emdash 0.38.0 → 0.39.0

package/dist/cli/index.mjs

@@ -1,58 +1,62 @@
 #!/usr/bin/env node
-import { a as getMigrationStatus, c as __exportAll, s as runMigrations } from "../runner-nEzvnogG.mjs";
+import { a as getMigrationStatus, c as formatDatetimeStorageReport, i as getExactMigrationStatus, l as scanDatetimeStorage, s as runMigrations, u as __exportAll } from "../runner-ClrleR8A.mjs";
 import { t as EmDashDatabaseError } from "../errors-9P_FDrJ_.mjs";
-import { t as validateIdentifier } from "../validate-BpwoDOgt.mjs";
-import { d as listTablesLike } from "../dialect-helpers-BcQvkHgn.mjs";
-import { i as isI18nEnabled, r as getI18nConfig } from "../config-C3EBstHi.mjs";
-import "../after-CBU2vkoO.mjs";
-import "../object-cache-DVKnyOfy.mjs";
-import { t as ContentRepository } from "../content-CNfMWuhY.mjs";
-import { n as isMissingTableError } from "../db-errors-Cl-sKYTm.mjs";
-import { n as slugify } from "../slugify-B994zkXC.mjs";
-import { a as encodeBase64url } from "../base64-CvLhUKQv.mjs";
-import "../types-CQPWhPxE.mjs";
-import { t as MediaRepository } from "../media-BBm8Wg3f.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-DP1vny4K.mjs";
-import { t as OptionsRepository } from "../options-D1FBiAv1.mjs";
-import "../resolve-Cy0aWSRj.mjs";
-import "../redirect-DId44BS1.mjs";
-import "../request-cache-DAZZmesc.mjs";
-import "../byline-registry-BxDGIO0I.mjs";
-import "../field-defs-cache-Cf5FHK0M.mjs";
-import { t as BylineRepository } from "../byline-Vdi85CsZ.mjs";
-import "../dist-BAsh8dbf.mjs";
-import "../fts-manager-iddym8cd.mjs";
+import { n as isMissingTableError } from "../db-errors-CBD5yMro.mjs";
+import { busyLockHeldSince, migrationLockHeldMessage } from "../database/migration-lock.mjs";
+import { t as validateIdentifier } from "../validate-DANX1-Qi.mjs";
+import { p as listTablesLike } from "../dialect-helpers-CtYdsX4W.mjs";
+import { i as isI18nEnabled, r as getI18nConfig } from "../config-CGVeT8Hc.mjs";
+import "../datetime-normalization-PeiEdcRY.mjs";
+import "../after-PcEvMY_6.mjs";
+import { t as OptionsRepository } from "../options-D5WcorD5.mjs";
+import { a as encodeBase64url } from "../base64-DvnNgP7e.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-DNgVgz_e.mjs";
+import { t as ContentRepository } from "../content-DZ3B5qtA.mjs";
+import "../object-cache-DlSVbn5Y.mjs";
+import { n as slugify } from "../slugify-T5GHH42D.mjs";
+import "../types-BkUg2yHx.mjs";
+import { t as MediaRepository } from "../media-TBlKCwo7.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-Dj1vpw5E.mjs";
+import "../resolve-BJIS8wKr.mjs";
+import "../redirect-D2Yo-b6S.mjs";
+import "../request-cache-DaMhSQdx.mjs";
+import "../byline-registry-D6lWzXk6.mjs";
+import "../field-defs-cache-B337z8UJ.mjs";
+import { t as BylineRepository } from "../byline-Doh-wt99.mjs";
+import { t as imageSize } from "../dist-2hDLsLeq.mjs";
+import "../fts-manager-DMb0sbIQ.mjs";
 import { kyselyLogOption } from "../database/instrumentation.mjs";
-import "../loader-WJi6GFRn.mjs";
-import "../collection-slugs-cache-7lTmNzeA.mjs";
-import "../capture-triggers-CeAsC76Z.mjs";
-import "../activation-DyNTe_Tl.mjs";
-import "../collection-deletion-BCwaWTDw.mjs";
-import "../content-refresh-GTMyi2Xy.mjs";
-import { n as SchemaRegistry } from "../registry-DTqaqxed.mjs";
-import "../settings-DcMjREe5.mjs";
-import { i as pluginManifestSchema } from "../manifest-schema-CILooI5J.mjs";
-import { r as isDeprecatedCapability, t as CAPABILITY_RENAMES } from "../types-A2cN6a4a.mjs";
-import "../ssrf-gl4gFNhw.mjs";
-import "../ssrf-TQhaljuI.mjs";
-import { t as validateSeed } from "../validate-D8VPn4Hv.mjs";
-import { t as applySeed } from "../apply-DLmM3R7f.mjs";
-import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-BfNlGQIA.mjs";
-import "../identity-CjGKDq8J.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-CdfzLdoO.mjs";
-import { t as openNodeSqliteDatabase } from "../node-sqlite-compat-2sezm-Zd.mjs";
+import "../loader-t4TxaFiQ.mjs";
+import "../collection-slugs-cache-D9auiKmI.mjs";
+import "../capture-triggers-gxQxnxrJ.mjs";
+import "../activation-CaMfdBt1.mjs";
+import "../collection-deletion-C3Xixmkx.mjs";
+import "../content-refresh-BHLHJgyt.mjs";
+import { n as SchemaRegistry } from "../registry-CkuPoZs7.mjs";
+import "../settings-DmroR53o.mjs";
+import { a as pluginManifestBaseSchema } from "../manifest-schema-Bkh8SeHd.mjs";
+import { i as isDeprecatedCapability, n as capabilitiesToDeclaredAccess$1, r as declaredAccessToCapabilities$1, t as CAPABILITY_RENAMES } from "../types-k--LneIF.mjs";
+import "../ssrf-Co1GGFZz.mjs";
+import "../ssrf-BRpTDMV6.mjs";
+import { t as validateSeed } from "../validate-BCP9HNDn.mjs";
+import { t as applySeed } from "../apply-drpfmqrR.mjs";
+import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-D31UoJCu.mjs";
+import "../identity-DRGSHEEr.mjs";
+import { t as openNodeSqliteDatabase } from "../node-sqlite-compat-vpVaILnb.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { t as convertDataForRead } from "../portable-text-BS3d5n-0.mjs";
+import { t as convertDataForRead } from "../portable-text-oAwodbPS.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
 import { EmDashClient } from "../client/index.mjs";
-import { r as fileExists$4, t as bundleCommand } from "../bundle-CL0JjIPx.mjs";
 import { createRequire } from "node:module";
 import { Kysely, SqliteDialect, sql } from "kysely";
+import { z } from "zod";
+import { extractManifestRoute, extractRouteOptions, isJsonPostRouteContract } from "@emdash-cms/plugin-types";
 import { createGzipDecoder, unpackTar } from "modern-tar";
 import { pathToFileURL } from "node:url";
-import { access, mkdir, readFile, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, parse, resolve } from "node:path";
+import { createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { defineCommand, runCommand, runMain } from "citty";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
@@ -61,6 +65,8 @@ import { homedir } from "node:os";
 import { parse as parse$1, printParseErrorCode } from "jsonc-parser";
 import { parse as parse$2 } from "smol-toml";
 import { createInterface } from "node:readline/promises";
+import { pipeline } from "node:stream/promises";
+import { packTar } from "modern-tar/fs";
 
 //#region src/cli/commands/auth.ts
 /**
@@ -789,7 +795,7 @@ const scheduleCommand = defineCommand({
 		},
 		at: {
 			type: "string",
-			description: "ISO 8601 datetime to publish at",
+			description: "ISO 8601 datetime with Z or an explicit UTC offset to publish at",
 			required: true
 		},
 		"override-lock": {
@@ -902,7 +908,10 @@ const contentCommand = defineCommand({
 function createDatabase(config) {
 	try {
 		if (config.url.startsWith("file:") || config.url === ":memory:") return new Kysely({
-			dialect: new SqliteDialect({ database: openNodeSqliteDatabase(config.url === ":memory:" ? ":memory:" : config.url.replace("file:", ""), { journalMode: "wal" }) }),
+			dialect: new SqliteDialect({ database: openNodeSqliteDatabase(config.url === ":memory:" ? ":memory:" : config.url.replace("file:", ""), {
+				journalMode: "wal",
+				readOnly: config.readOnly
+			}) }),
 			log: kyselyLogOption()
 		});
 		if (config.url.startsWith("libsql:")) {
@@ -932,7 +941,7 @@ async function readPackageJson$2(cwd) {
 		return null;
 	}
 }
-async function fileExists$3(path) {
+async function fileExists$4(path) {
 	try {
 		await access(path);
 		return true;
@@ -984,7 +993,7 @@ const devCommand = defineCommand({
 			process.exit(1);
 		}
 		const dbPath = resolve(cwd, args.database);
-		if (!await fileExists$3(dbPath)) consola.start("Database not found, initializing...");
+		if (!await fileExists$4(dbPath)) consola.start("Database not found, initializing...");
 		const db = createDatabase({ url: `file:${dbPath}` });
 		try {
 			consola.start("Checking database migrations...");
@@ -1023,8 +1032,8 @@ const devCommand = defineCommand({
 			"--port",
 			args.port
 		];
-		const pnpmLockExists = await fileExists$3(resolve(cwd, "pnpm-lock.yaml"));
-		const yarnLockExists = await fileExists$3(resolve(cwd, "yarn.lock"));
+		const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));
+		const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));
 		let cmd;
 		let cmdArgs;
 		if (pnpmLockExists) {
@@ -1087,7 +1096,7 @@ function triggerFix(configPath) {
 function mainFix(configPath) {
 	return configPath.endsWith(".toml") ? MAIN_FIX_TOML : MAIN_FIX_JSONC;
 }
-async function fileExists$2(path) {
+async function fileExists$3(path) {
 	try {
 		await access(path);
 		return true;
@@ -1108,7 +1117,7 @@ function sourcePosition(source, offset) {
 async function findWranglerConfig(cwd) {
 	for (const filename of WRANGLER_CONFIG_FILES) {
 		const path = resolve(cwd, filename);
-		if (await fileExists$2(path)) return path;
+		if (await fileExists$3(path)) return path;
 	}
 	return null;
 }
@@ -1203,7 +1212,7 @@ function printResult(result) {
 }
 async function checkDatabase(dbPath) {
 	const results = [];
-	if (!await fileExists$2(dbPath)) {
+	if (!await fileExists$3(dbPath)) {
 		results.push({
 			name: "database",
 			status: "fail",
@@ -1255,6 +1264,21 @@ async function checkDatabase(dbPath) {
 				status: "warn",
 				message: `found ${orphaned.length}: ${orphaned.join(", ")}`
 			});
+			try {
+				const report = await scanDatetimeStorage(db);
+				const clean = report.noncanonicalCount === 0 && report.manualReviewCount === 0 && report.inspectionErrorCount === 0;
+				results.push({
+					name: "datetime storage",
+					status: clean ? "pass" : "fail",
+					message: clean ? `all stored content datetimes are canonical (${report.timezone})` : formatDatetimeStorageReport(report)
+				});
+			} catch (error) {
+				results.push({
+					name: "datetime storage",
+					status: "fail",
+					message: `could not inspect stored datetimes: ${error instanceof Error ? error.message : String(error)}`
+				});
+			}
 		} catch {}
 		try {
 			const count = (await sql`SELECT COUNT(id) as count FROM users`.execute(db)).rows[0]?.count ?? 0;
@@ -1364,12 +1388,17 @@ const exportSeedCommand = defineCommand({
 	},
 	async run({ args }) {
 		const dbPath = resolve(resolve(args.cwd), args.database);
-		consola.info(`Database: ${dbPath}`);
-		const db = createDatabase({ url: `file:${dbPath}` });
+		process.stderr.write(`Database: ${dbPath}\n`);
+		const db = createDatabase({
+			url: `file:${dbPath}`,
+			readOnly: true
+		});
 		try {
-			await runMigrations(db);
+			const { pending, unknownApplied } = await getExactMigrationStatus(db);
+			if (unknownApplied.length > 0) throw new Error("The database was migrated by a newer EmDash version. Upgrade EmDash before exporting it.");
+			if (pending.length > 0) throw new Error(`The database has ${pending.length} pending migration${pending.length === 1 ? "" : "s"}. Run \`emdash migrate\` before exporting it.`);
 		} catch (error) {
-			consola.error("Migration failed:", error);
+			consola.error("Export requires a current database schema:", error);
 			await db.destroy();
 			process.exit(1);
 		}
@@ -1559,7 +1588,7 @@ async function exportCollections(db) {
 * Export taxonomy definitions and terms
 */
 async function exportTaxonomies(db, i18nEnabled) {
-	const defs = await db.selectFrom("_emdash_taxonomy_defs").selectAll().orderBy(["name", "locale"]).execute();
+	const defs = await db.selectFrom("_emdash_taxonomy_defs").selectAll().orderBy("name").orderBy("locale").execute();
 	const result = [];
 	const termRepo = new TaxonomyRepository(db);
 	const defGroupToSeedId = /* @__PURE__ */ new Map();
@@ -1616,7 +1645,7 @@ async function exportTaxonomies(db, i18nEnabled) {
 * Export menus with their items
 */
 async function exportMenus(db, i18nEnabled) {
-	const menus = await db.selectFrom("_emdash_menus").selectAll().orderBy(["name", "locale"]).execute();
+	const menus = await db.selectFrom("_emdash_menus").selectAll().orderBy("name").orderBy("locale").execute();
 	const result = [];
 	const groupToSeedId = /* @__PURE__ */ new Map();
 	const itemGroupToSeedId = /* @__PURE__ */ new Map();
@@ -1734,6 +1763,57 @@ async function exportWidgetAreas(db) {
 	}
 	return result;
 }
+/** A reference field holds a single entry id or an array of them. */
+function referenceValues(value) {
+	if (typeof value === "string") return [value];
+	if (Array.isArray(value)) return value.filter((v) => typeof v === "string");
+	return [];
+}
+/**
+* For each exported collection, the other exported collections its entries
+* point into. Read from the values rather than a field's declared target so a
+* `reference` field without `options.collection` is still accounted for.
+*/
+function referenceTargets(collected, collectionsBySlug, entryIdToCollection) {
+	const targets = /* @__PURE__ */ new Map();
+	for (const [slug, items] of collected) {
+		const referenceFields = (collectionsBySlug.get(slug)?.fields ?? []).filter((field) => field.type === "reference").map((field) => field.slug);
+		if (referenceFields.length === 0) continue;
+		const found = /* @__PURE__ */ new Set();
+		for (const { item } of items) for (const fieldSlug of referenceFields) for (const value of referenceValues(item.data[fieldSlug])) {
+			const target = entryIdToCollection.get(value);
+			if (target && target !== slug) found.add(target);
+		}
+		if (found.size > 0) targets.set(slug, found);
+	}
+	return targets;
+}
+/**
+* Order collections so a reference's target is written before the entry that
+* points at it. `applySeed` fills its seed-id map as it walks the file, so a
+* `$ref` into a collection further down resolves to nothing and is stored
+* verbatim.
+*
+* Depth-first, with the caller's order as the tie-break so an export without
+* references keeps the collection order it had. A cycle has no valid order;
+* the collections on it stay where they were rather than failing the export.
+*/
+function orderByReferenceTargets(slugs, targets) {
+	const exported = new Set(slugs);
+	const ordered = [];
+	const placed = /* @__PURE__ */ new Set();
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (slug) => {
+		if (placed.has(slug) || visiting.has(slug)) return;
+		visiting.add(slug);
+		for (const target of targets.get(slug) ?? []) if (exported.has(target)) visit(target);
+		visiting.delete(slug);
+		placed.add(slug);
+		ordered.push(slug);
+	};
+	for (const slug of slugs) visit(slug);
+	return ordered;
+}
 /**
 * Export content from collections
 */
@@ -1760,11 +1840,13 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 			cursor = result.nextCursor;
 		} while (cursor);
 	} catch {}
+	const collected = /* @__PURE__ */ new Map();
+	const entryIdToSeedId = /* @__PURE__ */ new Map();
+	const entryIdToCollection = /* @__PURE__ */ new Map();
 	for (const collection of collections) {
 		if (includeCollections && !includeCollections.includes(collection.slug)) continue;
-		const entries = [];
+		const items = [];
 		let cursor;
-		const translationGroupToSeedId = /* @__PURE__ */ new Map();
 		do {
 			const result = await contentRepo.findMany(collection.slug, {
 				limit: 100,
@@ -1772,29 +1854,47 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 			});
 			for (const item of result.items) {
 				const seedId = item.slug ? i18nEnabled && item.locale ? `${collection.slug}:${item.slug}:${item.locale}` : `${collection.slug}:${item.slug}` : item.id;
-				const processedData = processDataForExport(item.data, collection.fields, mediaMap);
-				const entry = {
-					id: seedId,
-					slug: item.slug?.trim() ? item.slug : collection.routable === false ? void 0 : item.id,
-					status: item.status === "published" || item.status === "draft" ? item.status : void 0,
-					data: processedData
-				};
-				if (i18nEnabled && item.locale) {
-					entry.locale = item.locale;
-					if (item.translationGroup) {
-						const sourceSeedId = translationGroupToSeedId.get(item.translationGroup);
-						if (sourceSeedId) entry.translationOf = sourceSeedId;
-						else translationGroupToSeedId.set(item.translationGroup, seedId);
-					}
-				}
-				const taxonomies = await getTaxonomyAssignments(taxonomyRepo, collection.slug, item.id);
-				if (Object.keys(taxonomies).length > 0) entry.taxonomies = taxonomies;
-				const bylines = await getBylineCredits(db, collection.slug, item.id, bylineGroupToSeedId);
-				if (bylines.length > 0) entry.bylines = bylines;
-				entries.push(entry);
+				items.push({
+					item,
+					seedId
+				});
+				entryIdToSeedId.set(item.id, seedId);
+				entryIdToCollection.set(item.id, collection.slug);
 			}
 			cursor = result.nextCursor;
 		} while (cursor);
+		collected.set(collection.slug, items);
+	}
+	const collectionsBySlug = new Map(collections.map((c) => [c.slug, c]));
+	const orderedSlugs = orderByReferenceTargets([...collected.keys()], referenceTargets(collected, collectionsBySlug, entryIdToCollection));
+	for (const slug of orderedSlugs) {
+		const collection = collectionsBySlug.get(slug);
+		const items = collected.get(slug);
+		if (!collection || !items) continue;
+		const entries = [];
+		const translationGroupToSeedId = /* @__PURE__ */ new Map();
+		for (const { item, seedId } of items) {
+			const processedData = processDataForExport(item.data, collection.fields, mediaMap, entryIdToSeedId);
+			const entry = {
+				id: seedId,
+				slug: item.slug?.trim() ? item.slug : collection.routable === false ? void 0 : item.id,
+				status: item.status === "published" || item.status === "draft" ? item.status : void 0,
+				data: processedData
+			};
+			if (i18nEnabled && item.locale) {
+				entry.locale = item.locale;
+				if (item.translationGroup) {
+					const sourceSeedId = translationGroupToSeedId.get(item.translationGroup);
+					if (sourceSeedId) entry.translationOf = sourceSeedId;
+					else translationGroupToSeedId.set(item.translationGroup, seedId);
+				}
+			}
+			const taxonomies = await getTaxonomyAssignments(taxonomyRepo, collection.slug, item.id);
+			if (Object.keys(taxonomies).length > 0) entry.taxonomies = taxonomies;
+			const bylines = await getBylineCredits(db, collection.slug, item.id, bylineGroupToSeedId);
+			if (bylines.length > 0) entry.bylines = bylines;
+			entries.push(entry);
+		}
 		if (i18nEnabled && entries.length > 0) entries.sort((a, b) => {
 			if (a.translationOf && !b.translationOf) return 1;
 			if (!a.translationOf && b.translationOf) return -1;
@@ -1807,7 +1907,7 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 /**
 * Process content data for export, converting image fields to $media syntax
 */
-function processDataForExport(data, fields, mediaMap) {
+function processDataForExport(data, fields, mediaMap, entryIdToSeedId) {
 	const result = {};
 	const fieldTypes = /* @__PURE__ */ new Map();
 	for (const field of fields) fieldTypes.set(field.slug, field.type);
@@ -1828,9 +1928,9 @@ function processDataForExport(data, fields, mediaMap) {
 				}
 			}
 			result[key] = value;
-		} else if (fieldType === "reference" && typeof value === "string") result[key] = `$ref:${value}`;
+		} else if (fieldType === "reference" && typeof value === "string") result[key] = `$ref:${entryIdToSeedId.get(value) ?? value}`;
 		else if (Array.isArray(value)) result[key] = value.map((item) => {
-			if (typeof item === "string" && fieldType === "reference") return `$ref:${item}`;
+			if (typeof item === "string" && fieldType === "reference") return `$ref:${entryIdToSeedId.get(item) ?? item}`;
 			return item;
 		});
 		else result[key] = value;
@@ -1877,7 +1977,7 @@ async function getTaxonomyAssignments(taxonomyRepo, collection, entryId) {
 *
 * Initialize database from template config in package.json
 */
-async function fileExists$1(path) {
+async function fileExists$2(path) {
 	try {
 		await access(path);
 		return true;
@@ -1968,7 +2068,7 @@ const initCommand = defineCommand({
 		if (alreadyInitialized && args.force) consola.warn("Re-initializing (--force)...");
 		if (config?.schema) {
 			const schemaPath = resolve(cwd, config.schema);
-			if (await fileExists$1(schemaPath)) {
+			if (await fileExists$2(schemaPath)) {
 				consola.start(`Running schema: ${config.schema}`);
 				try {
 					await runSqlFile(db, schemaPath);
@@ -2735,6 +2835,9 @@ const SAFE_TARGET_KIND_PATTERN = /^[a-z][a-z0-9_-]*$/;
 const SAFE_MIGRATION_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const CREDENTIAL_URL_PATTERN = /:\/\/[^/\s]+@/;
 const CREDENTIAL_QUERY_PATTERN = /[?&](?:auth|credential|key|password|secret|signature|token)=/i;
+const LOCK_ID_PATTERN = /^[1-9]\d{0,15}$/;
+const ISO_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const MAX_DATE_MS = 864e13;
 const MIGRATE_EXIT_CODES = Object.freeze({
 	success: 0,
 	error: 1,
@@ -2856,6 +2959,10 @@ function validateOptions(options) {
 	if (options.manifest && options.fromConfig) throw new MigrateCommandError("--manifest and --from-config cannot be used together.");
 	if (options.config && !options.fromConfig) throw new MigrateCommandError("--config requires --from-config.");
 	if (options.check && options.status) throw new MigrateCommandError("--check and --status cannot be used together.");
+	if (options.releaseLock !== void 0) {
+		if (options.check || options.status) throw new MigrateCommandError("--release-lock cannot be used with --check or --status.");
+		if (!LOCK_ID_PATTERN.test(options.releaseLock)) throw new MigrateCommandError("--release-lock requires the lock id shown by --status.");
+	}
 	if (options.expectedTargetFingerprint && !FINGERPRINT_PATTERN.test(options.expectedTargetFingerprint)) throw new MigrateCommandError("--expected-target-fingerprint must be a SHA-256 fingerprint.");
 }
 function hasControlCharacter(value) {
@@ -2897,13 +3004,22 @@ function safeReport(value, target) {
 	if (!isRecord(value)) throw new MigrateCommandError("The migration executor returned an invalid report.");
 	const reportTarget = immutableTarget(value.target);
 	if (reportTarget.kind !== target.kind || reportTarget.label !== target.label || reportTarget.fingerprint !== target.fingerprint || reportTarget.accountId !== target.accountId || reportTarget.environment !== target.environment || reportTarget.resourceId !== target.resourceId) throw new MigrateCommandError("The migration executor report target does not match the confirmed target.");
-	return {
+	const report = {
 		target: { ...reportTarget },
 		knownApplied: safeMigrationNames(value.knownApplied, "knownApplied"),
 		pending: safeMigrationNames(value.pending, "pending"),
 		unknownApplied: safeMigrationNames(value.unknownApplied, "unknownApplied"),
 		executed: safeMigrationNames(value.executed, "executed")
 	};
+	if (value.lock !== void 0) {
+		const lock = value.lock;
+		if (!isRecord(lock) || typeof lock.id !== "string" || !LOCK_ID_PATTERN.test(lock.id) || typeof lock.heldSince !== "string" || !ISO_TIMESTAMP_PATTERN.test(lock.heldSince)) throw new MigrateCommandError("The migration executor returned an invalid lock report.");
+		report.lock = {
+			id: lock.id,
+			heldSince: lock.heldSince
+		};
+	}
+	return report;
 }
 function printTarget(target, write) {
 	write(`Migration target: ${target.kind} ${target.label}`);
@@ -2916,6 +3032,7 @@ function printNameSet(label, names, write) {
 	write(`${label}: ${names.length === 0 ? "none" : names.join(", ")}`);
 }
 function printHumanReport(report, write) {
+	if (report.lock) write(`Migration lock: held since ${report.lock.heldSince} (id ${report.lock.id})`);
 	printNameSet("Known applied", report.knownApplied, write);
 	printNameSet("Pending", report.pending, write);
 	printNameSet("Unknown applied", report.unknownApplied, write);
@@ -2961,6 +3078,10 @@ function redactExecutorMessage(message, env) {
 }
 function safeCommandMessage(error, env) {
 	if (error instanceof MigrateCommandError || error instanceof MigrationManifestValidationError) return error.message;
+	if (error instanceof Error && error.name === "MigrationLockHeldError") {
+		const heldSince = busyLockHeldSince(error);
+		if (heldSince !== void 0 && Number.isSafeInteger(heldSince) && heldSince <= MAX_DATE_MS) return migrationLockHeldMessage(heldSince);
+	}
 	if (error instanceof Error && error.message) return redactExecutorMessage(error.message, env);
 	return "Migration command failed. Check the project configuration, target, and credentials.";
 }
@@ -2998,9 +3119,11 @@ async function runMigrateCommand(options, dependencies = defaultDependencies) {
 				resolveInterruption?.();
 			};
 			removeSignalHandlers.push(dependencies.onSignal("SIGINT", onSignal), dependencies.onSignal("SIGTERM", onSignal));
-			const applying = !options.check && !options.status;
-			if (applying && target.kind === "d1") dependencies.writeStderr("Warning: D1 migration jobs must be serialized externally by Cloudflare account and database UUID; this command does not coordinate concurrent applies.");
-			if (applying) {
+			const releasing = options.releaseLock !== void 0;
+			const applying = !options.check && !options.status && !releasing;
+			if (applying || releasing) {
+				const operation = releasing ? "lock release" : "apply";
+				const question = releasing ? `Release migration lock ${options.releaseLock} on ${target.label}? Release it only when no migration is running.` : `Apply EmDash migrations to ${target.label}?`;
 				if (options.expectedTargetFingerprint) {
 					if (options.expectedTargetFingerprint !== target.fingerprint) {
 						dependencies.writeStderr("Expected target fingerprint does not match the target.");
@@ -3008,30 +3131,39 @@ async function runMigrateCommand(options, dependencies = defaultDependencies) {
 						return exitCode;
 					}
 				} else if (!dependencies.interactive || options.json) {
-					dependencies.writeStderr("Noninteractive apply requires --expected-target-fingerprint with the displayed fingerprint.");
+					dependencies.writeStderr(`Noninteractive ${operation} requires --expected-target-fingerprint with the displayed fingerprint.`);
 					exitCode = MIGRATE_EXIT_CODES.confirmation;
 					return exitCode;
-				} else if (!await dependencies.confirm(`Apply EmDash migrations to ${target.label}?`)) {
-					dependencies.writeStderr("Migration cancelled.");
+				} else if (!await dependencies.confirm(question)) {
+					dependencies.writeStderr(releasing ? "Lock release cancelled." : "Migration cancelled.");
 					exitCode = MIGRATE_EXIT_CODES.confirmation;
 					return exitCode;
 				}
 			}
-			const rawReport = await Promise.race([executor.execute({
-				action: applying ? "apply" : "check",
+			const request = {
+				action: "check",
 				i18n: manifest.i18n,
 				artifact: {
 					emdashVersion: manifest.emdashVersion,
 					migrationSetFingerprint: manifest.migrationSet.fingerprint
 				}
-			}), interruption]);
+			};
+			if (applying) request.action = "apply";
+			if (releasing) {
+				request.action = "release-lock";
+				request.lockId = options.releaseLock;
+			}
+			const rawReport = await Promise.race([executor.execute(request), interruption]);
 			if (rawReport === interruptedResult || interrupted) {
 				exitCode = MIGRATE_EXIT_CODES.interrupted;
 				return exitCode;
 			}
 			const report = safeReport(rawReport, target);
 			if (options.json) dependencies.writeStdout(JSON.stringify(report));
-			else printHumanReport(report, dependencies.writeStdout);
+			else {
+				if (releasing) dependencies.writeStdout(`Released migration lock ${options.releaseLock}.`);
+				printHumanReport(report, dependencies.writeStdout);
+			}
 			exitCode = reportExitCode(options, report);
 			return exitCode;
 		} catch (error) {
@@ -3086,7 +3218,11 @@ const migrateCommand = defineCommand({
 		},
 		"expected-target-fingerprint": {
 			type: "string",
-			description: "Required target fingerprint for noninteractive apply"
+			description: "Required target fingerprint for noninteractive apply or lock release"
+		},
+		"release-lock": {
+			type: "string",
+			description: "Release the migration lock with the id shown by --status"
 		},
 		database: {
 			type: "string",
@@ -3122,6 +3258,7 @@ const migrateCommand = defineCommand({
 			status: args.status,
 			json: args.json,
 			expectedTargetFingerprint: args["expected-target-fingerprint"],
+			releaseLock: args["release-lock"],
 			database: args.database,
 			databaseUrlEnv: args["database-url-env"],
 			d1: args.d1,
@@ -3132,6 +3269,656 @@ const migrateCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/bundle-utils.ts
+/**
+* Bundle utility functions
+*
+* Shared logic extracted from the bundle command so it can be tested
+* without the CLI harness and tsdown dependency.
+*/
+const MAX_BUNDLE_SIZE = 256 * 1024;
+const MAX_FILE_SIZE = 128 * 1024;
+const MAX_FILE_COUNT = 20;
+const MAX_SCREENSHOTS = 5;
+const MAX_SCREENSHOT_WIDTH = 1920;
+const MAX_SCREENSHOT_HEIGHT = 1080;
+const ICON_SIZE = 256;
+const MCP_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+/**
+* Matches Node.js built-in imports in bundled output:
+* - require("node:xxx") / require("xxx")
+* - import("node:xxx") / import("xxx")
+* - import X from "node:xxx" / import { X } from "node:xxx"
+* - import * as X from "node:xxx"
+* - export { X } from "node:xxx"
+* Captures the base module name (e.g. "fs" from "node:fs/promises").
+*/
+const NODE_BUILTIN_IMPORT_RE = /(?:import|export|require)\s*(?:\(|[^(]*?\bfrom\s+)["'](?:node:)?([a-z_]+)(?:\/[^"']*)?\s*["']\)?/g;
+const LEADING_DOT_SLASH_RE = /^\.\//;
+const DIST_PREFIX_RE = /^dist\//;
+const MJS_EXT_RE = /\.m?js$/;
+const TS_TO_TSX_RE = /\.ts$/;
+/** Node.js built-in modules that shouldn't appear in sandbox code */
+const NODE_BUILTINS = new Set([
+	"assert",
+	"buffer",
+	"child_process",
+	"cluster",
+	"crypto",
+	"dgram",
+	"dns",
+	"domain",
+	"events",
+	"fs",
+	"http",
+	"http2",
+	"https",
+	"inspector",
+	"module",
+	"net",
+	"os",
+	"path",
+	"perf_hooks",
+	"process",
+	"punycode",
+	"querystring",
+	"readline",
+	"repl",
+	"stream",
+	"string_decoder",
+	"sys",
+	"timers",
+	"tls",
+	"trace_events",
+	"tty",
+	"url",
+	"util",
+	"v8",
+	"vm",
+	"wasi",
+	"worker_threads",
+	"zlib"
+]);
+async function fileExists$1(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Convert an absolute build artifact path into a portable ESM import specifier. */
+function toFileImportSpecifier(path) {
+	return pathToFileURL(path).href;
+}
+/**
+* Read image dimensions from a buffer.
+* Returns [width, height] or null if the format is unrecognized.
+*/
+function readImageDimensions(buf) {
+	try {
+		const result = imageSize(buf);
+		if (result.width != null && result.height != null) return [result.width, result.height];
+		return null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Extract manifest metadata from a ResolvedPlugin.
+* Strips functions (hooks, route handlers) and keeps only serializable metadata.
+*/
+function extractManifest(plugin) {
+	if ((plugin.admin.pages?.length ?? 0) > 0 || (plugin.admin.widgets?.length ?? 0) > 0) {
+		const adminRoute = plugin.routes.admin;
+		if (adminRoute && (adminRoute.public === true || !isJsonPostRouteContract(adminRoute))) throw new Error("Block Kit admin route must accept POST JSON requests and return JSON");
+	}
+	const declaredAccess = capabilitiesToDeclaredAccess$1(plugin.capabilities, plugin.allowedHosts);
+	const enforcedAccess = declaredAccessToCapabilities$1(declaredAccess);
+	const hooks = [];
+	for (const [name, resolved] of Object.entries(plugin.hooks)) {
+		if (!resolved) continue;
+		if (resolved.exclusive || resolved.priority !== 100 || resolved.timeout !== 5e3) {
+			const entry = { name };
+			if (resolved.exclusive) entry.exclusive = true;
+			if (resolved.priority !== 100) entry.priority = resolved.priority;
+			if (resolved.timeout !== 5e3) entry.timeout = resolved.timeout;
+			hooks.push(entry);
+		} else hooks.push(name);
+	}
+	const routes = Object.entries(plugin.routes).map(([name, route]) => extractManifestRoute(name, route));
+	const tools = Object.entries(plugin.mcp?.tools ?? {}).map(([name, tool]) => {
+		if (!MCP_TOOL_NAME_PATTERN.test(name)) throw new Error(`Invalid MCP tool name "${name}"`);
+		const route = plugin.routes[tool.route];
+		if (!route?.permission || route.public || route.response === "raw") throw new Error(`MCP tool "${name}" must reference a private route with a permission`);
+		if (!isJsonPostRouteContract(route)) throw new Error(`MCP tool "${name}" must reference a POST-compatible JSON route`);
+		return {
+			name,
+			description: tool.description,
+			route: tool.route,
+			permission: route.permission,
+			destructive: tool.destructive ?? false,
+			inputSchema: z.toJSONSchema(tool.input, { target: "draft-7" }),
+			...tool.output ? { outputSchema: z.toJSONSchema(tool.output, { target: "draft-7" }) } : {}
+		};
+	});
+	return {
+		id: plugin.id,
+		version: plugin.version,
+		declaredAccess,
+		capabilities: enforcedAccess.capabilities,
+		allowedHosts: plugin.allowedHosts,
+		storage: plugin.storage,
+		hooks,
+		routes,
+		...tools.length > 0 ? { mcp: { tools } } : {},
+		admin: {
+			settingsSchema: plugin.admin.settingsSchema,
+			pages: plugin.admin.pages,
+			widgets: plugin.admin.widgets,
+			editorPanels: plugin.admin.editorPanels,
+			editorActions: plugin.admin.editorActions
+		}
+	};
+}
+/**
+* Scan bundled code for Node.js built-in imports.
+* Matches require("node:xxx"), require("xxx"), import("node:xxx") — the patterns
+* that appear in bundled ESM/CJS output (not source-level named imports).
+* Returns deduplicated array of built-in module names found.
+*/
+function findNodeBuiltinImports(code) {
+	const found = [];
+	NODE_BUILTIN_IMPORT_RE.lastIndex = 0;
+	let match;
+	while ((match = NODE_BUILTIN_IMPORT_RE.exec(code)) !== null) {
+		const mod = match[1];
+		if (NODE_BUILTINS.has(mod)) found.push(mod);
+	}
+	return [...new Set(found)];
+}
+/**
+* Find a build output file by base name, checking common extensions.
+* tsdown may output .mjs, .js, or .cjs depending on format and config.
+*/
+async function findBuildOutput(dir, baseName) {
+	for (const ext of [
+		".mjs",
+		".js",
+		".cjs"
+	]) {
+		const candidate = join(dir, `${baseName}${ext}`);
+		if (await fileExists$1(candidate)) return candidate;
+	}
+}
+/**
+* Resolve a dist/built path back to its source .ts/.tsx equivalent.
+* E.g., "./dist/index.mjs" → "src/index.ts"
+*/
+async function resolveSourceEntry(pluginDir, distPath) {
+	const cleaned = distPath.replace(LEADING_DOT_SLASH_RE, "");
+	const srcPath = cleaned.replace(DIST_PREFIX_RE, "src/").replace(MJS_EXT_RE, ".ts");
+	const srcFull = resolve(pluginDir, srcPath);
+	if (await fileExists$1(srcFull)) return srcFull;
+	const tsxFull = resolve(pluginDir, srcPath.replace(TS_TO_TSX_RE, ".tsx"));
+	if (await fileExists$1(tsxFull)) return tsxFull;
+	const direct = resolve(pluginDir, cleaned);
+	if (await fileExists$1(direct)) return direct;
+}
+const TS_SOURCE_EXPORT_RE = /\.(?:ts|tsx|mts|cts|jsx)$/;
+/**
+* Find package.json exports that point to source files instead of built output.
+* Returns an array of `{ exportPath, resolvedPath }` for each offending export.
+*/
+function findSourceExports(exports) {
+	const issues = [];
+	for (const [exportPath, exportValue] of Object.entries(exports)) {
+		const resolved = typeof exportValue === "string" ? exportValue : exportValue && typeof exportValue === "object" && "import" in exportValue ? exportValue.import : null;
+		if (resolved && TS_SOURCE_EXPORT_RE.test(resolved)) issues.push({
+			exportPath,
+			resolvedPath: resolved
+		});
+	}
+	return issues;
+}
+/**
+* Recursively walk a staging directory and return a flat list of all files
+* with sizes. Names are relative to `dir` so they match what would appear
+* as the tarball entry name.
+*/
+async function collectBundleEntries(dir) {
+	const entries = [];
+	await walkBundle(dir, "", entries);
+	return entries;
+}
+async function walkBundle(dir, prefix, into) {
+	const items = await readdir(dir, { withFileTypes: true });
+	for (const item of items) {
+		const fullPath = join(dir, item.name);
+		const relPath = prefix ? `${prefix}/${item.name}` : item.name;
+		if (item.isFile()) {
+			const s = await stat(fullPath);
+			into.push({
+				name: relPath,
+				bytes: s.size
+			});
+		} else if (item.isDirectory()) await walkBundle(fullPath, relPath, into);
+	}
+}
+/**
+* Sum the byte sizes of all entries.
+*/
+function totalBundleBytes(entries) {
+	let total = 0;
+	for (const e of entries) total += e.bytes;
+	return total;
+}
+/**
+* Check a bundle against the three size caps from RFC 0001:
+*   - total decompressed ≤ MAX_BUNDLE_SIZE
+*   - per-file decompressed ≤ MAX_FILE_SIZE
+*   - file count ≤ MAX_FILE_COUNT
+*
+* Returns a list of violation messages (empty if the bundle is within all
+* caps). Messages are deterministic per input — the total/count violations
+* come first, then oversized files in alphabetical order — so the same
+* bundle always produces the same error text.
+*/
+function validateBundleSize(entries) {
+	const violations = [];
+	const total = totalBundleBytes(entries);
+	if (total > MAX_BUNDLE_SIZE) violations.push(`Bundle size ${formatBytes(total)} exceeds maximum of ${formatBytes(MAX_BUNDLE_SIZE)}.`);
+	if (entries.length > MAX_FILE_COUNT) violations.push(`Bundle contains ${entries.length} files, exceeds maximum of ${MAX_FILE_COUNT}.`);
+	const oversized = entries.filter((e) => e.bytes > MAX_FILE_SIZE).toSorted((a, b) => a.name.localeCompare(b.name));
+	for (const e of oversized) violations.push(`File ${e.name} is ${formatBytes(e.bytes)}, exceeds per-file maximum of ${formatBytes(MAX_FILE_SIZE)}.`);
+	return violations;
+}
+/**
+* Render a byte count as a human-friendly string (e.g. "256.0 KB").
+*/
+function formatBytes(n) {
+	if (n < 1024) return `${n} B`;
+	if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+	return `${(n / 1024 / 1024).toFixed(2)} MB`;
+}
+/**
+* Create a gzipped tarball from a directory.
+*/
+async function createTarball(sourceDir, outputPath) {
+	const { createGzip } = await import("node:zlib");
+	await pipeline(packTar(sourceDir), createGzip({ level: 9 }), createWriteStream(outputPath));
+}
+
+//#endregion
+//#region src/cli/commands/bundle.ts
+/**
+* emdash plugin bundle
+*
+* Produces a publishable plugin tarball from a plugin source directory.
+*
+* Steps:
+* 1. Resolve plugin entrypoint (finds definePlugin() export)
+* 2. Bundle backend code with tsdown → backend.js (single ES module, tree-shaken)
+* 3. Bundle admin code if present → admin.js
+* 4. Extract manifest from definePlugin() → manifest.json
+* 5. Collect assets (README.md, icon.png, screenshots/)
+* 6. Validate bundle (manifest schema, size limits, no Node.js builtins)
+* 7. Create tarball ({id}-{version}.tar.gz)
+*/
+var bundle_exports = /* @__PURE__ */ __exportAll({ bundleCommand: () => bundleCommand });
+const TS_EXT_RE = /\.(tsx?|[mc]?js)$/;
+const SLASH_RE = /\//g;
+const LEADING_AT_RE = /^@/;
+const emdash_SCOPE_RE = /^@emdash-cms\//;
+const bundleCommand = defineCommand({
+	meta: {
+		name: "bundle",
+		description: "Bundle a plugin for marketplace distribution"
+	},
+	args: {
+		dir: {
+			type: "string",
+			description: "Plugin directory (default: current directory)",
+			default: process.cwd()
+		},
+		outDir: {
+			type: "string",
+			alias: "o",
+			description: "Output directory for the tarball (default: ./dist)",
+			default: "dist"
+		},
+		validateOnly: {
+			type: "boolean",
+			description: "Run validation only, skip tarball creation",
+			default: false
+		}
+	},
+	async run({ args }) {
+		const pluginDir = resolve(args.dir);
+		const outDir = resolve(pluginDir, args.outDir);
+		const validateOnly = args.validateOnly;
+		consola.start(validateOnly ? "Validating plugin..." : "Bundling plugin...");
+		const pkgPath = join(pluginDir, "package.json");
+		if (!await fileExists$1(pkgPath)) {
+			consola.error("No package.json found in", pluginDir);
+			process.exit(1);
+		}
+		const pkg = JSON.parse(await readFile(pkgPath, "utf-8"));
+		let backendEntry;
+		let adminEntry;
+		if (pkg.exports) {
+			const sandboxExport = pkg.exports["./sandbox"];
+			if (typeof sandboxExport === "string") backendEntry = await resolveSourceEntry(pluginDir, sandboxExport);
+			else if (sandboxExport && typeof sandboxExport === "object" && "import" in sandboxExport) backendEntry = await resolveSourceEntry(pluginDir, sandboxExport.import);
+			const adminExport = pkg.exports["./admin"];
+			if (typeof adminExport === "string") adminEntry = await resolveSourceEntry(pluginDir, adminExport);
+			else if (adminExport && typeof adminExport === "object" && "import" in adminExport) adminEntry = await resolveSourceEntry(pluginDir, adminExport.import);
+		}
+		if (!backendEntry) {
+			const defaultSandbox = join(pluginDir, "src/sandbox-entry.ts");
+			if (await fileExists$1(defaultSandbox)) backendEntry = defaultSandbox;
+		}
+		let mainEntry;
+		if (pkg.exports?.["."] !== void 0) {
+			const mainExport = pkg.exports["."];
+			if (typeof mainExport === "string") mainEntry = await resolveSourceEntry(pluginDir, mainExport);
+			else if (mainExport && typeof mainExport === "object" && "import" in mainExport) mainEntry = await resolveSourceEntry(pluginDir, mainExport.import);
+		}
+		if (!mainEntry && pkg.main) mainEntry = await resolveSourceEntry(pluginDir, pkg.main);
+		if (!mainEntry) {
+			const defaultMain = join(pluginDir, "src/index.ts");
+			if (await fileExists$1(defaultMain)) mainEntry = defaultMain;
+		}
+		if (!mainEntry) {
+			consola.error("Cannot find plugin entrypoint. Expected src/index.ts or main/exports in package.json");
+			process.exit(1);
+		}
+		consola.info(`Main entry: ${mainEntry}`);
+		if (backendEntry) consola.info(`Backend entry: ${backendEntry}`);
+		if (adminEntry) consola.info(`Admin entry: ${adminEntry}`);
+		consola.start("Extracting plugin manifest...");
+		const { build } = await import("tsdown");
+		const tmpDir = join(pluginDir, ".emdash-bundle-tmp");
+		try {
+			await rm(tmpDir, {
+				recursive: true,
+				force: true
+			});
+			await mkdir(tmpDir, { recursive: true });
+			const mainOutDir = join(tmpDir, "main");
+			await build({
+				config: false,
+				entry: [mainEntry],
+				format: "esm",
+				outDir: mainOutDir,
+				dts: false,
+				platform: "node",
+				external: ["emdash", emdash_SCOPE_RE]
+			});
+			const pluginNodeModules = join(pluginDir, "node_modules");
+			const tmpNodeModules = join(mainOutDir, "node_modules");
+			if (await fileExists$1(pluginNodeModules)) await symlink(pluginNodeModules, tmpNodeModules, "junction");
+			const mainOutputPath = await findBuildOutput(mainOutDir, basename(mainEntry).replace(TS_EXT_RE, ""));
+			if (!mainOutputPath) {
+				consola.error("Failed to build main entry — no output found in", mainOutDir);
+				process.exit(1);
+			}
+			const pluginModule = await import(toFileImportSpecifier(mainOutputPath));
+			let resolvedPlugin;
+			if (typeof pluginModule.createPlugin === "function") resolvedPlugin = pluginModule.createPlugin();
+			else if (typeof pluginModule.default === "function") resolvedPlugin = pluginModule.default();
+			else if (typeof pluginModule.default === "object" && pluginModule.default !== null) {
+				const defaultExport = pluginModule.default;
+				if ("id" in defaultExport && "version" in defaultExport) resolvedPlugin = defaultExport;
+			}
+			if (!resolvedPlugin) for (const [key, value] of Object.entries(pluginModule)) {
+				if (key === "default" || typeof value !== "function") continue;
+				try {
+					const result = value();
+					if (result && typeof result === "object" && "id" in result && "version" in result) {
+						resolvedPlugin = {
+							id: result.id,
+							version: result.version,
+							capabilities: result.capabilities ?? [],
+							allowedHosts: result.allowedHosts ?? [],
+							storage: result.storage ?? {},
+							hooks: {},
+							routes: {},
+							admin: {
+								pages: result.adminPages,
+								widgets: result.adminWidgets
+							}
+						};
+						if (backendEntry) {
+							const backendProbeDir = join(tmpDir, "backend-probe");
+							const probeShimDir = join(tmpDir, "probe-shims");
+							await mkdir(probeShimDir, { recursive: true });
+							await writeFile(join(probeShimDir, "emdash.mjs"), "export const definePlugin = (d) => d;\n");
+							await build({
+								config: false,
+								entry: [backendEntry],
+								format: "esm",
+								outDir: backendProbeDir,
+								dts: false,
+								platform: "neutral",
+								external: [],
+								alias: { emdash: join(probeShimDir, "emdash.mjs") },
+								treeshake: true
+							});
+							const backendProbePath = await findBuildOutput(backendProbeDir, basename(backendEntry).replace(TS_EXT_RE, ""));
+							if (backendProbePath) {
+								const standardDef = (await import(toFileImportSpecifier(backendProbePath))).default ?? {};
+								const hooks = standardDef.hooks;
+								const routes = standardDef.routes;
+								if (hooks) for (const hookName of Object.keys(hooks)) {
+									const hookEntry = hooks[hookName];
+									const isConfig = typeof hookEntry === "object" && hookEntry !== null && "handler" in hookEntry;
+									const config = isConfig ? hookEntry : {};
+									resolvedPlugin.hooks[hookName] = {
+										handler: isConfig ? hookEntry.handler : hookEntry,
+										priority: config.priority ?? 100,
+										timeout: config.timeout ?? 5e3,
+										dependencies: config.dependencies ?? [],
+										errorPolicy: config.errorPolicy ?? "abort",
+										exclusive: config.exclusive ?? false,
+										pluginId: result.id
+									};
+								}
+								if (routes) for (const [name, route] of Object.entries(routes)) {
+									const routeObj = typeof route === "object" && route !== null ? route : {};
+									resolvedPlugin.routes[name] = {
+										handler: typeof route === "function" ? route : routeObj.handler,
+										...extractRouteOptions(route)
+									};
+								}
+							}
+						}
+						break;
+					}
+				} catch (error) {
+					if (resolvedPlugin) throw error;
+				}
+			}
+			if (!resolvedPlugin?.id || !resolvedPlugin?.version) {
+				consola.error("Could not extract plugin definition. Expected one of:\n  - createPlugin() export (native format)\n  - Descriptor factory function returning { id, version, ... } (standard format)");
+				process.exit(1);
+			}
+			const manifest = extractManifest(resolvedPlugin);
+			if (resolvedPlugin.admin?.entry) {
+				consola.error("Plugin declares adminEntry — React admin components require native/trusted mode. Use Block Kit for sandboxed admin pages, or remove adminEntry.");
+				process.exit(1);
+			}
+			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) {
+				consola.error("Plugin declares portableTextBlocks — these require native/trusted mode and cannot be bundled for the marketplace.");
+				process.exit(1);
+			}
+			consola.success(`Plugin: ${manifest.id}@${manifest.version}`);
+			consola.info(`  Capabilities: ${manifest.capabilities.length > 0 ? manifest.capabilities.join(", ") : "(none)"}`);
+			consola.info(`  Hooks: ${manifest.hooks.length > 0 ? manifest.hooks.map((h) => typeof h === "string" ? h : h.name).join(", ") : "(none)"}`);
+			consola.info(`  Routes: ${manifest.routes.length > 0 ? manifest.routes.map((r) => typeof r === "string" ? r : r.name).join(", ") : "(none)"}`);
+			const bundleDir = join(tmpDir, "bundle");
+			await mkdir(bundleDir, { recursive: true });
+			if (backendEntry) {
+				consola.start("Bundling backend...");
+				const shimDir = join(tmpDir, "shims");
+				await mkdir(shimDir, { recursive: true });
+				await writeFile(join(shimDir, "emdash.mjs"), "export const definePlugin = (d) => d;\n");
+				await build({
+					config: false,
+					entry: [backendEntry],
+					format: "esm",
+					outDir: join(tmpDir, "backend"),
+					dts: false,
+					platform: "neutral",
+					external: [],
+					alias: { emdash: join(shimDir, "emdash.mjs") },
+					minify: true,
+					treeshake: true
+				});
+				const backendBaseName = basename(backendEntry).replace(TS_EXT_RE, "");
+				const backendOutputPath = await findBuildOutput(join(tmpDir, "backend"), backendBaseName);
+				if (backendOutputPath) {
+					await copyFile(backendOutputPath, join(bundleDir, "backend.js"));
+					consola.success("Built backend.js");
+				} else {
+					consola.error("Backend build produced no output");
+					process.exit(1);
+				}
+			} else {
+				consola.warn("No sandbox entry found — bundle will have no backend.js");
+				consola.warn("  Add a \"sandbox-entry.ts\" in src/ or a \"./sandbox\" export in package.json");
+			}
+			if (adminEntry) {
+				consola.start("Bundling admin...");
+				await build({
+					config: false,
+					entry: [adminEntry],
+					format: "esm",
+					outDir: join(tmpDir, "admin"),
+					dts: false,
+					platform: "neutral",
+					external: [],
+					minify: true,
+					treeshake: true
+				});
+				const adminBaseName = basename(adminEntry).replace(TS_EXT_RE, "");
+				const adminOutputPath = await findBuildOutput(join(tmpDir, "admin"), adminBaseName);
+				if (adminOutputPath) {
+					await copyFile(adminOutputPath, join(bundleDir, "admin.js"));
+					consola.success("Built admin.js");
+				}
+			}
+			await writeFile(join(bundleDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+			consola.start("Collecting assets...");
+			const readmePath = join(pluginDir, "README.md");
+			if (await fileExists$1(readmePath)) {
+				await copyFile(readmePath, join(bundleDir, "README.md"));
+				consola.success("Included README.md");
+			}
+			const iconPath = join(pluginDir, "icon.png");
+			if (await fileExists$1(iconPath)) {
+				const dims = readImageDimensions(await readFile(iconPath));
+				if (!dims) consola.warn("icon.png is not a valid PNG — skipping");
+				else if (dims[0] !== ICON_SIZE || dims[1] !== ICON_SIZE) {
+					consola.warn(`icon.png is ${dims[0]}x${dims[1]}, expected ${ICON_SIZE}x${ICON_SIZE} — including anyway`);
+					await copyFile(iconPath, join(bundleDir, "icon.png"));
+				} else {
+					await copyFile(iconPath, join(bundleDir, "icon.png"));
+					consola.success("Included icon.png");
+				}
+			}
+			const screenshotsDir = join(pluginDir, "screenshots");
+			if (await fileExists$1(screenshotsDir)) {
+				const screenshotFiles = (await readdir(screenshotsDir)).filter((f) => {
+					const ext = extname(f).toLowerCase();
+					return ext === ".png" || ext === ".jpg" || ext === ".jpeg";
+				}).toSorted().slice(0, MAX_SCREENSHOTS);
+				if (screenshotFiles.length > 0) {
+					await mkdir(join(bundleDir, "screenshots"), { recursive: true });
+					for (const file of screenshotFiles) {
+						const filePath = join(screenshotsDir, file);
+						const dims = readImageDimensions(await readFile(filePath));
+						if (!dims) {
+							consola.warn(`screenshots/${file} — cannot read dimensions, skipping`);
+							continue;
+						}
+						if (dims[0] > MAX_SCREENSHOT_WIDTH || dims[1] > MAX_SCREENSHOT_HEIGHT) consola.warn(`screenshots/${file} is ${dims[0]}x${dims[1]}, max ${MAX_SCREENSHOT_WIDTH}x${MAX_SCREENSHOT_HEIGHT} — including anyway`);
+						await copyFile(filePath, join(bundleDir, "screenshots", file));
+					}
+					consola.success(`Included ${screenshotFiles.length} screenshot(s)`);
+				}
+			}
+			consola.start("Validating bundle...");
+			let hasErrors = false;
+			if (pkg.exports) for (const issue of findSourceExports(pkg.exports)) {
+				consola.error(`Export "${issue.exportPath}" points to source (${issue.resolvedPath}). Package exports must point to built files (e.g. dist/*.mjs). Add a build step and update the exports map.`);
+				hasErrors = true;
+			}
+			const backendPath = join(bundleDir, "backend.js");
+			if (await fileExists$1(backendPath)) {
+				const builtins = findNodeBuiltinImports(await readFile(backendPath, "utf-8"));
+				if (builtins.length > 0) {
+					consola.error(`backend.js imports Node.js built-in modules: ${builtins.join(", ")}`);
+					consola.error("Sandboxed plugins cannot use Node.js APIs");
+					hasErrors = true;
+				}
+			}
+			const declaresUnrestricted = manifest.capabilities.includes("network:request:unrestricted") || manifest.capabilities.includes("network:fetch:any");
+			const declaresHostRestricted = manifest.capabilities.includes("network:request") || manifest.capabilities.includes("network:fetch");
+			if (declaresUnrestricted) consola.warn("Plugin declares unrestricted network access (network:request:unrestricted) — it can make requests to any host");
+			else if (declaresHostRestricted && manifest.allowedHosts.length === 0) consola.warn("Plugin declares network:request capability but no allowedHosts — all requests will be blocked");
+			const deprecatedCaps = manifest.capabilities.filter(isDeprecatedCapability);
+			if (deprecatedCaps.length > 0) {
+				consola.warn("Plugin uses deprecated capability names. Rename them before publishing:");
+				for (const cap of deprecatedCaps) {
+					const replacement = CAPABILITY_RENAMES[cap];
+					consola.warn(`  ${cap} → ${replacement}`);
+				}
+			}
+			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) consola.warn("Plugin declares portableTextBlocks — these require trusted mode and will be ignored in sandboxed plugins");
+			if (resolvedPlugin.admin?.entry) consola.warn("Plugin declares admin.entry — custom React components require trusted mode. Use Block Kit for sandboxed admin pages");
+			if (resolvedPlugin.hooks["page:fragments"]) consola.warn("Plugin declares page:fragments hook — this is trusted-only and will not work in sandboxed mode");
+			const hasAdminPages = (manifest.admin?.pages?.length ?? 0) > 0;
+			const hasAdminWidgets = (manifest.admin?.widgets?.length ?? 0) > 0;
+			if (hasAdminPages || hasAdminWidgets) {
+				if (!manifest.routes.map((r) => typeof r === "string" ? r : r.name).includes("admin")) {
+					consola.error(`Plugin declares ${hasAdminPages ? "adminPages" : ""}${hasAdminPages && hasAdminWidgets ? " and " : ""}${hasAdminWidgets ? "adminWidgets" : ""} but the sandbox entry has no "admin" route. Add an admin route handler to serve Block Kit pages.`);
+					hasErrors = true;
+				}
+			}
+			const bundleEntries = await collectBundleEntries(bundleDir);
+			const sizeViolations = validateBundleSize(bundleEntries);
+			if (sizeViolations.length > 0) {
+				for (const v of sizeViolations) consola.error(v);
+				hasErrors = true;
+			} else consola.info(`Bundle size: ${formatBytes(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`);
+			if (hasErrors) {
+				consola.error("Bundle validation failed");
+				process.exit(1);
+			}
+			consola.success("Validation passed");
+			if (validateOnly) return;
+			await mkdir(outDir, { recursive: true });
+			const tarballName = `${manifest.id.replace(SLASH_RE, "-").replace(LEADING_AT_RE, "")}-${manifest.version}.tar.gz`;
+			const tarballPath = join(outDir, tarballName);
+			consola.start("Creating tarball...");
+			await createTarball(bundleDir, tarballPath);
+			const tarballSizeKB = ((await stat(tarballPath)).size / 1024).toFixed(1);
+			const tarballBuf = await readFile(tarballPath);
+			const checksum = createHash("sha256").update(tarballBuf).digest("hex");
+			consola.success(`Created ${tarballName} (${tarballSizeKB}KB)`);
+			consola.info(`  SHA-256: ${checksum}`);
+			consola.info(`  Path: ${tarballPath}`);
+		} finally {
+			if (tmpDir.endsWith(".emdash-bundle-tmp")) await rm(tmpDir, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+});
+
 //#endregion
 //#region src/cli/commands/plugin-init.ts
 /**
@@ -3192,7 +3979,7 @@ const pluginInitCommand = defineCommand({
 			process.exit(1);
 		}
 		const srcDir = join(targetDir, "src");
-		if (await fileExists$4(join(targetDir, "package.json"))) {
+		if (await fileExists$1(join(targetDir, "package.json"))) {
 			consola.error(`package.json already exists in ${targetDir}`);
 			process.exit(1);
 		}
@@ -3569,7 +4356,7 @@ async function pollGitHubDeviceFlow(tokenEndpoint, clientId, deviceCode, interva
 	}
 	throw new Error("Device code expired (timeout). Please try again.");
 }
-const manifestSummarySchema = pluginManifestSchema.pick({
+const manifestSummarySchema = pluginManifestBaseSchema.pick({
 	id: true,
 	version: true,
 	capabilities: true,
@@ -3674,7 +4461,7 @@ const publishCommand = defineCommand({
 			const pluginDir = resolve(args.dir);
 			try {
 				const { runCommand } = await import("citty");
-				const { bundleCommand } = await import("../bundle-CL0JjIPx.mjs").then((n) => n.n);
+				const { bundleCommand } = await Promise.resolve().then(() => bundle_exports);
 				await runCommand(bundleCommand, { rawArgs: ["--dir", pluginDir] });
 			} catch {
 				consola.error("Build failed");