emdash 0.40.0 → 0.41.0

package/dist/emdash-runtime-CrzxJFmF.mjs

@@ -0,0 +1,4214 @@
+import { r as MIGRATION_RACE_WAIT_MS, t as ConcurrentMigrationTimeoutError } from "./runner-B3eyB9Gb.mjs";
+import { n as isMissingTableError } from "./db-errors-CBD5yMro.mjs";
+import { d as isSqlite, m as listTablesLike } from "./dialect-helpers-7_IqPdh9.mjs";
+import { r as getI18nConfig, s as resolveContentCreateLocale } from "./config-CvmjJcVw.mjs";
+import { S as definePlugin, _ as isContentSaveRejection, b as getActiveContentSaveHookName, c as inspectSandboxHookResult, g as ContentSaveRejectedError, h as EmailPipeline, x as resolveExclusiveHooks, y as createHookPipeline } from "./menus-BQfusWEC.mjs";
+import { t as after } from "./after-PcEvMY_6.mjs";
+import { getRequestContext } from "./request-context.mjs";
+import { t as OptionsRepository } from "./options-DhrI7eMv.mjs";
+import { n as decodeBase64Bytes } from "./base64-DvnNgP7e.mjs";
+import { n as initWithLock, t as createInitLock } from "./init-lock-4eRRB4Le.mjs";
+import { r as singleFlightCached, t as createSingleFlightCache } from "./single-flight-cache-B5O2qhO1.mjs";
+import { o as validateEncryptionKeyAtStartup } from "./secrets-CIi0nFiR.mjs";
+import { a as staleStoredKeys, i as keepKnownFields, t as ContentRepository } from "./content-CbnufDsM.mjs";
+import { f as isStoragelessField, p as isStoragelessFieldRow } from "./types-CJKsWVFR.mjs";
+import { n as ContentMutationConflictError } from "./types-aOOxRSx6.mjs";
+import { t as RevisionRepository } from "./revision-j1p4-bOj.mjs";
+import { t as MediaRepository } from "./media-BUQePMxP.mjs";
+import { t as CommentRepository } from "./comment-D2uvL63j.mjs";
+import { t as AuditRepository } from "./audit-CrgmE9LE.mjs";
+import { d as createTaxonomyAccessWithWrite, l as createSiteInfo, r as createCommentAccess, y as updatePluginMediaMetadata } from "./context-CGQLA1-a.mjs";
+import { t as RedirectRepository } from "./redirect-D1ArbO85.mjs";
+import { r as requestCached } from "./request-cache-iHRlHx1d.mjs";
+import { i as mergeStagedReferences, r as STAGED_REFERENCES_KEY } from "./staged-C36IWXff.mjs";
+import { n as normalizeMediaValue } from "./normalize-DduyxBjf.mjs";
+import { n as normalizeMime, t as matchesMimeAllowlist } from "./mime-C94qBG-P.mjs";
+import { t as enrichImageMetadata } from "./enrich-DBtCncE2.mjs";
+import { i as scheduledPolicyRejectionKey } from "./content-policy-CYu6K1KB.mjs";
+import { t as FTSManager } from "./fts-manager-CCaZTp8y.mjs";
+import { h as selectTaxonomyDefs, s as getDb } from "./loader-CrRPfkHS.mjs";
+import { kyselyLogOption } from "./database/instrumentation.mjs";
+import { r as primeRegisteredCollections } from "./collection-slugs-cache-CUuiduLq.mjs";
+import { A as handleContentDelete, B as handleContentSchedule, D as handleContentCountScheduled, E as handleContentCompare, F as handleContentList, G as handleScheduledPolicyRejection, H as handleContentUnpublish, I as handleContentListTrashed, K as storagelessDataKeyError, L as handleContentPermanentDelete, M as handleContentDuplicate, N as handleContentGet, O as handleContentCountTrashed, P as handleContentGetIncludingTrashed, R as handleContentPublish, S as buildManifestCollections, T as handleContentAuthors, U as handleContentUnschedule, V as handleContentTranslations, W as handleContentUpdate, b as handleRevisionList, h as syncDeclaredStorageIndexes, j as handleContentDiscardDraft, k as handleContentCreate, p as loadBundleFromR2, q as validateRev, w as changedStoragelessDataKeys, x as handleRevisionRestore, y as handleRevisionGet, z as handleContentRestore } from "./api-CXwQkV_m.mjs";
+import { r as activateMediaUsageCapture } from "./activation-PtniBLt9.mjs";
+import { D as refreshContentMediaUsageAfterWrite, E as findNonTranslatableSiblingContentIds, H as markContentMediaUsageCollectionStale, T as deleteContentMediaUsage, W as MediaUsageRepository, n as SchemaRegistry, t as SchemaError } from "./registry-CFcNCayZ.mjs";
+import { n as computeContentHash, r as hashString } from "./hash-COVK27Pc.mjs";
+import { i as resolveBlockTypes, r as normalizeBlocksData } from "./block-values-ACFqgB1D.mjs";
+import { f as resolveReferenceSelection } from "./relations-Cfaa1fDl.mjs";
+import { n as recordSchedulerHeartbeatSafely } from "./dashboard-CBq9kmOn.mjs";
+import { t as removeUploadAttempt } from "./upload-attempts-DduMy6B0.mjs";
+import { a as handleMediaRegisterUpload, i as handleMediaList, n as handleMediaDelete, o as handleMediaReplaceMetadata, r as handleMediaGet, s as handleMediaUpdate, t as handleMediaCreate } from "./media-DH8ibNlY.mjs";
+import { s as processMediaUsageWorkAfterWrite } from "./media-usage-D7Y64m6v.mjs";
+import { t as ErrorCode } from "./errors-BN1QAnEY.mjs";
+import { t as PluginStateRepository } from "./state-CKouMCSY.mjs";
+import { s as invalidateSiteSettingsCache } from "./settings-D5EHi0Tk.mjs";
+import { i as normalizeManifestRoute$1, r as normalizeManifestHook, t as HOOK_NAMES } from "./manifest-schema-Ci2gmd0u.mjs";
+import { i as getSandboxRouteErrorDetails } from "./types-4Dn9bZhu.mjs";
+import { s as normalizePluginCapabilities } from "./types-OC5c-edM.mjs";
+import { c as resolveRegistryConfigForSandbox, r as getRegistryConfigInput, s as resolveManifestRegistryConfig } from "./config-CCz3xOLc.mjs";
+import { n as DEFAULT_MAX_UPLOAD_SIZE, r as formatFileSize, t as CONTENT_TYPE_RE } from "./media-OEIQ3bVc.mjs";
+import { t as getTrustedProxyHeaders } from "./trusted-proxy-B6ECOZJc.mjs";
+import { n as sanitizeHeadersForSandbox, t as extractRequestMeta } from "./request-meta-D47mqyev.mjs";
+import { adaptSandboxEntry } from "./plugins/adapt-sandbox-entry.mjs";
+import { t as GLOBAL_UPLOAD_ALLOWLIST } from "./media-allowlist-pYtaBA95.mjs";
+import { n as CronExecutor } from "./cron-c4D5C5Fx.mjs";
+import { r as devConsoleEmailDeliver, t as DEV_CONSOLE_EMAIL_PLUGIN_ID } from "./email-console-DyQIgEnz.mjs";
+import { n as assertSiteWriteAllowed } from "./fence-Bb_IbCxI.mjs";
+import { t as PluginRouteRequestError } from "./route-wire-C9PJV9aL.mjs";
+import { a as toRouteCallerInfo, n as buildRouteMeta, r as parseRouteInput, t as PluginRouteRegistry } from "./routes-lyYw0mMf.mjs";
+import { n as enforceRuntimeMigrationPolicy, t as PendingMigrationsError } from "./policy-BcEqut3n.mjs";
+import { n as VERSION, t as COMMIT } from "./version-Dq71scUb.mjs";
+import { t as getSiteBaseUrl } from "./site-url-D6JB7tLW.mjs";
+import { t as getAuthMode } from "./mode-DpYW3w6U.mjs";
+import { n as lookupContentAuthor, r as sendCommentNotification, t as submitPublicComment } from "./public-submission-D9c9S14m.mjs";
+import { u as maybeRunScheduledBackup } from "./backup-Ck8_lMO3.mjs";
+import { t as cleanupExpiredChallenges } from "./challenge-store-CvBl81AQ.mjs";
+import { n as createComment, r as moderateComment, t as CommentStatusConflictError } from "./service-BsVG05gS.mjs";
+import { isRecord } from "./plugin-utils.mjs";
+import { n as enableRuntimePlugin, t as disableRuntimePlugin } from "./lifecycle-C815ZQfV.mjs";
+import { Kysely, sql } from "kysely";
+import { z } from "zod";
+import { ulid } from "ulidx";
+import { Permissions } from "@emdash-cms/auth";
+import { isJsonPostRouteContract } from "@emdash-cms/plugin-types";
+import * as path from "node:path";
+import virtualConfig from "virtual:emdash/config";
+import { getLocaleDir, resolveLocale } from "@emdash-cms/admin/locales";
+import { normalizePluginPagePath, validateBlockResponse, validateContentEditorActionResponse } from "@emdash-cms/blocks/server";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+
+//#region src/api/handlers/media-upload.ts
+/**
+* Programmatic media upload handler (MCP `media_upload` tool).
+*
+* Accepts file bytes as base64, then runs the same pipeline as the multipart
+* REST upload route: allowlist + size validation, content-hash deduplication,
+* storage upload, image metadata enrichment, and record creation.
+*/
+function fail(code, message) {
+	return {
+		success: false,
+		error: {
+			code,
+			message
+		}
+	};
+}
+/** Same relative-URL shape the REST media routes return. */
+function withUrl(item) {
+	return {
+		...item,
+		url: `/_emdash/api/media/file/${item.storageKey}`
+	};
+}
+/** Decode the file bytes after rejecting an oversized encoded payload. */
+async function acquireBytes(input, maxUploadSize) {
+	if (input.base64.length * 3 / 4 > maxUploadSize) return fail("PAYLOAD_TOO_LARGE", `File exceeds maximum size of ${formatFileSize(maxUploadSize)}`);
+	try {
+		return {
+			bytes: decodeBase64Bytes(input.base64),
+			mimeType: input.contentType
+		};
+	} catch {
+		return fail("VALIDATION_ERROR", "Invalid base64 data");
+	}
+}
+/**
+* Upload a media file from base64 data.
+*
+* Mirrors the REST `POST /_emdash/api/media` route: global MIME allowlist,
+* size limit, content-hash dedupe (returns the existing item with
+* `deduplicated: true`), storage upload with cleanup on failure, and
+* image metadata enrichment (dimensions, blurhash, dominant color).
+*/
+async function handleMediaUpload(db, storage, input, hooks = {}) {
+	if (!input.base64 || !input.contentType) return fail("VALIDATION_ERROR", "base64 and contentType are required");
+	const rawMax = input.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;
+	if (!Number.isFinite(rawMax) || rawMax <= 0) return fail("CONFIGURATION_ERROR", "Invalid maxUploadSize configuration");
+	const acquired = await acquireBytes(input, rawMax);
+	if ("success" in acquired) return acquired;
+	const { bytes } = acquired;
+	if (!CONTENT_TYPE_RE.test(acquired.mimeType)) return fail("VALIDATION_ERROR", "Invalid content type");
+	let filename = input.filename;
+	let mimeType = normalizeMime(acquired.mimeType);
+	let size = bytes.byteLength;
+	if (!matchesMimeAllowlist(mimeType, GLOBAL_UPLOAD_ALLOWLIST)) return fail("INVALID_TYPE", "File type not allowed");
+	if (bytes.byteLength > rawMax) return fail("PAYLOAD_TOO_LARGE", `File exceeds maximum size of ${formatFileSize(rawMax)}`);
+	try {
+		if (hooks.beforeUpload) {
+			const processed = await hooks.beforeUpload({
+				name: filename,
+				type: mimeType,
+				size: bytes.byteLength
+			});
+			filename = processed.name;
+			mimeType = normalizeMime(processed.type);
+			size = processed.size;
+			if (!CONTENT_TYPE_RE.test(processed.type)) return fail("VALIDATION_ERROR", "Invalid content type");
+			if (!matchesMimeAllowlist(mimeType, GLOBAL_UPLOAD_ALLOWLIST)) return fail("INVALID_TYPE", "File type not allowed");
+		}
+		const contentHash = await computeContentHash(bytes);
+		const repo = new MediaRepository(db);
+		const existing = await repo.findByContentHash(contentHash);
+		if (existing) return {
+			success: true,
+			data: {
+				item: withUrl(existing),
+				deduplicated: true
+			}
+		};
+		const storageKey = `${ulid()}${path.extname(filename)}`;
+		await storage.upload({
+			key: storageKey,
+			body: bytes,
+			contentType: mimeType
+		});
+		try {
+			const enriched = await enrichImageMetadata(bytes, mimeType);
+			return {
+				success: true,
+				data: { item: withUrl(await repo.create({
+					filename,
+					mimeType,
+					size,
+					width: enriched.width,
+					height: enriched.height,
+					alt: input.alt,
+					storageKey,
+					contentHash,
+					blurhash: enriched.blurhash,
+					dominantColor: enriched.dominantColor,
+					authorId: input.authorId
+				})) }
+			};
+		} catch (error) {
+			try {
+				await storage.delete(storageKey);
+			} catch {}
+			throw error;
+		}
+	} catch {
+		return fail("UPLOAD_ERROR", "Upload failed");
+	}
+}
+
+//#endregion
+//#region src/i18n/repair-locale-casing.ts
+/** Rewrite stored locales to the exact casing used by the site configuration. */
+async function repairLocaleCasing(db, configuredLocales) {
+	const tableNames = await listTablesLike(db, "ec_%");
+	for (const tableName of tableNames) {
+		const table = sql.ref(tableName);
+		for (const locale of configuredLocales) await sql`
+				UPDATE ${table} AS target
+				SET locale = ${locale}
+				WHERE lower(target.locale) = lower(${locale})
+					AND target.locale != ${locale}
+					AND NOT EXISTS (
+						SELECT 1
+						FROM ${table} AS existing
+						WHERE existing.slug = target.slug AND existing.locale = ${locale}
+					)
+					AND target.id = (
+						SELECT MIN(candidate.id)
+						FROM ${table} AS candidate
+						WHERE candidate.slug = target.slug
+							AND lower(candidate.locale) = lower(${locale})
+							AND candidate.locale != ${locale}
+					)
+			`.execute(db);
+	}
+}
+
+//#endregion
+//#region src/i18n/taxonomy-locale-diagnostic.ts
+const REPAIR_GUIDE = "https://docs.emdashcms.com/guides/internationalization/#repairing-taxonomy-locale-mismatches";
+async function warnAboutUnconfiguredTaxonomyLocales(db, configuredLocales, definitionLocales) {
+	const supportedLocales = configuredLocales.length > 0 ? configuredLocales : ["en"];
+	const definitionRows = definitionLocales === void 0 ? await db.selectFrom("_emdash_taxonomy_defs").select("locale").distinct().where("locale", "not in", supportedLocales).execute() : [...new Set(definitionLocales)].filter((locale) => !supportedLocales.includes(locale)).map((locale) => ({ locale }));
+	const termRows = await db.selectFrom("taxonomies").select("locale").distinct().where("locale", "not in", supportedLocales).execute();
+	const mismatches = [...definitionRows.map(({ locale }) => ({
+		source: "definitions",
+		locale
+	})), ...termRows.map(({ locale }) => ({
+		source: "terms",
+		locale
+	}))].toSorted((a, b) => a.source.localeCompare(b.source) || a.locale.localeCompare(b.locale));
+	if (mismatches.length === 0) return;
+	const details = mismatches.map(({ source, locale }) => `${source}: ${locale}`).join("; ");
+	console.warn(`EmDash: Taxonomy rows use locales outside the configured locales (${supportedLocales.join(", ")}): ${details}. Locale-scoped reads may not return these rows. Review and repair them explicitly: ${REPAIR_GUIDE}`);
+}
+
+//#endregion
+//#region src/plugins/sandbox/proxy.ts
+const SANDBOX_REJECTION = Symbol("emdash:sandbox-save-rejection");
+const VALID_METADATA_KINDS = new Set([
+	"meta",
+	"property",
+	"link",
+	"jsonld"
+]);
+const VALID_LINK_REL = new Set([
+	"canonical",
+	"alternate",
+	"author",
+	"license",
+	"nlweb",
+	"site.standard.document"
+]);
+function isValidMetadataContribution(value) {
+	if (!value || typeof value !== "object" || !("kind" in value)) return false;
+	const contribution = value;
+	if (typeof contribution.kind !== "string" || !VALID_METADATA_KINDS.has(contribution.kind)) return false;
+	if (contribution.kind === "meta") return typeof contribution.name === "string" && typeof contribution.content === "string";
+	if (contribution.kind === "property") return typeof contribution.property === "string" && typeof contribution.content === "string";
+	if (contribution.kind === "link") return typeof contribution.href === "string" && typeof contribution.rel === "string" && VALID_LINK_REL.has(contribution.rel);
+	return contribution.graph != null && typeof contribution.graph === "object";
+}
+function getSandboxSaveRejectionDetails(error) {
+	if (!(error instanceof ContentSaveRejectedError) || !(SANDBOX_REJECTION in error)) return null;
+	const details = Object.getOwnPropertyDescriptor(error, SANDBOX_REJECTION)?.value;
+	if (!details || typeof details !== "object") return null;
+	if (!("pluginId" in details) || typeof details.pluginId !== "string") return null;
+	if (!("reason" in details) || typeof details.reason !== "string") return null;
+	return {
+		pluginId: details.pluginId,
+		reason: details.reason
+	};
+}
+/**
+* Represent an isolate-backed plugin inside the normal host hook pipeline.
+* The proxy contains metadata and RPC handlers only; plugin code remains in
+* the runner isolate.
+*/
+function createSandboxedPluginProxy(manifest, instance) {
+	const hooks = {};
+	for (const entry of manifest.hooks) {
+		const hook = normalizeManifestHook(entry);
+		if (hook.name === "page:fragments") continue;
+		hooks[hook.name] = {
+			handler: async (event) => {
+				const result = await instance.invokeHook(hook.name, event);
+				if (hook.name === "page:metadata") {
+					if (result == null) return null;
+					const contributions = (Array.isArray(result) ? result : [result]).filter(isValidMetadataContribution);
+					return contributions.length > 0 ? contributions : null;
+				}
+				if (hook.name !== "content:beforeSave") return result;
+				const inspection = inspectSandboxHookResult(result);
+				if (inspection.kind === "error") {
+					const error = new ContentSaveRejectedError("Save rejected by a sandboxed plugin");
+					return Promise.reject(Object.assign(error, { [SANDBOX_REJECTION]: {
+						pluginId: manifest.id,
+						reason: inspection.error.reason
+					} }));
+				}
+				if (inspection.kind === "malformed") throw new Error(`Sandboxed plugin "${manifest.id}" returned an invalid hook result`);
+				return result;
+			},
+			priority: hook.priority,
+			timeout: hook.timeout,
+			dependencies: hook.dependencies,
+			errorPolicy: hook.errorPolicy,
+			exclusive: hook.exclusive
+		};
+	}
+	return adaptSandboxEntry({ hooks }, {
+		id: manifest.id,
+		version: manifest.version,
+		entrypoint: "",
+		format: "standard",
+		capabilities: manifest.capabilities,
+		allowedHosts: manifest.allowedHosts,
+		storage: manifest.storage,
+		adminPages: manifest.admin.pages,
+		adminWidgets: manifest.admin.widgets,
+		editorPanels: manifest.admin.editorPanels,
+		editorActions: manifest.admin.editorActions,
+		settingsSchema: manifest.admin.settingsSchema,
+		portableTextBlocks: manifest.admin.portableTextBlocks,
+		fieldWidgets: manifest.admin.fieldWidgets
+	});
+}
+
+//#endregion
+//#region src/plugins/sandbox/runner-options.ts
+/**
+* Build platform sandbox options with the same normalized site context used
+* by trusted plugin hooks and routes.
+*/
+function createSandboxRunnerOptions(options, siteInfo) {
+	return {
+		...options,
+		siteInfo: createSiteInfo(siteInfo ?? {})
+	};
+}
+
+//#endregion
+//#region src/media/usage/cleanup.ts
+const MEDIA_USAGE_CLEANUP_CANDIDATE_LIMIT = 250;
+const MEDIA_USAGE_CLEANUP_DELETE_LIMIT = 50;
+const MEDIA_USAGE_CLEANUP_WRITE_LEASE_DELETE_LIMIT = 49;
+const MEDIA_USAGE_CLEANUP_INTERVAL_MS = 60 * 1e3;
+const MEDIA_USAGE_CLEANUP_LEASE_MS = 300 * 1e3;
+const MEDIA_USAGE_CLEANUP_SAFETY_WINDOW_MS = 3600 * 1e3;
+const MEDIA_USAGE_CLEANUP_TIME_BUDGET_MS = 5 * 1e3;
+/**
+* Reclaims a bounded window of obsolete media-usage occurrences.
+*
+* The persisted claim makes a cron tick single-flight across Worker isolates
+* and Node processes.
+*/
+async function cleanupMediaUsage(db) {
+	const startedMs = Date.now();
+	const canIssueStatement = () => withinBudget(startedMs);
+	const repo = new MediaUsageRepository(db);
+	const leaseToken = ulid();
+	const claim = await repo.claimMediaUsageCleanup({
+		leaseToken,
+		leaseDurationSeconds: MEDIA_USAGE_CLEANUP_LEASE_MS / 1e3,
+		nextEligibleDelaySeconds: MEDIA_USAGE_CLEANUP_INTERVAL_MS / 1e3,
+		sweepSafetyWindowSeconds: MEDIA_USAGE_CLEANUP_SAFETY_WINDOW_MS / 1e3
+	});
+	if (!claim) return emptyResult("skipped", elapsedSince(startedMs));
+	let candidateRows = 0;
+	let deletedOrphans = 0;
+	let deletedStale = 0;
+	let deletedAbandoned = 0;
+	let deletedWriteLeases = 0;
+	let backlogLowerBound = 0;
+	let scanHasMore = false;
+	let nextCursor = claim.cursor;
+	let sweepComplete = false;
+	try {
+		if (canIssueStatement()) deletedWriteLeases = await repo.deleteExpiredGenerationWriteLeases(MEDIA_USAGE_CLEANUP_WRITE_LEASE_DELETE_LIMIT, cleanupLease(leaseToken), canIssueStatement);
+		const cutoff = claim.scanBeforeAt;
+		const candidates = await repo.findMediaUsageCleanupCandidates({
+			cutoff,
+			cursor: claim.cursor,
+			limit: MEDIA_USAGE_CLEANUP_CANDIDATE_LIMIT,
+			cleanupLease: cleanupLease(leaseToken),
+			canIssueStatement
+		});
+		if (candidates) {
+			candidateRows = candidates.length;
+			scanHasMore = candidates.length === MEDIA_USAGE_CLEANUP_CANDIDATE_LIMIT;
+			const selected = selectCleanupCandidates(candidates, claim.claimedAt);
+			backlogLowerBound = selected.orphanIds.length + selected.staleIds.length + selected.abandonedIds.length;
+			const completedTargets = /* @__PURE__ */ new Set();
+			let canContinue = true;
+			if (canIssueStatement() && selected.orphanIds.length > 0) {
+				deletedOrphans = await repo.deleteOrphanOccurrencesOlderThan(cutoff, selected.orphanIds.length, {
+					candidateIds: selected.orphanIds,
+					cleanupLease: cleanupLease(leaseToken),
+					canIssueStatement
+				});
+				canContinue = deletedOrphans === selected.orphanIds.length;
+				if (canContinue) completedTargets.add("orphan");
+			}
+			if (canContinue && canIssueStatement() && selected.staleIds.length > 0) {
+				deletedStale = await repo.deleteStaleGenerationsOlderThan(cutoff, selected.staleIds.length, {
+					candidateIds: selected.staleIds,
+					cleanupLease: cleanupLease(leaseToken),
+					canIssueStatement
+				});
+				canContinue = deletedStale === selected.staleIds.length;
+				if (canContinue) completedTargets.add("stale");
+			}
+			if (canContinue && canIssueStatement() && selected.abandonedIds.length > 0) {
+				deletedAbandoned = await repo.deleteAbandonedGenerationsOlderThan(cutoff, selected.abandonedIds.length, {
+					candidateIds: selected.abandonedIds,
+					cleanupLease: cleanupLease(leaseToken),
+					canIssueStatement
+				});
+				if (deletedAbandoned === selected.abandonedIds.length) completedTargets.add("abandoned");
+			}
+			const hasIncompleteTargets = selected.entries.some((entry) => entry.target !== null && !completedTargets.has(entry.target));
+			sweepComplete = !scanHasMore && selected.entries.length === candidates.length && !hasIncompleteTargets;
+			nextCursor = sweepComplete ? null : cursorAfterCompletedCandidates(selected, completedTargets, claim.cursor);
+		}
+		const durationMs = elapsedSince(startedMs);
+		return {
+			status: await repo.completeMediaUsageCleanup({
+				leaseToken,
+				nextCursor,
+				sweepComplete,
+				candidateCount: candidateRows,
+				deletedOrphans,
+				deletedStale,
+				deletedAbandoned,
+				deletedWriteLeases,
+				backlogLowerBound,
+				scanHasMore,
+				durationMs
+			}) ? "completed" : "skipped",
+			candidateRows,
+			deletedRows: deletedOrphans + deletedStale + deletedAbandoned,
+			deletedOrphans,
+			deletedStale,
+			deletedAbandoned,
+			deletedWriteLeases,
+			backlogLowerBound,
+			scanHasMore,
+			durationMs
+		};
+	} catch (error) {
+		const durationMs = elapsedSince(startedMs);
+		const failures = Math.min(claim.consecutiveFailures + 1, 5);
+		try {
+			await repo.failMediaUsageCleanup({
+				leaseToken,
+				retryDelaySeconds: failureDelayMs(failures) / 1e3,
+				consecutiveFailures: failures,
+				durationMs,
+				errorCode: "MEDIA_USAGE_CLEANUP_FAILED"
+			});
+		} catch (failureError) {
+			console.error("[media-usage-cleanup] Failed to record cleanup failure:", failureError);
+		}
+		console.error("[media-usage-cleanup] Cleanup failed:", error);
+		return {
+			...emptyResult("failed", durationMs),
+			candidateRows,
+			deletedRows: deletedOrphans + deletedStale + deletedAbandoned,
+			deletedOrphans,
+			deletedStale,
+			deletedAbandoned,
+			deletedWriteLeases,
+			backlogLowerBound,
+			scanHasMore
+		};
+	}
+}
+function selectCleanupCandidates(candidates, activeLeaseAt) {
+	const orphanIds = [];
+	const staleIds = [];
+	const abandonedIds = [];
+	const entries = [];
+	for (const candidate of candidates) {
+		if (hasActiveWriteLease(candidate, activeLeaseAt)) {
+			entries.push({
+				candidate,
+				target: null
+			});
+			continue;
+		}
+		const target = cleanupTarget(candidate);
+		if (target === null) {
+			entries.push({
+				candidate,
+				target: null
+			});
+			continue;
+		}
+		if (orphanIds.length + staleIds.length + abandonedIds.length >= MEDIA_USAGE_CLEANUP_DELETE_LIMIT) break;
+		if (target === "orphan") orphanIds.push(candidate.id);
+		if (target === "stale") staleIds.push(candidate.id);
+		if (target === "abandoned") abandonedIds.push(candidate.id);
+		entries.push({
+			candidate,
+			target
+		});
+	}
+	return {
+		orphanIds,
+		staleIds,
+		abandonedIds,
+		entries
+	};
+}
+function cleanupTarget(candidate) {
+	if (candidate.currentGeneration === null) return "orphan";
+	if (candidate.currentGeneration === candidate.generation || candidate.indexedAt === null) return null;
+	return candidate.createdAt < candidate.indexedAt ? "stale" : "abandoned";
+}
+function hasActiveWriteLease(candidate, activeLeaseAt) {
+	return candidate.writeLeaseExpiresAt !== null && candidate.writeLeaseExpiresAt > activeLeaseAt;
+}
+function cursorFor(candidate) {
+	return {
+		createdAt: candidate.createdAt,
+		id: candidate.id
+	};
+}
+function cursorAfterCompletedCandidates(selected, completedTargets, priorCursor) {
+	let cursor = priorCursor;
+	for (const entry of selected.entries) {
+		if (entry.target !== null && !completedTargets.has(entry.target)) break;
+		cursor = cursorFor(entry.candidate);
+	}
+	return cursor;
+}
+function emptyResult(status, durationMs) {
+	return {
+		status,
+		candidateRows: 0,
+		deletedRows: 0,
+		deletedOrphans: 0,
+		deletedStale: 0,
+		deletedAbandoned: 0,
+		deletedWriteLeases: 0,
+		backlogLowerBound: 0,
+		scanHasMore: false,
+		durationMs
+	};
+}
+function withinBudget(startedMs) {
+	return elapsedSince(startedMs) < MEDIA_USAGE_CLEANUP_TIME_BUDGET_MS;
+}
+function elapsedSince(startedMs) {
+	return Math.max(0, Date.now() - startedMs);
+}
+function failureDelayMs(consecutiveFailures) {
+	return Math.min(2 ** (consecutiveFailures - 1), 15) * MEDIA_USAGE_CLEANUP_INTERVAL_MS;
+}
+function cleanupLease(leaseToken) {
+	return { leaseToken };
+}
+
+//#endregion
+//#region src/cleanup.ts
+/**
+* System cleanup
+*
+* Runs periodic maintenance tasks that prevent unbounded accumulation of
+* expired or stale data. Called from cron scheduler ticks and (for latency-
+* sensitive subsystems) inline during relevant requests.
+*
+* Each subsystem cleanup is independent and non-fatal -- if one fails, the
+* rest still run. Failures are logged but never surface to callers.
+*/
+const REVISION_KEEP_COUNT = 50;
+const REVISION_PRUNE_BATCH_SIZE = 10;
+/**
+* Run all system cleanup tasks.
+*
+* Safe to call frequently -- each subsystem tolerates repeated calls, and
+* repeated calls with nothing to clean are cheap.
+*
+* @param db - The database instance
+* @param storage - Optional storage backend for deleting orphaned files.
+*   When omitted, pending upload DB rows are still deleted but the
+*   corresponding files in object storage are not removed.
+*/
+async function runSystemCleanup(db, storage) {
+	const result = {
+		challenges: -1,
+		expiredTokens: -1,
+		pendingUploads: -1,
+		pendingUploadFiles: -1,
+		uploadAttempts: -1,
+		revisionsPruned: -1,
+		mediaUsage: -1,
+		notFoundLog: -1,
+		transferStaging: -1
+	};
+	try {
+		result.challenges = await cleanupExpiredChallenges(db);
+	} catch (error) {
+		console.error("[cleanup] Failed to clean expired challenges:", error);
+	}
+	try {
+		await createKyselyAdapter(db).deleteExpiredTokens();
+		result.expiredTokens = 0;
+	} catch (error) {
+		console.error("[cleanup] Failed to clean expired tokens:", error);
+	}
+	try {
+		const orphanedKeys = await new MediaRepository(db).cleanupPendingUploads();
+		result.pendingUploads = orphanedKeys.length;
+		if (storage && orphanedKeys.length > 0) {
+			let filesDeleted = 0;
+			for (const key of orphanedKeys) try {
+				await storage.delete(key);
+				filesDeleted++;
+			} catch (error) {
+				console.error(`[cleanup] Failed to delete storage file ${key}:`, error);
+			}
+			result.pendingUploadFiles = filesDeleted;
+		} else result.pendingUploadFiles = 0;
+	} catch (error) {
+		console.error("[cleanup] Failed to clean pending uploads:", error);
+	}
+	try {
+		const mediaRepo = new MediaRepository(db);
+		const completedAttemptsDeleted = await mediaRepo.deleteCompletedUploadAttempts();
+		if (!storage) result.uploadAttempts = completedAttemptsDeleted;
+		else {
+			const storageKeys = await mediaRepo.findUploadAttemptsForCleanup();
+			let attemptsDeleted = completedAttemptsDeleted;
+			for (const storageKey of storageKeys) if (await removeUploadAttempt(storage, mediaRepo, storageKey)) attemptsDeleted++;
+			result.uploadAttempts = attemptsDeleted;
+		}
+	} catch (error) {
+		console.error("[cleanup] Failed to clean media upload attempts:", error);
+	}
+	try {
+		result.revisionsPruned = await pruneQueuedRevisions(db);
+	} catch (error) {
+		console.error("[cleanup] Failed to prune revisions:", error);
+	}
+	try {
+		const mediaUsage = await cleanupMediaUsage(db);
+		result.mediaUsage = mediaUsage.status === "failed" ? -1 : mediaUsage.deletedRows;
+	} catch (error) {
+		console.error("[cleanup] Failed to clean media usage:", error);
+	}
+	try {
+		result.notFoundLog = await new RedirectRepository(db).cleanup404Log();
+	} catch (error) {
+		console.error("[cleanup] Failed to cap the 404 log:", error);
+	}
+	if (storage) try {
+		const { collectTransferStaging } = await import("./gc-xowRjczI.mjs");
+		result.transferStaging = (await collectTransferStaging(db, storage)).collected;
+	} catch (error) {
+		console.error("[transfer] Failed to collect transfer staging:", error);
+	}
+	else result.transferStaging = 0;
+	return result;
+}
+async function pruneQueuedRevisions(db) {
+	const queued = await db.selectFrom("_emdash_revision_prune_queue").selectAll().orderBy("revision_id").limit(REVISION_PRUNE_BATCH_SIZE).execute();
+	const revisionRepo = new RevisionRepository(db);
+	let totalPruned = 0;
+	for (const row of queued) try {
+		totalPruned += await revisionRepo.pruneQueuedEntry(row.collection, row.entry_id, row.revision_id, REVISION_KEEP_COUNT);
+	} catch (error) {
+		console.error(`[cleanup] Failed to prune revisions for ${row.collection}/${row.entry_id}:`, error);
+	}
+	return totalPruned;
+}
+
+//#endregion
+//#region src/comments/moderator.ts
+/** Plugin ID for the built-in default comment moderator */
+const DEFAULT_COMMENT_MODERATOR_PLUGIN_ID = "emdash-default-comment-moderator";
+/**
+* The comment:moderate handler for the built-in default moderator.
+*/
+async function defaultCommentModerate(event, _ctx) {
+	const { comment, collectionSettings, priorApprovedCount } = event;
+	if (collectionSettings.commentsAutoApproveUsers && comment.authorUserId) return {
+		status: "approved",
+		reason: "Authenticated CMS user"
+	};
+	if (collectionSettings.commentsModeration === "none") return {
+		status: "approved",
+		reason: "Moderation disabled"
+	};
+	if (collectionSettings.commentsModeration === "first_time" && priorApprovedCount > 0) return {
+		status: "approved",
+		reason: "Returning commenter"
+	};
+	return {
+		status: "pending",
+		reason: "Held for review"
+	};
+}
+
+//#endregion
+//#region src/scheduled-publish.ts
+/**
+* Default cap on items promoted per collection in a single sweep. Bounds the
+* publish/webhook fan-out of one tick so a large backlog can't exhaust a Worker
+* invocation's CPU/subrequest budget; the remainder drains on later ticks.
+*/
+const SCHEDULED_PUBLISH_BATCH_LIMIT = 100;
+const SCHEDULED_PUBLISH_CURSOR_PREFIX = "emdash:scheduled-publish-cursor:";
+function scheduledPublishCursorKey(collection) {
+	return `${SCHEDULED_PUBLISH_CURSOR_PREFIX}${collection}`;
+}
+function isScheduledPublishCursor(value) {
+	return typeof value === "object" && value !== null && "scheduledAt" in value && typeof value.scheduledAt === "string" && "id" in value && typeof value.id === "string";
+}
+/**
+* Publish every content item whose `scheduled_at` is in the past.
+*
+* Iterates all collections, finds due items (`findReadyToPublish` returns both
+* scheduled drafts and published entries with pending scheduled changes), and
+* publishes each. `publish()` clears `scheduled_at`, so a second sweep is a
+* no-op — safe to run on every tick.
+*
+* Bounded per collection by `limit` (default `SCHEDULED_PUBLISH_BATCH_LIMIT`):
+* a large backlog drains across successive ticks rather than in one unbounded
+* pass. After each collection's batch, `onPublished` (if given) is awaited so
+* cache-tag invalidation happens incrementally, not just at the very end.
+*
+* Returns every item it promoted so request-less callers (the Cloudflare
+* `scheduled()` handler) can also act on the full set.
+*/
+async function publishDueContent(db, options = {}) {
+	const { publish, onPublished, limit = SCHEDULED_PUBLISH_BATCH_LIMIT, currentTime = /* @__PURE__ */ new Date() } = options;
+	const published = [];
+	let collections;
+	try {
+		collections = await new SchemaRegistry(db).listCollections();
+	} catch (error) {
+		console.error("[scheduled-publish] Failed to list collections:", error);
+		return published;
+	}
+	const repo = new ContentRepository(db);
+	const optionsRepo = new OptionsRepository(db);
+	const doPublish = publish ?? ((collection, id, opts) => handleContentPublish(db, collection, id, opts));
+	const batchLimit = limit > 0 ? limit : void 0;
+	for (const collection of collections) try {
+		let cursor;
+		let cursorRevision = null;
+		if (batchLimit !== void 0) try {
+			const stored = await optionsRepo.getVersioned(scheduledPublishCursorKey(collection.slug));
+			cursorRevision = stored?.revision ?? null;
+			if (isScheduledPublishCursor(stored?.value)) cursor = stored.value;
+		} catch (error) {
+			console.error(`[scheduled-publish] Failed to read cursor for "${collection.slug}":`, error);
+		}
+		let due = await repo.findReadyToPublish(collection.slug, batchLimit, currentTime, cursor);
+		if (cursor && due.length === 0) due = await repo.findReadyToPublish(collection.slug, batchLimit, currentTime);
+		const batch = [];
+		for (const item of due) {
+			const publishedAt = item.publishedAt == null ? item.scheduledAt ?? void 0 : void 0;
+			const result = await doPublish(collection.slug, item.id, {
+				publishedAt,
+				requireScheduledDue: true,
+				expectedScheduledAt: item.scheduledAt ?? void 0,
+				currentTime
+			});
+			if (result.success) batch.push({
+				collection: collection.slug,
+				id: item.id
+			});
+			else if (result.error?.code === "NOT_DUE" || result.error?.code === "PUBLISH_REJECTED") {} else console.error(`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`, result.error);
+		}
+		const lastAttempted = due.at(-1);
+		if (batchLimit !== void 0 && lastAttempted?.scheduledAt) try {
+			await optionsRepo.compareAndSet(scheduledPublishCursorKey(collection.slug), cursorRevision, {
+				scheduledAt: lastAttempted.scheduledAt,
+				id: lastAttempted.id
+			});
+		} catch (error) {
+			console.error(`[scheduled-publish] Failed to save cursor for "${collection.slug}":`, error);
+		}
+		if (batch.length > 0) {
+			published.push(...batch);
+			if (onPublished) try {
+				await onPublished(batch);
+			} catch (error) {
+				console.error(`[scheduled-publish] onPublished failed after "${collection.slug}" batch:`, error);
+			}
+		}
+	} catch (error) {
+		console.error(`[scheduled-publish] Sweep failed for "${collection.slug}":`, error);
+	}
+	return published;
+}
+
+//#endregion
+//#region src/emdash-runtime.ts
+/**
+* EmDashRuntime - Core runtime for EmDash CMS
+*
+* Manages database, storage, plugins (trusted + sandboxed), hooks, and
+* provides handlers for content/media operations.
+*
+* Created once per worker lifetime, cached and reused across requests.
+*/
+const LEADING_SLASH_PATTERN = /^\//;
+const LOCALE_CASING_REPAIR_OPTION = "emdash:repair_locale_casing";
+const PLUGIN_COMMENT_STATUSES = new Set([
+	"approved",
+	"pending",
+	"spam"
+]);
+function assertPluginCommentStatus(value, name) {
+	if (!PLUGIN_COMMENT_STATUSES.has(value)) throw Object.assign(/* @__PURE__ */ new Error(`${name} must be one of: approved, pending, spam`), { code: "COMMENT_STATUS_INVALID" });
+}
+function getLocaleCasingRepairVersion(locales) {
+	if (locales.length === 0) return null;
+	return `1:${locales.toSorted().join(",")}`;
+}
+/**
+* Parse a JSON column expected to contain an array of strings.
+*
+* Throws on malformed JSON rather than returning []; callers are responsible
+* for deciding how to handle/log the error. Empty string / null inputs return
+* [] (they represent "no value"). Non-string array entries are filtered out.
+*/
+function parseStringArray(raw) {
+	if (!raw) return [];
+	const parsed = JSON.parse(raw);
+	if (!Array.isArray(parsed)) return [];
+	return parsed.filter((v) => typeof v === "string");
+}
+function isModerationDecision(value) {
+	if (typeof value !== "object" || value === null || !("status" in value)) return false;
+	if (value.status !== "pending" && value.status !== "approved" && value.status !== "spam") return false;
+	return !("reason" in value) || value.reason === void 0 || typeof value.reason === "string";
+}
+const DRAFT_ONLY_UPDATE_KEYS = new Set([
+	"data",
+	"slug",
+	"locale",
+	"skipRevision",
+	"references",
+	"actor",
+	"migrateBlocks",
+	"replaceBlocks"
+]);
+/** Field types whose schema is an array, so a stored blank string can never validate. */
+const ARRAY_FIELD_TYPES = new Set([
+	"portableText",
+	"multiSelect",
+	"repeater"
+]);
+const MAX_DRAFT_STAGE_ATTEMPTS = 32;
+const PLUGIN_INVOCATION_RELEASE_GRACE_MS = 6e4;
+/**
+* A `ContentSaveRejectedError` carries a message the plugin wrote for the
+* editor; every other exception stays internal and is replaced by a generic
+* message so hook internals cannot leak through the API.
+*/
+function beforeSaveFailure(error) {
+	if (isContentSaveRejection(error)) {
+		const sandbox = getSandboxSaveRejectionDetails(error);
+		if (sandbox) return {
+			success: false,
+			error: {
+				code: ErrorCode.SAVE_REJECTED,
+				message: error.message,
+				details: sandbox
+			}
+		};
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.SAVE_REJECTED,
+				message: error.message
+			}
+		};
+	}
+	console.error("EmDash: content:beforeSave hook failed:", error);
+	return {
+		success: false,
+		error: {
+			code: ErrorCode.CONTENT_HOOK_ERROR,
+			message: "A plugin hook failed while saving content"
+		}
+	};
+}
+/**
+* Convert a ContentItem to Record<string, unknown> for hook consumption.
+* Hooks receive the full item as a flat record.
+*/
+function contentItemToRecord(item) {
+	return { ...item };
+}
+function toPluginContentItem(item) {
+	return {
+		id: item.id,
+		type: item.type,
+		slug: item.slug,
+		status: item.status,
+		locale: item.locale,
+		data: item.data,
+		createdAt: item.createdAt,
+		updatedAt: item.updatedAt,
+		publishedAt: item.publishedAt,
+		scheduledAt: item.scheduledAt,
+		authorId: item.authorId,
+		translationGroup: item.translationGroup,
+		liveRevisionId: item.liveRevisionId,
+		draftRevisionId: item.draftRevisionId,
+		version: item.version,
+		...item.seo === void 0 ? {} : { seo: item.seo }
+	};
+}
+/**
+* Db init lock reclaim deadline. Derived from the migration race wait so
+* they can't drift apart: a healthy init can legitimately block for the
+* full MIGRATION_RACE_WAIT_MS inside waitForConcurrentMigrator, plus cold
+* connect and migrator work, before it should be presumed dead. The outer
+* runtime init lock (middleware.ts) must use a strictly larger deadline —
+* it wraps create() → getDatabase() → this lock, and equal deadlines would
+* let the outer reclaim while the inner is legitimately still working.
+*/
+const DB_INIT_DEADLINE_MS = MIGRATION_RACE_WAIT_MS + 2e4;
+/**
+* Db cache + its init lock live on globalThis behind a Symbol: the bundler
+* can duplicate this module across SSR chunks (same reasoning as
+* request-cache.ts), and a duplicated cache/lock would mean concurrent
+* independent db inits — and duplicate migrators — per isolate.
+*/
+const DB_HOLDER_KEY = Symbol.for("emdash:db-cache");
+const globalSymbolStore = globalThis;
+function getDbHolder() {
+	let holder = globalSymbolStore[DB_HOLDER_KEY];
+	if (!holder) {
+		holder = {
+			cache: /* @__PURE__ */ new Map(),
+			lock: createInitLock(),
+			failures: /* @__PURE__ */ new Map()
+		};
+		globalSymbolStore[DB_HOLDER_KEY] = holder;
+	}
+	holder.failures ??= /* @__PURE__ */ new Map();
+	return holder;
+}
+/**
+* After a database init fails (migrations threw), skip re-attempting for
+* this long. Cold isolates still get one attempt each, so a transient
+* failure heals on its own; a persistently failing migration is retried at
+* most once per backoff window per isolate instead of on every request.
+*/
+const DB_INIT_FAILURE_BACKOFF_MS = 3e4;
+/**
+* Auto-seed runs at most once per isolate per database. Its lock + "done" set
+* live on globalThis (same bundler-duplication reasoning as the db cache) so a
+* reclaimed-and-rerun `create()` can't seed a second time concurrently. The
+* lock polls rather than sharing a promise, so it is safe to await across a
+* cancelled owner in workerd.
+*/
+const SEED_HOLDER_KEY = Symbol.for("emdash:seed-state");
+function getSeedHolder() {
+	let holder = globalSymbolStore[SEED_HOLDER_KEY];
+	if (!holder) {
+		holder = {
+			done: /* @__PURE__ */ new Set(),
+			lock: createInitLock()
+		};
+		globalSymbolStore[SEED_HOLDER_KEY] = holder;
+	}
+	return holder;
+}
+const storageCache = /* @__PURE__ */ new Map();
+const sandboxedPluginCache = /* @__PURE__ */ new Map();
+const sandboxedManifestCache = /* @__PURE__ */ new Map();
+/**
+* Per-tier sets of `${pluginId}:${version}` keys present in
+* `sandboxedPluginCache`. Used during sync to know which entries belong
+* to which install source so we can invalidate only what belongs to the
+* tier currently being synced.
+*/
+const marketplacePluginKeys = /* @__PURE__ */ new Set();
+const registryPluginKeys = /* @__PURE__ */ new Set();
+/**
+* Manifest metadata for runtime-installed sandboxed plugins (marketplace
+* and registry both). Keyed by `pluginId`; readers don't care which
+* source the plugin came from. Named `marketplace*` for legacy reasons.
+*/
+const marketplaceManifestCache = /* @__PURE__ */ new Map();
+/** Route metadata for sandboxed plugins: pluginId -> routeName -> RouteMeta */
+const sandboxedRouteMetaCache = /* @__PURE__ */ new Map();
+let sandboxRunner = null;
+function allowedBrowserImageHosts(capabilities, allowedHosts) {
+	if (capabilities.includes("network:request:unrestricted") || capabilities.includes("network:fetch:any")) return ["*"];
+	if (capabilities.includes("network:request") || capabilities.includes("network:fetch")) return allowedHosts;
+	return [];
+}
+/**
+* EmDashRuntime - singleton per worker
+*/
+var EmDashRuntime = class EmDashRuntime {
+	/**
+	* The singleton database instance (worker-lifetime cached).
+	* Use the `db` getter instead — it checks the request context first
+	* for per-request overrides (D1 read replica sessions, DO multi-site).
+	*/
+	_db;
+	storage;
+	configuredPlugins;
+	sandboxedPlugins;
+	sandboxedPluginEntries;
+	/**
+	* Schema registry bound to the current request/event-scoped connection.
+	* Built per access (SchemaRegistry just wraps a db) against `this.db`, the
+	* ALS-aware getter — never a captured snapshot of the singleton. On a
+	* connection-backed adapter (Postgres over Hyperdrive) a captured singleton
+	* would query a socket opened by an earlier event and trip workerd's
+	* cross-request I/O guard; the catch in handlers like handleContentUpdate
+	* would then silently treat a revision-enabled collection as non-revisioned
+	* and write draft edits to live columns. Same reasoning as the per-call
+	* registry in _buildManifest().
+	*/
+	get schemaRegistry() {
+		return new SchemaRegistry(this.db);
+	}
+	_hooks;
+	config;
+	mediaProviders;
+	mediaProviderEntries;
+	cronExecutor;
+	email;
+	cronScheduler;
+	enabledPlugins;
+	pluginStates;
+	activePluginContentActions = /* @__PURE__ */ new Map();
+	pendingPluginAfterHooks = /* @__PURE__ */ new Map();
+	activePluginInvocations = /* @__PURE__ */ new Set();
+	/** Timed-out sandbox invocations whose later actions must schedule hooks without another flush. */
+	releasedPluginInvocations = /* @__PURE__ */ new Set();
+	pluginInvocationCacheInvalidators = /* @__PURE__ */ new Map();
+	pluginContentCacheInvalidator;
+	/**
+	* Isolate-lifetime guard so FTS indexes are verified at most once per
+	* worker rather than on every admin request. See ensureSearchHealthy().
+	* Uses the poison-immune single-flight cache (never a shared awaitable
+	* promise) so a cancelled first caller can't wedge later ones.
+	*/
+	_searchHealthCache = createSingleFlightCache();
+	/** Current hook pipeline. Use the `hooks` getter for external access. */
+	get hooks() {
+		return this._hooks;
+	}
+	/** All plugins eligible for the hook pipeline (includes built-in plugins).
+	*  Stored so we can rebuild the pipeline when plugins are enabled/disabled. */
+	allPipelinePlugins;
+	/** Guards the once-per-process plugin storage-index sync. */
+	storageIndexesSynced = false;
+	/** Factory options for the hook pipeline context factory */
+	pipelineFactoryOptions;
+	/** Dependencies needed for exclusive hook resolution */
+	runtimeDeps;
+	/** Mutable ref for the cron invokeCronHook closure to read the current pipeline */
+	pipelineRef;
+	commentModerationInProgress = /* @__PURE__ */ new Set();
+	/**
+	* Get the database instance for the current request.
+	*
+	* Checks the ALS-based request context first — middleware sets a
+	* per-request Kysely instance there for D1 read replica sessions
+	* or DO preview databases. Falls back to the singleton instance.
+	*/
+	get db() {
+		const ctx = getRequestContext();
+		if (ctx?.db) return ctx.db;
+		return this._db;
+	}
+	/** Bind the platform cache provider used by plugin actions, including request-less cron hooks. */
+	setPluginContentCacheInvalidator(invalidateContentCache) {
+		this.pluginContentCacheInvalidator = invalidateContentCache;
+	}
+	constructor(parts) {
+		this._db = parts.db;
+		this.storage = parts.storage;
+		this.configuredPlugins = parts.configuredPlugins;
+		this.sandboxedPlugins = parts.sandboxedPlugins;
+		this.sandboxedPluginEntries = parts.sandboxedPluginEntries;
+		this._hooks = parts.hooks;
+		this.enabledPlugins = parts.enabledPlugins;
+		this.pluginStates = parts.pluginStates;
+		this.config = parts.config;
+		this.mediaProviders = parts.mediaProviders;
+		this.mediaProviderEntries = parts.mediaProviderEntries;
+		this.cronExecutor = parts.cronExecutor;
+		this.cronScheduler = parts.cronScheduler;
+		this.email = parts.emailPipeline;
+		this.allPipelinePlugins = parts.allPipelinePlugins;
+		this.pipelineFactoryOptions = parts.pipelineFactoryOptions;
+		this.runtimeDeps = parts.runtimeDeps;
+		this.pipelineRef = parts.pipelineRef;
+	}
+	/**
+	* Get the sandbox runner instance (for marketplace install/update)
+	*/
+	getSandboxRunner() {
+		return sandboxRunner;
+	}
+	/**
+	* Whether the sandbox bypass mode (sandbox: false) is active.
+	* Marketplace install/update handlers use this to skip the
+	* SANDBOX_NOT_AVAILABLE gate, since the bypass path loads
+	* marketplace plugins in-process via syncMarketplacePlugins().
+	*/
+	isSandboxBypassed() {
+		return this.runtimeDeps.sandboxBypassed === true;
+	}
+	/**
+	* Publish any content whose scheduled time has passed.
+	* Returns the items promoted so callers can invalidate their cache tags.
+	*/
+	async publishScheduled() {
+		return this.publishScheduledWithFence();
+	}
+	async publishScheduledWithFence(onPublished) {
+		const recordWrite = await assertSiteWriteAllowed(this.db);
+		const currentTime = this.runtimeDeps.now?.() ?? /* @__PURE__ */ new Date();
+		const published = await publishDueContent(this.db, {
+			publish: (collection, id, options) => this.handleContentPublish(collection, id, {
+				...options,
+				origin: { source: "scheduler" }
+			}),
+			onPublished,
+			currentTime
+		});
+		if (published.length > 0) await recordWrite();
+		return published;
+	}
+	/**
+	* Run the full scheduled-maintenance batch: cron tasks, scheduled
+	* publishing, and system cleanup. For request-less drivers — the
+	* Cloudflare `scheduled()` handler invokes this from a Cron Trigger.
+	* (On Node the timer-based scheduler drives the same work itself.)
+	*
+	* Each step is independent and non-fatal. Returns the content promoted
+	* by the publishing sweep so the caller can purge edge-cache tags.
+	*
+	* `onPublished` (optional) is awaited after each collection's batch so a
+	* request-less driver can invalidate edge-cache tags incrementally rather
+	* than only after the whole sweep — bounding stale-cache exposure if the
+	* runtime is killed mid-sweep.
+	*/
+	async runScheduledTasks(options = {}) {
+		const { published } = await this.runScheduledTasksWithStats(options);
+		return { published };
+	}
+	async runScheduledTasksWithStats(options = {}) {
+		if (options.invalidateContentCache) this.pluginContentCacheInvalidator = options.invalidateContentCache;
+		let processed = 0;
+		if (this.cronExecutor) {
+			try {
+				processed = await this.cronExecutor.tick();
+			} catch (error) {
+				console.error("[cron] Tick failed:", error);
+			}
+			try {
+				await this.cronExecutor.recoverStaleLocks();
+			} catch (error) {
+				console.error("[cron] Stale lock recovery failed:", error);
+			}
+		}
+		let published = [];
+		try {
+			published = await this.publishScheduledWithFence(options.onPublished);
+		} catch (error) {
+			console.error("[scheduled-publish] Sweep failed:", error);
+		}
+		try {
+			await runSystemCleanup(this.db, this.storage ?? void 0);
+		} catch (error) {
+			console.error("[cleanup] System cleanup failed:", error);
+		}
+		try {
+			await this.syncPluginStorageIndexesOnce();
+		} catch (error) {
+			console.error("[plugins] Storage index sync failed:", error);
+		}
+		await maybeRunScheduledBackup(this.db, this.storage ?? void 0);
+		await recordSchedulerHeartbeatSafely(this.db);
+		return {
+			processed,
+			published
+		};
+	}
+	/**
+	* Materialize plugin-declared storage indexes, once per process.
+	*
+	* Called from the scheduler path, not from request handlers — configured
+	* plugins have no install handler, so the tick is their only sync moment.
+	*/
+	async syncPluginStorageIndexesOnce() {
+		if (this.storageIndexesSynced) return;
+		this.storageIndexesSynced = true;
+		await syncDeclaredStorageIndexes(this.db, [...this.allPipelinePlugins, ...marketplaceManifestCache.values()]);
+	}
+	/**
+	* Stop the cron scheduler gracefully.
+	* Call during worker shutdown or hot-reload.
+	*/
+	async stopCron() {
+		if (this.cronScheduler) await this.cronScheduler.stop();
+	}
+	/** Stop background work and discard loaded sandbox isolates. */
+	async shutdown() {
+		await this.stopCron();
+		sandboxRunner?.setCommentModerate?.(null);
+		await sandboxRunner?.terminateAll();
+		sandboxRunner = null;
+		sandboxedPluginCache.clear();
+		sandboxedManifestCache.clear();
+		sandboxedRouteMetaCache.clear();
+		marketplaceManifestCache.clear();
+		marketplacePluginKeys.clear();
+		registryPluginKeys.clear();
+	}
+	/**
+	* Update in-memory plugin status and rebuild the hook pipeline.
+	*
+	* Rebuilding the pipeline ensures disabled plugins' hooks stop firing
+	* and re-enabled plugins' hooks start firing again without a restart.
+	* Exclusive hook selections are re-resolved after each rebuild.
+	*/
+	async setPluginStatus(pluginId, status) {
+		this.pluginStates.set(pluginId, status);
+		if (status === "active") {
+			this.setSandboxedPluginActive(pluginId, true);
+			this.enabledPlugins.add(pluginId);
+			await this.rebuildHookPipeline();
+			await this._hooks.runPluginActivate(pluginId);
+		} else try {
+			await this._hooks.runPluginDeactivate(pluginId);
+		} finally {
+			this.setSandboxedPluginActive(pluginId, false);
+			this.enabledPlugins.delete(pluginId);
+			await this.rebuildHookPipeline();
+		}
+	}
+	setSandboxedPluginActive(pluginId, active) {
+		for (const [key, plugin] of this.sandboxedPlugins) if (key.slice(0, key.lastIndexOf(":")) === pluginId) plugin.setActive?.(active);
+	}
+	async handlePluginEnable(pluginId) {
+		return enableRuntimePlugin(this, pluginId);
+	}
+	async handlePluginDisable(pluginId) {
+		return disableRuntimePlugin(this, pluginId);
+	}
+	/** Dispatch teardown lifecycle while the runtime-installed isolate is still loaded. */
+	async runPluginUninstallLifecycle(pluginId, deleteData) {
+		if (this.isPluginEnabled(pluginId)) try {
+			await this._hooks.runPluginDeactivate(pluginId);
+		} catch (error) {
+			console.error(`EmDash: Plugin ${pluginId} deactivate hook failed during uninstall:`, error);
+		}
+		try {
+			if ((await this._hooks.runPluginUninstall(pluginId, deleteData)).length > 0) return;
+			await this.findSandboxedPlugin(pluginId)?.invokeHook("plugin:uninstall", { deleteData });
+		} catch (error) {
+			console.error(`EmDash: Plugin ${pluginId} uninstall hook failed:`, error);
+		}
+	}
+	async runPluginInstallLifecycle(pluginId) {
+		await this._hooks.runPluginInstall(pluginId);
+		await this._hooks.runPluginActivate(pluginId);
+	}
+	async runPluginActivateLifecycle(pluginId) {
+		await this._hooks.runPluginActivate(pluginId);
+	}
+	/**
+	* Rebuild the hook pipeline from the current set of enabled plugins.
+	*
+	* Filters `allPipelinePlugins` to only those in `enabledPlugins`,
+	* creates a fresh HookPipeline, re-resolves exclusive hook selections,
+	* and re-wires the context factory so existing references (cron
+	* callbacks, email pipeline) use the new pipeline.
+	*/
+	async rebuildHookPipeline() {
+		const newPipeline = createHookPipeline(this.allPipelinePlugins.filter((p) => this.enabledPlugins.has(p.id)), this.pipelineFactoryOptions);
+		await EmDashRuntime.resolveExclusiveHooks(newPipeline, this.db, this.runtimeDeps);
+		if (this.email) newPipeline.setContextFactory({ emailPipeline: this.email });
+		newPipeline.setContextFactory({ cronReschedule: () => this.cronScheduler?.reschedule() });
+		if (this.email) this.email.setPipeline(newPipeline);
+		this.pipelineRef.current = newPipeline;
+		this._hooks = newPipeline;
+	}
+	/**
+	* Synchronize marketplace plugin runtime state with DB + storage.
+	*
+	* Ensures install/update/uninstall changes take effect immediately in the
+	* current worker: loads newly active plugins and removes uninstalled ones.
+	*/
+	async syncMarketplacePlugins() {
+		if (!this.config.marketplace) return;
+		if (this.runtimeDeps.sandboxBypassed) {
+			await this.syncMarketplacePluginsBypassed();
+			return;
+		}
+		await this.syncSandboxedSourcePlugins("marketplace");
+	}
+	/**
+	* Synchronize registry plugin runtime state with DB + storage.
+	*
+	* Mirrors {@link syncMarketplacePlugins} for plugins installed via the
+	* experimental decentralized plugin registry. Called after install,
+	* update, and uninstall handlers complete.
+	*/
+	async syncRegistryPlugins() {
+		if (!getRegistryConfigInput(this.config.registry, this.config.experimental?.registry)) return;
+		await this.syncSandboxedSourcePlugins("registry");
+	}
+	/**
+	* Internal: reconcile in-memory sandboxed-plugin state with the
+	* `_plugin_state` table for the given source tier. Shared
+	* implementation behind {@link syncMarketplacePlugins} and
+	* {@link syncRegistryPlugins}.
+	*
+	* Each source tier has its own key set in `${source}PluginKeys` so a
+	* sync for one tier doesn't invalidate the other.
+	*/
+	async syncSandboxedSourcePlugins(source) {
+		if (!this.storage) return;
+		if (!sandboxRunner || !sandboxRunner.isAvailable()) return;
+		const keySet = source === "marketplace" ? marketplacePluginKeys : registryPluginKeys;
+		let pipelineChanged = false;
+		try {
+			const stateRepo = new PluginStateRepository(this.db);
+			const states = source === "marketplace" ? await stateRepo.getMarketplacePlugins() : await stateRepo.getRegistryPlugins();
+			const desired = /* @__PURE__ */ new Map();
+			for (const state of states) {
+				this.pluginStates.set(state.pluginId, state.status);
+				if (state.status === "active") this.enabledPlugins.add(state.pluginId);
+				else this.enabledPlugins.delete(state.pluginId);
+				if (state.status !== "active") continue;
+				const desiredVersion = source === "marketplace" ? state.marketplaceVersion ?? state.version : state.version;
+				desired.set(state.pluginId, desiredVersion);
+			}
+			const keysToRemove = [];
+			for (const key of keySet) {
+				const [pluginId] = key.split(":");
+				if (!pluginId) continue;
+				const desiredVersion = desired.get(pluginId);
+				if (desiredVersion && key === `${pluginId}:${desiredVersion}`) continue;
+				keysToRemove.push(key);
+			}
+			for (const key of keysToRemove) {
+				const [pluginId] = key.split(":");
+				if (!pluginId) continue;
+				if (!desired.get(pluginId)) {
+					this.pluginStates.delete(pluginId);
+					this.enabledPlugins.delete(pluginId);
+				}
+				const existing = sandboxedPluginCache.get(key);
+				if (existing) try {
+					await existing.terminate();
+				} catch (error) {
+					console.warn(`EmDash: Failed to terminate sandboxed plugin ${key}:`, error);
+				}
+				sandboxedPluginCache.delete(key);
+				sandboxedManifestCache.delete(key);
+				this.sandboxedPlugins.delete(key);
+				this.removePluginFromLists(pluginId);
+				keySet.delete(key);
+				pipelineChanged = true;
+				if (pluginId) {
+					sandboxedRouteMetaCache.delete(pluginId);
+					marketplaceManifestCache.delete(pluginId);
+				}
+			}
+			for (const [pluginId, version] of desired) {
+				const key = `${pluginId}:${version}`;
+				if (sandboxedPluginCache.has(key)) {
+					keySet.add(key);
+					continue;
+				}
+				const bundle = await loadBundleFromR2(this.storage, pluginId, version, source);
+				if (!bundle) {
+					console.warn(`EmDash: ${source} plugin ${pluginId}@${version} not found in R2`);
+					continue;
+				}
+				const loaded = await sandboxRunner.load(bundle.manifest, bundle.backendCode);
+				sandboxedPluginCache.set(key, loaded);
+				sandboxedManifestCache.set(key, bundle.manifest);
+				this.sandboxedPlugins.set(key, loaded);
+				this.allPipelinePlugins.push(createSandboxedPluginProxy(bundle.manifest, loaded));
+				keySet.add(key);
+				pipelineChanged = true;
+				marketplaceManifestCache.set(pluginId, {
+					id: bundle.manifest.id,
+					version: bundle.manifest.version,
+					admin: bundle.manifest.admin,
+					mcp: bundle.manifest.mcp,
+					storage: bundle.manifest.storage,
+					allowedHosts: bundle.manifest.allowedHosts,
+					capabilities: bundle.manifest.capabilities
+				});
+				if (bundle.manifest.routes.length > 0) {
+					const routeMetaMap = /* @__PURE__ */ new Map();
+					for (const entry of bundle.manifest.routes) {
+						const normalized = normalizeManifestRoute$1(entry);
+						routeMetaMap.set(normalized.name, buildRouteMeta(normalized));
+					}
+					sandboxedRouteMetaCache.set(pluginId, routeMetaMap);
+				} else sandboxedRouteMetaCache.delete(pluginId);
+			}
+			if (pipelineChanged) await this.rebuildHookPipeline();
+		} catch (error) {
+			console.error(`EmDash: Failed to sync ${source} plugins:`, error);
+		}
+	}
+	/**
+	* Remove a plugin from the in-memory pipeline lists by ID.
+	* Mutates allPipelinePlugins and configuredPlugins in place.
+	*/
+	removePluginFromLists(pluginId) {
+		const allIdx = this.allPipelinePlugins.findIndex((p) => p.id === pluginId);
+		if (allIdx !== -1) this.allPipelinePlugins.splice(allIdx, 1);
+		const configIdx = this.configuredPlugins.findIndex((p) => p.id === pluginId);
+		if (configIdx !== -1) this.configuredPlugins.splice(configIdx, 1);
+	}
+	/**
+	* Sync marketplace plugin metadata in sandbox: false bypass mode.
+	*
+	* In bypass mode the noop runner can't load plugins, but admin pages,
+	* widgets, and route metadata still need to refresh in-process when an
+	* admin installs/updates/uninstalls a marketplace plugin. Otherwise the
+	* admin UI shows stale data until the server restarts.
+	*
+	* Hooks and routes still won't execute under bypass (matches the
+	* cold-start bypass behavior in loadMarketplacePluginsBypassed).
+	*
+	* Known limitation: bypass plugins are loaded via `import(dataUrl)`,
+	* which Node's ESM cache keys on the full URL. Updates create fresh
+	* module objects, but old ones remain cached for the worker's lifetime.
+	* In practice this is a few KB per update — only matters for sites with
+	* very frequent marketplace updates running long-lived processes. The
+	* fix would be vm.SourceTextModule for explicit lifecycle management.
+	*/
+	async syncMarketplacePluginsBypassed() {
+		if (!this.storage) return;
+		try {
+			const marketplaceStates = await new PluginStateRepository(this.db).getMarketplacePlugins();
+			const desired = /* @__PURE__ */ new Map();
+			for (const state of marketplaceStates) {
+				this.pluginStates.set(state.pluginId, state.status);
+				if (state.status === "active") this.enabledPlugins.add(state.pluginId);
+				else this.enabledPlugins.delete(state.pluginId);
+				if (state.status !== "active") continue;
+				desired.set(state.pluginId, state.marketplaceVersion ?? state.version);
+			}
+			const toRemove = [];
+			for (const pluginId of marketplaceManifestCache.keys()) if (!desired.has(pluginId)) toRemove.push(pluginId);
+			for (const pluginId of toRemove) {
+				const resolved = this.allPipelinePlugins.find((p) => p.id === pluginId);
+				if (resolved) try {
+					const deactivateHook = resolved.hooks?.["plugin:deactivate"];
+					if (deactivateHook) {
+						const handler = typeof deactivateHook === "function" ? deactivateHook : deactivateHook.handler;
+						if (typeof handler === "function") await handler({ pluginId }, {});
+					}
+				} catch (err) {
+					console.warn(`[emdash] plugin:deactivate hook failed for ${pluginId}:`, err);
+				}
+				marketplaceManifestCache.delete(pluginId);
+				sandboxedRouteMetaCache.delete(pluginId);
+				this.removePluginFromLists(pluginId);
+				this.enabledPlugins.delete(pluginId);
+			}
+			const { adaptSandboxEntry } = await import("./plugins/adapt-sandbox-entry.mjs");
+			const newPlugins = [];
+			for (const [pluginId, version] of desired) {
+				const bundle = await loadBundleFromR2(this.storage, pluginId, version);
+				if (!bundle) {
+					console.warn(`EmDash: Marketplace plugin ${pluginId}@${version} not found in R2`);
+					continue;
+				}
+				marketplaceManifestCache.set(pluginId, {
+					id: bundle.manifest.id,
+					version: bundle.manifest.version,
+					admin: bundle.manifest.admin,
+					mcp: bundle.manifest.mcp,
+					storage: bundle.manifest.storage,
+					allowedHosts: bundle.manifest.allowedHosts,
+					capabilities: bundle.manifest.capabilities
+				});
+				if (bundle.manifest.routes.length > 0) {
+					const routeMetaMap = /* @__PURE__ */ new Map();
+					for (const entry of bundle.manifest.routes) {
+						const normalized = normalizeManifestRoute$1(entry);
+						routeMetaMap.set(normalized.name, buildRouteMeta(normalized));
+					}
+					sandboxedRouteMetaCache.set(pluginId, routeMetaMap);
+				} else sandboxedRouteMetaCache.delete(pluginId);
+				const existing = this.allPipelinePlugins.find((p) => p.id === pluginId);
+				if (existing && existing.version === bundle.manifest.version) continue;
+				if (existing) this.removePluginFromLists(pluginId);
+				try {
+					const pluginModule = await import(`data:text/javascript;base64,${Buffer.from(bundle.backendCode).toString("base64")}`);
+					const adapted = adaptSandboxEntry(pluginModule.default ?? pluginModule, {
+						id: bundle.manifest.id,
+						version: bundle.manifest.version,
+						entrypoint: "",
+						capabilities: bundle.manifest.capabilities ?? [],
+						allowedHosts: bundle.manifest.allowedHosts ?? [],
+						storage: bundle.manifest.storage ?? {},
+						adminPages: bundle.manifest.admin?.pages,
+						adminWidgets: bundle.manifest.admin?.widgets?.map((w) => ({
+							id: w.id,
+							title: w.title,
+							size: w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0
+						})),
+						settingsSchema: bundle.manifest.admin?.settingsSchema,
+						editorPanels: bundle.manifest.admin?.editorPanels,
+						editorActions: bundle.manifest.admin?.editorActions
+					});
+					newPlugins.push(adapted);
+					this.allPipelinePlugins.push(adapted);
+					this.configuredPlugins.push(adapted);
+					this.enabledPlugins.add(adapted.id);
+				} catch (error) {
+					console.error(`EmDash: Failed to load marketplace plugin ${pluginId}@${version} in-process:`, error);
+				}
+			}
+			if (toRemove.length > 0 || newPlugins.length > 0) await this.rebuildHookPipeline();
+		} catch (error) {
+			console.error("EmDash: Failed to sync marketplace plugins (bypass):", error);
+		}
+	}
+	/**
+	* Create and initialize the runtime
+	*/
+	static async create(deps, timings) {
+		const phase = async (name, desc, fn) => {
+			if (!timings) return fn();
+			const t0 = performance.now();
+			try {
+				return await fn();
+			} finally {
+				timings.push({
+					name,
+					dur: performance.now() - t0,
+					desc
+				});
+			}
+		};
+		const db = await phase("rt.db", "DB init + migration policy", () => EmDashRuntime.getDatabase(deps));
+		const resolveDb = () => {
+			return getRequestContext()?.db ?? db;
+		};
+		await phase("rt.secrets", "Validate encryption key", () => validateEncryptionKeyAtStartup());
+		const storage = EmDashRuntime.getStorage(deps);
+		let pluginStates = /* @__PURE__ */ new Map();
+		const configuredLocales = virtualConfig?.i18n?.locales ?? getI18nConfig()?.locales ?? [];
+		const localeCasingRepairVersion = getLocaleCasingRepairVersion(configuredLocales);
+		let storedLocaleCasingRepairVersion;
+		let siteInfo;
+		let seedGate = {
+			collectionCount: 1,
+			setupDone: true
+		};
+		const reqCtx = getRequestContext();
+		const ownsConfiguredDb = !!deps.config.database && !(reqCtx?.dbIsIsolated && reqCtx.db);
+		let readDb = db;
+		let readDbDisposable;
+		const disposeReadDb = async () => {
+			const disposable = readDbDisposable;
+			readDbDisposable = void 0;
+			if (!disposable) return;
+			try {
+				await disposable.destroy();
+			} catch {}
+		};
+		if (ownsConfiguredDb && deps.createCoalescingDialect && deps.config.database) try {
+			const dialect = deps.createCoalescingDialect(deps.config.database.config);
+			if (dialect) {
+				readDb = new Kysely({
+					dialect,
+					log: kyselyLogOption()
+				});
+				readDbDisposable = readDb;
+			}
+		} catch {
+			readDb = db;
+		}
+		const optionsRepo = new OptionsRepository(readDb);
+		let missingManualSchemaError;
+		const captureMissingManualSchema = (error) => {
+			if ((deps.migrationMode ?? "auto") === "manual" && isMissingTableError(error)) missingManualSchemaError ??= error;
+		};
+		const readSiteInfo = async () => {
+			const siteOpts = await optionsRepo.getMany([
+				"emdash:site_title",
+				"emdash:site_url",
+				"emdash:locale",
+				LOCALE_CASING_REPAIR_OPTION
+			]);
+			storedLocaleCasingRepairVersion = siteOpts.get(LOCALE_CASING_REPAIR_OPTION);
+			return {
+				siteName: deps.siteInfo?.name ?? siteOpts.get("emdash:site_title") ?? void 0,
+				siteUrl: deps.siteInfo?.url ?? siteOpts.get("emdash:site_url") ?? void 0,
+				locale: deps.siteInfo?.locale ?? siteOpts.get("emdash:locale") ?? void 0,
+				trailingSlash: deps.siteInfo?.trailingSlash ?? virtualConfig?.trailingSlash
+			};
+		};
+		const coldStartReads = [phase("rt.plugins", "Plugin states", async () => {
+			try {
+				const states = await readDb.selectFrom("_plugin_state").select(["plugin_id", "status"]).execute();
+				pluginStates = new Map(states.map((s) => [s.plugin_id, s.status]));
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
+		}), phase("rt.site", "Site info options", async () => {
+			try {
+				siteInfo = await readSiteInfo();
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
+		})];
+		if (ownsConfiguredDb) coldStartReads.push(phase("rt.seedcheck", "Auto-seed gate", async () => {
+			try {
+				const [collectionRows, setupOption] = await Promise.all([readDb.selectFrom("_emdash_collections").select("slug").execute(), readDb.selectFrom("options").select("value").where("name", "=", "emdash:setup_complete").executeTakeFirst()]);
+				primeRegisteredCollections(collectionRows.map((row) => row.slug));
+				const setupDone = (() => {
+					try {
+						return !!setupOption && JSON.parse(setupOption.value) === true;
+					} catch {
+						return false;
+					}
+				})();
+				seedGate = {
+					collectionCount: collectionRows.length,
+					setupDone
+				};
+			} catch (error) {
+				captureMissingManualSchema(error);
+			}
+		}));
+		await Promise.all(coldStartReads);
+		if (missingManualSchemaError) {
+			await disposeReadDb();
+			throw missingManualSchemaError;
+		}
+		if (localeCasingRepairVersion && (configuredLocales.some((locale) => locale.includes("-") || locale !== locale.toLowerCase()) || storedLocaleCasingRepairVersion !== void 0) && storedLocaleCasingRepairVersion !== localeCasingRepairVersion) await phase("rt.locale", "Repair locale casing", async () => {
+			await repairLocaleCasing(db, configuredLocales);
+			await new OptionsRepository(db).set(LOCALE_CASING_REPAIR_OPTION, localeCasingRepairVersion);
+		});
+		if (seedGate.collectionCount === 0 && !seedGate.setupDone) {
+			try {
+				if ((await activateMediaUsageCapture(db, { writersDrained: true })).outcome !== "active") throw new Error("Fresh-site media usage activation did not complete");
+			} catch (error) {
+				await disposeReadDb();
+				throw error;
+			}
+			const seedKey = deps.config.database?.entrypoint ?? "default";
+			const seedHolder = getSeedHolder();
+			try {
+				await initWithLock(seedHolder.lock, () => seedHolder.done.has(seedKey) ? true : void 0, async () => {
+					const { applySeed } = await import("./apply-Do3KNnUk.mjs").then((n) => n.r);
+					const { loadSeed } = await import("./load-D99axixL.mjs").then((n) => n.r);
+					const { validateSeed } = await import("./validate-CfgRpcjA.mjs").then((n) => n.r);
+					const seed = await loadSeed();
+					if (validateSeed(seed).valid) {
+						const seedResult = await applySeed(db, seed, { onConflict: "skip" });
+						console.log("Auto-seeded default collections");
+						if (seedResult.taxonomies.skipped > 0) console.warn(`[auto-seed] Kept ${seedResult.taxonomies.skipped} existing taxonomy definition(s) instead of the seed's. Edit them in the admin, or run \`emdash seed <file> --on-conflict update\` to replace them (this also overwrites other seeded records).`);
+					}
+					seedHolder.done.add(seedKey);
+					return true;
+				}, {
+					deadlineMs: DB_INIT_DEADLINE_MS,
+					anchor: (promise) => after(() => promise)
+				});
+				try {
+					siteInfo = await readSiteInfo();
+				} catch {}
+			} catch {}
+		}
+		await disposeReadDb();
+		const enabledPlugins = /* @__PURE__ */ new Set();
+		for (const plugin of deps.plugins) {
+			const status = pluginStates.get(plugin.id);
+			if (status === void 0 || status === "active") enabledPlugins.add(plugin.id);
+		}
+		const allPipelinePlugins = [...deps.plugins];
+		const bypassedPluginsList = [];
+		if (import.meta.env.DEV) try {
+			const devConsolePlugin = definePlugin({
+				id: DEV_CONSOLE_EMAIL_PLUGIN_ID,
+				version: "0.0.0",
+				capabilities: ["hooks.email-transport:register"],
+				hooks: { "email:deliver": {
+					exclusive: true,
+					handler: devConsoleEmailDeliver
+				} }
+			});
+			allPipelinePlugins.push(devConsolePlugin);
+			enabledPlugins.add(devConsolePlugin.id);
+		} catch (error) {
+			console.warn("[email] Failed to register dev console email provider:", error);
+		}
+		try {
+			const defaultModeratorPlugin = definePlugin({
+				id: DEFAULT_COMMENT_MODERATOR_PLUGIN_ID,
+				version: "0.0.0",
+				capabilities: ["users:read"],
+				hooks: { "comment:moderate": {
+					exclusive: true,
+					handler: defaultCommentModerate
+				} }
+			});
+			allPipelinePlugins.push(defaultModeratorPlugin);
+			enabledPlugins.add(defaultModeratorPlugin.id);
+		} catch (error) {
+			console.warn("[comments] Failed to register default moderator:", error);
+		}
+		if (deps.sandboxBypassed && deps.sandboxedPluginEntries.length > 0) {
+			if (typeof navigator !== "undefined" && typeof navigator.userAgent === "string" && navigator.userAgent.includes("Cloudflare-Workers")) throw new Error("sandbox: false is not supported in Cloudflare Workers. Remove the sandbox: false option or use the Cloudflare sandbox runner.");
+			console.info("EmDash: Sandbox disabled (sandbox: false). Sandboxed plugins will run in-process without isolation.");
+			const bypassedPlugins = await EmDashRuntime.loadBypassedPlugins(deps.sandboxedPluginEntries);
+			for (const plugin of bypassedPlugins) {
+				allPipelinePlugins.push(plugin);
+				bypassedPluginsList.push(plugin);
+				const status = pluginStates.get(plugin.id);
+				if (status === void 0 || status === "active") enabledPlugins.add(plugin.id);
+			}
+		}
+		if (deps.sandboxBypassed && deps.config.marketplace && storage) {
+			const marketplaceBypassed = await EmDashRuntime.loadMarketplacePluginsBypassed(db, storage);
+			for (const plugin of marketplaceBypassed) {
+				allPipelinePlugins.push(plugin);
+				bypassedPluginsList.push(plugin);
+				const status = pluginStates.get(plugin.id);
+				if (status === void 0 || status === "active") enabledPlugins.add(plugin.id);
+			}
+		}
+		const sandboxedPluginPool = await phase("rt.sandbox", "Sandboxed plugins", () => EmDashRuntime.loadSandboxedPlugins(deps, db, storage, siteInfo));
+		for (const [key, plugin] of sandboxedPluginPool) {
+			const pluginId = key.slice(0, key.lastIndexOf(":"));
+			const status = pluginStates.get(pluginId);
+			plugin.setActive?.(status === void 0 || status === "active");
+		}
+		const installedTierPhases = [];
+		if (deps.config.marketplace && storage && !deps.sandboxBypassed) installedTierPhases.push(phase("rt.market", "Marketplace plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("marketplace", db, storage, deps, sandboxedPluginPool, siteInfo)));
+		if (getRegistryConfigInput(deps.config.registry, deps.config.experimental?.registry) && storage) installedTierPhases.push(phase("rt.registry", "Registry plugins", () => EmDashRuntime.loadInstalledSandboxedPlugins("registry", db, storage, deps, sandboxedPluginPool, siteInfo)));
+		if (installedTierPhases.length > 0) await Promise.all(installedTierPhases);
+		const configuredSandboxIds = new Set(deps.sandboxedPluginEntries.map((entry) => entry.id));
+		const sandboxedPlugins = new Map([...sandboxedPluginPool].filter(([pluginKey]) => {
+			const pluginId = pluginKey.slice(0, pluginKey.lastIndexOf(":"));
+			return configuredSandboxIds.has(pluginId) || pluginStates.get(pluginId) === "active";
+		}));
+		for (const [pluginKey, instance] of sandboxedPlugins) {
+			const manifest = sandboxedManifestCache.get(pluginKey);
+			if (!manifest) continue;
+			allPipelinePlugins.push(createSandboxedPluginProxy(manifest, instance));
+			const status = pluginStates.get(manifest.id);
+			if (status === void 0 || status === "active") enabledPlugins.add(manifest.id);
+		}
+		const runtimeRef = { current: null };
+		const requireRuntime = () => {
+			if (!runtimeRef.current) throw new Error("EmDash runtime is not ready");
+			return runtimeRef.current;
+		};
+		const contentActions = {
+			begin: (pluginId, invocationId, invalidateContentCache) => requireRuntime().beginPluginInvocation(pluginId, invocationId, invalidateContentCache),
+			flush: (pluginId, invocationId, final) => requireRuntime().flushPluginAfterHooks(pluginId, invocationId, final),
+			getVersioned: (pluginId, collection, id) => requireRuntime().pluginGetVersioned(pluginId, collection, id),
+			publish: (pluginId, collection, id, options, invocationId, invalidateContentCache) => requireRuntime().pluginPublish(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			unpublish: (pluginId, collection, id, options, invocationId, invalidateContentCache) => requireRuntime().pluginUnpublish(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			schedule: (pluginId, collection, id, options, invocationId, invalidateContentCache) => requireRuntime().pluginSchedule(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			unschedule: (pluginId, collection, id, options, invocationId, invalidateContentCache) => requireRuntime().pluginUnschedule(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			getTrashedVersioned: (pluginId, collection, id) => requireRuntime().pluginGetTrashedVersioned(pluginId, collection, id),
+			restore: (pluginId, collection, id, options, invocationId, invalidateContentCache) => requireRuntime().pluginRestore(pluginId, collection, id, options, invocationId, invalidateContentCache)
+		};
+		const pipelineFactoryOptions = {
+			db,
+			getDb: resolveDb,
+			beforeContentWrite: () => assertSiteWriteAllowed(resolveDb()),
+			contentActions,
+			now: deps.now,
+			storage: storage ?? void 0,
+			siteInfo,
+			commentModerate: (pluginId, id, status, expectedStatus) => {
+				const current = runtimeRef.current;
+				if (!current) throw new Error("Comment moderation is unavailable during runtime startup");
+				return current.handlePluginCommentModerate(pluginId, id, status, expectedStatus);
+			}
+		};
+		const pipeline = createHookPipeline(allPipelinePlugins.filter((p) => enabledPlugins.has(p.id)), pipelineFactoryOptions);
+		const mediaProviders = /* @__PURE__ */ new Map();
+		const mediaProviderEntries = deps.mediaProviderEntries ?? [];
+		const providerContext = {
+			db,
+			storage,
+			getDb: resolveDb
+		};
+		for (const entry of mediaProviderEntries) try {
+			const provider = entry.createProvider(providerContext);
+			mediaProviders.set(entry.id, provider);
+		} catch (error) {
+			console.warn(`Failed to initialize media provider "${entry.id}":`, error);
+		}
+		await phase("rt.hooks", "Exclusive hook resolution", () => EmDashRuntime.resolveExclusiveHooks(pipeline, db, deps));
+		const emailPipeline = new EmailPipeline(pipeline);
+		if (sandboxRunner) sandboxRunner.setEmailSend((message, pluginId) => emailPipeline.send(message, pluginId));
+		const pipelineRef = { current: pipeline };
+		const invokeCronHook = async (pluginId, event) => {
+			const result = await pipelineRef.current.invokeCronHook(pluginId, event);
+			if (!result.success && result.error) throw result.error;
+		};
+		pipeline.setContextFactory({ emailPipeline });
+		let cronExecutor = null;
+		let cronScheduler = null;
+		await phase("rt.cron", "Cron init (recovery deferred post-response)", async () => {
+			try {
+				cronExecutor = new CronExecutor(resolveDb, invokeCronHook, deps.now);
+				pipeline.setContextFactory({ cronReschedule: () => cronScheduler?.reschedule() });
+				const executorForRecovery = cronExecutor;
+				after(async () => {
+					try {
+						const recovered = await executorForRecovery.recoverStaleLocks();
+						if (recovered > 0) console.log(`[cron] Recovered ${recovered} stale task lock(s)`);
+					} catch (error) {
+						console.error("[cron] Failed to recover stale task locks:", error);
+					}
+				});
+				if (deps.createScheduler) {
+					const scheduler = deps.createScheduler(cronExecutor);
+					cronScheduler = scheduler;
+					scheduler.setSystemCleanup(async () => {
+						try {
+							const runtime = runtimeRef.current;
+							if (runtime) await runtime.publishScheduled();
+							else {
+								const recordWrite = await assertSiteWriteAllowed(db);
+								if ((await publishDueContent(db)).length > 0) await recordWrite();
+							}
+						} catch (error) {
+							console.error("[scheduled-publish] Sweep failed:", error);
+						}
+						try {
+							await runSystemCleanup(db, storage ?? void 0);
+						} catch (error) {
+							console.error("[cleanup] System cleanup failed:", error);
+						}
+						try {
+							await runtimeRef.current?.syncPluginStorageIndexesOnce();
+						} catch (error) {
+							console.error("[plugins] Storage index sync failed:", error);
+						}
+						await maybeRunScheduledBackup(db, storage ?? void 0);
+						await recordSchedulerHeartbeatSafely(db);
+					});
+					scheduler.start();
+				}
+			} catch (error) {
+				console.warn("[cron] Failed to initialize cron system:", error);
+			}
+		});
+		sandboxRunner?.setCronReschedule?.(() => cronScheduler?.reschedule());
+		const runtime = new EmDashRuntime({
+			db,
+			storage,
+			configuredPlugins: [...deps.plugins, ...bypassedPluginsList],
+			sandboxedPlugins,
+			sandboxedPluginEntries: deps.sandboxedPluginEntries,
+			hooks: pipeline,
+			enabledPlugins,
+			pluginStates,
+			config: deps.config,
+			mediaProviders,
+			mediaProviderEntries,
+			cronExecutor,
+			cronScheduler,
+			emailPipeline,
+			allPipelinePlugins,
+			pipelineFactoryOptions,
+			runtimeDeps: deps,
+			pipelineRef
+		});
+		const contentCreate = async (_pluginId, collection, input, options) => {
+			const { seo, ...data } = input;
+			const result = await runtime.handleContentCreate(collection, {
+				data,
+				seo,
+				locale: resolveContentCreateLocale(options?.locale),
+				translationOf: options?.translationOf
+			}, {
+				skipSaveHooks: options?.sandboxOrigin ? options.originHook !== void 0 : getActiveContentSaveHookName() != null,
+				excludeAfterSavePluginId: _pluginId
+			});
+			if (!result.success) throw Object.assign(new Error(result.error.message), {
+				name: result.error.code,
+				code: result.error.code
+			});
+			return result.data.item;
+		};
+		runtime.pipelineFactoryOptions.contentCreate = contentCreate;
+		pipeline.setContextFactory({ contentCreate });
+		sandboxRunner?.setContentCreate?.(contentCreate);
+		runtimeRef.current = runtime;
+		sandboxRunner?.setCommentModerate?.((pluginId, id, status, expectedStatus) => runtime.handlePluginCommentModerate(pluginId, id, status, expectedStatus));
+		sandboxRunner?.setContentActions?.(contentActions);
+		return runtime;
+	}
+	/**
+	* Get a media provider by ID
+	*/
+	getMediaProvider(providerId) {
+		return this.mediaProviders.get(providerId);
+	}
+	/**
+	* Get all media provider entries (for admin UI)
+	*/
+	getMediaProviderList() {
+		return this.mediaProviderEntries.map((e) => ({
+			id: e.id,
+			name: e.name,
+			icon: e.icon,
+			capabilities: e.capabilities
+		}));
+	}
+	/**
+	* Get or create database instance
+	*/
+	static async getDatabase(deps) {
+		const ctx = getRequestContext();
+		if (ctx?.dbIsIsolated && ctx.db) return ctx.db;
+		const dbConfig = deps.config.database;
+		if (!dbConfig) try {
+			return await getDb();
+		} catch {
+			throw new Error("EmDash database not configured. Either configure database in astro.config.mjs or use emdashLoader in live.config.ts");
+		}
+		const cacheKey = dbConfig.entrypoint;
+		const holder = getDbHolder();
+		const throwIfBackingOff = () => {
+			const failure = holder.failures.get(cacheKey);
+			if (!failure) return;
+			if (Date.now() - failure.at < DB_INIT_FAILURE_BACKOFF_MS) throw new Error(`Database initialization is backing off after a recent migration failure: ${failure.message}`);
+			holder.failures.delete(cacheKey);
+		};
+		throwIfBackingOff();
+		return initWithLock(holder.lock, () => holder.cache.get(cacheKey), async (isCurrentClaim) => {
+			throwIfBackingOff();
+			const db = new Kysely({
+				dialect: deps.createDialect(dbConfig.config),
+				log: kyselyLogOption()
+			});
+			try {
+				await enforceRuntimeMigrationPolicy(db, deps.migrationMode ?? "auto");
+			} catch (error) {
+				if (!(error instanceof ConcurrentMigrationTimeoutError) && !(error instanceof PendingMigrationsError)) holder.failures.set(cacheKey, {
+					at: Date.now(),
+					message: error instanceof Error ? error.message : String(error)
+				});
+				await db.destroy().catch(() => {});
+				throw error;
+			}
+			holder.failures.delete(cacheKey);
+			if (isCurrentClaim()) holder.cache.set(cacheKey, db);
+			return db;
+		}, {
+			deadlineMs: DB_INIT_DEADLINE_MS,
+			anchor: (promise) => after(() => promise)
+		});
+	}
+	/**
+	* Get or create storage instance
+	*/
+	static getStorage(deps) {
+		const storageConfig = deps.config.storage;
+		if (!storageConfig || !deps.createStorage) return null;
+		const cacheKey = storageConfig.entrypoint;
+		const cached = storageCache.get(cacheKey);
+		if (cached) return cached;
+		const storage = deps.createStorage(storageConfig.config);
+		storageCache.set(cacheKey, storage);
+		return storage;
+	}
+	/**
+	* Load sandboxed plugin entries as trusted in-process plugins.
+	* Used by the sandbox: false debugging escape hatch.
+	*
+	* Imports each plugin's bundled ESM code via a data URL, adapts it
+	* with adaptSandboxEntry, and returns ResolvedPlugin objects ready
+	* to be merged into the pipeline plugin list.
+	*/
+	static async loadBypassedPlugins(entries) {
+		const { adaptSandboxEntry } = await import("./plugins/adapt-sandbox-entry.mjs");
+		const plugins = [];
+		for (const entry of entries) try {
+			const pluginModule = await import(`data:text/javascript;base64,${Buffer.from(entry.code).toString("base64")}`);
+			const pluginDef = pluginModule.default ?? pluginModule;
+			const adminPages = entry.adminPages?.map((p) => ({
+				path: p.path,
+				label: p.label ?? p.path,
+				icon: p.icon
+			}));
+			const adminWidgets = entry.adminWidgets?.map((w) => {
+				const size = w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0;
+				return {
+					id: w.id,
+					title: w.title,
+					size
+				};
+			});
+			const resolved = adaptSandboxEntry(pluginDef, {
+				id: entry.id,
+				version: entry.version,
+				entrypoint: "",
+				capabilities: entry.capabilities,
+				allowedHosts: entry.allowedHosts,
+				storage: entry.storage,
+				adminPages,
+				adminWidgets,
+				settingsSchema: entry.settingsSchema,
+				portableTextBlocks: entry.portableTextBlocks,
+				fieldWidgets: entry.fieldWidgets,
+				editorPanels: entry.editorPanels,
+				editorActions: entry.editorActions
+			});
+			plugins.push(resolved);
+			console.log(`EmDash: Loaded plugin ${entry.id}:${entry.version} in-process (sandbox bypassed)`);
+		} catch (error) {
+			console.error(`EmDash: Failed to load sandboxed plugin ${entry.id} in-process:`, error);
+		}
+		return plugins;
+	}
+	/**
+	* Load sandboxed plugins using SandboxRunner
+	*/
+	static async loadSandboxedPlugins(deps, db, mediaStorage, siteInfo) {
+		if (!deps.sandboxEnabled) return sandboxedPluginCache;
+		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner(createSandboxRunnerOptions({
+			db,
+			beforeContentWrite: () => assertSiteWriteAllowed(db),
+			taxonomyWrite: createTaxonomyAccessWithWrite(db),
+			now: deps.now,
+			mediaStorage: mediaStorage ? {
+				upload: (opts) => mediaStorage.upload({
+					key: opts.key,
+					body: opts.body,
+					contentType: opts.contentType
+				}),
+				download: (key) => mediaStorage.download(key),
+				delete: (key) => mediaStorage.delete(key)
+			} : void 0
+		}, siteInfo));
+		if (!sandboxRunner) return sandboxedPluginCache;
+		if (!sandboxRunner.isAvailable()) {
+			const reason = sandboxRunner.unavailableReason?.();
+			console.warn(reason ? `EmDash: Plugin sandbox is configured but not available on this platform: ${reason}. Sandboxed plugins will not be loaded.` : "EmDash: Plugin sandbox is configured but not available on this platform. Sandboxed plugins will not be loaded. If using @emdash-cms/sandbox-workerd/sandbox, ensure workerd is installed.");
+			return sandboxedPluginCache;
+		}
+		if (deps.sandboxedPluginEntries.length === 0) return sandboxedPluginCache;
+		if (deps.sandboxBypassed) return sandboxedPluginCache;
+		for (const entry of deps.sandboxedPluginEntries) {
+			const pluginKey = `${entry.id}:${entry.version}`;
+			if (sandboxedPluginCache.has(pluginKey)) continue;
+			try {
+				const adminPages = entry.adminPages?.map((page) => ({
+					path: page.path,
+					label: page.label ?? page.path,
+					icon: page.icon
+				}));
+				const adminWidgets = entry.adminWidgets?.map((widget) => ({
+					id: widget.id,
+					title: widget.title,
+					size: widget.size === "full" || widget.size === "half" || widget.size === "third" ? widget.size : void 0
+				}));
+				const capabilities = normalizePluginCapabilities(entry.capabilities ?? []);
+				const manifest = {
+					id: entry.id,
+					version: entry.version,
+					capabilities,
+					allowedHosts: entry.allowedHosts ?? [],
+					storage: entry.storage ?? {},
+					hooks: entry.hooks ?? [...HOOK_NAMES],
+					routes: entry.routes ?? [],
+					admin: {
+						pages: adminPages,
+						widgets: adminWidgets,
+						settingsSchema: entry.settingsSchema,
+						portableTextBlocks: entry.portableTextBlocks,
+						fieldWidgets: entry.fieldWidgets,
+						editorPanels: entry.editorPanels,
+						editorActions: entry.editorActions
+					},
+					mcp: entry.mcp
+				};
+				const plugin = await sandboxRunner.load(manifest, entry.code);
+				sandboxedPluginCache.set(pluginKey, plugin);
+				sandboxedManifestCache.set(pluginKey, manifest);
+				console.log(`EmDash: Loaded sandboxed plugin ${pluginKey} with capabilities: [${manifest.capabilities.join(", ")}]`);
+				if (manifest.routes.length > 0) {
+					const routeMetaMap = /* @__PURE__ */ new Map();
+					for (const routeEntry of manifest.routes) {
+						const normalized = normalizeManifestRoute$1(routeEntry);
+						routeMetaMap.set(normalized.name, buildRouteMeta(normalized));
+					}
+					sandboxedRouteMetaCache.set(entry.id, routeMetaMap);
+				} else sandboxedRouteMetaCache.delete(entry.id);
+			} catch (error) {
+				console.error(`EmDash: Failed to load sandboxed plugin ${entry.id}:`, error);
+			}
+		}
+		return sandboxedPluginCache;
+	}
+	/**
+	* Cold-start: load marketplace-installed plugins from site-local R2 storage
+	*
+	* Queries _plugin_state for source='marketplace' rows, fetches each bundle
+	* from R2, and loads via SandboxRunner.
+	*/
+	/**
+	* Cold-start load of all active sandboxed plugins for one install
+	* tier (marketplace or registry) from site-local R2.
+	*
+	* Mirrors {@link syncSandboxedSourcePlugins} but runs once at runtime
+	* creation, before request traffic arrives; the sync method runs on
+	* demand after install / update / uninstall handlers.
+	*/
+	static async loadInstalledSandboxedPlugins(source, db, storage, deps, cache, siteInfo) {
+		if (!sandboxRunner && deps.createSandboxRunner) sandboxRunner = deps.createSandboxRunner(createSandboxRunnerOptions({
+			db,
+			beforeContentWrite: () => assertSiteWriteAllowed(db),
+			taxonomyWrite: createTaxonomyAccessWithWrite(db),
+			now: deps.now,
+			mediaStorage: {
+				upload: (opts) => storage.upload({
+					key: opts.key,
+					body: opts.body,
+					contentType: opts.contentType
+				}),
+				download: (key) => storage.download(key),
+				delete: (key) => storage.delete(key)
+			}
+		}, siteInfo));
+		if (deps.sandboxBypassed) return;
+		if (!sandboxRunner || !sandboxRunner.isAvailable()) return;
+		const keySet = source === "marketplace" ? marketplacePluginKeys : registryPluginKeys;
+		try {
+			const stateRepo = new PluginStateRepository(db);
+			const plugins = source === "marketplace" ? await stateRepo.getMarketplacePlugins() : await stateRepo.getRegistryPlugins();
+			for (const plugin of plugins) {
+				if (plugin.status !== "active") continue;
+				const version = source === "marketplace" ? plugin.marketplaceVersion ?? plugin.version : plugin.version;
+				const pluginKey = `${plugin.pluginId}:${version}`;
+				if (cache.has(pluginKey)) continue;
+				try {
+					const bundle = await loadBundleFromR2(storage, plugin.pluginId, version, source);
+					if (!bundle) {
+						console.warn(`EmDash: ${source} plugin ${plugin.pluginId}@${version} not found in R2`);
+						continue;
+					}
+					const loaded = await sandboxRunner.load(bundle.manifest, bundle.backendCode);
+					cache.set(pluginKey, loaded);
+					sandboxedManifestCache.set(pluginKey, bundle.manifest);
+					keySet.add(pluginKey);
+					marketplaceManifestCache.set(plugin.pluginId, {
+						id: bundle.manifest.id,
+						version: bundle.manifest.version,
+						admin: bundle.manifest.admin,
+						mcp: bundle.manifest.mcp,
+						storage: bundle.manifest.storage,
+						allowedHosts: bundle.manifest.allowedHosts,
+						capabilities: bundle.manifest.capabilities
+					});
+					if (bundle.manifest.routes.length > 0) {
+						const routeMeta = /* @__PURE__ */ new Map();
+						for (const entry of bundle.manifest.routes) {
+							const normalized = normalizeManifestRoute$1(entry);
+							routeMeta.set(normalized.name, buildRouteMeta(normalized));
+						}
+						sandboxedRouteMetaCache.set(plugin.pluginId, routeMeta);
+					}
+					console.log(`EmDash: Loaded ${source} plugin ${pluginKey} with capabilities: [${bundle.manifest.capabilities.join(", ")}]`);
+				} catch (error) {
+					console.error(`EmDash: Failed to load ${source} plugin ${plugin.pluginId}:`, error);
+				}
+			}
+		} catch {}
+	}
+	/**
+	* Cold-start: load marketplace plugins in bypass mode (sandbox: false).
+	*
+	* Each active marketplace bundle is read, evaluated via data URL, adapted
+	* with adaptSandboxEntry, and returned as a ResolvedPlugin. The caller is
+	* responsible for merging these into allPipelinePlugins / configuredPlugins
+	* BEFORE the hook pipeline is created, so hooks and routes register in
+	* the trusted pipeline.
+	*
+	* Also caches manifest and route metadata so admin UI / getManifest() work.
+	*
+	* Returns ResolvedPlugins to be merged into the pipeline.
+	*/
+	static async loadMarketplacePluginsBypassed(db, storage) {
+		const resolved = [];
+		try {
+			const marketplacePlugins = await new PluginStateRepository(db).getMarketplacePlugins();
+			if (marketplacePlugins.length === 0) return resolved;
+			console.info("EmDash: Sandbox disabled (sandbox: false). Marketplace plugins will run in-process without isolation.");
+			const { adaptSandboxEntry } = await import("./plugins/adapt-sandbox-entry.mjs");
+			for (const plugin of marketplacePlugins) {
+				if (plugin.status !== "active") continue;
+				const version = plugin.marketplaceVersion ?? plugin.version;
+				try {
+					const bundle = await loadBundleFromR2(storage, plugin.pluginId, version);
+					if (!bundle) {
+						console.warn(`EmDash: Marketplace plugin ${plugin.pluginId}@${version} not found in R2`);
+						continue;
+					}
+					marketplaceManifestCache.set(plugin.pluginId, {
+						id: bundle.manifest.id,
+						version: bundle.manifest.version,
+						admin: bundle.manifest.admin,
+						mcp: bundle.manifest.mcp,
+						storage: bundle.manifest.storage,
+						allowedHosts: bundle.manifest.allowedHosts,
+						capabilities: bundle.manifest.capabilities
+					});
+					if (bundle.manifest.routes.length > 0) {
+						const routeMeta = /* @__PURE__ */ new Map();
+						for (const entry of bundle.manifest.routes) {
+							const normalized = normalizeManifestRoute$1(entry);
+							routeMeta.set(normalized.name, buildRouteMeta(normalized));
+						}
+						sandboxedRouteMetaCache.set(plugin.pluginId, routeMeta);
+					}
+					const pluginModule = await import(`data:text/javascript;base64,${Buffer.from(bundle.backendCode).toString("base64")}`);
+					const adapted = adaptSandboxEntry(pluginModule.default ?? pluginModule, {
+						id: bundle.manifest.id,
+						version: bundle.manifest.version,
+						entrypoint: "",
+						capabilities: bundle.manifest.capabilities ?? [],
+						allowedHosts: bundle.manifest.allowedHosts ?? [],
+						storage: bundle.manifest.storage ?? {},
+						adminPages: bundle.manifest.admin?.pages,
+						adminWidgets: bundle.manifest.admin?.widgets?.map((w) => ({
+							id: w.id,
+							title: w.title,
+							size: w.size === "full" || w.size === "half" || w.size === "third" ? w.size : void 0
+						})),
+						settingsSchema: bundle.manifest.admin?.settingsSchema,
+						editorPanels: bundle.manifest.admin?.editorPanels,
+						editorActions: bundle.manifest.admin?.editorActions
+					});
+					resolved.push(adapted);
+					console.log(`EmDash: Loaded marketplace plugin ${plugin.pluginId}@${version} in-process (sandbox bypassed)`);
+				} catch (error) {
+					console.error(`EmDash: Failed to load marketplace plugin ${plugin.pluginId} in-process:`, error);
+				}
+			}
+		} catch {}
+		return resolved;
+	}
+	/**
+	* Resolve exclusive hook selections on startup.
+	*
+	* Delegates to the shared resolveExclusiveHooks() in hooks.ts.
+	* The runtime version considers all pipeline providers as "active" since
+	* the pipeline was already built from only active/enabled plugins.
+	*/
+	static async resolveExclusiveHooks(pipeline, db, deps) {
+		if (pipeline.getRegisteredExclusiveHooks().length === 0) return;
+		let optionsRepo;
+		try {
+			optionsRepo = new OptionsRepository(db);
+		} catch {
+			return;
+		}
+		const preferredHints = /* @__PURE__ */ new Map();
+		for (const entry of deps.sandboxedPluginEntries) if (entry.preferred && entry.preferred.length > 0) preferredHints.set(entry.id, entry.preferred);
+		await resolveExclusiveHooks({
+			pipeline,
+			isActive: () => true,
+			getOption: (key) => optionsRepo.get(key),
+			getOptions: (keys) => optionsRepo.getMany(keys),
+			setOption: (key, value) => optionsRepo.set(key, value),
+			deleteOption: async (key) => {
+				await optionsRepo.delete(key);
+			},
+			preferredHints,
+			fallbackProviders: new Set([DEFAULT_COMMENT_MODERATOR_PLUGIN_ID])
+		});
+	}
+	/**
+	* Build the admin manifest from the live database.
+	*
+	* Used by the admin UI (sidebar collections, content editor field
+	* dispatch, manifest endpoint) and by WordPress import — it's never
+	* read on a public request, so this isn't on any anonymous hot path.
+	*
+	* No cross-request cache. The previous worker-isolate cache produced
+	* a class of cross-isolate staleness bugs (#776, #873, #876, #877)
+	* because Cloudflare Workers keeps multiple warm isolates per region
+	* and there's no fan-out primitive to invalidate them in step. The
+	* cache existed to amortize an N+1 schema query pattern; now that
+	* `listCollectionsWithFields()` does the same work in two queries,
+	* the rebuild is fast enough to pay on every admin request.
+	*
+	* Within a single request, `requestCached` deduplicates concurrent
+	* callers (the manifest endpoint and an admin SSR template, say).
+	*/
+	getManifest() {
+		return requestCached("emdash:manifest", () => this._buildManifest());
+	}
+	/**
+	* Build the manifest from the database.
+	*
+	* Constant query shapes via `listCollectionsWithFields()` — one query
+	* for collections, one batched query for fields (chunked at
+	* `SQL_BATCH_SIZE` collection IDs to stay under D1's bound-parameter
+	* limit). Typical sites stay well under the chunk threshold, so this
+	* is two queries in practice; never N+1.
+	*/
+	async _buildManifest() {
+		const manifestCollections = await buildManifestCollections({}, this.db);
+		const manifestPlugins = {};
+		for (const plugin of this.configuredPlugins) {
+			const status = this.pluginStates.get(plugin.id);
+			const enabled = status === void 0 || status === "active";
+			const hasAdminEntry = !!plugin.admin?.entry;
+			const hasAdminPages = (plugin.admin?.pages?.length ?? 0) > 0;
+			const hasWidgets = (plugin.admin?.widgets?.length ?? 0) > 0;
+			const hasEditorExtensions = (plugin.admin?.editorPanels?.length ?? 0) > 0 || (plugin.admin?.editorActions?.length ?? 0) > 0;
+			let adminMode = "none";
+			if (hasAdminEntry) adminMode = "react";
+			else if (hasAdminPages || hasWidgets || hasEditorExtensions) adminMode = "blocks";
+			manifestPlugins[plugin.id] = {
+				version: plugin.version,
+				enabled,
+				adminMode,
+				adminPages: plugin.admin?.pages ?? [],
+				dashboardWidgets: plugin.admin?.widgets ?? [],
+				portableTextBlocks: plugin.admin?.portableTextBlocks,
+				fieldWidgets: plugin.admin?.fieldWidgets,
+				editorPanels: plugin.admin?.editorPanels,
+				editorActions: plugin.admin?.editorActions
+			};
+		}
+		for (const entry of this.sandboxedPluginEntries) {
+			const status = this.pluginStates.get(entry.id);
+			const enabled = status === void 0 || status === "active";
+			const hasAdminPages = (entry.adminPages?.length ?? 0) > 0;
+			const hasWidgets = (entry.adminWidgets?.length ?? 0) > 0;
+			const hasEditorExtensions = (entry.editorPanels?.length ?? 0) > 0 || (entry.editorActions?.length ?? 0) > 0;
+			manifestPlugins[entry.id] = {
+				version: entry.version,
+				enabled,
+				sandboxed: true,
+				adminMode: hasAdminPages || hasWidgets || hasEditorExtensions ? "blocks" : "none",
+				adminPages: entry.adminPages ?? [],
+				dashboardWidgets: entry.adminWidgets ?? [],
+				portableTextBlocks: entry.portableTextBlocks,
+				fieldWidgets: entry.fieldWidgets,
+				editorPanels: entry.editorPanels,
+				editorActions: entry.editorActions
+			};
+		}
+		for (const [pluginId, meta] of marketplaceManifestCache) {
+			if (manifestPlugins[pluginId]) continue;
+			const enabled = this.pluginStates.get(pluginId) === "active";
+			const pages = meta.admin?.pages;
+			const widgets = meta.admin?.widgets;
+			const hasAdminPages = (pages?.length ?? 0) > 0;
+			const hasWidgets = (widgets?.length ?? 0) > 0;
+			const hasEditorExtensions = (meta.admin?.editorPanels?.length ?? 0) > 0 || (meta.admin?.editorActions?.length ?? 0) > 0;
+			manifestPlugins[pluginId] = {
+				version: meta.version,
+				enabled,
+				sandboxed: true,
+				adminMode: hasAdminPages || hasWidgets || hasEditorExtensions ? "blocks" : "none",
+				adminPages: pages ?? [],
+				dashboardWidgets: widgets ?? [],
+				editorPanels: meta.admin?.editorPanels,
+				editorActions: meta.admin?.editorActions
+			};
+		}
+		let manifestTaxonomies = [];
+		let taxonomyDefinitionLocales = [];
+		try {
+			const rows = await selectTaxonomyDefs(this.db).orderBy("d.name").execute();
+			taxonomyDefinitionLocales = rows.map((row) => row.locale);
+			manifestTaxonomies = rows.map((row) => ({
+				id: row.id,
+				name: row.name,
+				label: row.label,
+				labelSingular: row.label_singular ?? void 0,
+				hierarchical: row.hierarchical === 1,
+				collections: parseStringArray(row.collections).toSorted(),
+				locale: row.locale,
+				translationGroup: row.translation_group ?? row.id
+			}));
+		} catch (error) {
+			console.debug("EmDash: Could not load taxonomy definitions:", error);
+		}
+		try {
+			const configuredLocales = virtualConfig?.i18n?.locales ?? getI18nConfig()?.locales ?? [];
+			await warnAboutUnconfiguredTaxonomyLocales(this.db, configuredLocales, taxonomyDefinitionLocales);
+		} catch (error) {
+			console.warn("[i18n] taxonomy locale diagnostic failed:", error);
+		}
+		const manifestHash = await hashString(JSON.stringify(manifestCollections) + JSON.stringify(manifestPlugins) + JSON.stringify(manifestTaxonomies));
+		const authMode = getAuthMode(this.config);
+		const authModeValue = authMode.type === "external" ? authMode.providerType : "passkey";
+		const i18nConfig = virtualConfig?.i18n ?? getI18nConfig();
+		const i18n = i18nConfig && i18nConfig.locales && i18nConfig.locales.length > 1 ? {
+			defaultLocale: i18nConfig.defaultLocale,
+			locales: i18nConfig.locales,
+			prefixDefaultLocale: i18nConfig.prefixDefaultLocale
+		} : void 0;
+		const registryConfig = resolveRegistryConfigForSandbox({
+			registry: this.config.registry,
+			experimentalRegistry: this.config.experimental?.registry
+		});
+		const { registry, error: registryConfigurationError } = resolveManifestRegistryConfig(registryConfig.input, { fieldPrefix: registryConfig.fieldPrefix });
+		if (registryConfigurationError) console.error(`EmDash registry configuration error in ${registryConfigurationError.field} (${registryConfigurationError.code})`);
+		return {
+			version: VERSION,
+			commit: COMMIT,
+			astroVersion: this.config.astroVersion,
+			hash: manifestHash,
+			collections: manifestCollections,
+			plugins: manifestPlugins,
+			taxonomies: manifestTaxonomies,
+			authMode: authModeValue,
+			i18n,
+			contentLocale: {
+				defaultLocale: i18nConfig?.defaultLocale ?? "en",
+				implicit: i18nConfig === null
+			},
+			marketplace: !!this.config.marketplace,
+			sandboxEnabled: this.runtimeDeps.sandboxEnabled && this.runtimeDeps.sandboxBypassed !== true,
+			registry,
+			registryConfigurationError
+		};
+	}
+	/**
+	* Verify and repair FTS indexes on demand. Runs at most once per worker
+	* lifetime.
+	*
+	* Originally called from `EmDashRuntime.create()`, but on a busy D1 link
+	* (e.g. SIN replica ~80-150ms per query) it added ~1.5s to every cold
+	* start for a modest-sized site — more than every other init phase
+	* combined. Anonymous public reads never touch the search write path,
+	* so the cost isn't paid back for the vast majority of requests.
+	*
+	* Instead, search endpoints call this lazily: the first request that
+	* actually needs the index pays the verify cost (usually fast — no
+	* rebuild needed), everyone else runs cold-free.
+	*
+	* Uses the runtime's singleton database (`this._db`) rather than the
+	* request-scoped DB. Verify reads only, but `rebuildIndex` writes, and
+	* a GET search request on D1 carries a `first-unconstrained` session
+	* that's free to route at a read replica — unsafe for writes. The
+	* singleton always goes through the default binding, which the D1
+	* adapter will promote to `first-primary` for write statements.
+	*
+	* Safe to call concurrently: repeated callers share the same in-flight
+	* promise. Errors are swallowed internally so callers don't need to
+	* defend against FTS not existing yet (pre-setup).
+	*/
+	async ensureSearchHealthy() {
+		if (!isSqlite(this._db)) return;
+		try {
+			await singleFlightCached(this._searchHealthCache, async () => {
+				try {
+					const repaired = await new FTSManager(this._db).verifyAndRepairAll();
+					if (repaired > 0) console.log(`Repaired ${repaired} corrupted FTS index(es)`);
+				} catch {}
+			}, {
+				anchor: (promise) => after(() => promise),
+				ownerTimeoutMs: 3e4
+			});
+		} catch {}
+	}
+	async handleContentList(collection, params) {
+		return handleContentList(this.db, collection, params);
+	}
+	async handleContentAuthors(collection) {
+		return handleContentAuthors(this.db, collection);
+	}
+	async handleContentGet(collection, id, locale, referenceOptions) {
+		const result = await handleContentGet(this.db, collection, id, locale, referenceOptions);
+		return this.hydrateDraftData(result);
+	}
+	async handleContentGetIncludingTrashed(collection, id, locale) {
+		const result = await handleContentGetIncludingTrashed(this.db, collection, id, locale);
+		return this.hydrateDraftData(result);
+	}
+	/**
+	* If the response item has a `draftRevisionId`, replace `item.data` with
+	* the draft revision's data and expose the original published values as
+	* `liveData`. This makes the content_get / content_update round-trip
+	* intuitive — read returns the latest content the caller has saved
+	* (their pending draft), with the previously-published values still
+	* accessible for compare-style flows.
+	*
+	* No-op when no draft exists or the response is an error.
+	*/
+	async hydrateDraftData(result, options = {}) {
+		if (!result || typeof result !== "object") return result;
+		const r = result;
+		if (!r.success || !r.data?.item) return result;
+		const item = r.data.item;
+		const draftRevisionId = typeof item.draftRevisionId === "string" ? item.draftRevisionId : null;
+		if (!draftRevisionId) return result;
+		try {
+			const revision = await new RevisionRepository(this.db).findById(draftRevisionId);
+			if (!revision) {
+				if (options.strict) throw new Error(`Draft revision not found: ${draftRevisionId}`);
+				return result;
+			}
+			const liveData = item.data && typeof item.data === "object" ? item.data : {};
+			const revisionData = {};
+			for (const [key, value] of Object.entries(revision.data)) if (!key.startsWith("_")) revisionData[key] = value;
+			const mergedData = {
+				...liveData,
+				...revisionData
+			};
+			return {
+				...result,
+				data: {
+					...r.data,
+					item: {
+						...item,
+						...options.includeStagedSlug && typeof revision.data._slug === "string" ? { slug: revision.data._slug } : {},
+						data: mergedData,
+						liveData
+					}
+				}
+			};
+		} catch (error) {
+			if (options.strict) throw error;
+			console.error("[emdash] draft hydration failed:", error);
+			return result;
+		}
+	}
+	async handleContentCreate(collection, body, options = {}) {
+		const actor = body.actor ? { ...body.actor } : void 0;
+		let locale;
+		try {
+			locale = resolveContentCreateLocale(body.locale);
+		} catch (error) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: error instanceof Error ? error.message : "Invalid locale"
+				}
+			};
+		}
+		let translationSource = null;
+		let sharedFieldSlugs = [];
+		if (body.translationOf) {
+			const repo = new ContentRepository(this.db);
+			const source = await repo.findById(collection, body.translationOf);
+			if (!source) return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: "Translation source content not found"
+				}
+			};
+			translationSource = source;
+			sharedFieldSlugs = (await this.db.selectFrom("_emdash_fields as field").innerJoin("_emdash_collections as collection", "collection.id", "field.collection_id").select([
+				"field.slug",
+				"field.type",
+				"field.validation"
+			]).where("collection.slug", "=", collection).where("field.translatable", "=", 0).execute()).filter((field) => !isStoragelessFieldRow(field)).map((field) => field.slug);
+			if ((await repo.findTranslations(collection, source.translationGroup ?? source.id)).some((sibling) => sibling.locale?.toLowerCase() === locale.toLowerCase())) return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: `Translation already exists in locale "${locale}" for this content item`
+				}
+			};
+		}
+		let processedData = body.data;
+		if (!options.skipSaveHooks && this.hooks.hasHooks("content:beforeSave")) try {
+			processedData = (await this.hooks.runContentBeforeSave(body.data, collection, true, void 0, actor)).content;
+		} catch (error) {
+			return beforeSaveFailure(error);
+		}
+		if (translationSource) {
+			processedData = { ...processedData };
+			for (const slug of sharedFieldSlugs) if (Object.hasOwn(translationSource.data, slug)) processedData[slug] = translationSource.data[slug];
+			else delete processedData[slug];
+		}
+		const collectionInfo = await this.schemaRegistry.getCollectionWithFields(collection).catch(() => null);
+		const resolvedBlockTypes = collectionInfo?.fields.some((field) => field.type === "blocks") ? await resolveBlockTypes(this.db) : void 0;
+		if (collectionInfo) try {
+			processedData = await normalizeBlocksData(this.db, collectionInfo, processedData, translationSource?.data, {
+				migrateBlocks: body.migrateBlocks,
+				replaceBlocks: body.replaceBlocks
+			}, false, resolvedBlockTypes);
+		} catch (error) {
+			if (error instanceof SchemaError) return {
+				success: false,
+				error: {
+					code: error.code,
+					message: error.message,
+					details: error.details
+				}
+			};
+			throw error;
+		}
+		processedData = await this.normalizeFieldValues(collection, processedData, collectionInfo, resolvedBlockTypes);
+		const { validateContentData } = await import("./validation-DvYJtv4k.mjs");
+		const validation = await validateContentData(this.db, collection, processedData, { partial: false });
+		if (!validation.ok) return {
+			success: false,
+			error: validation.error
+		};
+		const { actor: _discardedActor, migrateBlocks: _discardedMigrateBlocks, replaceBlocks: _discardedReplaceBlocks, ...contentBody } = body;
+		const result = await handleContentCreate(this.db, collection, {
+			...contentBody,
+			data: processedData,
+			locale,
+			authorId: body.authorId,
+			bylines: body.bylines
+		});
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		if (!options.skipSaveHooks && result.success && result.data) this.runAfterSaveHooks(contentItemToRecord(result.data.item), collection, true, actor, options.excludeAfterSavePluginId);
+		return result;
+	}
+	async handleContentUpdate(collection, id, body) {
+		const actor = body.actor ? { ...body.actor } : void 0;
+		const repo = new ContentRepository(this.db);
+		const resolvedItem = await repo.findByIdOrSlug(collection, id, body.locale);
+		const resolvedId = resolvedItem?.id ?? id;
+		if (body._rev) {
+			if (!resolvedItem) return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: `Content item not found: ${id}`
+				}
+			};
+			const revCheck = validateRev(body._rev, resolvedItem);
+			if (!revCheck.valid) return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: revCheck.message
+				}
+			};
+		}
+		const { _rev: _discardedRev, actor: _discardedActor, migrateBlocks, replaceBlocks, ...bodyWithoutRev } = body;
+		const blockWriteOptions = {
+			migrateBlocks,
+			replaceBlocks
+		};
+		const collectionInfo = bodyWithoutRev.data || bodyWithoutRev.references ? await this.schemaRegistry.getCollectionWithFields(collection).catch(() => null) : null;
+		const knownFieldSlugs = new Set((collectionInfo?.fields ?? []).map((f) => f.slug));
+		if (bodyWithoutRev.data && collectionInfo) {
+			const changed = changedStoragelessDataKeys(new Set(collectionInfo.fields.filter(isStoragelessField).map((field) => field.slug)), bodyWithoutRev.data, resolvedItem?.data ?? {});
+			if (changed.length > 0) return storagelessDataKeyError(changed);
+		}
+		let processedData = bodyWithoutRev.data;
+		let resolvedBlockTypes;
+		if (bodyWithoutRev.data) {
+			if (this.hooks.hasHooks("content:beforeSave")) try {
+				processedData = (await this.hooks.runContentBeforeSave(bodyWithoutRev.data, collection, false, resolvedItem?.id, actor)).content;
+			} catch (error) {
+				return beforeSaveFailure(error);
+			}
+			processedData = await this.normalizeFieldValues(collection, processedData, collectionInfo, void 0, false);
+			if (collectionInfo?.fields) processedData = await this.dropUnknownKeysAlreadyStored(processedData, resolvedItem, knownFieldSlugs);
+			if (collectionInfo?.fields.some((field) => field.type === "blocks" && Object.hasOwn(processedData, field.slug))) resolvedBlockTypes = await resolveBlockTypes(this.db);
+			if (!collectionInfo?.supports?.includes("revisions")) {
+				if (collectionInfo) try {
+					processedData = await normalizeBlocksData(this.db, collectionInfo, processedData, resolvedItem?.data, blockWriteOptions, true, resolvedBlockTypes);
+					processedData = await this.normalizeFieldValues(collection, processedData, collectionInfo, resolvedBlockTypes);
+				} catch (error) {
+					if (error instanceof SchemaError) return {
+						success: false,
+						error: {
+							code: error.code,
+							message: error.message,
+							details: error.details
+						}
+					};
+					throw error;
+				}
+				const { validateContentData } = await import("./validation-DvYJtv4k.mjs");
+				const validation = await validateContentData(this.db, collection, processedData, { partial: true });
+				if (!validation.ok) return {
+					success: false,
+					error: validation.error
+				};
+			}
+		}
+		let usesDraftRevisions = false;
+		let draftStorageChanged = false;
+		if (processedData || bodyWithoutRev.references) {
+			if (collectionInfo?.supports?.includes("revisions")) {
+				usesDraftRevisions = true;
+				let stagedReferences;
+				if (bodyWithoutRev.references) {
+					stagedReferences = {};
+					for (const [fieldSlug, selectedIds] of Object.entries(bodyWithoutRev.references)) {
+						const resolved = await resolveReferenceSelection(this.db, collection, resolvedId, fieldSlug, selectedIds);
+						if (!resolved.success) return {
+							success: false,
+							error: resolved.error
+						};
+						stagedReferences[fieldSlug] = resolved.data.groups;
+					}
+				}
+				const revisionRepo = new RevisionRepository(this.db);
+				let existing = await repo.findById(collection, resolvedId);
+				for (let attempt = 0; existing && attempt < MAX_DRAFT_STAGE_ATTEMPTS; attempt++) {
+					let baseData;
+					if (existing.draftRevisionId) baseData = (await revisionRepo.findById(existing.draftRevisionId))?.data ?? existing.data;
+					else baseData = existing.data;
+					let attemptData = processedData ?? {};
+					try {
+						attemptData = await normalizeBlocksData(this.db, collectionInfo, attemptData, baseData, blockWriteOptions, true, resolvedBlockTypes);
+						attemptData = await this.normalizeFieldValues(collection, attemptData, collectionInfo, resolvedBlockTypes);
+					} catch (error) {
+						if (error instanceof SchemaError) return {
+							success: false,
+							error: {
+								code: error.code,
+								message: error.message,
+								details: error.details
+							}
+						};
+						throw error;
+					}
+					const { validateContentData } = await import("./validation-DvYJtv4k.mjs");
+					const validation = await validateContentData(this.db, collection, attemptData, { partial: true });
+					if (!validation.ok) return {
+						success: false,
+						error: validation.error
+					};
+					const mergedData = collectionInfo?.fields ? keepKnownFields({
+						...baseData,
+						...attemptData
+					}, knownFieldSlugs) : {
+						...baseData,
+						...attemptData
+					};
+					if (bodyWithoutRev.slug !== void 0) mergedData._slug = bodyWithoutRev.slug;
+					if (stagedReferences) mergedData[STAGED_REFERENCES_KEY] = mergeStagedReferences(baseData, stagedReferences);
+					const revision = await revisionRepo.create({
+						collection,
+						entryId: resolvedId,
+						data: mergedData,
+						authorId: actor?.id
+					});
+					let staged;
+					try {
+						staged = await repo.replaceDraftRevision(collection, resolvedId, revision.id, existing);
+					} catch (error) {
+						try {
+							await revisionRepo.deleteIfUnreferenced(collection, resolvedId, revision.id);
+						} catch (cleanupError) {
+							console.error(`[emdash] Failed to clean up unstaged revision ${revision.id}:`, cleanupError);
+						}
+						throw error;
+					}
+					if (!staged) {
+						try {
+							await revisionRepo.deleteIfUnreferenced(collection, resolvedId, revision.id);
+						} catch (cleanupError) {
+							console.error(`[emdash] Failed to clean up unstaged revision ${revision.id}:`, cleanupError);
+						}
+						if (body._rev || attempt === MAX_DRAFT_STAGE_ATTEMPTS - 1) return {
+							success: false,
+							error: {
+								code: "CONFLICT",
+								message: new ContentMutationConflictError().message
+							}
+						};
+						existing = await repo.findById(collection, resolvedId);
+						continue;
+					}
+					draftStorageChanged = true;
+					processedData = attemptData;
+					if (bodyWithoutRev.skipRevision && existing.draftRevisionId) try {
+						await revisionRepo.deleteIfUnreferenced(collection, resolvedId, existing.draftRevisionId);
+					} catch (error) {
+						console.error(`[emdash] Failed to clean up superseded revision ${existing.draftRevisionId}:`, error);
+					}
+					else after(async () => {
+						try {
+							await revisionRepo.pruneQueuedEntry(collection, resolvedId, revision.id, 50);
+						} catch (error) {
+							console.error(`[revisions] Failed to prune revisions for ${collection}/${resolvedId}:`, error);
+						}
+					});
+					break;
+				}
+			}
+		}
+		const liveMetaTouched = Object.entries(bodyWithoutRev).some(([key, value]) => value !== void 0 && !DRAFT_ONLY_UPDATE_KEYS.has(key));
+		const result = usesDraftRevisions && !liveMetaTouched ? await handleContentGet(this.db, collection, resolvedId) : await handleContentUpdate(this.db, collection, resolvedId, {
+			...bodyWithoutRev,
+			data: usesDraftRevisions ? void 0 : processedData,
+			slug: usesDraftRevisions ? void 0 : bodyWithoutRev.slug,
+			references: usesDraftRevisions ? void 0 : bodyWithoutRev.references,
+			authorId: bodyWithoutRev.authorId,
+			bylines: bodyWithoutRev.bylines
+		});
+		const liveContentChanged = usesDraftRevisions ? liveMetaTouched : Boolean(processedData || bodyWithoutRev.slug !== void 0 || bodyWithoutRev.references || liveMetaTouched);
+		const hydrated = await this.hydrateDraftData(result);
+		if (hydrated.success && hydrated.data) {
+			const contentIdsToRefresh = [resolvedId];
+			if (!usesDraftRevisions && processedData) contentIdsToRefresh.push(...await this.findSyncedSiblingsForUsageRefresh(collection, resolvedId, hydrated.data.item.translationGroup, processedData));
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, contentIdsToRefresh);
+		} else if (draftStorageChanged) try {
+			await markContentMediaUsageCollectionStale(this.db, collection, "CONTENT_USAGE_STALE");
+		} catch (error) {
+			console.error(`[media-usage] Failed to mark ${collection} stale:`, error);
+		}
+		if (hydrated.success && hydrated.data) this.runAfterSaveHooks(contentItemToRecord(hydrated.data.item), collection, false, actor);
+		if (hydrated.success) return {
+			...hydrated,
+			liveContentChanged
+		};
+		return hydrated;
+	}
+	async handleContentDelete(collection, id) {
+		if (this.hooks.hasHooks("content:beforeDelete")) {
+			const { allowed } = await this.hooks.runContentBeforeDelete(id, collection);
+			if (!allowed) return {
+				success: false,
+				error: {
+					code: "DELETE_BLOCKED",
+					message: "Delete blocked by plugin hook"
+				}
+			};
+		}
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
+		const result = await handleContentDelete(this.db, collection, id);
+		if (result.success) {
+			await this.clearScheduledPolicyRejection(collection, result.data.id, policyRejectionRevision);
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.id]);
+		}
+		if (result.success) this.runAfterDeleteHooks(id, collection, false);
+		return result;
+	}
+	async handleContentListTrashed(collection, params = {}) {
+		return handleContentListTrashed(this.db, collection, params);
+	}
+	async handleContentRestore(collection, id, options = {}) {
+		const result = await handleContentRestore(this.db, collection, id, { _rev: options._rev });
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		if (result.success) this.runAfterRestoreHooks(contentItemToRecord(result.data.item), collection, options.origin?.source === "plugin" ? options.origin.pluginId : void 0, options.pluginInvocationId);
+		return result;
+	}
+	async handleContentPermanentDelete(collection, id) {
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
+		const result = await handleContentPermanentDelete(this.db, collection, id);
+		if (result.success) {
+			await this.clearScheduledPolicyRejection(collection, result.data.id, policyRejectionRevision);
+			await this.deleteContentUsageAfterSuccessfulPermanentDelete(collection, result.data.id);
+		}
+		if (result.success) this.runAfterDeleteHooks(id, collection, true);
+		return result;
+	}
+	async handleContentCountTrashed(collection, params = {}) {
+		return handleContentCountTrashed(this.db, collection, params);
+	}
+	async handleContentDuplicate(collection, id, authorId) {
+		const result = await handleContentDuplicate(this.db, collection, id, authorId);
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		return result;
+	}
+	pluginVersionedResult(result) {
+		if (!result.success) throw Object.assign(new Error(result.error.message), { code: result.error.code });
+		if (!result.data._rev) throw new Error("Content action returned no revision");
+		return {
+			item: toPluginContentItem(result.data.item),
+			_rev: result.data._rev
+		};
+	}
+	async runPluginContentAction(pluginId, action, collection, id, fn, invocationId, invalidateContentCache) {
+		let invocationInvalidator;
+		if (invocationId) {
+			const invocationKey = this.pluginInvocationKey(pluginId, invocationId);
+			if (!this.activePluginInvocations.has(invocationKey) && !this.releasedPluginInvocations.has(invocationKey)) throw Object.assign(/* @__PURE__ */ new Error("Plugin content action invocation has expired"), { code: "CONTENT_ACTION_INVOCATION_EXPIRED" });
+			invocationInvalidator = this.pluginInvocationCacheInvalidators.get(invocationKey);
+		}
+		const recordWrite = await assertSiteWriteAllowed(this.db);
+		const repo = new ContentRepository(this.db);
+		const resolvedId = (action === "restore" ? await repo.findByIdOrSlugIncludingTrashed(collection, id) : await repo.findByIdOrSlug(collection, id))?.id ?? id;
+		const key = this.pluginContentActionKey(collection, resolvedId);
+		if ((this.activePluginContentActions.get(key) ?? 0) > 0) throw Object.assign(/* @__PURE__ */ new Error("Plugin content action re-entered itself"), { code: "CONTENT_ACTION_REENTRANT" });
+		this.retainPluginContentAction(key);
+		try {
+			const result = await fn(resolvedId);
+			await recordWrite();
+			const invalidator = invalidateContentCache ?? invocationInvalidator ?? this.pluginContentCacheInvalidator;
+			if (invalidator) try {
+				await invalidator([collection, resolvedId]);
+			} catch (error) {
+				console.error(`[plugin-content-action] Cache invalidation failed for ${collection}/${resolvedId}:`, error);
+			}
+			return result;
+		} finally {
+			this.releasePluginContentAction(key);
+		}
+	}
+	pluginContentActionKey(collection, id) {
+		return JSON.stringify([collection, id]);
+	}
+	retainPluginContentAction(key) {
+		this.activePluginContentActions.set(key, (this.activePluginContentActions.get(key) ?? 0) + 1);
+	}
+	releasePluginContentAction(key) {
+		const remaining = (this.activePluginContentActions.get(key) ?? 1) - 1;
+		if (remaining > 0) this.activePluginContentActions.set(key, remaining);
+		else this.activePluginContentActions.delete(key);
+	}
+	async pluginGetVersioned(_pluginId, collection, id) {
+		const result = await this.handleContentGet(collection, id);
+		if (!result.success) {
+			if (result.error.code === "NOT_FOUND") return null;
+			throw Object.assign(new Error(result.error.message), { code: result.error.code });
+		}
+		if (!result.data._rev) throw new Error("Content read returned no revision");
+		return {
+			item: toPluginContentItem(result.data.item),
+			_rev: result.data._rev
+		};
+	}
+	async pluginGetTrashedVersioned(_pluginId, collection, id) {
+		const result = await this.handleContentGetIncludingTrashed(collection, id);
+		if (!result.success) {
+			if (result.error.code === "NOT_FOUND") return null;
+			throw Object.assign(new Error(result.error.message), { code: result.error.code });
+		}
+		if (!await new ContentRepository(this.db).isTrashed(collection, result.data.item.id)) return null;
+		if (!result.data._rev) throw new Error("Trashed content read returned no revision");
+		return {
+			item: toPluginContentItem(result.data.item),
+			_rev: result.data._rev
+		};
+	}
+	pluginPublish(pluginId, collection, id, options, invocationId, invalidateContentCache) {
+		return this.runPluginContentAction(pluginId, "publish", collection, id, async (resolvedId) => this.pluginVersionedResult(await this.handleContentPublish(collection, resolvedId, {
+			_rev: options._rev,
+			origin: {
+				source: "plugin",
+				pluginId
+			},
+			pluginInvocationId: invocationId
+		})), invocationId, invalidateContentCache);
+	}
+	pluginUnpublish(pluginId, collection, id, options, invocationId, invalidateContentCache) {
+		return this.runPluginContentAction(pluginId, "unpublish", collection, id, async (resolvedId) => this.pluginVersionedResult(await this.handleContentUnpublish(collection, resolvedId, {
+			_rev: options._rev,
+			origin: {
+				source: "plugin",
+				pluginId
+			},
+			pluginInvocationId: invocationId
+		})), invocationId, invalidateContentCache);
+	}
+	pluginSchedule(pluginId, collection, id, options, invocationId, invalidateContentCache) {
+		return this.runPluginContentAction(pluginId, "schedule", collection, id, async (resolvedId) => this.pluginVersionedResult(await this.handleContentSchedule(collection, resolvedId, options.scheduledAt, {
+			_rev: options._rev,
+			origin: {
+				source: "plugin",
+				pluginId
+			},
+			pluginInvocationId: invocationId
+		})), invocationId, invalidateContentCache);
+	}
+	pluginUnschedule(pluginId, collection, id, options, invocationId, invalidateContentCache) {
+		return this.runPluginContentAction(pluginId, "unschedule", collection, id, async (resolvedId) => this.pluginVersionedResult(await this.handleContentUnschedule(collection, resolvedId, {
+			...options,
+			origin: {
+				source: "plugin",
+				pluginId
+			},
+			pluginInvocationId: invocationId
+		})), invocationId, invalidateContentCache);
+	}
+	pluginRestore(pluginId, collection, id, options, invocationId, invalidateContentCache) {
+		return this.runPluginContentAction(pluginId, "restore", collection, id, async (resolvedId) => this.pluginVersionedResult(await this.handleContentRestore(collection, resolvedId, {
+			...options,
+			origin: {
+				source: "plugin",
+				pluginId
+			},
+			pluginInvocationId: invocationId
+		})), invocationId, invalidateContentCache);
+	}
+	async checkContentPolicy(name, collection, id, options, rejectionCode, failureCode, scheduledAt) {
+		let current = await handleContentGet(this.db, collection, id);
+		if (!current.success) return {
+			allowed: false,
+			revision: options._rev ?? "",
+			error: current.error
+		};
+		const revision = current.data._rev;
+		if (!revision) return {
+			allowed: false,
+			revision: options._rev ?? "",
+			error: {
+				code: failureCode,
+				message: "Failed to read content revision"
+			}
+		};
+		if (options._rev !== void 0 && options._rev !== revision) return {
+			allowed: false,
+			revision,
+			error: {
+				code: "CONFLICT",
+				message: "Revision precondition did not match"
+			}
+		};
+		if (!this.hooks.hasHooks(name)) return {
+			allowed: true,
+			revision
+		};
+		if (name !== "content:beforeUnpublish") try {
+			current = await this.hydrateDraftData(current, {
+				includeStagedSlug: true,
+				strict: true
+			});
+		} catch (error) {
+			console.error(`[content-policy] ${name} draft hydration failed:`, error);
+			return {
+				allowed: false,
+				revision,
+				error: {
+					code: failureCode,
+					message: `Failed to read content for ${name} policy`
+				}
+			};
+		}
+		const origin = options.origin ?? { source: "system" };
+		const actor = options.actor && (origin.source === "api" || origin.source === "mcp" || origin.source === "visual-editor") ? {
+			...options.actor,
+			source: origin.source
+		} : void 0;
+		try {
+			const decision = await this.hooks.runContentPolicy(name, {
+				content: contentItemToRecord(current.data.item),
+				collection,
+				origin,
+				actor,
+				...scheduledAt === void 0 ? {} : { scheduledAt }
+			});
+			if (decision.cancellation) return {
+				allowed: false,
+				revision,
+				error: {
+					code: rejectionCode,
+					message: decision.cancellation.reason
+				},
+				cancellation: decision.cancellation
+			};
+			return {
+				allowed: true,
+				revision
+			};
+		} catch (error) {
+			console.error(`[content-policy] ${name} failed:`, error);
+			return {
+				allowed: false,
+				revision,
+				error: {
+					code: failureCode,
+					message: `Failed to run ${name} policy`
+				}
+			};
+		}
+	}
+	async getScheduledPolicyRejectionRevision(collection, id) {
+		try {
+			return (await new OptionsRepository(this.db).getVersioned(scheduledPolicyRejectionKey(collection, id)))?.revision;
+		} catch (error) {
+			console.error(`[content-policy] Failed to read scheduled rejection for ${collection}/${id}:`, error);
+			return;
+		}
+	}
+	async clearScheduledPolicyRejection(collection, id, expectedRevision) {
+		if (expectedRevision === void 0) return;
+		try {
+			await new OptionsRepository(this.db).compareAndDelete(scheduledPolicyRejectionKey(collection, id), expectedRevision);
+		} catch (error) {
+			console.error(`[content-policy] Failed to clear scheduled rejection for ${collection}/${id}:`, error);
+		}
+	}
+	createScheduledPolicyRejection(collection, id, cancellation) {
+		return {
+			collection,
+			id,
+			pluginId: cancellation.pluginId,
+			reason: cancellation.reason,
+			rejectedAt: (this.runtimeDeps.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+		};
+	}
+	async handleContentPublish(collection, id, options = {}) {
+		const policy = await this.checkContentPolicy("content:beforePublish", collection, id, options, "PUBLISH_REJECTED", "CONTENT_PUBLISH_ERROR");
+		if (!policy.allowed) {
+			if (policy.cancellation && options.origin?.source === "scheduler") {
+				const unscheduled = await handleScheduledPolicyRejection(this.db, collection, id, {
+					_rev: policy.revision,
+					rejection: this.createScheduledPolicyRejection(collection, id, policy.cancellation)
+				});
+				if (!unscheduled.success) return unscheduled;
+				await this.refreshContentUsageAfterSuccessfulWrite(collection, [unscheduled.data.item.id]);
+				this.runAfterUnscheduleHooks(contentItemToRecord(unscheduled.data.item), collection);
+			}
+			return {
+				success: false,
+				error: policy.error
+			};
+		}
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
+		const { actor: _actor, origin: _origin, pluginInvocationId: _pluginInvocationId, ...handlerOptions } = options;
+		const result = await handleContentPublish(this.db, collection, id, {
+			...handlerOptions,
+			_rev: policy.revision
+		});
+		if (result.success && result.data) {
+			await this.clearScheduledPolicyRejection(collection, result.data.item.id, policyRejectionRevision);
+			const { item } = result.data;
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [item.id, ...await this.findSyncedSiblingsForUsageRefresh(collection, item.id, item.translationGroup, item.data, { absentAsCleared: true })]);
+		}
+		if (result.success && result.data) this.runAfterPublishHooks(contentItemToRecord(result.data.item), collection, options.origin?.source === "plugin" ? options.origin.pluginId : void 0, options.pluginInvocationId);
+		return result;
+	}
+	async handleContentUnpublish(collection, id, options = {}) {
+		const policy = await this.checkContentPolicy("content:beforeUnpublish", collection, id, options, "UNPUBLISH_REJECTED", "CONTENT_UNPUBLISH_ERROR");
+		if (!policy.allowed) return {
+			success: false,
+			error: policy.error
+		};
+		const result = await handleContentUnpublish(this.db, collection, id, { _rev: policy.revision });
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		if (result.success && result.data) this.runAfterUnpublishHooks(contentItemToRecord(result.data.item), collection, options.origin?.source === "plugin" ? options.origin.pluginId : void 0, options.pluginInvocationId);
+		return result;
+	}
+	async handleContentSchedule(collection, id, scheduledAt, options = {}) {
+		const policy = await this.checkContentPolicy("content:beforeSchedule", collection, id, options, "SCHEDULE_REJECTED", "CONTENT_SCHEDULE_ERROR", scheduledAt);
+		if (!policy.allowed) return {
+			success: false,
+			error: policy.error
+		};
+		const policyRejectionRevision = await this.getScheduledPolicyRejectionRevision(collection, id);
+		const result = await handleContentSchedule(this.db, collection, id, scheduledAt, this.runtimeDeps.now?.() ?? /* @__PURE__ */ new Date(), policy.revision);
+		if (result.success && result.data) {
+			await this.clearScheduledPolicyRejection(collection, result.data.item.id, policyRejectionRevision);
+			await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		}
+		if (result.success && result.data) this.runAfterScheduleHooks(contentItemToRecord(result.data.item), collection, options.origin?.source === "plugin" ? options.origin.pluginId : void 0, options.pluginInvocationId);
+		return result;
+	}
+	async handleContentUnschedule(collection, id, options = {}) {
+		const result = await handleContentUnschedule(this.db, collection, id, { _rev: options._rev });
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		if (result.success && result.data) this.runAfterUnscheduleHooks(contentItemToRecord(result.data.item), collection, options.origin?.source === "plugin" ? options.origin.pluginId : void 0, options.pluginInvocationId);
+		return result;
+	}
+	async handleContentCountScheduled(collection) {
+		return handleContentCountScheduled(this.db, collection);
+	}
+	async handleContentDiscardDraft(collection, id, options = {}) {
+		const result = await handleContentDiscardDraft(this.db, collection, id, options);
+		if (result.success && result.data) await this.refreshContentUsageAfterSuccessfulWrite(collection, [result.data.item.id]);
+		return result;
+	}
+	async handleContentCompare(collection, id) {
+		return handleContentCompare(this.db, collection, id);
+	}
+	async handleContentTranslations(collection, id) {
+		return handleContentTranslations(this.db, collection, id);
+	}
+	async handleMediaList(params) {
+		return handleMediaList(this.db, params);
+	}
+	async handleMediaGet(id) {
+		return handleMediaGet(this.db, id);
+	}
+	async handleMediaUpload(input) {
+		if (!this.storage) return {
+			success: false,
+			error: {
+				code: "NO_STORAGE",
+				message: "Storage not configured"
+			}
+		};
+		const result = await handleMediaUpload(this.db, this.storage, input, { beforeUpload: async (file) => {
+			if (!this.hooks.hasHooks("media:beforeUpload")) return file;
+			return (await this.hooks.runMediaBeforeUpload(file)).file;
+		} });
+		if (result.success && !result.data.deduplicated && this.hooks.hasHooks("media:afterUpload")) {
+			const item = result.data.item;
+			await this.hooks.runMediaAfterUpload({
+				id: item.id,
+				filename: item.filename,
+				mimeType: item.mimeType,
+				size: item.size,
+				url: item.url,
+				createdAt: item.createdAt
+			});
+		}
+		return result;
+	}
+	async handleMediaRegisterUpload(input) {
+		if (!this.storage) return {
+			success: false,
+			error: {
+				code: "NO_STORAGE",
+				message: "Storage not configured"
+			}
+		};
+		const result = await handleMediaRegisterUpload(this.db, this.storage, input);
+		if (result.success && this.hooks.hasHooks("media:afterUpload")) {
+			const item = result.data.item;
+			const mediaItem = {
+				id: item.id,
+				filename: item.filename,
+				mimeType: item.mimeType,
+				size: item.size,
+				url: `/media/${item.id}/${item.filename}`,
+				createdAt: item.createdAt
+			};
+			this.hooks.runMediaAfterUpload(mediaItem).catch((err) => console.error("EmDash afterUpload hook error:", err));
+		}
+		return result;
+	}
+	async handleMediaCreate(input) {
+		let processedInput = input;
+		if (this.hooks.hasHooks("media:beforeUpload")) {
+			const hookResult = await this.hooks.runMediaBeforeUpload({
+				name: input.filename,
+				type: input.mimeType,
+				size: input.size || 0
+			});
+			processedInput = {
+				...input,
+				filename: hookResult.file.name,
+				mimeType: hookResult.file.type,
+				size: hookResult.file.size
+			};
+		}
+		const result = await handleMediaCreate(this.db, processedInput);
+		if (result.success && this.hooks.hasHooks("media:afterUpload")) {
+			const item = result.data.item;
+			const mediaItem = {
+				id: item.id,
+				filename: item.filename,
+				mimeType: item.mimeType,
+				size: item.size,
+				url: `/media/${item.id}/${item.filename}`,
+				createdAt: item.createdAt
+			};
+			this.hooks.runMediaAfterUpload(mediaItem).catch((err) => console.error("EmDash afterUpload hook error:", err));
+		}
+		return result;
+	}
+	async handleMediaUpdate(id, input) {
+		const result = await handleMediaUpdate(this.db, id, input);
+		if (result.success) invalidateSiteSettingsCache();
+		return result;
+	}
+	async handlePluginMediaMetadataUpdate(id, patch) {
+		return updatePluginMediaMetadata(this.db, id, patch);
+	}
+	async handleMediaReplaceMetadata(id, expectedStorageKey, input) {
+		const result = await handleMediaReplaceMetadata(this.db, id, expectedStorageKey, input);
+		if (result.success) invalidateSiteSettingsCache();
+		return result;
+	}
+	async handleMediaDelete(id) {
+		const result = await handleMediaDelete(this.db, id, this.storage);
+		if (result.success) invalidateSiteSettingsCache();
+		return result;
+	}
+	commentHooks() {
+		return {
+			runBeforeCreate: (event) => this.hooks.runCommentBeforeCreate(event),
+			runModerate: async (event) => {
+				const result = await this.hooks.invokeExclusiveHook("comment:moderate", event);
+				if (!result) return {
+					status: "pending",
+					reason: "No moderator configured"
+				};
+				if (result.error) {
+					console.error(`[comments] Moderation error (${result.pluginId}):`, result.error.message);
+					return {
+						status: "pending",
+						reason: "Moderation error"
+					};
+				}
+				if (!isModerationDecision(result.result)) return {
+					status: "pending",
+					reason: "Invalid moderation result"
+				};
+				return result.result;
+			},
+			fireAfterCreate: (event) => {
+				this.hooks.runCommentAfterCreate(event).catch((error) => console.error("[comments] afterCreate error:", error instanceof Error ? error.message : error));
+			},
+			fireAfterModerate: (event) => {
+				return this.hooks.runCommentAfterModerate(event).catch((error) => console.error("[comments] afterModerate error:", error instanceof Error ? error.message : error));
+			}
+		};
+	}
+	async handleCommentCreate(input, settings, contentInfo) {
+		return createComment(this.db, input, settings, this.commentHooks(), contentInfo);
+	}
+	async handlePublicCommentSubmission(collection, contentId, request, user) {
+		return submitPublicComment(this, collection, contentId, request, user);
+	}
+	async sendCommentApproval(comment, request) {
+		if (!comment || !this.email) return;
+		try {
+			const adminBaseUrl = await getSiteBaseUrl(this.db, request ?? new Request("https://plugin.invalid/"), this.config);
+			const content = await lookupContentAuthor(this.db, comment.collection, comment.contentId);
+			if (content?.author) await sendCommentNotification({
+				email: this.email,
+				comment,
+				contentAuthor: content.author,
+				adminBaseUrl
+			});
+		} catch (error) {
+			console.error("[comments] notification error:", error instanceof Error ? error.message : error);
+		}
+	}
+	async moderateCommentWithOrigin(id, status, expectedStatus, origin, request) {
+		if (this.commentModerationInProgress.has(id)) {
+			const current = await new CommentRepository(this.db).findById(id);
+			if (current && current.status !== expectedStatus) throw new CommentStatusConflictError(current.status);
+			throw Object.assign(/* @__PURE__ */ new Error("Comment moderation is already in progress"), { code: "COMMENT_MODERATION_IN_PROGRESS" });
+		}
+		this.commentModerationInProgress.add(id);
+		try {
+			return await moderateComment(this.db, id, status, expectedStatus, origin, this.commentHooks(), (comment) => this.sendCommentApproval(comment, request));
+		} finally {
+			this.commentModerationInProgress.delete(id);
+		}
+	}
+	async handleCommentModerate(id, status, moderator, expectedStatus, request) {
+		let expected = expectedStatus;
+		if (!expected) {
+			const current = await new CommentRepository(this.db).findById(id);
+			if (!current || current.status === "trash") return null;
+			expected = current.status;
+		}
+		return this.moderateCommentWithOrigin(id, status, expected, {
+			source: "admin",
+			userId: moderator.id,
+			name: moderator.name
+		}, request);
+	}
+	async handlePluginCommentModerate(pluginId, id, status, expectedStatus) {
+		assertPluginCommentStatus(status, "status");
+		assertPluginCommentStatus(expectedStatus, "expectedStatus");
+		if (!await this.moderateCommentWithOrigin(id, status, expectedStatus, {
+			source: "plugin",
+			pluginId
+		})) throw new Error(`Comment not found: ${id}`);
+		const result = await createCommentAccess(this.db).get(id);
+		if (!result) throw new Error(`Comment not found: ${id}`);
+		return result;
+	}
+	async handleRevisionList(collection, entryId, params = {}) {
+		return handleRevisionList(this.db, collection, entryId, params);
+	}
+	async handleRevisionGet(revisionId) {
+		return handleRevisionGet(this.db, revisionId);
+	}
+	async handleRevisionRestore(revisionId, callerUserId) {
+		const revisionRepo = new RevisionRepository(this.db);
+		const revision = await revisionRepo.findById(revisionId);
+		if (!revision) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Revision not found: ${revisionId}`
+			}
+		};
+		if (!((await this.schemaRegistry.getCollectionWithFields(revision.collection))?.supports?.includes("revisions") ?? false)) {
+			const result = await handleRevisionRestore(this.db, revisionId, callerUserId);
+			if (result.success) await this.refreshContentUsageAfterSuccessfulWrite(revision.collection, [revision.entryId]);
+			return this.hydrateDraftData(result);
+		}
+		try {
+			const newDraftId = await new ContentRepository(this.db).restoreDraftRevision(revision.collection, revision.entryId, revision.data, callerUserId);
+			if (!newDraftId) return {
+				success: false,
+				error: {
+					code: "NOT_FOUND",
+					message: `Content item not found: ${revision.entryId}`
+				}
+			};
+			after(async () => {
+				try {
+					await revisionRepo.pruneQueuedEntry(revision.collection, revision.entryId, newDraftId, 50);
+				} catch (error) {
+					console.error(`[revisions] Failed to prune revisions for ${revision.collection}/${revision.entryId}:`, error);
+				}
+			});
+			const refetched = await handleContentGet(this.db, revision.collection, revision.entryId);
+			const hydrated = await this.hydrateDraftData(refetched);
+			if (hydrated.success) await this.refreshContentUsageAfterSuccessfulWrite(revision.collection, [revision.entryId]);
+			return hydrated;
+		} catch (error) {
+			if (error instanceof ContentMutationConflictError) return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: error.message
+				}
+			};
+			console.error("[emdash] revision restore failed:", error);
+			return {
+				success: false,
+				error: {
+					code: "REVISION_RESTORE_ERROR",
+					message: "Failed to restore revision"
+				}
+			};
+		}
+	}
+	async findSyncedSiblingsForUsageRefresh(collection, contentId, translationGroup, data, options = {}) {
+		try {
+			return await findNonTranslatableSiblingContentIds(this.db, collection, contentId, translationGroup, data, options);
+		} catch (error) {
+			console.error(`[media-usage] Failed to discover synced i18n siblings for ${collection}/${contentId}:`, error);
+			try {
+				await markContentMediaUsageCollectionStale(this.db, collection, "CONTENT_USAGE_REFRESH_ERROR");
+			} catch (staleError) {
+				console.error(`[media-usage] Failed to mark ${collection} stale:`, staleError);
+			}
+			return [];
+		}
+	}
+	async refreshContentUsageAfterSuccessfulWrite(collection, contentIds) {
+		for (const contentId of new Set(contentIds)) try {
+			if ((await processMediaUsageWorkAfterWrite(this.db, collection, contentId)).outcome !== "inactive") continue;
+			await refreshContentMediaUsageAfterWrite(this.db, collection, contentId);
+		} catch (error) {
+			console.error(`[media-usage] Failed after content write ${collection}/${contentId}:`, error);
+			continue;
+		}
+	}
+	async deleteContentUsageAfterSuccessfulPermanentDelete(collection, contentId) {
+		try {
+			if ((await processMediaUsageWorkAfterWrite(this.db, collection, contentId)).outcome !== "inactive") return;
+			const result = await deleteContentMediaUsage(this.db, collection, contentId);
+			if (!result.success) console.error(`[media-usage] Usage delete for ${collection}/${contentId} finished with ${result.errorCode}`);
+		} catch (error) {
+			console.error(`[media-usage] Failed after permanent content delete ${collection}/${contentId}:`, error);
+		}
+	}
+	getSandboxedAdminDefinition(pluginId) {
+		const entry = this.sandboxedPluginEntries.find((candidate) => candidate.id === pluginId);
+		if (entry) {
+			const pages = (entry.adminPages ?? []).map((page) => normalizePluginPagePath(page.path));
+			const imageHosts = allowedBrowserImageHosts(entry.capabilities, entry.allowedHosts);
+			return {
+				pages,
+				widgets: (entry.adminWidgets ?? []).map((widget) => widget.id),
+				policy: {
+					pluginPagePaths: pages,
+					allowedImageHosts: imageHosts
+				}
+			};
+		}
+		const manifest = marketplaceManifestCache.get(pluginId);
+		if (!manifest) return null;
+		const pages = (manifest.admin?.pages ?? []).map((page) => normalizePluginPagePath(page.path));
+		const imageHosts = allowedBrowserImageHosts(manifest.capabilities ?? [], manifest.allowedHosts ?? []);
+		return {
+			pages,
+			widgets: (manifest.admin?.widgets ?? []).map((widget) => widget.id),
+			policy: {
+				pluginPagePaths: pages,
+				allowedImageHosts: imageHosts
+			}
+		};
+	}
+	resolvePluginUiContext(definition, body, request) {
+		if (typeof body !== "object" || body === null || !("page" in body)) return {};
+		const page = body.page;
+		if (typeof page !== "string") return { error: {
+			code: "INVALID_PLUGIN_UI_CONTEXT",
+			message: "Plugin UI page must be a string"
+		} };
+		let surface;
+		if (page.startsWith("widget:")) {
+			if (!definition.widgets.includes(page.slice(7))) return { error: {
+				code: "INVALID_PLUGIN_UI_CONTEXT",
+				message: "Plugin dashboard widget is not declared"
+			} };
+			surface = "dashboard-widget";
+		} else {
+			if (!definition.pages.includes(normalizePluginPagePath(page))) return { error: {
+				code: "INVALID_PLUGIN_UI_CONTEXT",
+				message: "Plugin admin page is not declared"
+			} };
+			surface = "admin-page";
+		}
+		const locale = resolveLocale(request);
+		return { context: {
+			surface,
+			locale,
+			direction: getLocaleDir(locale)
+		} };
+	}
+	validateSandboxedAdminResponse(pluginId, definition, result) {
+		if (!result.success) return result;
+		const validation = validateBlockResponse(result.data, definition.policy);
+		if (validation.valid) return result;
+		console.error(`EmDash: Sandboxed plugin ${pluginId} returned invalid Block Kit content:`, validation.errors);
+		return {
+			success: false,
+			status: 502,
+			error: {
+				code: "INVALID_BLOCK_RESPONSE",
+				message: "Plugin returned invalid Block Kit content"
+			}
+		};
+	}
+	getPluginEditorExtension(pluginId, kind, extensionId, collection) {
+		if (!this.isPluginEnabled(pluginId)) return null;
+		let panels;
+		let actions;
+		let pages = [];
+		let capabilities = [];
+		let allowedHosts = [];
+		const configured = this.configuredPlugins.find((plugin) => plugin.id === pluginId);
+		if (configured) {
+			if (configured.admin.entry) return null;
+			panels = configured.admin.editorPanels;
+			actions = configured.admin.editorActions;
+			pages = (configured.admin.pages ?? []).map((page) => page.path);
+			capabilities = configured.capabilities;
+			allowedHosts = configured.allowedHosts;
+		} else {
+			const entry = this.sandboxedPluginEntries.find((candidate) => candidate.id === pluginId);
+			if (entry) {
+				panels = entry.editorPanels;
+				actions = entry.editorActions;
+				pages = (entry.adminPages ?? []).map((page) => page.path);
+				capabilities = entry.capabilities;
+				allowedHosts = entry.allowedHosts;
+			} else {
+				const manifest = marketplaceManifestCache.get(pluginId);
+				if (!manifest) return null;
+				panels = manifest.admin?.editorPanels;
+				actions = manifest.admin?.editorActions;
+				pages = (manifest.admin?.pages ?? []).map((page) => page.path);
+				capabilities = manifest.capabilities ?? [];
+				allowedHosts = manifest.allowedHosts ?? [];
+			}
+		}
+		const normalizedCapabilities = normalizePluginCapabilities(capabilities);
+		const policy = {
+			pluginPagePaths: pages,
+			allowedImageHosts: allowedBrowserImageHosts(capabilities, allowedHosts)
+		};
+		if (kind === "panel") {
+			const matches = panels?.filter((panel) => panel.id === extensionId) ?? [];
+			const extension = matches[0];
+			if (matches.length !== 1 || !extension || extension.collections && !extension.collections.includes(collection)) return null;
+			return {
+				kind,
+				extension,
+				policy,
+				capabilities: normalizedCapabilities
+			};
+		}
+		const matches = actions?.filter((action) => action.id === extensionId) ?? [];
+		const extension = matches[0];
+		if (matches.length !== 1 || !extension || extension.collections && !extension.collections.includes(collection) || extension.style === "danger" && !extension.confirm) return null;
+		return {
+			kind,
+			extension,
+			policy,
+			capabilities: normalizedCapabilities
+		};
+	}
+	async getPluginEditorDraftSchema(collection) {
+		return this.schemaRegistry.getCollectionWithFields(collection);
+	}
+	validatePluginEditorExtensionResponse(pluginId, dispatch, result) {
+		if (!result.success) return result;
+		const validation = dispatch.kind === "panel" ? validateBlockResponse(result.data, dispatch.policy) : validateContentEditorActionResponse(result.data, dispatch.policy);
+		if (validation.valid) return result;
+		console.error(`EmDash: Plugin ${pluginId} returned an invalid content editor ${dispatch.kind} response:`, validation.errors);
+		return {
+			success: false,
+			status: 502,
+			error: {
+				code: dispatch.kind === "panel" ? "INVALID_BLOCK_RESPONSE" : "INVALID_EDITOR_ACTION_RESPONSE",
+				message: "Plugin returned an invalid editor extension response"
+			}
+		};
+	}
+	/**
+	* Get route metadata for a plugin route without invoking the handler.
+	* Used by the catch-all route to decide auth before dispatch.
+	* Returns null if the plugin or route doesn't exist.
+	*/
+	getPluginRouteMeta(pluginId, path) {
+		if (!this.isPluginEnabled(pluginId)) return null;
+		const routeKey = path.replace(LEADING_SLASH_PATTERN, "");
+		const trustedPlugin = this.configuredPlugins.find((p) => p.id === pluginId);
+		if (trustedPlugin) {
+			const route = trustedPlugin.routes[routeKey];
+			if (!route) return null;
+			return buildRouteMeta(route);
+		}
+		const meta = sandboxedRouteMetaCache.get(pluginId);
+		if (meta) {
+			const routeMeta = meta.get(routeKey);
+			if (routeMeta) return routeMeta;
+		}
+		if (routeKey === "admin") {
+			const manifestMeta = marketplaceManifestCache.get(pluginId);
+			if (manifestMeta?.admin?.pages?.length || manifestMeta?.admin?.widgets?.length) return { public: false };
+			const entry = this.sandboxedPluginEntries.find((e) => e.id === pluginId);
+			if (entry?.adminPages?.length || entry?.adminWidgets?.length) return { public: false };
+		}
+		if (this.findSandboxedPlugin(pluginId)) return { public: false };
+		return null;
+	}
+	/**
+	* Resolve the settings schema for a runtime-installed (marketplace or
+	* registry) plugin from its cached manifest. Returns `{}` for a known
+	* plugin without a schema and `null` for unknown plugins, matching the
+	* contract of `getPluginSettingsSchema` for build-time plugins.
+	*/
+	getRuntimePluginSettingsSchema(pluginId) {
+		const meta = marketplaceManifestCache.get(pluginId);
+		if (!meta) return null;
+		return meta.admin?.settingsSchema ?? {};
+	}
+	async handlePluginApiRoute(pluginId, method, path, request, user, invalidateContentCache, editorDispatch) {
+		if (!this.isPluginEnabled(pluginId)) return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Plugin not enabled: ${pluginId}`
+			}
+		};
+		const normalizedMethod = method.toUpperCase();
+		const routeMeta = this.getPluginRouteMeta(pluginId, path);
+		if (routeMeta?.methods && !routeMeta.methods.some((allowed) => allowed === normalizedMethod)) return {
+			success: false,
+			status: 405,
+			error: {
+				code: "METHOD_NOT_ALLOWED",
+				message: "Method not allowed"
+			}
+		};
+		const caller = user ? toRouteCallerInfo(user) : void 0;
+		let body;
+		try {
+			body = await parseRouteInput(request, routeMeta?.request);
+		} catch (error) {
+			if (error instanceof PluginRouteRequestError) return {
+				success: false,
+				status: error.status,
+				error: {
+					code: "INVALID_PLUGIN_REQUEST",
+					message: error.message
+				}
+			};
+			throw error;
+		}
+		const routeKey = path.replace(LEADING_SLASH_PATTERN, "");
+		const adminDefinition = !editorDispatch && routeKey === "admin" ? this.getSandboxedAdminDefinition(pluginId) : null;
+		const uiResult = adminDefinition ? this.resolvePluginUiContext(adminDefinition, body, request) : {};
+		if (uiResult.error) return {
+			success: false,
+			status: 400,
+			error: uiResult.error
+		};
+		const trustedPlugin = this.configuredPlugins.find((p) => p.id === pluginId);
+		if (trustedPlugin && this.enabledPlugins.has(trustedPlugin.id)) {
+			const routeRegistry = new PluginRouteRegistry({
+				...this.pipelineFactoryOptions,
+				contentActions: this.contentActionsWithInvalidator(invalidateContentCache),
+				emailPipeline: this.email ?? void 0,
+				cronReschedule: () => this.cronScheduler?.reschedule(),
+				trustedProxyHeaders: getTrustedProxyHeaders(this.config)
+			});
+			routeRegistry.register(trustedPlugin);
+			const result = await routeRegistry.invoke(pluginId, routeKey, {
+				request,
+				body,
+				user: caller,
+				ui: editorDispatch?.ui ?? uiResult.context
+			});
+			return editorDispatch ? this.validatePluginEditorExtensionResponse(pluginId, editorDispatch, result) : adminDefinition ? this.validateSandboxedAdminResponse(pluginId, adminDefinition, result) : result;
+		}
+		const sandboxedPlugin = this.findSandboxedPlugin(pluginId);
+		if (sandboxedPlugin) {
+			const result = await this.handleSandboxedRoute(sandboxedPlugin, path, request, body, routeMeta ?? { public: false }, caller, editorDispatch?.ui ?? uiResult.context, invalidateContentCache);
+			return editorDispatch ? this.validatePluginEditorExtensionResponse(pluginId, editorDispatch, result) : adminDefinition ? this.validateSandboxedAdminResponse(pluginId, adminDefinition, result) : result;
+		}
+		return {
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Plugin not found: ${pluginId}`
+			}
+		};
+	}
+	contentActionsWithInvalidator(invalidateContentCache) {
+		const actions = this.pipelineFactoryOptions.contentActions;
+		if (!actions || !invalidateContentCache) return actions;
+		return {
+			...actions,
+			begin: (pluginId, invocationId, invocationInvalidator) => actions.begin?.(pluginId, invocationId, invocationInvalidator ?? invalidateContentCache),
+			publish: (pluginId, collection, id, options, invocationId) => actions.publish(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			unpublish: (pluginId, collection, id, options, invocationId) => actions.unpublish(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			schedule: (pluginId, collection, id, options, invocationId) => actions.schedule(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			unschedule: (pluginId, collection, id, options, invocationId) => actions.unschedule(pluginId, collection, id, options, invocationId, invalidateContentCache),
+			restore: (pluginId, collection, id, options, invocationId) => actions.restore(pluginId, collection, id, options, invocationId, invalidateContentCache)
+		};
+	}
+	async getPluginMcpTools(pluginId) {
+		const tools = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const plugin of this.configuredPlugins) {
+			if (pluginId && plugin.id !== pluginId) continue;
+			for (const [name, tool] of Object.entries(plugin.mcp?.tools ?? {})) {
+				const route = plugin.routes[tool.route];
+				if (!route || route.public || route.response === "raw" || !isJsonPostRouteContract(route) || !route.permission || !Object.hasOwn(Permissions, route.permission)) continue;
+				const key = `${plugin.id}__${name}`;
+				if (seen.has(key)) continue;
+				seen.add(key);
+				tools.push({
+					pluginId: plugin.id,
+					name,
+					description: tool.description,
+					route: tool.route,
+					permission: route.permission,
+					destructive: tool.destructive ?? false,
+					inputSchema: tool.input,
+					outputSchema: tool.output
+				});
+			}
+		}
+		const addManifestTools = (id, mcp) => {
+			if (pluginId && id !== pluginId) return;
+			for (const tool of mcp?.tools ?? []) {
+				const key = `${id}__${tool.name}`;
+				const routeMeta = this.getPluginRouteMeta(id, tool.route);
+				if (seen.has(key) || !routeMeta || routeMeta.public || routeMeta.response === "raw" || !isJsonPostRouteContract(routeMeta) || routeMeta.permission !== tool.permission || !Object.hasOwn(Permissions, tool.permission)) continue;
+				seen.add(key);
+				tools.push({
+					pluginId: id,
+					name: tool.name,
+					description: tool.description,
+					route: tool.route,
+					permission: tool.permission,
+					destructive: tool.destructive,
+					inputSchema: z.fromJSONSchema({ ...tool.inputSchema }),
+					outputSchema: tool.outputSchema ? z.fromJSONSchema({ ...tool.outputSchema }) : void 0
+				});
+			}
+		};
+		for (const entry of this.sandboxedPluginEntries) addManifestTools(entry.id, entry.mcp);
+		for (const [id, manifest] of marketplaceManifestCache) addManifestTools(id, manifest.mcp);
+		return tools;
+	}
+	async getEnabledPluginMcpTools() {
+		const [tools, states] = await Promise.all([this.getPluginMcpTools(), new PluginStateRepository(this.db).getAll()]);
+		const stateByPlugin = new Map(states.map((state) => [state.pluginId, state]));
+		return tools.filter((tool) => {
+			const state = stateByPlugin.get(tool.pluginId);
+			if (!state?.mcpToolsEnabled || state.status !== "active" || !this.isPluginEnabled(tool.pluginId)) return false;
+			return state.mcpToolsConsent === this.serializePluginMcpConsent(tools, tool.pluginId);
+		});
+	}
+	serializePluginMcpConsent(tools, pluginId) {
+		return JSON.stringify(tools.filter((tool) => tool.pluginId === pluginId).map((tool) => ({
+			name: tool.name,
+			description: tool.description,
+			route: tool.route,
+			permission: tool.permission,
+			destructive: tool.destructive,
+			inputSchema: z.toJSONSchema(tool.inputSchema, { target: "draft-7" }),
+			...tool.outputSchema ? { outputSchema: z.toJSONSchema(tool.outputSchema, { target: "draft-7" }) } : {}
+		})).toSorted((a, b) => a.name.localeCompare(b.name)));
+	}
+	async handlePluginMcpTool(pluginId, toolName, route, input, actorId, request, caller, invalidateContentCache) {
+		const requestMeta = extractRequestMeta(request, getTrustedProxyHeaders(this.config));
+		const audit = new AuditRepository(this.db);
+		const headers = new Headers(request.headers);
+		headers.delete("content-length");
+		headers.delete("content-encoding");
+		const internalRequest = new Request(request.url, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(input)
+		});
+		const result = await this.handlePluginApiRoute(pluginId, "POST", route, internalRequest, caller, invalidateContentCache);
+		await audit.log({
+			actorId,
+			actorIp: requestMeta.ip ?? void 0,
+			action: "plugin_tool_invoke",
+			resourceType: "plugin_mcp_tool",
+			resourceId: `${pluginId}__${toolName}`,
+			details: {
+				pluginId,
+				tool: toolName,
+				route
+			},
+			status: result.success ? "success" : "failure"
+		});
+		return result;
+	}
+	async handlePluginMcpDenied(pluginId, toolName, route, actorId, request, reason) {
+		const requestMeta = extractRequestMeta(request, getTrustedProxyHeaders(this.config));
+		await new AuditRepository(this.db).log({
+			actorId,
+			actorIp: requestMeta.ip ?? void 0,
+			action: "plugin_tool_invoke",
+			resourceType: "plugin_mcp_tool",
+			resourceId: `${pluginId}__${toolName}`,
+			details: {
+				pluginId,
+				tool: toolName,
+				route,
+				reason
+			},
+			status: "denied"
+		});
+	}
+	findSandboxedPlugin(pluginId) {
+		for (const [key, plugin] of this.sandboxedPlugins) if (key.startsWith(pluginId + ":")) return plugin;
+	}
+	/**
+	* Drop incoming keys that have no matching collection field when the entry
+	* already stores them in its live data or current draft revision.
+	*
+	* Draft revisions keep the full `data` JSON, so deleting a field can strand
+	* the old value; this lets a read-then-write save succeed without allowing
+	* genuinely unknown keys.
+	*/
+	async dropUnknownKeysAlreadyStored(data, existing, knownFieldSlugs) {
+		if (!existing) return data;
+		let stored = existing.data ?? {};
+		if (existing.draftRevisionId) {
+			const draft = await new RevisionRepository(this.db).findById(existing.draftRevisionId).catch(() => null);
+			if (draft?.data) stored = draft.data;
+		}
+		const stale = staleStoredKeys(data, stored, knownFieldSlugs);
+		if (stale.length === 0) return data;
+		const result = { ...data };
+		for (const key of stale) delete result[key];
+		return result;
+	}
+	/**
+	* Normalize field values in content data before validation.
+	* Turns a blank string in an array-valued field into `null`, and fills
+	* missing image/file dimensions, storageKey, mimeType, and filename from providers.
+	*/
+	async normalizeFieldValues(collection, data, preloaded, preloadedBlockTypes, includeBlocks = true) {
+		let collectionInfo = preloaded;
+		if (collectionInfo === void 0) try {
+			collectionInfo = await this.schemaRegistry.getCollectionWithFields(collection);
+		} catch {
+			return data;
+		}
+		if (!collectionInfo?.fields) return data;
+		const result = { ...data };
+		for (const field of collectionInfo.fields) {
+			const value = result[field.slug];
+			if (ARRAY_FIELD_TYPES.has(field.type) && typeof value === "string" && !value.trim()) result[field.slug] = null;
+		}
+		const imageFields = collectionInfo.fields.filter((f) => f.type === "image" || f.type === "file");
+		const repeaterFields = collectionInfo.fields.filter((f) => f.type === "repeater" && Array.isArray(f.validation?.subFields));
+		const blockFields = includeBlocks ? collectionInfo.fields.filter((field) => field.type === "blocks") : [];
+		if (imageFields.length === 0 && repeaterFields.length === 0 && blockFields.length === 0) return result;
+		const getProvider = (id) => this.getMediaProvider(id);
+		for (const field of imageFields) {
+			const value = result[field.slug];
+			if (value == null) continue;
+			try {
+				const normalized = field.type === "image" ? await normalizeImageValue(value, getProvider) : await normalizeMediaValue(value, getProvider);
+				if (normalized) result[field.slug] = normalized;
+			} catch {}
+		}
+		for (const field of repeaterFields) {
+			const value = result[field.slug];
+			if (!Array.isArray(value)) continue;
+			const mediaSubFieldSlugs = (field.validation?.subFields ?? []).filter((sub) => sub.type === "image").map((sub) => sub.slug);
+			if (mediaSubFieldSlugs.length === 0) continue;
+			const items = value;
+			result[field.slug] = await Promise.all(items.map(async (item) => {
+				if (!isRecord(item)) return item;
+				const normalizedItem = { ...item };
+				for (const slug of mediaSubFieldSlugs) {
+					const subValue = normalizedItem[slug];
+					if (subValue == null) continue;
+					try {
+						const normalized = await normalizeImageValue(subValue, getProvider);
+						if (normalized) normalizedItem[slug] = normalized;
+					} catch {}
+				}
+				return normalizedItem;
+			}));
+		}
+		if (blockFields.length > 0) {
+			const blockTypes = preloadedBlockTypes ?? await resolveBlockTypes(this.db);
+			for (const field of blockFields) {
+				const value = result[field.slug];
+				if (!Array.isArray(value)) continue;
+				result[field.slug] = await Promise.all(value.map(async (block) => {
+					if (!isRecord(block) || typeof block._type !== "string") return block;
+					const version = blockTypes.get(block._type)?.versions.find((candidate) => candidate.version === block._version);
+					if (!version || version.unsupportedTypes?.length) return block;
+					const normalizedBlock = { ...block };
+					for (const nestedField of version.fields) {
+						const nestedValue = normalizedBlock[nestedField.slug];
+						if (nestedValue == null) continue;
+						try {
+							if (nestedField.type === "image") {
+								const normalized = await normalizeImageValue(nestedValue, getProvider);
+								if (normalized) normalizedBlock[nestedField.slug] = normalized;
+							} else if (nestedField.type === "file") {
+								const normalized = await normalizeMediaValue(nestedValue, getProvider);
+								if (normalized) normalizedBlock[nestedField.slug] = normalized;
+							} else if (nestedField.type === "repeater" && Array.isArray(nestedValue)) {
+								const imageSlugs = (nestedField.validation?.subFields ?? []).filter((subField) => subField.type === "image").map((subField) => subField.slug);
+								normalizedBlock[nestedField.slug] = await Promise.all(nestedValue.map(async (item) => {
+									if (!isRecord(item)) return item;
+									const normalizedItem = { ...item };
+									for (const slug of imageSlugs) try {
+										const normalized = await normalizeImageValue(normalizedItem[slug], getProvider);
+										if (normalized) normalizedItem[slug] = normalized;
+									} catch {
+										continue;
+									}
+									return normalizedItem;
+								}));
+							}
+						} catch {
+							continue;
+						}
+					}
+					return normalizedBlock;
+				}));
+			}
+		}
+		return result;
+	}
+	runAfterSaveHooks(content, collection, isNew, actor, excludePluginId) {
+		after(async () => {
+			if (this.hooks.hasHooks("content:afterSave")) try {
+				await this.hooks.runContentAfterSave(content, collection, isNew, actor, excludePluginId);
+			} catch (err) {
+				console.error("EmDash afterSave hook error:", err);
+			}
+		});
+	}
+	runAfterDeleteHooks(id, collection, permanent) {
+		after(async () => {
+			if (this.hooks.hasHooks("content:afterDelete")) try {
+				await this.hooks.runContentAfterDelete(id, collection, permanent);
+			} catch (err) {
+				console.error("EmDash afterDelete hook error:", err);
+			}
+		});
+	}
+	runDeferredContentHook(name, content, collection, afterPluginId, pluginInvocationId) {
+		const label = name.slice(8);
+		const invoke = async () => {
+			if (this.hooks.hasHooks(name)) try {
+				switch (name) {
+					case "content:afterPublish":
+						await this.hooks.runContentAfterPublish(content, collection);
+						break;
+					case "content:afterUnpublish":
+						await this.hooks.runContentAfterUnpublish(content, collection);
+						break;
+					case "content:afterRestore":
+						await this.hooks.runContentAfterRestore(content, collection);
+						break;
+					case "content:afterSchedule":
+						await this.hooks.runContentAfterSchedule(content, collection);
+						break;
+					case "content:afterUnschedule":
+						await this.hooks.runContentAfterUnschedule(content, collection);
+						break;
+				}
+			} catch (err) {
+				console.error(`EmDash ${label} hook error:`, err);
+			}
+		};
+		const contentId = typeof content.id === "string" ? content.id : void 0;
+		const guardKey = afterPluginId && contentId ? this.pluginContentActionKey(collection, contentId) : void 0;
+		const invokeWithGuard = async () => {
+			if (guardKey) this.retainPluginContentAction(guardKey);
+			try {
+				await invoke();
+			} finally {
+				if (guardKey) this.releasePluginContentAction(guardKey);
+			}
+		};
+		if (afterPluginId && pluginInvocationId && this.findSandboxedPlugin(afterPluginId)) {
+			const key = this.pluginInvocationKey(afterPluginId, pluginInvocationId);
+			if (!this.activePluginInvocations.has(key) || this.releasedPluginInvocations.has(key)) {
+				after(invokeWithGuard);
+				return;
+			}
+			const pending = this.pendingPluginAfterHooks.get(key) ?? [];
+			pending.push(invokeWithGuard);
+			this.pendingPluginAfterHooks.set(key, pending);
+			return;
+		}
+		after(invokeWithGuard);
+	}
+	pluginInvocationKey(pluginId, invocationId) {
+		return JSON.stringify([pluginId, invocationId]);
+	}
+	beginPluginInvocation(pluginId, invocationId, invalidateContentCache) {
+		const key = this.pluginInvocationKey(pluginId, invocationId);
+		this.pendingPluginAfterHooks.delete(key);
+		this.releasedPluginInvocations.delete(key);
+		if (invalidateContentCache) this.pluginInvocationCacheInvalidators.set(key, invalidateContentCache);
+		else this.pluginInvocationCacheInvalidators.delete(key);
+		this.activePluginInvocations.add(key);
+	}
+	flushPluginAfterHooks(pluginId, invocationId, final = true) {
+		if (!invocationId) return Promise.resolve();
+		const key = this.pluginInvocationKey(pluginId, invocationId);
+		this.releasedPluginInvocations.add(key);
+		const pending = this.pendingPluginAfterHooks.get(key) ?? [];
+		this.pendingPluginAfterHooks.delete(key);
+		for (const invoke of pending) after(invoke);
+		if (final) {
+			this.releasedPluginInvocations.delete(key);
+			this.activePluginInvocations.delete(key);
+			this.pluginInvocationCacheInvalidators.delete(key);
+		} else {
+			const timer = setTimeout(() => {
+				this.releasedPluginInvocations.delete(key);
+				this.activePluginInvocations.delete(key);
+				this.pluginInvocationCacheInvalidators.delete(key);
+			}, PLUGIN_INVOCATION_RELEASE_GRACE_MS);
+			if (typeof timer === "object") timer.unref();
+		}
+		return Promise.resolve();
+	}
+	runAfterPublishHooks(content, collection, afterPluginId, pluginInvocationId) {
+		this.runDeferredContentHook("content:afterPublish", content, collection, afterPluginId, pluginInvocationId);
+	}
+	runAfterUnpublishHooks(content, collection, afterPluginId, pluginInvocationId) {
+		this.runDeferredContentHook("content:afterUnpublish", content, collection, afterPluginId, pluginInvocationId);
+	}
+	runAfterRestoreHooks(content, collection, afterPluginId, pluginInvocationId) {
+		this.runDeferredContentHook("content:afterRestore", content, collection, afterPluginId, pluginInvocationId);
+	}
+	runAfterScheduleHooks(content, collection, afterPluginId, pluginInvocationId) {
+		this.runDeferredContentHook("content:afterSchedule", content, collection, afterPluginId, pluginInvocationId);
+	}
+	runAfterUnscheduleHooks(content, collection, afterPluginId, pluginInvocationId) {
+		this.runDeferredContentHook("content:afterUnschedule", content, collection, afterPluginId, pluginInvocationId);
+	}
+	async handleSandboxedRoute(plugin, path, request, body, routeMeta, user, ui, invalidateContentCache) {
+		const routeName = path.replace(LEADING_SLASH_PATTERN, "");
+		try {
+			const declaredHeaders = routeMeta.request ? routeMeta.request.headers ?? [] : void 0;
+			const headers = sanitizeHeadersForSandbox(request.headers, declaredHeaders);
+			const meta = extractRequestMeta(request, this.config);
+			return {
+				success: true,
+				data: await plugin.invokeRoute(routeName, body, {
+					url: request.url,
+					method: request.method,
+					headers,
+					meta,
+					user,
+					ui
+				}, { invalidateContentCache })
+			};
+		} catch (error) {
+			if (error instanceof PluginRouteRequestError) return {
+				success: false,
+				status: error.status,
+				error: {
+					code: "INVALID_PLUGIN_REQUEST",
+					message: error.message
+				}
+			};
+			console.error(`EmDash: Sandboxed plugin route error:`, error);
+			const sandboxRouteError = getSandboxRouteErrorDetails(error);
+			if (sandboxRouteError) return {
+				success: false,
+				status: sandboxRouteError.status,
+				error: {
+					code: sandboxRouteError.code,
+					message: sandboxRouteError.message
+				}
+			};
+			return {
+				success: false,
+				error: {
+					code: "ROUTE_ERROR",
+					message: error instanceof Error ? error.message : String(error)
+				}
+			};
+		}
+	}
+	/**
+	* Cache for page contributions. Uses a WeakMap keyed on the PublicPageContext
+	* object so results are collected once per page context per request, even when
+	* multiple render components (EmDashHead, EmDashBodyStart, EmDashBodyEnd)
+	* request contributions from the same page.
+	*/
+	pageContributionCache = /* @__PURE__ */ new WeakMap();
+	/**
+	* Collect all page contributions (metadata + fragments) in a single pass.
+	* Results are cached by page context object identity.
+	*/
+	async collectPageContributions(page) {
+		const cached = this.pageContributionCache.get(page);
+		if (cached) return cached;
+		const promise = this.doCollectPageContributions(page);
+		this.pageContributionCache.set(page, promise);
+		return promise;
+	}
+	async doCollectPageContributions(page) {
+		const metadata = [];
+		const fragments = [];
+		if (this.hooks.hasHooks("page:metadata")) {
+			const results = await this.hooks.runPageMetadata({ page });
+			for (const r of results) metadata.push(...r.contributions);
+		}
+		if (this.hooks.hasHooks("page:fragments")) {
+			const results = await this.hooks.runPageFragments({ page });
+			for (const r of results) fragments.push(...r.contributions);
+		}
+		return {
+			metadata,
+			fragments
+		};
+	}
+	/**
+	* Collect page metadata contributions from trusted and sandboxed plugins.
+	* Delegates to the single-pass collector and returns the metadata portion.
+	*/
+	async collectPageMetadata(page) {
+		const { metadata } = await this.collectPageContributions(page);
+		return metadata;
+	}
+	/**
+	* Collect page fragment contributions from trusted plugins only.
+	* Delegates to the single-pass collector and returns the fragments portion.
+	*/
+	async collectPageFragments(page) {
+		const { fragments } = await this.collectPageContributions(page);
+		return fragments;
+	}
+	isPluginEnabled(pluginId) {
+		const status = this.pluginStates.get(pluginId);
+		return status === void 0 || status === "active";
+	}
+};
+/**
+* Normalize an image field value together with its `darkVariant`. The media
+* normalizer only keeps the media item's own keys, so the variant is normalized
+* separately and reattached.
+*/
+async function normalizeImageValue(value, getProvider) {
+	const primary = await normalizePrimaryImageValue(value, getProvider);
+	if (!primary || !isRecord(value) || value.darkVariant == null) return primary;
+	const darkVariant = await normalizeMediaValue(value.darkVariant, getProvider);
+	return darkVariant ? {
+		...primary,
+		darkVariant
+	} : primary;
+}
+/**
+* Normalize the primary image of an image field value.
+*
+* A legacy string URL that the admin upgraded to `{ id: "", src: url }` so it
+* can carry a dark variant still has to normalize as a string: as an object it
+* counts as local media, which strips `src` and leaves nothing behind. The
+* upgrade outlives the variant — an editor can add one and remove it again —
+* so the shape decides, not the presence of `darkVariant`.
+*/
+async function normalizePrimaryImageValue(value, getProvider) {
+	if (isRecord(value) && !value.id && typeof value.src === "string" && !value.provider) return normalizeMediaValue(value.src, getProvider);
+	return normalizeMediaValue(value, getProvider);
+}
+
+//#endregion
+export { EmDashRuntime as n, DB_INIT_DEADLINE_MS as t };
+//# sourceMappingURL=emdash-runtime-CrzxJFmF.mjs.map