emdash 0.40.0 → 0.41.0

package/dist/context-CGQLA1-a.mjs

@@ -0,0 +1,1922 @@
+import { n as validateJsonFieldName } from "./validate-DANX1-Qi.mjs";
+import { _ as pluginDataUpdateGuard, g as pluginDataOrderExpr, h as pluginDataExtractExpr, v as pluginDataWriteExpr } from "./dialect-helpers-7_IqPdh9.mjs";
+import { r as getI18nConfig, s as resolveContentCreateLocale } from "./config-CvmjJcVw.mjs";
+import { i as serializeConditionalValue, n as assertStorageKey, r as assertStorageRevision, t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { t as ContentRepository } from "./content-CbnufDsM.mjs";
+import { c as encodeCursor, s as decodeCursor } from "./types-aOOxRSx6.mjs";
+import { r as normalizeRevisionLimit, t as RevisionRepository } from "./revision-j1p4-bOj.mjs";
+import { t as withTransaction } from "./transaction-DLPQWik1.mjs";
+import { t as isValidFocalPointUpdate } from "./focal-point-CZ3d1wK5.mjs";
+import { t as MediaRepository } from "./media-BUQePMxP.mjs";
+import { t as UserRepository } from "./user-ElwQjTQT.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-CKDwM61Y.mjs";
+import { t as CommentRepository } from "./comment-D2uvL63j.mjs";
+import { a as resolveLocalizedContentRoutePath } from "./resolve-C0s1E_fH.mjs";
+import { t as RedirectRepository } from "./redirect-D1ArbO85.mjs";
+import { n as normalizeMime, t as matchesMimeAllowlist } from "./mime-C94qBG-P.mjs";
+import { t as enrichImageMetadata } from "./enrich-DBtCncE2.mjs";
+import { t as EntryLockRepository } from "./entry-locks-BTyQLdbC.mjs";
+import { t as SeoRepository } from "./seo-XvH4LNNp.mjs";
+import { f as findTaxonomyStructure, h as selectTaxonomyDefs } from "./loader-CrRPfkHS.mjs";
+import { U as markContentMediaUsageCollectionStaleSafely, n as SchemaRegistry } from "./registry-CFcNCayZ.mjs";
+import { n as handleMediaDelete } from "./media-DH8ibNlY.mjs";
+import { createPluginSecretRedactor } from "./plugins/secret-redactor.mjs";
+import { s as invalidateSiteSettingsCache, u as createSettingsAccess } from "./settings-D5EHi0Tk.mjs";
+import { s as handleTermCreate } from "./taxonomies-Byyo7LOZ.mjs";
+import { o as stripCredentialHeaders, r as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-Dv0_tRpo.mjs";
+import { f as updateRedirectBody, t as createRedirectBody } from "./redirects-BjTwDTsV.mjs";
+import { t as CONTENT_TYPE_RE } from "./media-OEIQ3bVc.mjs";
+import { t as GLOBAL_UPLOAD_ALLOWLIST } from "./media-allowlist-pYtaBA95.mjs";
+import { a as handleRedirectCreate, c as handleRedirectList, l as handleRedirectUpdate, o as handleRedirectDelete } from "./redirects-Ck50kH3n.mjs";
+import { t as CronAccessImpl } from "./cron-c4D5C5Fx.mjs";
+import { bufferPluginHttpRequest, pluginHttpRedirectAction, pluginHttpResponseFromWire, pluginHttpResponseToWire, rewritePluginHttpRedirect } from "./plugins/http-wire.mjs";
+import { sql } from "kysely";
+import { ulid } from "ulidx";
+import mime from "mime/lite";
+
+//#region src/plugins/storage-query.ts
+/**
+* Error thrown when querying non-indexed fields
+*/
+var StorageQueryError = class extends Error {
+	constructor(message, field, suggestion) {
+		super(message);
+		this.field = field;
+		this.suggestion = suggestion;
+		this.name = "StorageQueryError";
+	}
+};
+/**
+* Error thrown when a guarded `updateIf` loses a concurrent race by aborting
+* rather than resolving to `{ applied: false }`.
+*
+* `updateIf`'s `{ applied: false }` contract (row absent OR guard failed)
+* assumes READ COMMITTED — the default. There, a losing concurrent writer
+* re-evaluates the guard against the winner's freshly committed row and
+* cleanly resolves to `{ applied: false }`. Two aborts escape that contract:
+*
+* - `40001` (serialization_failure), only above READ COMMITTED, where the
+*   loser cannot re-read against a newer snapshot.
+* - `40P01` (deadlock_detected), at any isolation level, when transactions
+*   take row locks in opposite order.
+*
+* This error surfaces either abort so the caller can retry the write.
+*
+* The no-oversell SAFETY invariant holds either way: a losing writer NEVER
+* applies its update — it either sees `{ applied: false }` or throws here.
+*/
+var StorageSerializationError = class extends Error {
+	code = "STORAGE_SERIALIZATION_FAILURE";
+	retryable = true;
+	/** The Postgres SQLSTATE that triggered this error (`40001` / `40P01`). */
+	sqlState;
+	constructor(message, options) {
+		super(message, { cause: options?.cause });
+		this.name = "StorageSerializationError";
+		this.sqlState = options?.sqlState;
+	}
+};
+/**
+* Check if a value is a range filter
+*/
+function isRangeFilter(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return "gt" in value || "gte" in value || "lt" in value || "lte" in value;
+}
+/**
+* Check if a value is an IN filter
+*/
+function isInFilter(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return "in" in value && Array.isArray(value.in);
+}
+/**
+* Check if a value is a startsWith filter
+*/
+function isStartsWithFilter(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return "startsWith" in value && typeof value.startsWith === "string";
+}
+/**
+* Escape LIKE pattern metacharacters so a startsWith prefix matches
+* literally. Without this, `%` and `_` in the prefix act as wildcards
+* (e.g. `{ startsWith: "50%" }` would match "50x off").
+*/
+function escapeLikePattern(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
+/**
+* Get the set of indexed fields from index declarations
+*/
+function getIndexedFields(indexes) {
+	const fields = /* @__PURE__ */ new Set();
+	for (const index of indexes) if (Array.isArray(index)) for (const field of index) fields.add(field);
+	else fields.add(index);
+	return fields;
+}
+/**
+* Validate that all fields in a where clause are indexed
+*/
+function validateWhereClause(where, indexedFields, pluginId, collection) {
+	for (const field of Object.keys(where)) if (!indexedFields.has(field)) throw new StorageQueryError(`Cannot query on non-indexed field '${field}'.`, field, `Add '${field}' to storage.${collection}.indexes in plugin '${pluginId}' to enable this query.`);
+}
+/**
+* Validate orderBy fields are indexed
+*/
+function validateOrderByClause(orderBy, indexedFields, pluginId, collection) {
+	for (const field of Object.keys(orderBy)) if (!indexedFields.has(field)) throw new StorageQueryError(`Cannot order by non-indexed field '${field}'.`, field, `Add '${field}' to storage.${collection}.indexes in plugin '${pluginId}' to enable ordering by this field.`);
+}
+/**
+* SQL expression for extracting a queryable field from the `_plugin_storage.data`
+* column.
+*
+* Delegates to `pluginDataExtractExpr`, which validates the field name before
+* interpolation and applies the dialect-correct extraction: a `::jsonb` cast on
+* Postgres (the `data` column is `text`) plus an optional type-guarded
+* `::numeric` cast so numeric comparisons don't fall back to lexical text
+* ordering.
+*/
+function jsonExtract(db, field, options) {
+	return pluginDataExtractExpr(db, field, options);
+}
+/**
+* SQL expression for ordering by a `_plugin_storage.data` field.
+*
+* Delegates to `pluginDataOrderExpr`, which orders over the jsonb-native value
+* on Postgres so numeric fields sort numerically (not lexically) while staying
+* total across heterogeneous data. SQLite keeps `json_extract` (already numeric).
+*/
+function jsonOrderExtract(db, field) {
+	return pluginDataOrderExpr(db, field);
+}
+/**
+* Build a WHERE clause condition for a single field
+*/
+function buildCondition(db, field, value) {
+	const extractFor = (numeric) => jsonExtract(db, field, { numeric });
+	if (value === null) return {
+		sql: `${extractFor(false)} IS NULL`,
+		params: []
+	};
+	if (typeof value === "number") return {
+		sql: `${extractFor(true)} = ?`,
+		params: [value]
+	};
+	if (typeof value === "string") return {
+		sql: `${extractFor(false)} = ?`,
+		params: [value]
+	};
+	if (typeof value === "boolean") return {
+		sql: `${extractFor(false)} = ?`,
+		params: [value]
+	};
+	if (isInFilter(value)) {
+		const numeric = value.in.length > 0 && value.in.every((v) => typeof v === "number");
+		const placeholders = value.in.map(() => "?").join(", ");
+		return {
+			sql: `${extractFor(numeric)} IN (${placeholders})`,
+			params: value.in
+		};
+	}
+	if (isStartsWithFilter(value)) return {
+		sql: `${extractFor(false)} LIKE ? ESCAPE '\\'`,
+		params: [`${escapeLikePattern(value.startsWith)}%`]
+	};
+	if (isRangeFilter(value)) {
+		const conditions = [];
+		const params = [];
+		const pushBound = (op, bound) => {
+			conditions.push(`${extractFor(typeof bound === "number")} ${op} ?`);
+			params.push(bound);
+		};
+		if (value.gt !== void 0) pushBound(">", value.gt);
+		if (value.gte !== void 0) pushBound(">=", value.gte);
+		if (value.lt !== void 0) pushBound("<", value.lt);
+		if (value.lte !== void 0) pushBound("<=", value.lte);
+		if (conditions.length === 0) throw new StorageQueryError(`Range filter for field '${field}' has no defined bound`, field, "Provide at least one of gt, gte, lt, or lte, or omit the field.");
+		return {
+			sql: conditions.join(" AND "),
+			params
+		};
+	}
+	throw new StorageQueryError(`Unknown filter type for field '${field}'`);
+}
+/**
+* Build a complete WHERE clause from a WhereClause object
+*/
+function buildWhereClause(db, where) {
+	const conditions = [];
+	const params = [];
+	for (const [field, value] of Object.entries(where)) {
+		const condition = buildCondition(db, field, value);
+		if (!condition.sql) continue;
+		conditions.push(condition.sql);
+		params.push(...condition.params);
+	}
+	if (conditions.length === 0) return {
+		sql: "",
+		params: []
+	};
+	return {
+		sql: conditions.join(" AND "),
+		params
+	};
+}
+
+//#endregion
+//#region src/plugins/storage-update.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireRecord(value, label) {
+	if (!isRecord(value)) throw new TypeError(`${label} must be an object`);
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) throw new TypeError(`${label} must be a plain object`);
+	return value;
+}
+function operand(value) {
+	if (typeof value === "string" || typeof value === "number" && Number.isFinite(value)) return value;
+	throw new TypeError("Storage guard operands must be strings or finite numbers");
+}
+function normalizeFilter(value) {
+	if (value === null || typeof value === "boolean") return value;
+	if (typeof value === "string" || typeof value === "number") return operand(value);
+	const filter = requireRecord(value, "Storage guard filter");
+	const values = filter.in;
+	if (Array.isArray(values)) return { in: Array.from(values, operand) };
+	const prefix = filter.startsWith;
+	if (typeof prefix === "string") return { startsWith: prefix };
+	const range = {};
+	for (const key of [
+		"gt",
+		"gte",
+		"lt",
+		"lte"
+	]) if (key in filter) {
+		const bound = filter[key];
+		range[key] = bound === void 0 ? void 0 : operand(bound);
+	}
+	return range;
+}
+function parseStorageUpdate(value) {
+	const args = requireRecord(value, "Storage update arguments");
+	if (Object.keys(args).some((key) => key !== "where" && key !== "set" && key !== "delta")) throw new TypeError("Unknown storage update argument");
+	const where = {};
+	for (const [field, filter] of Object.entries(requireRecord(args.where, "Storage where guard"))) {
+		validateJsonFieldName(field);
+		where[field] = normalizeFilter(filter);
+	}
+	const set = args.set === void 0 ? {} : requireRecord(args.set, "Storage set");
+	const delta = args.delta === void 0 ? {} : requireRecord(args.delta, "Storage delta");
+	const setEntries = [];
+	for (const [field, entry] of Object.entries(set)) {
+		if (entry === void 0) continue;
+		validateJsonFieldName(field);
+		const serialized = JSON.stringify(entry);
+		if (serialized === void 0) throw new TypeError("Storage set values must be JSON serializable");
+		const normalized = JSON.parse(serialized);
+		setEntries.push([field, normalized]);
+	}
+	const setFields = new Set(setEntries.map(([field]) => field));
+	const deltaEntries = [];
+	for (const [field, entry] of Object.entries(delta)) {
+		if (entry === void 0) continue;
+		validateJsonFieldName(field);
+		if (setFields.has(field)) throw new TypeError("Storage field appears in both set and delta");
+		const spec = requireRecord(entry, "Storage numeric delta");
+		const keys = Object.keys(spec);
+		const key = keys[0];
+		if (keys.length !== 1 || key !== "inc" && key !== "dec") throw new TypeError("Storage delta must contain exactly one of inc or dec");
+		const amount = spec[key];
+		if (typeof amount !== "number" || !Number.isSafeInteger(amount)) throw new TypeError("Storage delta must be a safe integer");
+		deltaEntries.push([field, key === "dec" ? -amount : amount]);
+	}
+	if (setEntries.length + deltaEntries.length === 0) throw new TypeError("Storage update requires at least one of set or delta");
+	return {
+		where,
+		setEntries,
+		deltaEntries
+	};
+}
+
+//#endregion
+//#region src/database/repositories/plugin-storage.ts
+/**
+* SQLSTATEs a losing concurrent `updateIf` writer can abort with.
+*
+* `40001` (serialization_failure) is raised only above READ COMMITTED, where
+* the loser cannot re-evaluate its guard against a newer snapshot. `40P01`
+* (deadlock_detected) is not tied to isolation level: it needs only two
+* transactions taking row locks in opposite order, which a caller reaches at
+* READ COMMITTED by wrapping several `updateIf` calls in one transaction.
+*/
+const SERIALIZATION_SQLSTATES = new Set(["40001", "40P01"]);
+function errSqlState(err) {
+	if (typeof err !== "object" || err === null) return void 0;
+	const code = err.code;
+	if (typeof code === "string") return code;
+	const cause = err.cause;
+	if (typeof cause === "object" && cause !== null) {
+		const causeCode = cause.code;
+		if (typeof causeCode === "string") return causeCode;
+	}
+}
+function mapSerializationFailure(err) {
+	const sqlState = errSqlState(err);
+	if (sqlState !== void 0 && SERIALIZATION_SQLSTATES.has(sqlState)) return new StorageSerializationError("Storage write must be retried. Restart the transaction before retrying when using an explicit transaction.", {
+		cause: err,
+		sqlState
+	});
+	return err;
+}
+/**
+* Interleave a `?`-placeholder SQL string with its params into a single
+* boolean raw expression. Used as a WHERE predicate directly — wrapping it
+* in `(...) = 1` breaks on Postgres, which has a strict boolean type (#920).
+*/
+function rawWhereExpr(sqlText, params) {
+	const parts = [];
+	let paramIndex = 0;
+	const sqlParts = sqlText.split("?");
+	for (let i = 0; i < sqlParts.length; i++) {
+		if (i > 0) parts.push(sql`${params[paramIndex++]}`);
+		if (sqlParts[i]) parts.push(sql.raw(sqlParts[i]));
+	}
+	return sql`(${sql.join(parts, sql.raw(""))})`;
+}
+/**
+* Plugin Storage Repository
+*
+* Implements the StorageCollection interface for a specific plugin and collection.
+*/
+/**
+* Rank a sort expression so NULLs get a deterministic position.
+*
+* A missing key in a schemaless document extracts as NULL, which sorts
+* differently per dialect (SQLite first, Postgres last) and makes every
+* comparison against it UNKNOWN. Sorting on this rank ahead of the value puts
+* NULLs in the same place on both dialects and keeps the seek operands
+* non-NULL.
+*/
+function nullRank(expr) {
+	return sql`(case when ${expr} is null then 1 else 0 end)`;
+}
+var PluginStorageRepository = class {
+	indexedFields;
+	constructor(db, pluginId, collection, indexes) {
+		this.db = db;
+		this.pluginId = pluginId;
+		this.collection = collection;
+		this.indexedFields = getIndexedFields(indexes);
+	}
+	/**
+	* Get a document by ID
+	*/
+	async get(id) {
+		const row = await this.db.selectFrom("_plugin_storage").select("data").where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "=", id).executeTakeFirst();
+		if (!row) return null;
+		return JSON.parse(row.data);
+	}
+	/**
+	* Store a document
+	*/
+	async put(id, data) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const jsonData = JSON.stringify(data);
+		const revision = crypto.randomUUID();
+		await this.db.insertInto("_plugin_storage").values({
+			plugin_id: this.pluginId,
+			collection: this.collection,
+			id,
+			data: jsonData,
+			revision,
+			created_at: now,
+			updated_at: now
+		}).onConflict((oc) => oc.columns([
+			"plugin_id",
+			"collection",
+			"id"
+		]).doUpdateSet({
+			data: jsonData,
+			revision,
+			updated_at: now
+		})).execute();
+	}
+	async getVersioned(id) {
+		assertStorageKey(id);
+		const row = await this.db.selectFrom("_plugin_storage").select(["data", "revision"]).where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "=", id).executeTakeFirst();
+		if (!row) return null;
+		return {
+			value: JSON.parse(row.data),
+			revision: row.revision
+		};
+	}
+	async compareAndSet(id, expectedRevision, data) {
+		assertStorageKey(id);
+		if (expectedRevision !== null) assertStorageRevision(expectedRevision);
+		const jsonData = serializeConditionalValue(data);
+		const revision = crypto.randomUUID();
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const row = expectedRevision === null ? await this.db.insertInto("_plugin_storage").values({
+			plugin_id: this.pluginId,
+			collection: this.collection,
+			id,
+			data: jsonData,
+			revision,
+			created_at: now,
+			updated_at: now
+		}).onConflict((oc) => oc.columns([
+			"plugin_id",
+			"collection",
+			"id"
+		]).doNothing()).returning("revision").executeTakeFirst() : await this.db.updateTable("_plugin_storage").set({
+			data: jsonData,
+			revision,
+			updated_at: now
+		}).where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "=", id).where("revision", "=", expectedRevision).returning("revision").executeTakeFirst();
+		return row ? {
+			applied: true,
+			revision: row.revision
+		} : { applied: false };
+	}
+	async compareAndDelete(id, expectedRevision) {
+		assertStorageKey(id);
+		assertStorageRevision(expectedRevision);
+		return { applied: await this.db.deleteFrom("_plugin_storage").where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "=", id).where("revision", "=", expectedRevision).returning("id").executeTakeFirst() !== void 0 };
+	}
+	/**
+	* Delete a document
+	*/
+	async delete(id) {
+		return ((await this.db.deleteFrom("_plugin_storage").where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "=", id).executeTakeFirst()).numDeletedRows ?? 0) > 0;
+	}
+	/**
+	* Check if a document exists
+	*/
+	async exists(id) {
+		return !!await this.db.selectFrom("_plugin_storage").select("id").where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "=", id).executeTakeFirst();
+	}
+	/**
+	* Get multiple documents by ID
+	*/
+	async getMany(ids) {
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		const rows = await this.db.selectFrom("_plugin_storage").select(["id", "data"]).where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "in", ids).execute();
+		const result = /* @__PURE__ */ new Map();
+		for (const row of rows) result.set(row.id, JSON.parse(row.data));
+		return result;
+	}
+	/**
+	* Store multiple documents
+	*/
+	async putMany(items) {
+		if (items.length === 0) return;
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		await withTransaction(this.db, async (trx) => {
+			for (const item of items) {
+				const jsonData = JSON.stringify(item.data);
+				const revision = crypto.randomUUID();
+				await trx.insertInto("_plugin_storage").values({
+					plugin_id: this.pluginId,
+					collection: this.collection,
+					id: item.id,
+					data: jsonData,
+					revision,
+					created_at: now,
+					updated_at: now
+				}).onConflict((oc) => oc.columns([
+					"plugin_id",
+					"collection",
+					"id"
+				]).doUpdateSet({
+					data: jsonData,
+					revision,
+					updated_at: now
+				})).execute();
+			}
+		});
+	}
+	/**
+	* Delete multiple documents
+	*/
+	async deleteMany(ids) {
+		if (ids.length === 0) return 0;
+		const result = await this.db.deleteFrom("_plugin_storage").where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "in", ids).executeTakeFirst();
+		return Number(result.numDeletedRows ?? 0);
+	}
+	/**
+	* Query documents with filters
+	*/
+	async query(options = {}) {
+		const { where = {}, orderBy = {}, cursor } = options;
+		const limit = Math.min(options.limit ?? 50, 100);
+		validateWhereClause(where, this.indexedFields, this.pluginId, this.collection);
+		if (Object.keys(orderBy).length > 0) validateOrderByClause(orderBy, this.indexedFields, this.pluginId, this.collection);
+		let query = this.db.selectFrom("_plugin_storage").select([
+			"id",
+			"data",
+			"created_at"
+		]).where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection);
+		const whereResult = buildWhereClause(this.db, where);
+		if (whereResult.sql) query = query.where(rawWhereExpr(whereResult.sql, whereResult.params));
+		const orderEntries = Object.entries(orderBy);
+		const orderDirections = new Set(orderEntries.map(([, direction]) => direction));
+		const descending = orderEntries.length > 0 && orderEntries[0][1] === "desc";
+		const sortExpr = (field) => sql`${sql.raw(jsonOrderExtract(this.db, field))}`;
+		if (cursor) {
+			const decoded = decodeCursor(cursor);
+			if (orderEntries.length === 0) query = query.where(({ eb }) => eb(sql`(created_at, id)`, ">", sql`(${decoded.orderValue}, ${decoded.id})`));
+			else {
+				if (orderDirections.size > 1) throw new StorageQueryError("Cursor pagination requires every orderBy field to share one direction.", Object.keys(orderBy).join(", "), "Sort every field the same way, or page without a cursor.");
+				const op = descending ? sql`<` : sql`>`;
+				const cursorExpr = (field) => sql`(select ${sql.raw(jsonOrderExtract(this.db, field))} from _plugin_storage where plugin_id = ${this.pluginId} and collection = ${this.collection} and id = ${decoded.id})`;
+				const fields = orderEntries.map(([field]) => {
+					const own = sortExpr(field);
+					const theirs = cursorExpr(field);
+					return {
+						equal: sql`(${nullRank(own)} = ${nullRank(theirs)} and (${nullRank(own)} = 1 or ${own} = ${theirs}))`,
+						after: sql`(${nullRank(own)} ${op} ${nullRank(theirs)} or (${nullRank(own)} = ${nullRank(theirs)} and ${nullRank(own)} = 0 and ${own} ${op} ${theirs}))`
+					};
+				});
+				const terms = fields.map((_, k) => sql`(${sql.join([...fields.slice(0, k).map((f) => f.equal), fields[k].after], sql` and `)})`);
+				terms.push(sql`(${sql.join([...fields.map((f) => f.equal), sql`id ${op} ${decoded.id}`], sql` and `)})`);
+				query = query.where(sql`(${sql.join(terms, sql` or `)})`);
+			}
+		}
+		if (orderEntries.length > 0) {
+			for (const [field, direction] of orderEntries) {
+				const dir = direction === "desc" ? sql`desc` : sql`asc`;
+				const expr = sortExpr(field);
+				query = query.orderBy(sql`${nullRank(expr)} ${dir}`);
+				query = query.orderBy(sql`${expr} ${dir}`);
+			}
+			query = query.orderBy("id", descending ? "desc" : "asc");
+		} else query = query.orderBy("created_at", "asc").orderBy("id", "asc");
+		query = query.limit(limit + 1);
+		const rows = await query.execute();
+		const hasMore = rows.length > limit;
+		const items = rows.slice(0, limit).map((row) => ({
+			id: row.id,
+			data: JSON.parse(row.data)
+		}));
+		let nextCursor;
+		if (hasMore) {
+			const lastItem = rows[limit - 1];
+			if (lastItem) nextCursor = encodeCursor(lastItem.created_at, lastItem.id);
+		}
+		return {
+			items,
+			cursor: nextCursor,
+			hasMore
+		};
+	}
+	/**
+	* Count documents matching a filter
+	*/
+	async count(where) {
+		if (where && Object.keys(where).length > 0) validateWhereClause(where, this.indexedFields, this.pluginId, this.collection);
+		let query = this.db.selectFrom("_plugin_storage").select(sql`COUNT(*)`.as("count")).where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection);
+		if (where && Object.keys(where).length > 0) {
+			const whereResult = buildWhereClause(this.db, where);
+			if (whereResult.sql) query = query.where(rawWhereExpr(whereResult.sql, whereResult.params));
+		}
+		const result = await query.executeTakeFirst();
+		return Number(result?.count ?? 0);
+	}
+	async updateIf(id, args) {
+		if (typeof id !== "string") throw new TypeError("Storage ID must be a string");
+		const { where, setEntries, deltaEntries } = parseStorageUpdate(args);
+		for (const value of Object.values(where)) if (isInFilter(value) && value.in.length === 0) return { applied: false };
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const dataExpr = pluginDataWriteExpr(this.db, setEntries, deltaEntries);
+		let query = this.db.updateTable("_plugin_storage").set({
+			data: dataExpr,
+			updated_at: now
+		}).where("plugin_id", "=", this.pluginId).where("collection", "=", this.collection).where("id", "=", id).where(pluginDataUpdateGuard(this.db, deltaEntries));
+		const whereResult = buildWhereClause(this.db, where);
+		if (whereResult.sql) query = query.where(rawWhereExpr(whereResult.sql, whereResult.params));
+		let row;
+		try {
+			row = await query.returning("data").executeTakeFirst();
+		} catch (err) {
+			throw mapSerializationFailure(err);
+		}
+		if (!row) return { applied: false };
+		return {
+			applied: true,
+			data: JSON.parse(row.data)
+		};
+	}
+};
+
+//#endregion
+//#region src/plugins/content-access.ts
+function createContentAccess(db, accessOptions) {
+	const contentRepo = new ContentRepository(db);
+	const seoRepo = new SeoRepository(db);
+	return {
+		async get(collection, id) {
+			const item = await contentRepo.findById(collection, id);
+			if (!item) return null;
+			const result = {
+				id: item.id,
+				type: item.type,
+				slug: item.slug,
+				status: item.status,
+				data: item.data,
+				createdAt: item.createdAt,
+				updatedAt: item.updatedAt,
+				locale: item.locale,
+				publishedAt: item.publishedAt,
+				scheduledAt: item.scheduledAt,
+				authorId: item.authorId,
+				translationGroup: item.translationGroup,
+				liveRevisionId: item.liveRevisionId,
+				draftRevisionId: item.draftRevisionId,
+				version: item.version
+			};
+			if (await seoRepo.isEnabled(collection)) result.seo = await seoRepo.get(collection, item.id);
+			return result;
+		},
+		async list(collection, options) {
+			let orderBy;
+			if (options?.orderBy) {
+				const first = Object.entries(options.orderBy)[0];
+				if (first) orderBy = {
+					field: first[0],
+					direction: first[1]
+				};
+			}
+			const result = await contentRepo.findMany(collection, {
+				limit: options?.limit ?? 50,
+				cursor: options?.cursor,
+				orderBy,
+				where: options?.where
+			});
+			const items = result.items.map((item) => ({
+				id: item.id,
+				type: item.type,
+				slug: item.slug,
+				status: item.status,
+				data: item.data,
+				createdAt: item.createdAt,
+				updatedAt: item.updatedAt,
+				locale: item.locale,
+				publishedAt: item.publishedAt,
+				scheduledAt: item.scheduledAt,
+				authorId: item.authorId,
+				translationGroup: item.translationGroup,
+				liveRevisionId: item.liveRevisionId,
+				draftRevisionId: item.draftRevisionId,
+				version: item.version
+			}));
+			if (items.length > 0 && await seoRepo.isEnabled(collection)) {
+				const seoMap = await seoRepo.getMany(collection, items.map((item) => item.id));
+				for (const item of items) {
+					const seo = seoMap.get(item.id);
+					if (seo) item.seo = seo;
+				}
+			}
+			return {
+				items,
+				cursor: result.nextCursor,
+				hasMore: !!result.nextCursor
+			};
+		},
+		async getTranslations(collection, id) {
+			const item = await contentRepo.findById(collection, id);
+			if (!item) throw new Error(`Content not found: ${collection}/${id}`);
+			return {
+				translationGroup: item.translationGroup || item.id,
+				translations: (item.translationGroup ? await contentRepo.findTranslations(collection, item.translationGroup) : [item]).map((translation) => ({
+					id: translation.id,
+					locale: translation.locale,
+					slug: translation.slug,
+					status: translation.status,
+					updatedAt: translation.updatedAt
+				}))
+			};
+		},
+		async getPublicUrl(collection, id) {
+			const site = accessOptions?.site;
+			if (!site?.url) return null;
+			const [item, collectionInfo] = await Promise.all([contentRepo.findById(collection, id), new SchemaRegistry(db).getCollection(collection)]);
+			if (!item || item.status !== "published" || !item.slug || !collectionInfo?.routable) return null;
+			const path = await resolveLocalizedContentRoutePath({
+				pattern: collectionInfo.urlPattern ?? null,
+				collection,
+				slug: item.slug,
+				id: item.id,
+				date: item.publishedAt,
+				locale: item.locale || site.locale,
+				trailingSlash: site.trailingSlash
+			});
+			return path === null ? null : `${site.url}${path}`;
+		},
+		...accessOptions?.revisions ? {
+			async listRevisions(collection, id, revisionOptions) {
+				return (await new RevisionRepository(db).findVisibleByEntry(collection, id, { limit: normalizeRevisionLimit(revisionOptions?.limit) })).map(({ authorId: _authorId, ...revision }) => revision);
+			},
+			async getRevision(collection, id, revisionId) {
+				const revision = await new RevisionRepository(db).findVisibleById(collection, id, revisionId);
+				if (!revision) return null;
+				const { authorId: _authorId, ...safeRevision } = revision;
+				return safeRevision;
+			}
+		} : {}
+	};
+}
+
+//#endregion
+//#region src/plugins/media.ts
+const DEFAULT_PLUGIN_MEDIA_READ_BYTES = 10 * 1024 * 1024;
+const MAX_PLUGIN_MEDIA_READ_BYTES = 16 * 1024 * 1024;
+function mediaUrl(item) {
+	return `/_emdash/api/media/asset/${encodeURIComponent(item.id)}/${encodeURIComponent(item.filename)}`;
+}
+function toPluginMediaItem(item) {
+	return {
+		id: item.id,
+		filename: item.filename,
+		mimeType: item.mimeType,
+		size: item.size,
+		url: mediaUrl(item),
+		createdAt: item.createdAt,
+		width: item.width,
+		height: item.height,
+		alt: item.alt,
+		caption: item.caption,
+		focalX: item.focalX,
+		focalY: item.focalY,
+		blurhash: item.blurhash,
+		dominantColor: item.dominantColor,
+		folderId: item.folderId ?? null,
+		status: "ready"
+	};
+}
+function resolveByteLimit(maxBytes) {
+	const limit = maxBytes ?? DEFAULT_PLUGIN_MEDIA_READ_BYTES;
+	if (!Number.isSafeInteger(limit) || limit <= 0 || limit > MAX_PLUGIN_MEDIA_READ_BYTES) throw new RangeError(`media.readBytes maxBytes must be a positive integer no greater than ${MAX_PLUGIN_MEDIA_READ_BYTES}`);
+	return limit;
+}
+async function readStreamWithLimit(body, maxBytes) {
+	const reader = body.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > maxBytes) {
+				try {
+					await reader.cancel();
+				} catch {}
+				throw new PluginMediaByteLimitError(`Media exceeds the requested ${maxBytes}-byte limit`);
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+var PluginMediaByteLimitError = class extends RangeError {};
+async function readPluginMediaBytes(db, storage, id, options) {
+	if (!storage) throw new Error("Media storage is not configured");
+	const limit = resolveByteLimit(options?.maxBytes);
+	const item = await new MediaRepository(db).findById(id);
+	if (!item || item.status !== "ready") throw new Error("Media item is not ready or does not exist");
+	let bytes;
+	try {
+		bytes = await readStreamWithLimit((await storage.download(item.storageKey)).body, limit);
+	} catch (error) {
+		if (error instanceof PluginMediaByteLimitError) throw error;
+		throw new Error("Failed to read media bytes");
+	}
+	return {
+		bytes,
+		filename: item.filename,
+		mimeType: item.mimeType,
+		size: bytes.byteLength,
+		...item.contentHash ? { contentHash: item.contentHash } : {}
+	};
+}
+async function updatePluginMediaMetadata(db, id, patch) {
+	const parsed = parsePluginMediaMetadataPatch(patch);
+	const item = await new MediaRepository(db).updateReadyMetadata(id, parsed);
+	if (!item) throw new Error("Media item is not ready or does not exist");
+	return toPluginMediaItem(item);
+}
+const MEDIA_METADATA_KEYS = new Set([
+	"alt",
+	"caption",
+	"focalX",
+	"focalY"
+]);
+function parsePluginMediaMetadataPatch(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("media.updateMetadata patch must be an object");
+	const keys = Object.keys(value);
+	if (keys.length === 0) throw new TypeError("media.updateMetadata must change at least one metadata field");
+	for (const key of keys) if (!MEDIA_METADATA_KEYS.has(key)) throw new TypeError(`media.updateMetadata cannot change ${key}`);
+	const alt = Reflect.get(value, "alt");
+	const caption = Reflect.get(value, "caption");
+	const focalX = Reflect.get(value, "focalX");
+	const focalY = Reflect.get(value, "focalY");
+	if (alt !== void 0 && alt !== null && typeof alt !== "string") throw new TypeError("media.updateMetadata alt must be a string or null");
+	if (caption !== void 0 && caption !== null && typeof caption !== "string") throw new TypeError("media.updateMetadata caption must be a string or null");
+	if (focalX !== void 0 && focalX !== null && typeof focalX !== "number") throw new TypeError("media.updateMetadata focalX must be a number or null");
+	if (focalY !== void 0 && focalY !== null && typeof focalY !== "number") throw new TypeError("media.updateMetadata focalY must be a number or null");
+	const patch = {};
+	if (alt !== void 0) patch.alt = alt;
+	if (caption !== void 0) patch.caption = caption;
+	if (focalX !== void 0) patch.focalX = focalX;
+	if (focalY !== void 0) patch.focalY = focalY;
+	if (!isValidFocalPointUpdate(patch)) throw new TypeError("focalX and focalY must both be valid numbers or both be null");
+	return patch;
+}
+
+//#endregion
+//#region src/plugins/route-error.ts
+/**
+* Error class for plugin routes
+* Allows plugins to return structured errors with specific HTTP status codes
+*/
+var PluginRouteError = class PluginRouteError extends Error {
+	constructor(code, message, status = 400, details) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.details = details;
+		this.name = "PluginRouteError";
+	}
+	/**
+	* Create a bad request error (400)
+	*/
+	static badRequest(message, details) {
+		return new PluginRouteError("BAD_REQUEST", message, 400, details);
+	}
+	/**
+	* Create an unauthorized error (401)
+	*/
+	static unauthorized(message = "Unauthorized") {
+		return new PluginRouteError("UNAUTHORIZED", message, 401);
+	}
+	/**
+	* Create a forbidden error (403)
+	*/
+	static forbidden(message = "Forbidden") {
+		return new PluginRouteError("FORBIDDEN", message, 403);
+	}
+	/**
+	* Create a not found error (404)
+	*/
+	static notFound(message = "Not found") {
+		return new PluginRouteError("NOT_FOUND", message, 404);
+	}
+	/**
+	* Create a conflict error (409)
+	*/
+	static conflict(message, details) {
+		return new PluginRouteError("CONFLICT", message, 409, details);
+	}
+	/**
+	* Create an internal error (500)
+	*/
+	static internal(message = "Internal error") {
+		return new PluginRouteError("INTERNAL_ERROR", message, 500);
+	}
+};
+
+//#endregion
+//#region src/plugins/context.ts
+/**
+* Create KV accessor for a plugin
+* All keys are automatically prefixed with the plugin ID
+*/
+function createKVAccess(optionsRepo, pluginId, settings = createSettingsAccess(optionsRepo, pluginId)) {
+	const prefix = `plugin:${pluginId}:`;
+	return {
+		async get(key) {
+			if (key.startsWith("settings:")) return settings.get(key.slice(9));
+			return optionsRepo.get(`${prefix}${key}`);
+		},
+		async getVersioned(key) {
+			assertStorageKey(key);
+			if (key.startsWith("settings:")) return settings.getVersioned(key.slice(9));
+			return optionsRepo.getVersioned(`${prefix}${key}`);
+		},
+		async compareAndSet(key, expectedRevision, value) {
+			assertStorageKey(key);
+			if (key.startsWith("settings:")) return settings.compareAndSet(key.slice(9), expectedRevision, value);
+			return optionsRepo.compareAndSet(`${prefix}${key}`, expectedRevision, value);
+		},
+		async compareAndDelete(key, expectedRevision) {
+			assertStorageKey(key);
+			if (key.startsWith("settings:")) return settings.compareAndDelete(key.slice(9), expectedRevision);
+			return optionsRepo.compareAndDelete(`${prefix}${key}`, expectedRevision);
+		},
+		async set(key, value) {
+			if (key.startsWith("settings:")) {
+				await settings.set(key.slice(9), value);
+				return;
+			}
+			await optionsRepo.set(`${prefix}${key}`, value);
+		},
+		async delete(key) {
+			if (key.startsWith("settings:")) return settings.delete(key.slice(9));
+			return optionsRepo.delete(`${prefix}${key}`);
+		},
+		async list(keyPrefix) {
+			const requestedPrefix = keyPrefix ?? "";
+			const includesSettings = "settings:".startsWith(requestedPrefix) || requestedPrefix.startsWith("settings:");
+			const fullPrefix = `${prefix}${requestedPrefix}`;
+			const entriesMap = await optionsRepo.getByPrefix(fullPrefix);
+			const result = [];
+			for (const [fullKey, value] of entriesMap) {
+				if (includesSettings && fullKey.startsWith(`${prefix}settings:`)) continue;
+				result.push({
+					key: fullKey.slice(prefix.length),
+					value
+				});
+			}
+			if (includesSettings) {
+				const settingPrefix = requestedPrefix.startsWith("settings:") ? requestedPrefix.slice(9) : "";
+				for (const entry of await settings.list(settingPrefix)) {
+					const key = `settings:${entry.key}`;
+					if (key.startsWith(requestedPrefix)) result.push({
+						key,
+						value: entry.value
+					});
+				}
+			}
+			return result;
+		}
+	};
+}
+/**
+* Create storage collection accessor for a plugin
+* Wraps PluginStorageRepository with the v2 interface (no async iterators)
+*/
+function createStorageCollection(db, pluginId, collectionName, indexes) {
+	const repo = new PluginStorageRepository(db, pluginId, collectionName, indexes);
+	return {
+		get: (id) => repo.get(id),
+		getVersioned: (id) => repo.getVersioned(id),
+		compareAndSet: (id, expectedRevision, data) => repo.compareAndSet(id, expectedRevision, data),
+		compareAndDelete: (id, expectedRevision) => repo.compareAndDelete(id, expectedRevision),
+		put: (id, data) => repo.put(id, data),
+		delete: (id) => repo.delete(id),
+		exists: (id) => repo.exists(id),
+		getMany: (ids) => repo.getMany(ids),
+		putMany: (items) => repo.putMany(items),
+		deleteMany: (ids) => repo.deleteMany(ids),
+		count: (where) => repo.count(where),
+		updateIf: (id, updateArgs) => repo.updateIf(id, updateArgs),
+		async query(options) {
+			const result = await repo.query({
+				where: options?.where,
+				orderBy: options?.orderBy,
+				limit: options?.limit,
+				cursor: options?.cursor
+			});
+			return {
+				items: result.items,
+				cursor: result.cursor,
+				hasMore: result.hasMore
+			};
+		}
+	};
+}
+/**
+* Create storage accessor with all declared collections
+*/
+function createStorageAccess(db, pluginId, storageConfig) {
+	const storage = {};
+	for (const [collectionName, config] of Object.entries(storageConfig)) storage[collectionName] = createStorageCollection(db, pluginId, collectionName, [...config.indexes, ...config.uniqueIndexes ?? []]);
+	return storage;
+}
+/**
+* Extract `seo` from a plugin-supplied content write input and return both
+* parts. Mutates nothing — returns a new field map without the `seo` key.
+*/
+function splitSeoFromInput(input) {
+	const { seo, ...fields } = input;
+	if (seo !== void 0 && (seo === null || typeof seo !== "object" || Array.isArray(seo))) throw new Error("content.seo must be an object");
+	return {
+		fields,
+		seo
+	};
+}
+/**
+* Reject writing SEO to a collection that does not have it enabled.
+* Matches the REST API behavior (VALIDATION_ERROR).
+*/
+async function assertSeoEnabled(seoRepo, collection, seo) {
+	const hasSeo = await seoRepo.isEnabled(collection);
+	if (seo !== void 0 && !hasSeo) throw new Error(`Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`);
+	return hasSeo;
+}
+/**
+* Parse the `collections` JSON column into a string array (`[]` on anything
+* else). Mirrors the guards in the Cloudflare/workerd bridges so an
+* in-process plugin degrades on malformed data instead of crashing.
+*/
+function parseCollectionsColumn(value) {
+	if (!value) return [];
+	try {
+		const parsed = JSON.parse(value);
+		return Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : [];
+	} catch {
+		return [];
+	}
+}
+/** Map a repository `Taxonomy` row to the plugin-facing term shape. */
+function taxonomyToTermInfo(term) {
+	return {
+		id: term.id,
+		taxonomy: term.name,
+		slug: term.slug,
+		label: term.label,
+		parentId: term.parentId,
+		data: term.data,
+		locale: term.locale,
+		translationGroup: term.translationGroup
+	};
+}
+function collectionToSchemaInfo(collection) {
+	if (!collection) return null;
+	return {
+		slug: collection.slug,
+		label: collection.label,
+		labelSingular: collection.labelSingular ?? null,
+		description: collection.description ?? null,
+		supports: collection.supports,
+		hasSeo: collection.hasSeo,
+		titleField: collection.titleField ?? null,
+		dateField: collection.dateField ?? null,
+		urlPattern: collection.urlPattern ?? null,
+		routable: collection.routable !== false,
+		hidden: collection.hidden,
+		fields: collection.fields.map((field) => ({
+			slug: field.slug,
+			label: field.label,
+			type: field.type,
+			required: field.required,
+			unique: field.unique,
+			...field.defaultValue === void 0 ? {} : { default: field.defaultValue },
+			...field.validation === void 0 ? {} : { validation: field.validation },
+			...field.widget === void 0 ? {} : { widget: field.widget },
+			...field.options === void 0 ? {} : { options: field.options },
+			searchable: field.searchable,
+			indexed: field.indexed,
+			translatable: field.translatable,
+			sortOrder: field.sortOrder
+		}))
+	};
+}
+function createSchemaAccess(db) {
+	const registry = new SchemaRegistry(db);
+	return {
+		async listCollections() {
+			const collections = [];
+			for (const collection of await registry.listCollectionsWithFields()) {
+				const info = collectionToSchemaInfo(collection);
+				if (info) collections.push(info);
+			}
+			return collections;
+		},
+		async getCollection(slug) {
+			return collectionToSchemaInfo(await registry.getCollectionWithFields(slug));
+		}
+	};
+}
+/**
+* Create read-only taxonomy access (gated on `taxonomies:read`).
+*/
+function createTaxonomyAccess(db) {
+	const taxonomyRepo = new TaxonomyRepository(db);
+	return {
+		async getAll(options) {
+			let query = selectTaxonomyDefs(db);
+			if (options?.locale !== void 0) query = query.where("d.locale", "=", options.locale);
+			return (await query.orderBy("d.name", "asc").execute()).map((row) => ({
+				name: row.name,
+				label: row.label,
+				labelSingular: row.label_singular,
+				hierarchical: row.hierarchical === 1,
+				collections: parseCollectionsColumn(row.collections),
+				locale: row.locale
+			}));
+		},
+		async getTerms(taxonomy, options) {
+			return (await taxonomyRepo.findByName(taxonomy, { locale: options?.locale })).map(taxonomyToTermInfo);
+		},
+		async getEntryTerms(collection, entryId, options) {
+			return (await taxonomyRepo.getTermsForEntry(collection, entryId, options?.taxonomy, options?.locale)).map(taxonomyToTermInfo);
+		}
+	};
+}
+function toPluginComment(comment) {
+	if (comment.status === "trash") throw new Error("Trashed comments are not plugin-readable");
+	return {
+		id: comment.id,
+		collection: comment.collection,
+		contentId: comment.contentId,
+		parentId: comment.parentId,
+		authorName: comment.authorName,
+		authorEmail: comment.authorEmail,
+		body: comment.body,
+		status: comment.status,
+		ipHash: comment.ipHash,
+		userAgent: comment.userAgent,
+		moderationMetadata: comment.moderationMetadata,
+		createdAt: comment.createdAt,
+		updatedAt: comment.updatedAt
+	};
+}
+function createCommentAccess(db, moderate) {
+	const repo = new CommentRepository(db);
+	return {
+		async get(id) {
+			const comment = await repo.findById(id);
+			return !comment || comment.status === "trash" ? null : toPluginComment(comment);
+		},
+		async list(options = {}) {
+			const result = await repo.findForPlugin(options);
+			return {
+				items: result.items.map(toPluginComment),
+				cursor: result.nextCursor,
+				hasMore: result.nextCursor !== void 0
+			};
+		},
+		count: (options) => repo.countForPlugin(options),
+		...moderate ? { setStatus: (id, status, options) => moderate(id, status, options.expectedStatus) } : {}
+	};
+}
+var RedirectAccessError = class extends Error {
+	name = "RedirectAccessError";
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const REDIRECT_REVISION_PREFIX = "r1.";
+const BASE64_PADDING_RE = /=+$/;
+function encodeRedirectRevision(id, revision) {
+	const payload = `${id}\0${revision}`;
+	return `${REDIRECT_REVISION_PREFIX}${btoa(payload).replaceAll("+", "-").replaceAll("/", "_").replace(BASE64_PADDING_RE, "")}`;
+}
+function decodeRedirectRevision(id, revision) {
+	if (typeof revision !== "string" || !revision.startsWith(REDIRECT_REVISION_PREFIX)) throw new RedirectAccessError("INVALID_PRECONDITION", "Invalid redirect revision");
+	try {
+		const encoded = revision.slice(3).replaceAll("-", "+").replaceAll("_", "/");
+		const padded = encoded.padEnd(Math.ceil(encoded.length / 4) * 4, "=");
+		const [revisionId, updatedAt, extra] = atob(padded).split("\0");
+		if (revisionId !== id || !updatedAt || extra !== void 0) throw new Error("invalid");
+		return updatedAt;
+	} catch (error) {
+		if (error instanceof RedirectAccessError) throw error;
+		throw new RedirectAccessError("INVALID_PRECONDITION", "Invalid redirect revision");
+	}
+}
+function toRedirectInfo(redirect) {
+	return {
+		...redirect,
+		type: redirect.type
+	};
+}
+function toVersionedRedirect(record) {
+	return {
+		redirect: toRedirectInfo(record.redirect),
+		_rev: encodeRedirectRevision(record.redirect.id, record.configRevision)
+	};
+}
+async function readVersionedRedirect(repo, id) {
+	const record = await repo.findVersionedById(id);
+	return record ? toVersionedRedirect(record) : null;
+}
+function throwRedirectResult(error) {
+	throw new RedirectAccessError(error.code, error.message);
+}
+function assertNoAutomaticRedirectMarker(input) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new RedirectAccessError("VALIDATION_ERROR", "Redirect input must be an object");
+	if (Object.hasOwn(input, "auto")) throw new RedirectAccessError("VALIDATION_ERROR", "The automatic redirect marker is managed by EmDash");
+}
+function createRedirectAccess(db, writable = false) {
+	const repo = new RedirectRepository(db);
+	const readAccess = {
+		async list(options = {}) {
+			const result = await handleRedirectList(db, options);
+			if (!result.success) return throwRedirectResult(result.error);
+			return {
+				items: result.data.items.map(toRedirectInfo),
+				cursor: result.data.nextCursor,
+				hasMore: result.data.nextCursor !== void 0
+			};
+		},
+		get: (id) => readVersionedRedirect(repo, id)
+	};
+	if (!writable) return readAccess;
+	return {
+		...readAccess,
+		async create(input) {
+			assertNoAutomaticRedirectMarker(input);
+			const parsed = createRedirectBody.safeParse(input);
+			if (!parsed.success) throw new RedirectAccessError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid redirect");
+			const result = await handleRedirectCreate(db, parsed.data);
+			if (!result.success) return throwRedirectResult(result.error);
+			const current = await readVersionedRedirect(repo, result.data.id);
+			if (!current) throw new RedirectAccessError("NOT_FOUND", "Created redirect not found");
+			return current;
+		},
+		async update(id, input) {
+			assertNoAutomaticRedirectMarker(input);
+			const { _rev, ...patch } = input;
+			const expectedRevision = decodeRedirectRevision(id, _rev);
+			const parsed = updateRedirectBody.safeParse(patch);
+			if (!parsed.success) throw new RedirectAccessError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid redirect");
+			const result = await handleRedirectUpdate(db, id, parsed.data, { expectedRevision });
+			if (!result.success) return throwRedirectResult(result.error);
+			const current = await readVersionedRedirect(repo, result.data.id);
+			if (!current) throw new RedirectAccessError("NOT_FOUND", "Updated redirect not found");
+			return current;
+		},
+		async delete(id, options) {
+			if (typeof options !== "object" || options === null) throw new RedirectAccessError("INVALID_PRECONDITION", "Invalid redirect revision");
+			const result = await handleRedirectDelete(db, id, { expectedRevision: decodeRedirectRevision(id, options._rev) });
+			if (!result.success) return throwRedirectResult(result.error);
+			return result.data.deleted;
+		}
+	};
+}
+const MAX_TAXONOMY_DELTA_TERMS = 64;
+function taxonomyAccessError(code, message) {
+	return Object.assign(new Error(message), { code });
+}
+async function resolveTaxonomyDelta(db, collection, entryId, taxonomy, termIds) {
+	if (termIds.length > MAX_TAXONOMY_DELTA_TERMS) throw taxonomyAccessError("VALIDATION_ERROR", `A taxonomy assignment delta can contain at most ${MAX_TAXONOMY_DELTA_TERMS} term IDs`);
+	if (termIds.some((id) => typeof id !== "string" || id.length === 0)) throw taxonomyAccessError("VALIDATION_ERROR", "Taxonomy term IDs must be non-empty strings");
+	const structure = await findTaxonomyStructure(db, taxonomy);
+	if (!structure) throw taxonomyAccessError("NOT_FOUND", `Taxonomy '${taxonomy}' not found`);
+	if (!structure.collections.includes(collection)) throw taxonomyAccessError("VALIDATION_ERROR", `Taxonomy '${taxonomy}' is not attached to collection '${collection}'`);
+	const entry = await new ContentRepository(db).findById(collection, entryId);
+	if (!entry) throw taxonomyAccessError("NOT_FOUND", `Content entry '${entryId}' not found in '${collection}'`);
+	const repo = new TaxonomyRepository(db);
+	const groups = [];
+	for (const id of new Set(termIds)) {
+		const term = await repo.findByIdOrTranslationGroup(id);
+		if (!term) throw taxonomyAccessError("NOT_FOUND", `Taxonomy term '${id}' not found`);
+		if (term.name !== taxonomy) throw taxonomyAccessError("VALIDATION_ERROR", `Taxonomy term '${id}' belongs to '${term.name}', not '${taxonomy}'`);
+		groups.push(term.translationGroup ?? term.id);
+	}
+	return {
+		repo,
+		groups,
+		locale: entry.locale ?? getI18nConfig()?.defaultLocale ?? "en"
+	};
+}
+async function readResolvedEntryTerms(repo, collection, entryId, taxonomy, locale) {
+	const defaultLocale = getI18nConfig()?.defaultLocale ?? locale;
+	return (await repo.getTermAssignmentsForEntry(collection, entryId, taxonomy, locale, defaultLocale)).flatMap(({ term }) => term ? [taxonomyToTermInfo(term)] : []);
+}
+function createTaxonomyAccessWithWrite(db) {
+	return {
+		...createTaxonomyAccess(db),
+		async createTerm(taxonomy, input) {
+			const result = await handleTermCreate(db, taxonomy, input);
+			if (!result.success) throw taxonomyAccessError(result.error.code, result.error.message);
+			const { term } = result.data;
+			return {
+				id: term.id,
+				taxonomy: term.name,
+				slug: term.slug,
+				label: term.label,
+				parentId: term.parentId,
+				data: term.description ? { description: term.description } : null,
+				locale: term.locale,
+				translationGroup: term.translationGroup
+			};
+		},
+		async addEntryTerms(collection, entryId, taxonomy, termIds) {
+			const { repo, groups, locale } = await resolveTaxonomyDelta(db, collection, entryId, taxonomy, termIds);
+			await repo.attachGroupsToEntry(collection, entryId, groups);
+			return readResolvedEntryTerms(repo, collection, entryId, taxonomy, locale);
+		},
+		async removeEntryTerms(collection, entryId, taxonomy, termIds) {
+			const { repo, groups, locale } = await resolveTaxonomyDelta(db, collection, entryId, taxonomy, termIds);
+			await repo.detachGroupsFromEntry(collection, entryId, groups);
+			return readResolvedEntryTerms(repo, collection, entryId, taxonomy, locale);
+		}
+	};
+}
+async function afterContentWrite(recordWrite) {
+	if (typeof recordWrite === "function") await recordWrite();
+}
+/**
+* Create full content access with write operations.
+*
+* `create` and `update` accept a reserved `seo` key in their `data`
+* argument. When present, it is routed to the core SEO panel
+* (`_emdash_seo`) via `SeoRepository.upsert`, in the same transaction as
+* the content write. The returned `ContentItem.seo` reflects the resulting
+* SEO state for SEO-enabled collections.
+*/
+function createContentAccessWithWrite(db, beforeContentWrite, accessOptions, contentCreate) {
+	return {
+		...createContentAccess(db, accessOptions),
+		async create(collection, data, options) {
+			const locale = resolveContentCreateLocale(options?.locale);
+			const recordWrite = await beforeContentWrite?.();
+			if (contentCreate) {
+				const created = await contentCreate({
+					collection,
+					input: data,
+					options: {
+						...options,
+						locale
+					}
+				});
+				await afterContentWrite(recordWrite);
+				return created;
+			}
+			const { fields, seo } = splitSeoFromInput(data);
+			let contentMutated = false;
+			try {
+				const created = await withTransaction(db, async (trx) => {
+					const trxContentRepo = new ContentRepository(trx);
+					const trxSeoRepo = new SeoRepository(trx);
+					const hasSeo = await assertSeoEnabled(trxSeoRepo, collection, seo);
+					const item = await trxContentRepo.create({
+						type: collection,
+						data: fields,
+						locale,
+						translationOf: options?.translationOf
+					});
+					contentMutated = true;
+					const result = {
+						id: item.id,
+						type: item.type,
+						slug: item.slug,
+						status: item.status,
+						data: item.data,
+						createdAt: item.createdAt,
+						updatedAt: item.updatedAt,
+						locale: item.locale,
+						publishedAt: item.publishedAt,
+						scheduledAt: item.scheduledAt
+					};
+					if (hasSeo) result.seo = seo !== void 0 ? await trxSeoRepo.upsert(collection, item.id, seo) : await trxSeoRepo.get(collection, item.id);
+					return result;
+				});
+				await markContentMediaUsageCollectionStaleSafely(db, collection, "CONTENT_USAGE_STALE");
+				await afterContentWrite(recordWrite);
+				return created;
+			} catch (error) {
+				if (contentMutated) await markContentMediaUsageCollectionStaleSafely(db, collection, "CONTENT_USAGE_STALE");
+				throw error;
+			}
+		},
+		async update(collection, id, data) {
+			const recordWrite = await beforeContentWrite?.();
+			const { fields, seo } = splitSeoFromInput(data);
+			const hasFieldUpdates = Object.keys(fields).length > 0;
+			let contentMutated = false;
+			try {
+				const updated = await withTransaction(db, async (trx) => {
+					const trxContentRepo = new ContentRepository(trx);
+					const trxSeoRepo = new SeoRepository(trx);
+					const hasSeo = await assertSeoEnabled(trxSeoRepo, collection, seo);
+					const item = hasFieldUpdates ? await trxContentRepo.updateDraftAware(collection, id, { data: fields }) : await (async () => {
+						const existing = await trxContentRepo.findById(collection, id);
+						if (!existing) throw new Error("Content not found");
+						return existing;
+					})();
+					if (hasFieldUpdates) contentMutated = true;
+					const result = {
+						id: item.id,
+						type: item.type,
+						slug: item.slug,
+						status: item.status,
+						data: item.data,
+						createdAt: item.createdAt,
+						updatedAt: item.updatedAt,
+						locale: item.locale,
+						publishedAt: item.publishedAt,
+						scheduledAt: item.scheduledAt
+					};
+					if (hasSeo) result.seo = seo !== void 0 ? await trxSeoRepo.upsert(collection, item.id, seo) : await trxSeoRepo.get(collection, item.id);
+					return result;
+				});
+				if (hasFieldUpdates) await markContentMediaUsageCollectionStaleSafely(db, collection, "CONTENT_USAGE_STALE");
+				await afterContentWrite(recordWrite);
+				return updated;
+			} catch (error) {
+				if (contentMutated) await markContentMediaUsageCollectionStaleSafely(db, collection, "CONTENT_USAGE_STALE");
+				throw error;
+			}
+		},
+		async delete(collection, id) {
+			const recordWrite = await beforeContentWrite?.();
+			const deleted = await new ContentRepository(db).delete(collection, id);
+			if (deleted) {
+				await new EntryLockRepository(db).releaseEntry(collection, id);
+				await markContentMediaUsageCollectionStaleSafely(db, collection, "CONTENT_USAGE_STALE");
+				await afterContentWrite(recordWrite);
+			}
+			return deleted;
+		}
+	};
+}
+/**
+* Create read-only media access
+*/
+function createMediaAccess(db) {
+	const mediaRepo = new MediaRepository(db);
+	return {
+		async get(id) {
+			const item = await mediaRepo.findById(id);
+			return item?.status === "ready" ? toPluginMediaItem(item) : null;
+		},
+		async list(options) {
+			const result = await mediaRepo.findMany({
+				limit: options?.limit ?? 50,
+				cursor: options?.cursor,
+				mimeType: options?.mimeType
+			});
+			return {
+				items: result.items.map(toPluginMediaItem),
+				cursor: result.nextCursor,
+				hasMore: !!result.nextCursor
+			};
+		}
+	};
+}
+function mediaReadDenied() {
+	throw new Error("Missing capability: media:read");
+}
+function createBlockedMediaReadAccess() {
+	return {
+		get: async () => mediaReadDenied(),
+		list: async () => mediaReadDenied()
+	};
+}
+function allowedUploadType(contentType) {
+	if (!CONTENT_TYPE_RE.test(contentType)) throw PluginRouteError.badRequest("Invalid content type");
+	const mimeType = normalizeMime(contentType);
+	if (!matchesMimeAllowlist(mimeType, GLOBAL_UPLOAD_ALLOWLIST)) throw new PluginRouteError("UNSUPPORTED_MEDIA_TYPE", "File type not allowed", 415);
+	return mimeType;
+}
+function uploadStorageKey(filename, mimeType) {
+	const keyPrefix = ulid();
+	const basename = filename.split("/").pop() ?? filename;
+	const dotIdx = basename.lastIndexOf(".");
+	const nameExt = dotIdx > 0 ? basename.slice(dotIdx + 1).toLowerCase() : "";
+	const nameType = mime.getType(nameExt);
+	const nameExtAllowed = nameType !== null && matchesMimeAllowlist(nameType, GLOBAL_UPLOAD_ALLOWLIST);
+	const ext = nameType === mimeType ? nameExt : mime.getExtension(mimeType) ?? (nameExtAllowed ? nameExt : null);
+	return {
+		basename,
+		storageKey: ext ? `${keyPrefix}.${ext}` : keyPrefix
+	};
+}
+/**
+* Create full media access with write operations.
+*
+* `getUploadUrlFn` is optional: when omitted, `getUploadUrl()` is derived from
+* `storage` (create a pending record + a signed PUT URL), mirroring the REST
+* `/_emdash/api/media/upload-url` endpoint. `upload()` only needs `storage`.
+* If storage is not provided, both throw at call time.
+*/
+function createMediaAccessWithWrite(db, getUploadUrlFn, storage) {
+	const mediaRepo = new MediaRepository(db);
+	const readAccess = createMediaAccess(db);
+	const getUploadUrl = getUploadUrlFn ? async (filename, contentType) => getUploadUrlFn(filename, allowedUploadType(contentType)) : async (filename, contentType) => {
+		if (!storage) throw new Error("Media getUploadUrl() requires a storage backend. Configure storage in PluginContextFactoryOptions.");
+		const mimeType = allowedUploadType(contentType);
+		const { basename, storageKey } = uploadStorageKey(filename, mimeType);
+		const media = await mediaRepo.createPending({
+			filename: basename,
+			mimeType,
+			storageKey
+		});
+		return {
+			uploadUrl: (await storage.getSignedUploadUrl({
+				key: storageKey,
+				contentType: mimeType,
+				expiresIn: 3600
+			})).url,
+			mediaId: media.id
+		};
+	};
+	return {
+		...readAccess,
+		getUploadUrl,
+		async upload(filename, contentType, bytes) {
+			if (!storage) throw new Error("Media upload() requires a storage backend. Configure storage in PluginContextFactoryOptions.");
+			const mimeType = allowedUploadType(contentType);
+			const { basename, storageKey } = uploadStorageKey(filename, mimeType);
+			await storage.upload({
+				key: storageKey,
+				body: new Uint8Array(bytes),
+				contentType: mimeType
+			});
+			const enriched = await enrichImageMetadata(new Uint8Array(bytes), mimeType);
+			let media;
+			try {
+				media = await mediaRepo.create({
+					filename: basename,
+					mimeType,
+					size: bytes.byteLength,
+					storageKey,
+					status: "ready",
+					width: enriched.width,
+					height: enriched.height,
+					blurhash: enriched.blurhash,
+					dominantColor: enriched.dominantColor
+				});
+			} catch (error) {
+				try {
+					await storage.delete(storageKey);
+				} catch {}
+				throw error;
+			}
+			return {
+				mediaId: media.id,
+				storageKey,
+				url: `/_emdash/api/media/file/${storageKey}`
+			};
+		},
+		async delete(id) {
+			const result = await handleMediaDelete(db, id, storage);
+			if (!result.success) {
+				if (result.error.code === "NOT_FOUND") return false;
+				throw new Error(result.error.message);
+			}
+			invalidateSiteSettingsCache();
+			return true;
+		}
+	};
+}
+/** Maximum number of redirects to follow in plugin HTTP access */
+const MAX_PLUGIN_REDIRECTS = 5;
+function stripTrailingDots(value) {
+	let end = value.length;
+	while (end > 0 && value.charCodeAt(end - 1) === 46) end--;
+	return end === value.length ? value : value.slice(0, end);
+}
+/**
+* Check if a hostname matches any pattern in the allowed list.
+* Patterns: "*" matches all, "*.example.com" matches subdomains AND bare "example.com",
+* "api.example.com" matches exactly.
+*/
+function isHostAllowed(host, allowedHosts) {
+	const normalizedHost = stripTrailingDots(host.toLowerCase());
+	return allowedHosts.some((pattern) => {
+		const normalizedPattern = stripTrailingDots(pattern.toLowerCase());
+		if (normalizedPattern === "*") return true;
+		if (normalizedPattern.startsWith("*.")) {
+			const suffix = normalizedPattern.slice(1);
+			return normalizedHost.endsWith(suffix) || normalizedHost === normalizedPattern.slice(2);
+		}
+		return normalizedHost === normalizedPattern;
+	});
+}
+function tryParsePluginHttpTarget(url) {
+	try {
+		return new URL(url);
+	} catch {
+		return null;
+	}
+}
+async function validatePluginHttpTarget(pluginId, url) {
+	try {
+		return await resolveAndValidateExternalUrl(url);
+	} catch (error) {
+		const message = error instanceof SsrfError ? error.message : "SSRF validation failed";
+		const target = tryParsePluginHttpTarget(url);
+		throw new Error(`Plugin "${pluginId}": blocked fetch to "${target ? target.hostname : "invalid URL"}": ${message}`, { cause: error });
+	}
+}
+/**
+* Create HTTP access with host validation and SSRF protection.
+*
+* Uses redirect: "manual" to re-validate each redirect target before dispatch.
+*/
+function createHttpAccess(pluginId, allowedHosts, fetchImpl = globalThis.fetch) {
+	return { async fetch(url, init) {
+		if (allowedHosts.length === 0) throw new Error(`Plugin "${pluginId}" has no allowed hosts configured. Add hosts to the plugin's allowedHosts array to enable HTTP requests.`);
+		let currentUrl = url;
+		let currentInit = init;
+		let requestBuffered = false;
+		let redirected = false;
+		for (let i = 0; i <= MAX_PLUGIN_REDIRECTS; i++) {
+			const target = tryParsePluginHttpTarget(currentUrl);
+			if (target && !isHostAllowed(target.hostname, allowedHosts)) throw new Error(`Plugin "${pluginId}" is not allowed to fetch from host "${target.hostname}". Allowed hosts: ${allowedHosts.join(", ")}`);
+			await validatePluginHttpTarget(pluginId, currentUrl);
+			if (!requestBuffered) {
+				currentInit = await bufferPluginHttpRequest(currentInit);
+				requestBuffered = true;
+			}
+			const response = await fetchImpl(currentUrl, {
+				...currentInit,
+				redirect: "manual"
+			});
+			const location = response.headers.get("Location");
+			if (location === null) return pluginHttpResponseFromWire(await pluginHttpResponseToWire(response, currentUrl, redirected));
+			const redirectAction = pluginHttpRedirectAction(response.status, true, currentInit);
+			if (redirectAction === "return") return pluginHttpResponseFromWire(await pluginHttpResponseToWire(response, currentUrl, redirected));
+			await response.body?.cancel();
+			if (redirectAction === "error") throw new Error(`Plugin "${pluginId}": redirect mode is "error"`);
+			const previousOrigin = new URL(currentUrl).origin;
+			currentUrl = new URL(location, currentUrl).href;
+			redirected = true;
+			const nextOrigin = new URL(currentUrl).origin;
+			currentInit = rewritePluginHttpRedirect(response.status, currentInit);
+			if (previousOrigin !== nextOrigin && currentInit) currentInit = stripCredentialHeaders(currentInit);
+		}
+		throw new Error(`Plugin "${pluginId}": too many redirects (max ${MAX_PLUGIN_REDIRECTS})`);
+	} };
+}
+/**
+* Create unrestricted HTTP access (for plugins with network:request:unrestricted capability).
+* No host validation, but applies SSRF protection on redirect targets to
+* prevent plugins from being tricked into reaching internal services.
+*/
+function createUnrestrictedHttpAccess(pluginId, fetchImpl = globalThis.fetch) {
+	return { async fetch(url, init) {
+		let currentUrl = url;
+		let currentInit = init;
+		let requestBuffered = false;
+		let redirected = false;
+		for (let i = 0; i <= MAX_PLUGIN_REDIRECTS; i++) {
+			await validatePluginHttpTarget(pluginId, currentUrl);
+			if (!requestBuffered) {
+				currentInit = await bufferPluginHttpRequest(currentInit);
+				requestBuffered = true;
+			}
+			const response = await fetchImpl(currentUrl, {
+				...currentInit,
+				redirect: "manual"
+			});
+			const location = response.headers.get("Location");
+			if (location === null) return pluginHttpResponseFromWire(await pluginHttpResponseToWire(response, currentUrl, redirected));
+			const redirectAction = pluginHttpRedirectAction(response.status, true, currentInit);
+			if (redirectAction === "return") return pluginHttpResponseFromWire(await pluginHttpResponseToWire(response, currentUrl, redirected));
+			await response.body?.cancel();
+			if (redirectAction === "error") throw new Error(`Plugin "${pluginId}": redirect mode is "error"`);
+			const previousOrigin = new URL(currentUrl).origin;
+			currentUrl = new URL(location, currentUrl).href;
+			redirected = true;
+			const nextOrigin = new URL(currentUrl).origin;
+			currentInit = rewritePluginHttpRedirect(response.status, currentInit);
+			if (previousOrigin !== nextOrigin && currentInit) currentInit = stripCredentialHeaders(currentInit);
+		}
+		throw new Error(`Plugin "${pluginId}": too many redirects (max ${MAX_PLUGIN_REDIRECTS})`);
+	} };
+}
+/**
+* Create logger for a plugin
+*/
+function createLogAccess(pluginId, redactor) {
+	const prefix = `[plugin:${pluginId}]`;
+	const redact = (value) => redactor?.redact(value) ?? value;
+	return {
+		debug(message, data) {
+			if (data !== void 0) console.debug(prefix, redact(message), redact(data));
+			else console.debug(prefix, redact(message));
+		},
+		info(message, data) {
+			if (data !== void 0) console.info(prefix, redact(message), redact(data));
+			else console.info(prefix, redact(message));
+		},
+		warn(message, data) {
+			if (data !== void 0) console.warn(prefix, redact(message), redact(data));
+			else console.warn(prefix, redact(message));
+		},
+		error(message, data) {
+			if (data !== void 0) console.error(prefix, redact(message), redact(data));
+			else console.error(prefix, redact(message));
+		}
+	};
+}
+const TRAILING_SLASH_RE = /\/$/;
+/**
+* Create site info from config and settings.
+*
+* Resolution order for URL:
+* 1. options table (emdash:site_url)
+* 2. Astro `site` config
+* 3. fallback to empty string
+*/
+function createSiteInfo(options) {
+	return {
+		name: options.siteName ?? "",
+		url: (options.siteUrl ?? "").replace(TRAILING_SLASH_RE, ""),
+		locale: options.locale ?? "en",
+		trailingSlash: options.trailingSlash ?? "ignore"
+	};
+}
+/**
+* Create a URL helper that generates absolute URLs from relative paths.
+* Validates that path starts with "/" and rejects protocol-relative paths ("//").
+*/
+function createUrlHelper(siteUrl) {
+	const base = siteUrl.replace(TRAILING_SLASH_RE, "");
+	return (path) => {
+		if (!path.startsWith("/")) throw new Error(`URL path must start with "/", got: "${path}"`);
+		if (path.startsWith("//")) throw new Error(`URL path must not be protocol-relative, got: "${path}"`);
+		return `${base}${path}`;
+	};
+}
+/**
+* Convert a UserRepository user to the plugin-facing UserInfo shape.
+* Strips sensitive fields (avatarUrl, emailVerified, data).
+*/
+function toUserInfo(user) {
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		role: user.role,
+		createdAt: user.createdAt
+	};
+}
+/**
+* Create read-only user access for plugins.
+* Excludes sensitive fields (password hashes, sessions, passkeys, avatar URL, data).
+*/
+function createUserAccess(db) {
+	const userRepo = new UserRepository(db);
+	return {
+		async get(id) {
+			const user = await userRepo.findById(id);
+			if (!user) return null;
+			return toUserInfo(user);
+		},
+		async getByEmail(email) {
+			const user = await userRepo.findByEmail(email);
+			if (!user) return null;
+			return toUserInfo(user);
+		},
+		async list(opts) {
+			const result = await userRepo.findMany({
+				role: opts?.role,
+				cursor: opts?.cursor,
+				limit: opts?.limit
+			});
+			return {
+				items: result.items.map(toUserInfo),
+				nextCursor: result.nextCursor
+			};
+		}
+	};
+}
+/**
+* Factory for creating plugin contexts
+*/
+var PluginContextFactory = class {
+	resolveDb;
+	beforeContentWrite;
+	contentCreate;
+	contentActions;
+	storage;
+	getUploadUrl;
+	site;
+	urlHelper;
+	cronReschedule;
+	now;
+	emailPipeline;
+	commentModerate;
+	/**
+	* Plugin IDs already warned about a missing media-write backend, so the
+	* warning fires once per factory instead of on every hook/route context
+	* creation (which would spam logs for hook-participating plugins).
+	*/
+	warnedMissingMediaBackend = /* @__PURE__ */ new Set();
+	constructor(options) {
+		const fixedDb = options.db;
+		this.resolveDb = options.getDb ?? (() => fixedDb);
+		this.beforeContentWrite = options.beforeContentWrite;
+		this.contentCreate = options.contentCreate;
+		this.contentActions = options.contentActions;
+		this.storage = options.storage;
+		this.getUploadUrl = options.getUploadUrl;
+		this.site = createSiteInfo(options.siteInfo ?? {});
+		this.urlHelper = createUrlHelper(this.site.url);
+		this.cronReschedule = options.cronReschedule;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.emailPipeline = options.emailPipeline;
+		this.commentModerate = options.commentModerate;
+	}
+	/**
+	* Create the unified plugin context
+	*/
+	createContext(plugin) {
+		const capabilities = new Set(plugin.capabilities);
+		const db = this.resolveDb();
+		const optionsRepo = new OptionsRepository(db);
+		const secretRedactor = createPluginSecretRedactor();
+		const settings = createSettingsAccess(optionsRepo, plugin.id, plugin.admin.settingsSchema ?? {}, void 0, secretRedactor.add);
+		const kv = createKVAccess(optionsRepo, plugin.id, settings);
+		const log = createLogAccess(plugin.id, secretRedactor);
+		const storage = createStorageAccess(db, plugin.id, plugin.storage);
+		let content;
+		if (capabilities.has("content:write")) content = createContentAccessWithWrite(db, this.beforeContentWrite, {
+			site: this.site,
+			revisions: capabilities.has("content:revisions:read")
+		}, this.contentCreate ? (input) => this.contentCreate(plugin.id, input.collection, input.input, input.options) : void 0);
+		else if (capabilities.has("content:read")) content = createContentAccess(db, {
+			site: this.site,
+			revisions: capabilities.has("content:revisions:read")
+		});
+		if (capabilities.has("content:publish") && this.contentActions) content = Object.assign(content ?? createContentAccess(db), {
+			getVersioned: (collection, id) => this.contentActions.getVersioned(plugin.id, collection, id),
+			publish: (collection, id, options) => this.contentActions.publish(plugin.id, collection, id, options),
+			unpublish: (collection, id, options) => this.contentActions.unpublish(plugin.id, collection, id, options),
+			schedule: (collection, id, options) => this.contentActions.schedule(plugin.id, collection, id, options),
+			unschedule: (collection, id, options) => this.contentActions.unschedule(plugin.id, collection, id, options)
+		});
+		if (capabilities.has("content:restore") && this.contentActions) content = Object.assign(content ?? {
+			get: async () => {
+				throw new Error("Missing capability: content:read");
+			},
+			list: async () => {
+				throw new Error("Missing capability: content:read");
+			}
+		}, {
+			getTrashedVersioned: (collection, id) => this.contentActions.getTrashedVersioned(plugin.id, collection, id),
+			restore: (collection, id, options) => this.contentActions.restore(plugin.id, collection, id, options)
+		});
+		const schema = capabilities.has("schema:read") ? createSchemaAccess(db) : void 0;
+		let taxonomies;
+		if (capabilities.has("taxonomies:write")) taxonomies = createTaxonomyAccessWithWrite(db);
+		else if (capabilities.has("taxonomies:read")) taxonomies = createTaxonomyAccess(db);
+		let redirects;
+		if (capabilities.has("redirects:write")) redirects = createRedirectAccess(db, true);
+		else if (capabilities.has("redirects:read")) redirects = createRedirectAccess(db);
+		let media;
+		if (capabilities.has("media:read") || capabilities.has("media:write") || capabilities.has("media:bytes:read") || capabilities.has("media:metadata:write")) media = capabilities.has("media:read") || capabilities.has("media:write") ? createMediaAccess(db) : createBlockedMediaReadAccess();
+		if (capabilities.has("media:write")) if (this.getUploadUrl || this.storage) media = createMediaAccessWithWrite(db, this.getUploadUrl, this.storage);
+		else {
+			if (!this.warnedMissingMediaBackend.has(plugin.id)) {
+				this.warnedMissingMediaBackend.add(plugin.id);
+				log.warn("declares the media:write capability but no storage backend is configured; upload() is unavailable.");
+			}
+			media ??= createMediaAccess(db);
+		}
+		if (capabilities.has("media:bytes:read") && media) media.readBytes = (id, options) => readPluginMediaBytes(db, this.storage, id, options);
+		if (capabilities.has("media:metadata:write") && media) media.updateMetadata = (id, patch) => updatePluginMediaMetadata(db, id, patch);
+		let http;
+		if (capabilities.has("network:request:unrestricted")) http = createUnrestrictedHttpAccess(plugin.id);
+		else if (capabilities.has("network:request")) http = createHttpAccess(plugin.id, plugin.allowedHosts);
+		let users;
+		if (capabilities.has("users:read")) users = createUserAccess(db);
+		let comments;
+		if (capabilities.has("comments:moderate")) comments = createCommentAccess(db, (id, status, expectedStatus) => {
+			if (!this.commentModerate) throw new Error("Comment moderation is unavailable");
+			return this.commentModerate(plugin.id, id, status, expectedStatus);
+		});
+		else if (capabilities.has("comments:read")) comments = createCommentAccess(db);
+		let cron;
+		if (this.cronReschedule) cron = new CronAccessImpl(db, plugin.id, this.cronReschedule, this.now);
+		let email;
+		if (capabilities.has("email:send") && this.emailPipeline?.isAvailable()) {
+			const pipeline = this.emailPipeline;
+			const pluginId = plugin.id;
+			email = { send: (message) => pipeline.send(message, pluginId) };
+		}
+		return {
+			plugin: {
+				id: plugin.id,
+				version: plugin.version
+			},
+			storage,
+			kv,
+			settings,
+			content,
+			schema,
+			taxonomies,
+			redirects,
+			media,
+			http,
+			log,
+			site: this.site,
+			url: this.urlHelper,
+			users,
+			comments,
+			cron,
+			email
+		};
+	}
+};
+
+//#endregion
+export { StorageSerializationError as S, readPluginMediaBytes as _, createHttpAccess as a, createContentAccess as b, createSchemaAccess as c, createTaxonomyAccessWithWrite as d, createUnrestrictedHttpAccess as f, parsePluginMediaMetadataPatch as g, MAX_PLUGIN_MEDIA_READ_BYTES as h, createContentAccessWithWrite as i, createSiteInfo as l, DEFAULT_PLUGIN_MEDIA_READ_BYTES as m, RedirectAccessError as n, createMediaAccess as o, PluginRouteError as p, createCommentAccess as r, createRedirectAccess as s, PluginContextFactory as t, createStorageAccess as u, toPluginMediaItem as v, PluginStorageRepository as x, updatePluginMediaMetadata as y };
+//# sourceMappingURL=context-CGQLA1-a.mjs.map