if (isRecord(error) && error.code !== "ENOENT" && error.code !== "ENOTDIR") throw new MigrateCommandError("Could not read the project package.json.");
+		}
+		if (current === filesystemRoot) break;
+		current = dirname(current);
 	}
+	throw new MigrateCommandError("Could not find a project root containing package.json.");
 }
-/**
-* Resolve a dist/built path back to its source .ts/.tsx equivalent.
-* E.g., "./dist/index.mjs" → "src/index.ts"
-*/
-async function resolveSourceEntry(pluginDir, distPath) {
-	const cleaned = distPath.replace(LEADING_DOT_SLASH_RE, "");
-	const srcPath = cleaned.replace(DIST_PREFIX_RE, "src/").replace(MJS_EXT_RE, ".ts");
-	const srcFull = resolve(pluginDir, srcPath);
-	if (await fileExists$1(srcFull)) return srcFull;
-	const tsxFull = resolve(pluginDir, srcPath.replace(TS_TO_TSX_RE, ".tsx"));
-	if (await fileExists$1(tsxFull)) return tsxFull;
-	const direct = resolve(pluginDir, cleaned);
-	if (await fileExists$1(direct)) return direct;
+async function readMigrationManifestFile(path, isDefault) {
+	let source;
+	try {
+		source = await readFile(path, "utf8");
+	} catch (error) {
+		if (isDefault && isRecord(error) && (error.code === "ENOENT" || error.code === "ENOTDIR")) throw new MigrateCommandError(`No migration manifest found at ${path}. Build the project or use --from-config.`);
+		throw new MigrateCommandError(`Could not read migration manifest: ${path}`);
+	}
+	try {
+		return JSON.parse(source);
+	} catch {
+		throw new MigrateCommandError(`Migration manifest is not valid JSON: ${path}`);
+	}
 }
-const TS_SOURCE_EXPORT_RE = /\.(?:ts|tsx|mts|cts|jsx)$/;
-/**
-* Find package.json exports that point to source files instead of built output.
-* Returns an array of `{ exportPath, resolvedPath }` for each offending export.
-*/
-function findSourceExports(exports) {
-	const issues = [];
-	for (const [exportPath, exportValue] of Object.entries(exports)) {
-		const resolved = typeof exportValue === "string" ? exportValue : exportValue && typeof exportValue === "object" && "import" in exportValue ? exportValue.import : null;
-		if (resolved && TS_SOURCE_EXPORT_RE.test(resolved)) issues.push({
-			exportPath,
-			resolvedPath: resolved
-		});
+async function confirmWithReadline(message) {
+	const prompt = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	try {
+		const answer = await prompt.question(`${message} [y/N] `);
+		return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+	} finally {
+		prompt.close();
 	}
-	return issues;
 }
-/**
-* Recursively walk a staging directory and return a flat list of all files
-* with sizes. Names are relative to `dir` so they match what would appear
-* as the tarball entry name.
-*/
-async function collectBundleEntries(dir) {
-	const entries = [];
-	await walkBundle(dir, "", entries);
-	return entries;
+function onProcessSignal(signal, handler) {
+	const listener = () => {
+		handler().finally(() => process.exit(MIGRATE_EXIT_CODES.interrupted));
+	};
+	process.once(signal, listener);
+	return () => process.removeListener(signal, listener);
 }
-async function walkBundle(dir, prefix, into) {
-	const items = await readdir(dir, { withFileTypes: true });
-	for (const item of items) {
-		const fullPath = join(dir, item.name);
-		const relPath = prefix ? `${prefix}/${item.name}` : item.name;
-		if (item.isFile()) {
-			const s = await stat(fullPath);
-			into.push({
-				name: relPath,
-				bytes: s.size
-			});
-		} else if (item.isDirectory()) await walkBundle(fullPath, relPath, into);
+const defaultDependencies = {
+	cwd: process.cwd(),
+	env: process.env,
+	interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+	findProjectRoot,
+	readManifest: readMigrationManifestFile,
+	buildManifestFromConfig: (projectRoot, configFile) => buildMigrationManifestFromConfig({
+		projectRoot,
+		configFile
+	}),
+	loadProjectIdentity: loadProjectMigrationIdentity,
+	loadProjectExecutor: loadProjectMigrationExecutor,
+	confirm: confirmWithReadline,
+	writeStdout: (value) => process.stdout.write(`${value}\n`),
+	writeStderr: (value) => process.stderr.write(`${value}\n`),
+	onSignal: onProcessSignal,
+	cleanupTimeoutMs: 2e3
+};
+function validateOptions(options) {
+	if (options.manifest && options.fromConfig) throw new MigrateCommandError("--manifest and --from-config cannot be used together.");
+	if (options.config && !options.fromConfig) throw new MigrateCommandError("--config requires --from-config.");
+	if (options.check && options.status) throw new MigrateCommandError("--check and --status cannot be used together.");
+	if (options.expectedTargetFingerprint && !FINGERPRINT_PATTERN.test(options.expectedTargetFingerprint)) throw new MigrateCommandError("--expected-target-fingerprint must be a SHA-256 fingerprint.");
+}
+function hasControlCharacter(value) {
+	for (let index = 0; index < value.length; index++) {
+		const code = value.charCodeAt(index);
+		if (code <= 31 || code === 127) return true;
 	}
+	return false;
 }
-/**
-* Sum the byte sizes of all entries.
-*/
-function totalBundleBytes(entries) {
-	let total = 0;
-	for (const e of entries) total += e.bytes;
-	return total;
+function targetField(value, name) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || value.length === 0 || hasControlCharacter(value) || CREDENTIAL_URL_PATTERN.test(value) || CREDENTIAL_QUERY_PATTERN.test(value)) throw new MigrateCommandError(`The executor returned an unsafe migration target ${name}.`);
+	return value;
 }
-/**
-* Check a bundle against the three size caps from RFC 0001:
-*   - total decompressed ≤ MAX_BUNDLE_SIZE
-*   - per-file decompressed ≤ MAX_FILE_SIZE
-*   - file count ≤ MAX_FILE_COUNT
-*
-* Returns a list of violation messages (empty if the bundle is within all
-* caps). Messages are deterministic per input — the total/count violations
-* come first, then oversized files in alphabetical order — so the same
-* bundle always produces the same error text.
-*/
-function validateBundleSize(entries) {
-	const violations = [];
-	const total = totalBundleBytes(entries);
-	if (total > MAX_BUNDLE_SIZE) violations.push(`Bundle size ${formatBytes(total)} exceeds maximum of ${formatBytes(MAX_BUNDLE_SIZE)}.`);
-	if (entries.length > MAX_FILE_COUNT) violations.push(`Bundle contains ${entries.length} files, exceeds maximum of ${MAX_FILE_COUNT}.`);
-	const oversized = entries.filter((e) => e.bytes > MAX_FILE_SIZE).toSorted((a, b) => a.name.localeCompare(b.name));
-	for (const e of oversized) violations.push(`File ${e.name} is ${formatBytes(e.bytes)}, exceeds per-file maximum of ${formatBytes(MAX_FILE_SIZE)}.`);
-	return violations;
+function immutableTarget(value) {
+	if (!isRecord(value)) throw new MigrateCommandError("The executor returned an invalid migration target.");
+	const kind = targetField(value.kind, "kind");
+	const label = targetField(value.label, "label");
+	const fingerprint = targetField(value.fingerprint, "fingerprint");
+	if (!kind || !SAFE_TARGET_KIND_PATTERN.test(kind) || !label || !fingerprint || !FINGERPRINT_PATTERN.test(fingerprint)) throw new MigrateCommandError("The executor returned an invalid migration target.");
+	const target = {
+		kind,
+		label,
+		fingerprint
+	};
+	const accountId = targetField(value.accountId, "accountId");
+	const environment = targetField(value.environment, "environment");
+	const resourceId = targetField(value.resourceId, "resourceId");
+	if (accountId) target.accountId = accountId;
+	if (environment) target.environment = environment;
+	if (resourceId) target.resourceId = resourceId;
+	return Object.freeze(target);
 }
-/**
-* Render a byte count as a human-friendly string (e.g. "256.0 KB").
-*/
-function formatBytes(n) {
-	if (n < 1024) return `${n} B`;
-	if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
-	return `${(n / 1024 / 1024).toFixed(2)} MB`;
+function safeMigrationNames(value, field) {
+	if (!Array.isArray(value) || !value.every((name) => typeof name === "string" && SAFE_MIGRATION_NAME_PATTERN.test(name))) throw new MigrateCommandError(`The migration executor returned an invalid ${field} report.`);
+	return [...value];
 }
-/**
-* Create a gzipped tarball from a directory.
-*/
-async function createTarball(sourceDir, outputPath) {
-	const { createGzip } = await import("node:zlib");
-	await pipeline(packTar(sourceDir), createGzip({ level: 9 }), createWriteStream(outputPath));
+function safeReport(value, target) {
+	if (!isRecord(value)) throw new MigrateCommandError("The migration executor returned an invalid report.");
+	const reportTarget = immutableTarget(value.target);
+	if (reportTarget.kind !== target.kind || reportTarget.label !== target.label || reportTarget.fingerprint !== target.fingerprint || reportTarget.accountId !== target.accountId || reportTarget.environment !== target.environment || reportTarget.resourceId !== target.resourceId) throw new MigrateCommandError("The migration executor report target does not match the confirmed target.");
+	return {
+		target: { ...reportTarget },
+		knownApplied: safeMigrationNames(value.knownApplied, "knownApplied"),
+		pending: safeMigrationNames(value.pending, "pending"),
+		unknownApplied: safeMigrationNames(value.unknownApplied, "unknownApplied"),
+		executed: safeMigrationNames(value.executed, "executed")
+	};
 }
-
-//#endregion
-//#region src/cli/commands/bundle.ts
-/**
-* emdash plugin bundle
-*
-* Produces a publishable plugin tarball from a plugin source directory.
-*
-* Steps:
-* 1. Resolve plugin entrypoint (finds definePlugin() export)
-* 2. Bundle backend code with tsdown → backend.js (single ES module, tree-shaken)
-* 3. Bundle admin code if present → admin.js
-* 4. Extract manifest from definePlugin() → manifest.json
-* 5. Collect assets (README.md, icon.png, screenshots/)
-* 6. Validate bundle (manifest schema, size limits, no Node.js builtins)
-* 7. Create tarball ({id}-{version}.tar.gz)
-*/
-var bundle_exports = /* @__PURE__ */ __exportAll({ bundleCommand: () => bundleCommand });
-const TS_EXT_RE = /\.(tsx?|[mc]?js)$/;
-const SLASH_RE = /\//g;
-const LEADING_AT_RE = /^@/;
-const emdash_SCOPE_RE = /^@emdash-cms\//;
-const bundleCommand = defineCommand({
+function printTarget(target, write) {
+	write(`Migration target: ${target.kind} ${target.label}`);
+	if (target.accountId) write(`Account: ${target.accountId}`);
+	if (target.environment) write(`Environment: ${target.environment}`);
+	if (target.resourceId) write(`Resource: ${target.resourceId}`);
+	write(`Target fingerprint: ${target.fingerprint}`);
+}
+function printNameSet(label, names, write) {
+	write(`${label}: ${names.length === 0 ? "none" : names.join(", ")}`);
+}
+function printHumanReport(report, write) {
+	printNameSet("Known applied", report.knownApplied, write);
+	printNameSet("Pending", report.pending, write);
+	printNameSet("Unknown applied", report.unknownApplied, write);
+	printNameSet("Executed", report.executed, write);
+}
+function reportExitCode(options, report) {
+	if (!options.check) return MIGRATE_EXIT_CODES.success;
+	if (report.unknownApplied.length > 0) return MIGRATE_EXIT_CODES.unknownApplied;
+	if (report.pending.length > 0) return MIGRATE_EXIT_CODES.pending;
+	return MIGRATE_EXIT_CODES.success;
+}
+function createOverrides(options) {
+	return {
+		database: options.database,
+		databaseUrlEnv: options.databaseUrlEnv,
+		d1: options.d1,
+		accountId: options.accountId,
+		wranglerConfig: options.wranglerConfig,
+		wranglerEnv: options.wranglerEnv
+	};
+}
+function bounded(operation, timeoutMs) {
+	let timer;
+	const timeout = new Promise((resolveTimeout) => {
+		timer = setTimeout(resolveTimeout, timeoutMs, "timeout");
+	});
+	const completion = operation.then(() => "complete", () => "failed");
+	return Promise.race([completion, timeout]).finally(() => clearTimeout(timer));
+}
+async function loadManifest(options, projectRoot, dependencies) {
+	if (options.fromConfig) {
+		dependencies.writeStderr(`Using trusted evaluated Astro configuration${options.config ? `: ${options.config}` : "."}`);
+		return dependencies.buildManifestFromConfig(projectRoot, options.config);
+	}
+	const isDefault = !options.manifest;
+	const path = options.manifest ? isAbsolute(options.manifest) ? options.manifest : resolve(projectRoot, options.manifest) : resolve(projectRoot, ".emdash/migrations.json");
+	return dependencies.readManifest(path, isDefault);
+}
+function redactExecutorMessage(message, env) {
+	let redacted = message.replace(/[A-Za-z][A-Za-z0-9+.-]*:\/\/\S+/g, "[REDACTED_URL]").replace(/\b(auth|credential|key|password|secret|signature|token)\s*[=:]\s*\S+/gi, "$1=[REDACTED]");
+	for (const value of Object.values(env)) if (value && value.length >= 4) redacted = redacted.replaceAll(value, "[REDACTED]");
+	return redacted.replaceAll(/[\r\n\t]/g, " ").slice(0, 1e3);
+}
+function safeCommandMessage(error, env) {
+	if (error instanceof MigrateCommandError || error instanceof MigrationManifestValidationError) return error.message;
+	if (error instanceof Error && error.message) return redactExecutorMessage(error.message, env);
+	return "Migration command failed. Check the project configuration, target, and credentials.";
+}
+async function runMigrateCommand(options, dependencies = defaultDependencies) {
+	let executor;
+	let disposePromise;
+	let interrupted = false;
+	let primaryFailure = false;
+	let exitCode = MIGRATE_EXIT_CODES.error;
+	const interruptedResult = Symbol("interrupted");
+	let resolveInterruption;
+	const interruption = new Promise((resolveInterrupted) => {
+		resolveInterruption = () => resolveInterrupted(interruptedResult);
+	});
+	const dispose = () => {
+		disposePromise ??= executor?.dispose?.() ?? Promise.resolve();
+		return disposePromise;
+	};
+	const removeSignalHandlers = [];
+	const execute = async () => {
+		try {
+			validateOptions(options);
+			const projectRoot = await dependencies.findProjectRoot(dependencies.cwd);
+			const manifest = await validateMigrationManifest(await loadManifest(options, projectRoot, dependencies), await dependencies.loadProjectIdentity(projectRoot));
+			executor = await (await dependencies.loadProjectExecutor(projectRoot, manifest.database.executorEntrypoint))(manifest.database.executorConfig, {
+				projectRoot,
+				env: dependencies.env,
+				overrides: createOverrides(options)
+			});
+			const target = immutableTarget(executor.target);
+			printTarget(target, dependencies.writeStderr);
+			const onSignal = async () => {
+				interrupted = true;
+				await bounded(dispose(), dependencies.cleanupTimeoutMs);
+				resolveInterruption?.();
+			};
+			removeSignalHandlers.push(dependencies.onSignal("SIGINT", onSignal), dependencies.onSignal("SIGTERM", onSignal));
+			const applying = !options.check && !options.status;
+			if (applying && target.kind === "d1") dependencies.writeStderr("Warning: D1 migration jobs must be serialized externally by Cloudflare account and database UUID; this command does not coordinate concurrent applies.");
+			if (applying) {
+				if (options.expectedTargetFingerprint) {
+					if (options.expectedTargetFingerprint !== target.fingerprint) {
+						dependencies.writeStderr("Expected target fingerprint does not match the target.");
+						exitCode = MIGRATE_EXIT_CODES.confirmation;
+						return exitCode;
+					}
+				} else if (!dependencies.interactive || options.json) {
+					dependencies.writeStderr("Noninteractive apply requires --expected-target-fingerprint with the displayed fingerprint.");
+					exitCode = MIGRATE_EXIT_CODES.confirmation;
+					return exitCode;
+				} else if (!await dependencies.confirm(`Apply EmDash migrations to ${target.label}?`)) {
+					dependencies.writeStderr("Migration cancelled.");
+					exitCode = MIGRATE_EXIT_CODES.confirmation;
+					return exitCode;
+				}
+			}
+			const rawReport = await Promise.race([executor.execute({
+				action: applying ? "apply" : "check",
+				i18n: manifest.i18n,
+				artifact: {
+					emdashVersion: manifest.emdashVersion,
+					migrationSetFingerprint: manifest.migrationSet.fingerprint
+				}
+			}), interruption]);
+			if (rawReport === interruptedResult || interrupted) {
+				exitCode = MIGRATE_EXIT_CODES.interrupted;
+				return exitCode;
+			}
+			const report = safeReport(rawReport, target);
+			if (options.json) dependencies.writeStdout(JSON.stringify(report));
+			else printHumanReport(report, dependencies.writeStdout);
+			exitCode = reportExitCode(options, report);
+			return exitCode;
+		} catch (error) {
+			primaryFailure = true;
+			dependencies.writeStderr(safeCommandMessage(error, dependencies.env));
+			exitCode = interrupted ? MIGRATE_EXIT_CODES.interrupted : MIGRATE_EXIT_CODES.error;
+			return exitCode;
+		}
+	};
+	try {
+		exitCode = await execute();
+	} finally {
+		for (const remove of removeSignalHandlers) remove();
+		if (executor) {
+			if (await bounded(dispose(), dependencies.cleanupTimeoutMs) !== "complete" && !primaryFailure && !interrupted) {
+				dependencies.writeStderr("Migration executor cleanup failed.");
+				exitCode = MIGRATE_EXIT_CODES.error;
+			}
+		}
+	}
+	return exitCode;
+}
+const migrateCommand = defineCommand({
 	meta: {
-		name: "bundle",
-		description: "Bundle a plugin for marketplace distribution"
+		name: "migrate",
+		description: "Check or apply deployment-managed EmDash migrations"
 	},
 	args: {
-		dir: {
+		manifest: {
 			type: "string",
-			description: "Plugin directory (default: current directory)",
-			default: process.cwd()
+			description: "Migration manifest path"
+		},
+		"from-config": {
+			type: "boolean",
+			description: "Build the manifest from Astro config"
 		},
-		outDir: {
+		config: {
 			type: "string",
-			alias: "o",
-			description: "Output directory for the tarball (default: ./dist)",
-			default: "dist"
+			description: "Astro config path (requires --from-config)"
 		},
-		validateOnly: {
+		check: {
 			type: "boolean",
-			description: "Run validation only, skip tarball creation",
-			default: false
+			description: "Check for pending or unknown migrations"
+		},
+		status: {
+			type: "boolean",
+			description: "Report all migration status sets"
+		},
+		json: {
+			type: "boolean",
+			description: "Print the stable JSON report"
+		},
+		"expected-target-fingerprint": {
+			type: "string",
+			description: "Required target fingerprint for noninteractive apply"
+		},
+		database: {
+			type: "string",
+			description: "Override the SQLite database path"
+		},
+		"database-url-env": {
+			type: "string",
+			description: "Override the database URL environment-variable name"
+		},
+		d1: {
+			type: "string",
+			description: "Override the D1 database UUID or name"
+		},
+		"account-id": {
+			type: "string",
+			description: "Override the Cloudflare account ID"
+		},
+		"wrangler-config": {
+			type: "string",
+			description: "Override the Wrangler config path"
+		},
+		"wrangler-env": {
+			type: "string",
+			description: "Override the Wrangler environment"
 		}
 	},
 	async run({ args }) {
-		const pluginDir = resolve(args.dir);
-		const outDir = resolve(pluginDir, args.outDir);
-		const validateOnly = args.validateOnly;
-		consola.start(validateOnly ? "Validating plugin..." : "Bundling plugin...");
-		const pkgPath = join(pluginDir, "package.json");
-		if (!await fileExists$1(pkgPath)) {
-			consola.error("No package.json found in", pluginDir);
-			process.exit(1);
-		}
-		const pkg = JSON.parse(await readFile(pkgPath, "utf-8"));
-		let backendEntry;
-		let adminEntry;
-		if (pkg.exports) {
-			const sandboxExport = pkg.exports["./sandbox"];
-			if (typeof sandboxExport === "string") backendEntry = await resolveSourceEntry(pluginDir, sandboxExport);
-			else if (sandboxExport && typeof sandboxExport === "object" && "import" in sandboxExport) backendEntry = await resolveSourceEntry(pluginDir, sandboxExport.import);
-			const adminExport = pkg.exports["./admin"];
-			if (typeof adminExport === "string") adminEntry = await resolveSourceEntry(pluginDir, adminExport);
-			else if (adminExport && typeof adminExport === "object" && "import" in adminExport) adminEntry = await resolveSourceEntry(pluginDir, adminExport.import);
-		}
-		if (!backendEntry) {
-			const defaultSandbox = join(pluginDir, "src/sandbox-entry.ts");
-			if (await fileExists$1(defaultSandbox)) backendEntry = defaultSandbox;
-		}
-		let mainEntry;
-		if (pkg.exports?.["."] !== void 0) {
-			const mainExport = pkg.exports["."];
-			if (typeof mainExport === "string") mainEntry = await resolveSourceEntry(pluginDir, mainExport);
-			else if (mainExport && typeof mainExport === "object" && "import" in mainExport) mainEntry = await resolveSourceEntry(pluginDir, mainExport.import);
-		}
-		if (!mainEntry && pkg.main) mainEntry = await resolveSourceEntry(pluginDir, pkg.main);
-		if (!mainEntry) {
-			const defaultMain = join(pluginDir, "src/index.ts");
-			if (await fileExists$1(defaultMain)) mainEntry = defaultMain;
-		}
-		if (!mainEntry) {
-			consola.error("Cannot find plugin entrypoint. Expected src/index.ts or main/exports in package.json");
-			process.exit(1);
-		}
-		consola.info(`Main entry: ${mainEntry}`);
-		if (backendEntry) consola.info(`Backend entry: ${backendEntry}`);
-		if (adminEntry) consola.info(`Admin entry: ${adminEntry}`);
-		consola.start("Extracting plugin manifest...");
-		const { build } = await import("tsdown");
-		const tmpDir = join(pluginDir, ".emdash-bundle-tmp");
-		try {
-			await rm(tmpDir, {
-				recursive: true,
-				force: true
-			});
-			await mkdir(tmpDir, { recursive: true });
-			const mainOutDir = join(tmpDir, "main");
-			await build({
-				config: false,
-				entry: [mainEntry],
-				format: "esm",
-				outDir: mainOutDir,
-				dts: false,
-				platform: "node",
-				external: ["emdash", emdash_SCOPE_RE]
-			});
-			const pluginNodeModules = join(pluginDir, "node_modules");
-			const tmpNodeModules = join(mainOutDir, "node_modules");
-			if (await fileExists$1(pluginNodeModules)) await symlink(pluginNodeModules, tmpNodeModules, "junction");
-			const mainOutputPath = await findBuildOutput(mainOutDir, basename(mainEntry).replace(TS_EXT_RE, ""));
-			if (!mainOutputPath) {
-				consola.error("Failed to build main entry — no output found in", mainOutDir);
-				process.exit(1);
-			}
-			const pluginModule = await import(toFileImportSpecifier(mainOutputPath));
-			let resolvedPlugin;
-			if (typeof pluginModule.createPlugin === "function") resolvedPlugin = pluginModule.createPlugin();
-			else if (typeof pluginModule.default === "function") resolvedPlugin = pluginModule.default();
-			else if (typeof pluginModule.default === "object" && pluginModule.default !== null) {
-				const defaultExport = pluginModule.default;
-				if ("id" in defaultExport && "version" in defaultExport) resolvedPlugin = defaultExport;
-			}
-			if (!resolvedPlugin) for (const [key, value] of Object.entries(pluginModule)) {
-				if (key === "default" || typeof value !== "function") continue;
-				try {
-					const result = value();
-					if (result && typeof result === "object" && "id" in result && "version" in result) {
-						resolvedPlugin = {
-							id: result.id,
-							version: result.version,
-							capabilities: result.capabilities ?? [],
-							allowedHosts: result.allowedHosts ?? [],
-							storage: result.storage ?? {},
-							hooks: {},
-							routes: {},
-							admin: {
-								pages: result.adminPages,
-								widgets: result.adminWidgets
-							}
-						};
-						if (backendEntry) {
-							const backendProbeDir = join(tmpDir, "backend-probe");
-							const probeShimDir = join(tmpDir, "probe-shims");
-							await mkdir(probeShimDir, { recursive: true });
-							await writeFile(join(probeShimDir, "emdash.mjs"), "export const definePlugin = (d) => d;\n");
-							await build({
-								config: false,
-								entry: [backendEntry],
-								format: "esm",
-								outDir: backendProbeDir,
-								dts: false,
-								platform: "neutral",
-								external: [],
-								alias: { emdash: join(probeShimDir, "emdash.mjs") },
-								treeshake: true
-							});
-							const backendProbePath = await findBuildOutput(backendProbeDir, basename(backendEntry).replace(TS_EXT_RE, ""));
-							if (backendProbePath) {
-								const standardDef = (await import(toFileImportSpecifier(backendProbePath))).default ?? {};
-								const hooks = standardDef.hooks;
-								const routes = standardDef.routes;
-								if (hooks) for (const hookName of Object.keys(hooks)) {
-									const hookEntry = hooks[hookName];
-									const isConfig = typeof hookEntry === "object" && hookEntry !== null && "handler" in hookEntry;
-									const config = isConfig ? hookEntry : {};
-									resolvedPlugin.hooks[hookName] = {
-										handler: isConfig ? hookEntry.handler : hookEntry,
-										priority: config.priority ?? 100,
-										timeout: config.timeout ?? 5e3,
-										dependencies: config.dependencies ?? [],
-										errorPolicy: config.errorPolicy ?? "abort",
-										exclusive: config.exclusive ?? false,
-										pluginId: result.id
-									};
-								}
-								if (routes) for (const [name, route] of Object.entries(routes)) {
-									const routeObj = route;
-									resolvedPlugin.routes[name] = {
-										handler: routeObj.handler,
-										public: routeObj.public,
-										cacheControl: routeObj.cacheControl
-									};
-								}
-							}
-						}
-						break;
-					}
-				} catch {}
-			}
-			if (!resolvedPlugin?.id || !resolvedPlugin?.version) {
-				consola.error("Could not extract plugin definition. Expected one of:\n  - createPlugin() export (native format)\n  - Descriptor factory function returning { id, version, ... } (standard format)");
-				process.exit(1);
-			}
-			const manifest = extractManifest(resolvedPlugin);
-			if (resolvedPlugin.admin?.entry) {
-				consola.error("Plugin declares adminEntry — React admin components require native/trusted mode. Use Block Kit for sandboxed admin pages, or remove adminEntry.");
-				process.exit(1);
-			}
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) {
-				consola.error("Plugin declares portableTextBlocks — these require native/trusted mode and cannot be bundled for the marketplace.");
-				process.exit(1);
-			}
-			consola.success(`Plugin: ${manifest.id}@${manifest.version}`);
-			consola.info(`  Capabilities: ${manifest.capabilities.length > 0 ? manifest.capabilities.join(", ") : "(none)"}`);
-			consola.info(`  Hooks: ${manifest.hooks.length > 0 ? manifest.hooks.map((h) => typeof h === "string" ? h : h.name).join(", ") : "(none)"}`);
-			consola.info(`  Routes: ${manifest.routes.length > 0 ? manifest.routes.map((r) => typeof r === "string" ? r : r.name).join(", ") : "(none)"}`);
-			const bundleDir = join(tmpDir, "bundle");
-			await mkdir(bundleDir, { recursive: true });
-			if (backendEntry) {
-				consola.start("Bundling backend...");
-				const shimDir = join(tmpDir, "shims");
-				await mkdir(shimDir, { recursive: true });
-				await writeFile(join(shimDir, "emdash.mjs"), "export const definePlugin = (d) => d;\n");
-				await build({
-					config: false,
-					entry: [backendEntry],
-					format: "esm",
-					outDir: join(tmpDir, "backend"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					alias: { emdash: join(shimDir, "emdash.mjs") },
-					minify: true,
-					treeshake: true
-				});
-				const backendBaseName = basename(backendEntry).replace(TS_EXT_RE, "");
-				const backendOutputPath = await findBuildOutput(join(tmpDir, "backend"), backendBaseName);
-				if (backendOutputPath) {
-					await copyFile(backendOutputPath, join(bundleDir, "backend.js"));
-					consola.success("Built backend.js");
-				} else {
-					consola.error("Backend build produced no output");
-					process.exit(1);
-				}
-			} else {
-				consola.warn("No sandbox entry found — bundle will have no backend.js");
-				consola.warn("  Add a \"sandbox-entry.ts\" in src/ or a \"./sandbox\" export in package.json");
-			}
-			if (adminEntry) {
-				consola.start("Bundling admin...");
-				await build({
-					config: false,
-					entry: [adminEntry],
-					format: "esm",
-					outDir: join(tmpDir, "admin"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					minify: true,
-					treeshake: true
-				});
-				const adminBaseName = basename(adminEntry).replace(TS_EXT_RE, "");
-				const adminOutputPath = await findBuildOutput(join(tmpDir, "admin"), adminBaseName);
-				if (adminOutputPath) {
-					await copyFile(adminOutputPath, join(bundleDir, "admin.js"));
-					consola.success("Built admin.js");
-				}
-			}
-			await writeFile(join(bundleDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-			consola.start("Collecting assets...");
-			const readmePath = join(pluginDir, "README.md");
-			if (await fileExists$1(readmePath)) {
-				await copyFile(readmePath, join(bundleDir, "README.md"));
-				consola.success("Included README.md");
-			}
-			const iconPath = join(pluginDir, "icon.png");
-			if (await fileExists$1(iconPath)) {
-				const dims = readImageDimensions(await readFile(iconPath));
-				if (!dims) consola.warn("icon.png is not a valid PNG — skipping");
-				else if (dims[0] !== ICON_SIZE || dims[1] !== ICON_SIZE) {
-					consola.warn(`icon.png is ${dims[0]}x${dims[1]}, expected ${ICON_SIZE}x${ICON_SIZE} — including anyway`);
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-				} else {
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-					consola.success("Included icon.png");
-				}
-			}
-			const screenshotsDir = join(pluginDir, "screenshots");
-			if (await fileExists$1(screenshotsDir)) {
-				const screenshotFiles = (await readdir(screenshotsDir)).filter((f) => {
-					const ext = extname(f).toLowerCase();
-					return ext === ".png" || ext === ".jpg" || ext === ".jpeg";
-				}).toSorted().slice(0, MAX_SCREENSHOTS);
-				if (screenshotFiles.length > 0) {
-					await mkdir(join(bundleDir, "screenshots"), { recursive: true });
-					for (const file of screenshotFiles) {
-						const filePath = join(screenshotsDir, file);
-						const dims = readImageDimensions(await readFile(filePath));
-						if (!dims) {
-							consola.warn(`screenshots/${file} — cannot read dimensions, skipping`);
-							continue;
-						}
-						if (dims[0] > MAX_SCREENSHOT_WIDTH || dims[1] > MAX_SCREENSHOT_HEIGHT) consola.warn(`screenshots/${file} is ${dims[0]}x${dims[1]}, max ${MAX_SCREENSHOT_WIDTH}x${MAX_SCREENSHOT_HEIGHT} — including anyway`);
-						await copyFile(filePath, join(bundleDir, "screenshots", file));
-					}
-					consola.success(`Included ${screenshotFiles.length} screenshot(s)`);
-				}
-			}
-			consola.start("Validating bundle...");
-			let hasErrors = false;
-			if (pkg.exports) for (const issue of findSourceExports(pkg.exports)) {
-				consola.error(`Export "${issue.exportPath}" points to source (${issue.resolvedPath}). Package exports must point to built files (e.g. dist/*.mjs). Add a build step and update the exports map.`);
-				hasErrors = true;
-			}
-			const backendPath = join(bundleDir, "backend.js");
-			if (await fileExists$1(backendPath)) {
-				const builtins = findNodeBuiltinImports(await readFile(backendPath, "utf-8"));
-				if (builtins.length > 0) {
-					consola.error(`backend.js imports Node.js built-in modules: ${builtins.join(", ")}`);
-					consola.error("Sandboxed plugins cannot use Node.js APIs");
-					hasErrors = true;
-				}
-			}
-			const declaresUnrestricted = manifest.capabilities.includes("network:request:unrestricted") || manifest.capabilities.includes("network:fetch:any");
-			const declaresHostRestricted = manifest.capabilities.includes("network:request") || manifest.capabilities.includes("network:fetch");
-			if (declaresUnrestricted) consola.warn("Plugin declares unrestricted network access (network:request:unrestricted) — it can make requests to any host");
-			else if (declaresHostRestricted && manifest.allowedHosts.length === 0) consola.warn("Plugin declares network:request capability but no allowedHosts — all requests will be blocked");
-			const deprecatedCaps = manifest.capabilities.filter(isDeprecatedCapability);
-			if (deprecatedCaps.length > 0) {
-				consola.warn("Plugin uses deprecated capability names. Rename them before publishing:");
-				for (const cap of deprecatedCaps) {
-					const replacement = CAPABILITY_RENAMES[cap];
-					consola.warn(`  ${cap} → ${replacement}`);
-				}
-			}
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) consola.warn("Plugin declares portableTextBlocks — these require trusted mode and will be ignored in sandboxed plugins");
-			if (resolvedPlugin.admin?.entry) consola.warn("Plugin declares admin.entry — custom React components require trusted mode. Use Block Kit for sandboxed admin pages");
-			if (resolvedPlugin.hooks["page:fragments"]) consola.warn("Plugin declares page:fragments hook — this is trusted-only and will not work in sandboxed mode");
-			const hasAdminPages = (manifest.admin?.pages?.length ?? 0) > 0;
-			const hasAdminWidgets = (manifest.admin?.widgets?.length ?? 0) > 0;
-			if (hasAdminPages || hasAdminWidgets) {
-				if (!manifest.routes.map((r) => typeof r === "string" ? r : r.name).includes("admin")) {
-					consola.error(`Plugin declares ${hasAdminPages ? "adminPages" : ""}${hasAdminPages && hasAdminWidgets ? " and " : ""}${hasAdminWidgets ? "adminWidgets" : ""} but the sandbox entry has no "admin" route. Add an admin route handler to serve Block Kit pages.`);
-					hasErrors = true;
-				}
-			}
-			const bundleEntries = await collectBundleEntries(bundleDir);
-			const sizeViolations = validateBundleSize(bundleEntries);
-			if (sizeViolations.length > 0) {
-				for (const v of sizeViolations) consola.error(v);
-				hasErrors = true;
-			} else consola.info(`Bundle size: ${formatBytes(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`);
-			if (hasErrors) {
-				consola.error("Bundle validation failed");
-				process.exit(1);
-			}
-			consola.success("Validation passed");
-			if (validateOnly) return;
-			await mkdir(outDir, { recursive: true });
-			const tarballName = `${manifest.id.replace(SLASH_RE, "-").replace(LEADING_AT_RE, "")}-${manifest.version}.tar.gz`;
-			const tarballPath = join(outDir, tarballName);
-			consola.start("Creating tarball...");
-			await createTarball(bundleDir, tarballPath);
-			const tarballSizeKB = ((await stat(tarballPath)).size / 1024).toFixed(1);
-			const tarballBuf = await readFile(tarballPath);
-			const checksum = createHash("sha256").update(tarballBuf).digest("hex");
-			consola.success(`Created ${tarballName} (${tarballSizeKB}KB)`);
-			consola.info(`  SHA-256: ${checksum}`);
-			consola.info(`  Path: ${tarballPath}`);
-		} finally {
-			if (tmpDir.endsWith(".emdash-bundle-tmp")) await rm(tmpDir, {
-				recursive: true,
-				force: true
-			});
-		}
+		process.exitCode = await runMigrateCommand({
+			manifest: args.manifest,
+			fromConfig: args["from-config"],
+			config: args.config,
+			check: args.check,
+			status: args.status,
+			json: args.json,
+			expectedTargetFingerprint: args["expected-target-fingerprint"],
+			database: args.database,
+			databaseUrlEnv: args["database-url-env"],
+			d1: args.d1,
+			accountId: args["account-id"],
+			wranglerConfig: args["wrangler-config"],
+			wranglerEnv: args["wrangler-env"]
+		});
 	}
 });
 
@@ -3181,7 +3180,7 @@ const pluginInitCommand = defineCommand({
 			process.exit(1);
 		}
 		const srcDir = join(targetDir, "src");
-		if (await fileExists$1(join(targetDir, "package.json"))) {
+		if (await fileExists$4(join(targetDir, "package.json"))) {
 			consola.error(`package.json already exists in ${targetDir}`);
 			process.exit(1);
 		}
@@ -3663,7 +3662,7 @@ const publishCommand = defineCommand({
 			const pluginDir = resolve(args.dir);
 			try {
 				const { runCommand } = await import("citty");
-				const { bundleCommand } = await Promise.resolve().then(() => bundle_exports);
+				const { bundleCommand } = await import("../bundle-vn56sLos.mjs").then((n) => n.n);
 				await runCommand(bundleCommand, { rawArgs: ["--dir", pluginDir] });
 			} catch {
 				consola.error("Build failed");
@@ -4647,28 +4646,6 @@ const typesCommand = defineCommand({
 
 //#endregion
 //#region src/cli/index.ts
-/**
-* EmDash CLI
-*
-* Built with citty + clack (same stack as Nuxt CLI)
-*
-* Commands:
-* - init: Bootstrap database from template config, or interactive setup
-* - types: Generate TypeScript types from schema
-* - dev: [DEPRECATED, hidden] Run dev server with a local SQLite database
-* - seed: Apply a seed file to the database
-* - export-seed: Export database schema and content as a seed file
-* - secrets: Generate and inspect EmDash secrets (encryption keys, etc.)
-* - auth: [DEPRECATED] Generate auth secret (use `secrets` instead)
-* - login/logout/whoami: Session management
-* - content: Create, read, update, delete content
-* - schema: Manage collections and fields
-* - media: Upload and manage media
-* - search: Full-text search
-* - taxonomy: Manage taxonomies and terms
-* - menu: Manage navigation menus
-* - plugin: Plugin management (init, bundle, validate, publish, login, logout)
-*/
 runMain(defineCommand({
 	meta: {
 		name: "emdash",
@@ -4681,6 +4658,7 @@ runMain(defineCommand({
 		dev: devCommand,
 		doctor: doctorCommand,
 		seed: seedCommand,
+		migrate: migrateCommand,
 		"export-seed": exportSeedCommand,
 		secrets: secretsCommand,
 		auth: authCommand,