emdash 0.40.1 → 0.42.0

package/dist/cli/index.mjs

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
-import { a as getMigrationStatus, c as formatDatetimeStorageReport, i as getExactMigrationStatus, l as scanDatetimeStorage, s as runMigrations, u as __exportAll } from "../runner-1y4J9fJB.mjs";
-import { t as EmDashDatabaseError } from "../errors-9P_FDrJ_.mjs";
+import { a as getMigrationStatus, c as formatDatetimeStorageReport, i as getExactMigrationStatus, l as scanDatetimeStorage, s as runMigrations, u as __exportAll } from "../runner-CLpxmhl8.mjs";
 import { n as isMissingTableError } from "../db-errors-CBD5yMro.mjs";
 import { busyLockHeldSince, migrationLockHeldMessage } from "../database/migration-lock.mjs";
 import { t as validateIdentifier } from "../validate-DANX1-Qi.mjs";
@@ -11,67 +10,69 @@ import "../after-PcEvMY_6.mjs";
 import { t as OptionsRepository } from "../options-DhrI7eMv.mjs";
 import { a as encodeBase64url } from "../base64-DvnNgP7e.mjs";
 import { n as fingerprintKey, r as generateEncryptionKey, t as EmDashSecretsError } from "../secrets-CIi0nFiR.mjs";
-import { t as ContentRepository } from "../content-DFaIEDj9.mjs";
-import "../object-cache-CqWNY5uP.mjs";
+import { t as ContentRepository } from "../content-RzEXY3QX.mjs";
+import "../object-cache-Bo6DGaC9.mjs";
 import { n as slugify } from "../slugify-T5GHH42D.mjs";
-import "../types-BkUg2yHx.mjs";
-import { t as MediaRepository } from "../media-CPXTbb1R.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-C3Fu1YeH.mjs";
-import "../resolve-2WbQsCvT.mjs";
-import "../redirect-B29UjdUn.mjs";
-import "../request-cache-DzLYKm_x.mjs";
-import "../byline-registry-gnKscbQX.mjs";
-import "../field-defs-cache-HIgBbqZZ.mjs";
-import { t as BylineRepository } from "../byline-DYmkXqvo.mjs";
-import { t as imageSize } from "../dist-BNwANFJR.mjs";
-import "../fts-manager-S-K0laoS.mjs";
-import { f as parseTaxonomyCollections, m as selectTaxonomyDefs } from "../loader-BzqeR1ZN.mjs";
-import { kyselyLogOption } from "../database/instrumentation.mjs";
-import "../collection-slugs-cache-CjGk__zp.mjs";
-import "../capture-triggers-kJyl_yyM.mjs";
-import "../activation-LOkDM5WT.mjs";
-import { a as SchemaRegistry, t as BlockTypeRegistry } from "../block-type-registry-DUI_3KxT.mjs";
-import "../collection-deletion-BIm28mo3.mjs";
-import { r as isTransferError, t as TransferError } from "../errors-DgE1zJGG.mjs";
-import "../canonical-YhEQezjg.mjs";
-import { d as sha256Hex, i as createSha256, s as packageDigest } from "../digest-BarSh-pN.mjs";
-import "../hash-SDAW6zC-.mjs";
-import "../zod-generator-D6uE4WiS.mjs";
-import "../block-values-C_VIPr5t.mjs";
-import "../settings-DYidIB26.mjs";
-import "../settings-B4vDl1fK.mjs";
-import { a as pluginManifestBaseSchema } from "../manifest-schema-CY3zng_M.mjs";
-import { i as isDeprecatedCapability, n as capabilitiesToDeclaredAccess$1, r as declaredAccessToCapabilities$1, t as CAPABILITY_RENAMES } from "../types-BZakh7Ym.mjs";
-import "../ssrf-CJUnJymJ.mjs";
-import { t as applySeed } from "../apply-npY1TAhG.mjs";
-import "../ssrf-DpBH7aOt.mjs";
-import { n as validateSeed } from "../validate-CHosPEhs.mjs";
-import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-BmSAOOEF.mjs";
-import "../identity-Be5kzutJ.mjs";
-import { t as openNodeSqliteDatabase } from "../node-sqlite-compat-CONMsl-x.mjs";
+import "../request-cache-C4CIo5ad.mjs";
+import "../url-Dn3IStq8.mjs";
+import "../types-j6MBDjlZ.mjs";
+import "../revision-CGkQA0e5.mjs";
+import { t as MediaRepository } from "../media-CputjGE1.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-BesdHIwi.mjs";
+import "../resolve-D-kqyKns.mjs";
+import "../redirect-BvFKh8Sz.mjs";
+import "../byline-registry-dvt4N3xV.mjs";
+import "../field-defs-cache-DEkFYCDE.mjs";
+import { t as BylineRepository } from "../byline-02tu_Uc-.mjs";
+import "../staged-Bw5eHbKS.mjs";
+import "../dist-Cfu8mMBs.mjs";
+import "../fts-manager-DU03MxWu.mjs";
+import { h as selectTaxonomyDefs, p as parseTaxonomyCollections } from "../loader-B_bcoE1h.mjs";
+import "../collection-slugs-cache-BNRAPNiu.mjs";
+import "../capture-triggers-CdZfvHtF.mjs";
+import "../activation-DDuqAat2.mjs";
+import "../collection-deletion-JecE26cS.mjs";
+import { L as BlockTypeRegistry, n as SchemaRegistry } from "../registry-CtHRqVe-.mjs";
+import "../hash-CY4QdeMJ.mjs";
+import "../zod-generator-DnfG5sGQ.mjs";
+import { r as isTransferError, t as TransferError } from "../errors-CjXd1LgH.mjs";
+import "../canonical-CAecl1UQ.mjs";
+import { d as sha256Hex, i as createSha256, s as packageDigest } from "../digest-DiYAoZpf.mjs";
+import "../block-values-BrTrtA-v.mjs";
+import "../query-DC3bv__4.mjs";
+import "../schema-BZPj3kwZ.mjs";
+import "../relations-CVI2nbrn.mjs";
+import "../settings-B0zQj_Tj.mjs";
+import "../schema-Berj5VQx.mjs";
+import "../settings-BbVRRGDp.mjs";
+import "../ssrf-DsmvZB80.mjs";
+import { t as applySeed } from "../apply-C1kq5l7p.mjs";
+import "../ssrf-tA45vIPX.mjs";
+import { n as validateSeed } from "../validate-WkjGwBSO.mjs";
+import { a as MigrationManifestValidationError, c as normalizeAstroI18n, i as getMigrationIntegrationMetadata, n as MIGRATION_CONFIG_SYMBOL, s as validateMigrationManifest, t as buildMigrationManifest } from "../manifest-builder-D7Y8iirE.mjs";
+import "../identity-u3KgtUC9.mjs";
+import { n as claimExplicitSeedOwnership } from "../ownership-DoeAIuTg.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { t as convertDataForRead } from "../portable-text-5O_ZGUjB.mjs";
+import { t as createDatabase } from "../connection-B9pIasFd.mjs";
+import { t as convertDataForRead } from "../portable-text-BnRuiR1-.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, getCachedAccessToken, isAccessRedirect, resolveCustomHeaders, runCloudflaredLogin } from "../client/cf-access.mjs";
 import { EmDashApiError, EmDashClient } from "../client/index.mjs";
-import { a as parseIndexLine, n as unpackSitePackage, o as parseManifest, r as decodeUtf8, t as packSitePackage } from "../tar-_1AgTYFu.mjs";
-import "../kinds-CRu_T5T5.mjs";
-import { t as MANIFEST_PATH } from "../paths-JxokKIbr.mjs";
-import "../transformations-9gfpwY65.mjs";
-import "../version-BRZXVifl.mjs";
-import { r as verifyReceiptDigest } from "../receipt-B4wJj5Jq.mjs";
+import { a as parseIndexLine, n as unpackSitePackage, o as parseManifest, r as decodeUtf8, t as packSitePackage } from "../tar-lDI_fzLD.mjs";
+import "../kinds-CXY-fwQ6.mjs";
+import { t as MANIFEST_PATH } from "../paths-DiENGBx5.mjs";
+import "../transformations-DdnpSdeC.mjs";
+import "../version-DbT04wbH.mjs";
+import { r as verifyReceiptDigest } from "../receipt-q1VK9jhj.mjs";
 import { createRequire } from "node:module";
-import { Kysely, SqliteDialect, sql } from "kysely";
+import { sql } from "kysely";
 import { z } from "zod";
 import { ulid } from "ulidx";
-import { extractManifestRoute, extractRouteOptions, isJsonPostRouteContract } from "@emdash-cms/plugin-types";
-import { createGzipDecoder, unpackTar } from "modern-tar";
 import { pathToFileURL } from "node:url";
-import { createHash } from "node:crypto";
-import { access, copyFile, mkdir, readFile, readdir, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
-import { basename, dirname, extname, isAbsolute, join, parse, resolve } from "node:path";
+import { access, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
 import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { Readable, Writable } from "node:stream";
-import { defineCommand, runCommand, runMain } from "citty";
+import { defineCommand, runMain } from "citty";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
 import { spawn } from "node:child_process";
@@ -79,8 +80,6 @@ import { homedir } from "node:os";
 import { parse as parse$1, printParseErrorCode } from "jsonc-parser";
 import { parse as parse$2 } from "smol-toml";
 import { createInterface } from "node:readline/promises";
-import { pipeline } from "node:stream/promises";
-import { packTar } from "modern-tar/fs";
 
 //#region src/cli/commands/auth.ts
 /**
@@ -238,45 +237,6 @@ function removeCredentials(baseUrl) {
 	}
 	return false;
 }
-function marketplaceKey(registryUrl) {
-	try {
-		return `marketplace:${new URL(registryUrl).origin}`;
-	} catch {
-		return `marketplace:${registryUrl}`;
-	}
-}
-/**
-* Get stored marketplace credential for a registry URL.
-*/
-function getMarketplaceCredential(registryUrl) {
-	const key = marketplaceKey(registryUrl);
-	const cred = readStore()[key];
-	if (!cred || !("token" in cred)) return null;
-	if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) return null;
-	return cred;
-}
-/**
-* Save marketplace credential for a registry URL.
-*/
-function saveMarketplaceCredential(registryUrl, cred) {
-	const key = marketplaceKey(registryUrl);
-	const store = readStore();
-	store[key] = cred;
-	writeStore(store);
-}
-/**
-* Remove marketplace credential for a registry URL.
-*/
-function removeMarketplaceCredential(registryUrl) {
-	const key = marketplaceKey(registryUrl);
-	const store = readStore();
-	if (key in store) {
-		delete store[key];
-		writeStore(store);
-		return true;
-	}
-	return false;
-}
 
 //#endregion
 //#region src/cli/client-factory.ts
@@ -728,7 +688,7 @@ const deleteCommand$2 = defineCommand({
 		}
 	}
 });
-const publishCommand$1 = defineCommand({
+const publishCommand = defineCommand({
 	meta: {
 		name: "publish",
 		description: "Publish a content item"
@@ -907,7 +867,7 @@ const contentCommand = defineCommand({
 		create: createCommand$1,
 		update: updateCommand,
 		delete: deleteCommand$2,
-		publish: publishCommand$1,
+		publish: publishCommand,
 		unpublish: unpublishCommand,
 		schedule: scheduleCommand,
 		restore: restoreCommand,
@@ -915,35 +875,6 @@ const contentCommand = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/database/connection.ts
-/**
-* Creates a Kysely database instance
-* Supports:
-* - file:./path/to/db.sqlite (local SQLite)
-* - :memory: (in-memory SQLite for testing)
-* - libsql://... (Turso/libSQL with auth token) - TODO
-*/
-function createDatabase(config) {
-	try {
-		if (config.url.startsWith("file:") || config.url === ":memory:") return new Kysely({
-			dialect: new SqliteDialect({ database: openNodeSqliteDatabase(config.url === ":memory:" ? ":memory:" : config.url.replace("file:", ""), {
-				journalMode: "wal",
-				readOnly: config.readOnly
-			}) }),
-			log: kyselyLogOption()
-		});
-		if (config.url.startsWith("libsql:")) {
-			if (!config.authToken) throw new EmDashDatabaseError("Auth token required for remote libSQL database");
-			throw new EmDashDatabaseError("LibSQL not yet implemented");
-		}
-		throw new EmDashDatabaseError(`Unsupported database URL scheme: ${config.url}`);
-	} catch (error) {
-		if (error instanceof EmDashDatabaseError) throw error;
-		throw new EmDashDatabaseError("Failed to create database", error);
-	}
-}
-
 //#endregion
 //#region src/cli/commands/dev.ts
 /**
@@ -960,7 +891,7 @@ async function readPackageJson$2(cwd) {
 		return null;
 	}
 }
-async function fileExists$4(path) {
+async function fileExists$3(path) {
 	try {
 		await access(path);
 		return true;
@@ -1012,7 +943,7 @@ const devCommand = defineCommand({
 			process.exit(1);
 		}
 		const dbPath = resolve(cwd, args.database);
-		if (!await fileExists$4(dbPath)) consola.start("Database not found, initializing...");
+		if (!await fileExists$3(dbPath)) consola.start("Database not found, initializing...");
 		const db = createDatabase({ url: `file:${dbPath}` });
 		try {
 			consola.start("Checking database migrations...");
@@ -1051,8 +982,8 @@ const devCommand = defineCommand({
 			"--port",
 			args.port
 		];
-		const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));
-		const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));
+		const pnpmLockExists = await fileExists$3(resolve(cwd, "pnpm-lock.yaml"));
+		const yarnLockExists = await fileExists$3(resolve(cwd, "yarn.lock"));
 		let cmd;
 		let cmdArgs;
 		if (pnpmLockExists) {
@@ -1115,7 +1046,7 @@ function triggerFix(configPath) {
 function mainFix(configPath) {
 	return configPath.endsWith(".toml") ? MAIN_FIX_TOML : MAIN_FIX_JSONC;
 }
-async function fileExists$3(path) {
+async function fileExists$2(path) {
 	try {
 		await access(path);
 		return true;
@@ -1136,7 +1067,7 @@ function sourcePosition(source, offset) {
 async function findWranglerConfig(cwd) {
 	for (const filename of WRANGLER_CONFIG_FILES) {
 		const path = resolve(cwd, filename);
-		if (await fileExists$3(path)) return path;
+		if (await fileExists$2(path)) return path;
 	}
 	return null;
 }
@@ -1231,7 +1162,7 @@ function printResult(result) {
 }
 async function checkDatabase(dbPath) {
 	const results = [];
-	if (!await fileExists$3(dbPath)) {
+	if (!await fileExists$2(dbPath)) {
 		results.push({
 			name: "database",
 			status: "fail",
@@ -1377,6 +1308,7 @@ const doctorCommand = defineCommand({
 * Export current database schema (and optionally content) as a seed file
 */
 const SETTINGS_PREFIX = "site:";
+const TRAILING_SLASHES = /\/+$/;
 const exportSeedCommand = defineCommand({
 	meta: {
 		name: "export-seed",
@@ -1403,6 +1335,11 @@ const exportSeedCommand = defineCommand({
 			type: "boolean",
 			description: "Pretty print JSON output",
 			default: true
+		},
+		"media-base-url": {
+			type: "string",
+			description: "Public URL of the site, used to write absolute media URLs",
+			required: false
 		}
 	},
 	async run({ args }) {
@@ -1422,7 +1359,10 @@ const exportSeedCommand = defineCommand({
 			process.exit(1);
 		}
 		try {
-			const seed = await exportSeed(db, args["with-content"]);
+			const seed = await exportSeed(db, args["with-content"], {
+				mediaBaseUrl: args["media-base-url"],
+				warn: (message) => process.stderr.write(`Warning: ${message}\n`)
+			});
 			const output = args.pretty ? JSON.stringify(seed, null, "	") : JSON.stringify(seed);
 			console.log(output);
 		} catch (error) {
@@ -1436,7 +1376,9 @@ const exportSeedCommand = defineCommand({
 /**
 * Export database to seed file format
 */
-async function exportSeed(db, withContent) {
+async function exportSeed(db, withContent, options = {}) {
+	const warn = options.warn ?? (() => {});
+	const mediaUrlPrefix = mediaFileUrlPrefix(options.mediaBaseUrl);
 	const seed = {
 		$schema: "https://emdashcms.com/seed.schema.json",
 		version: "1",
@@ -1448,19 +1390,46 @@ async function exportSeed(db, withContent) {
 	seed.settings = await exportSettings(db);
 	seed.blockTypes = await exportBlockTypes(db);
 	seed.collections = await exportCollections(db);
+	const relations = await exportRelations(db);
+	if (relations.length > 0) seed.relations = relations;
 	const { i18nEnabled, defaultLocale } = await detectLocaleInfo(db, seed.collections);
 	if (defaultLocale) seed.defaultLocale = defaultLocale;
 	seed.taxonomies = await exportTaxonomies(db, i18nEnabled);
-	seed.menus = await exportMenus(db, i18nEnabled);
-	seed.widgetAreas = await exportWidgetAreas(db);
 	const { bylines, groupToSeedId } = await exportBylines(db);
-	if (bylines.length > 0) seed.bylines = bylines;
+	let exportedContent;
 	if (withContent !== void 0) {
 		const collections = withContent === "" || withContent === "true" || withContent === "all" ? null : withContent.split(",").map((s) => s.trim()).filter(Boolean);
-		seed.content = await exportContent(db, seed.collections || [], collections, groupToSeedId, i18nEnabled);
+		exportedContent = await exportContent(db, seed.collections || [], collections, groupToSeedId, i18nEnabled, mediaUrlPrefix);
+	}
+	seed.menus = await exportMenus(db, i18nEnabled, exportedContent?.groupSeedIds ?? /* @__PURE__ */ new Map());
+	const redirects = await exportRedirects(db, warn);
+	if (redirects.length > 0) seed.redirects = redirects;
+	seed.widgetAreas = await exportWidgetAreas(db);
+	const sections = await exportSections(db, warn);
+	if (sections.length > 0) seed.sections = sections;
+	if (bylines.length > 0) seed.bylines = bylines;
+	if (exportedContent) {
+		seed.content = exportedContent.content;
+		if (exportedContent.mediaCount > 0 && !options.mediaBaseUrl) warn(`${exportedContent.mediaCount} media reference(s) use site-relative URLs, which \`emdash seed\` cannot download. Pass --media-base-url with the site's public URL to make them importable.`);
 	}
 	return seed;
 }
+const MEDIA_FILE_PATH = "/_emdash/api/media/file/";
+/**
+* Prefix for `$media` URLs: the site's base URL (without a trailing slash)
+* plus the public media route, or the bare route when no base is given.
+*/
+function mediaFileUrlPrefix(mediaBaseUrl) {
+	if (mediaBaseUrl === void 0) return MEDIA_FILE_PATH;
+	let base;
+	try {
+		base = new URL(mediaBaseUrl);
+	} catch {
+		throw new Error(`Invalid media base URL: ${mediaBaseUrl}`);
+	}
+	if (base.protocol !== "http:" && base.protocol !== "https:") throw new Error(`Media base URL must use http or https: ${mediaBaseUrl}`);
+	return `${base.origin}${base.pathname.replace(TRAILING_SLASHES, "")}${MEDIA_FILE_PATH}`;
+}
 /**
 * Export byline profiles as root-level `bylines[]`.
 *
@@ -1508,7 +1477,7 @@ async function exportBylines(db) {
 * Determine locale-awareness and the data's default locale for the export.
 *
 * The runtime initializes the i18n config in middleware, but the CLI never does,
-* so `isI18nEnabled()` is always false under `emdash export-seed` (#1330). When
+* so `isI18nEnabled()` is always false under `emdash export-seed`. When
 * the flag is unset, fall back to the data: a project is multi-locale when its
 * i18n-aware tables hold rows in more than one distinct locale. `locale` is
 * NOT NULL (defaulting to the site's default locale), so a per-row presence
@@ -1518,7 +1487,7 @@ async function exportBylines(db) {
 * per-locale suffix they need to avoid duplicate seed ids.
 *
 * `defaultLocale` self-describes the single-locale case so a non-`en` default
-* survives the round-trip (#1421). When more than one locale is present every
+* survives the round-trip. When more than one locale is present every
 * row already carries its own `locale`, so no fallback is needed and we leave it
 * undefined rather than guess which locale is the "default" without the runtime
 * config.
@@ -1600,6 +1569,9 @@ async function exportCollections(db) {
 			hidden: collection.hidden || void 0,
 			sortOrder: collection.sortOrder,
 			group: collection.group,
+			commentsEnabled: collection.commentsEnabled || void 0,
+			titleField: collection.titleField,
+			dateField: collection.dateField,
 			fields: fields.map((field) => ({
 				slug: field.slug,
 				label: field.label,
@@ -1608,6 +1580,7 @@ async function exportCollections(db) {
 				unique: field.unique || void 0,
 				searchable: field.searchable || void 0,
 				indexed: field.indexed || void 0,
+				translatable: field.translatable === false ? false : void 0,
 				defaultValue: field.defaultValue,
 				validation: field.validation ? { ...field.validation } : void 0,
 				widget: field.widget || void 0,
@@ -1619,6 +1592,36 @@ async function exportCollections(db) {
 	return result;
 }
 /**
+* Export relations as root-level `relations[]`.
+*
+* A reference field's `validation.relation` names a relation by slug, and the
+* field's validation is exported verbatim, so re-applying the seed binds the
+* field to this relation rather than creating another one.
+*/
+async function exportRelations(db) {
+	return (await db.selectFrom("_emdash_relations").select([
+		"slug",
+		"parent_collection",
+		"child_collection",
+		"parent_label",
+		"parent_label_singular",
+		"child_label",
+		"child_label_singular",
+		"max_children_per_parent",
+		"max_parents_per_child"
+	]).orderBy("slug", "asc").execute()).map((row) => ({
+		slug: row.slug,
+		parentCollection: row.parent_collection,
+		childCollection: row.child_collection,
+		parentLabel: row.parent_label,
+		parentLabelSingular: row.parent_label_singular ?? void 0,
+		childLabel: row.child_label,
+		childLabelSingular: row.child_label_singular ?? void 0,
+		maxChildrenPerParent: row.max_children_per_parent,
+		maxParentsPerChild: row.max_parents_per_child
+	}));
+}
+/**
 * Export taxonomy definitions and terms
 */
 async function exportTaxonomies(db, i18nEnabled) {
@@ -1678,7 +1681,7 @@ async function exportTaxonomies(db, i18nEnabled) {
 /**
 * Export menus with their items
 */
-async function exportMenus(db, i18nEnabled) {
+async function exportMenus(db, i18nEnabled, contentGroupSeedIds) {
 	const menus = await db.selectFrom("_emdash_menus").selectAll().orderBy("name").orderBy("locale").execute();
 	const result = [];
 	const groupToSeedId = /* @__PURE__ */ new Map();
@@ -1691,7 +1694,8 @@ async function exportMenus(db, i18nEnabled) {
 			menuName: menu.name,
 			menuLocale: menu.locale ?? null,
 			itemGroupToSeedId,
-			usedItemSeedIds
+			usedItemSeedIds,
+			contentGroupSeedIds
 		});
 		const seedMenu = {
 			id: seedId,
@@ -1746,7 +1750,7 @@ function buildMenuItemTree(items, i18nCtx) {
 			};
 			if (item.type === "custom") seedItem.url = item.custom_url || void 0;
 			else {
-				seedItem.ref = item.reference_id || void 0;
+				seedItem.ref = (item.type !== "taxonomy" && item.reference_id ? i18nCtx.contentGroupSeedIds.get(item.reference_id) : void 0) ?? (item.reference_id || void 0);
 				seedItem.collection = item.reference_collection || void 0;
 			}
 			if (item.target === "_blank") seedItem.target = "_blank";
@@ -1797,27 +1801,129 @@ async function exportWidgetAreas(db) {
 	}
 	return result;
 }
-/** A reference field holds a single entry id or an array of them. */
-function referenceValues(value) {
+function isSeedRedirectType(type) {
+	return type === 301 || type === 302 || type === 307 || type === 308;
+}
+/**
+* Export redirect rules. Terminal rules (410/451) have no seed representation
+* and are reported through `warn` instead.
+*
+* Databases migrated from before the source guard can hold several rows for
+* one source; only the guarded row is exported, since a seed rejects duplicate
+* sources.
+*/
+async function exportRedirects(db, warn) {
+	const rows = await db.selectFrom("_emdash_redirects").select([
+		"source",
+		"destination",
+		"type",
+		"enabled",
+		"group_name",
+		"source_guard"
+	]).orderBy("created_at").orderBy("id").execute();
+	const guardedRows = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const current = guardedRows.get(row.source);
+		if (!current || row.source_guard === 1 && current.source_guard !== 1) guardedRows.set(row.source, row);
+	}
+	const result = [];
+	for (const row of rows) {
+		if (guardedRows.get(row.source) !== row) {
+			warn(`Skipping duplicate rule for "${row.source}" -> "${row.destination}".`);
+			continue;
+		}
+		if (!isSeedRedirectType(row.type)) {
+			warn(`Skipping ${row.type} rule for "${row.source}": seeds only carry 301/302/307/308.`);
+			continue;
+		}
+		const redirect = {
+			source: row.source,
+			destination: row.destination,
+			type: row.type
+		};
+		if (row.enabled === 0) redirect.enabled = false;
+		if (row.group_name) redirect.groupName = row.group_name;
+		result.push(redirect);
+	}
+	return result;
+}
+function isSeedSectionSource(source) {
+	return source === "theme" || source === "user" || source === "import";
+}
+/** Section slugs a seed accepts. The WordPress importer can store others. */
+const SEED_SECTION_SLUG_PATTERN = /^[a-z0-9-]+$/;
+async function exportSections(db, warn) {
+	const rows = await db.selectFrom("_emdash_sections").select([
+		"slug",
+		"title",
+		"description",
+		"keywords",
+		"content",
+		"source"
+	]).orderBy("slug").execute();
+	const result = [];
+	for (const row of rows) {
+		if (!SEED_SECTION_SLUG_PATTERN.test(row.slug)) {
+			warn(`Skipping section "${row.slug}": seed section slugs may only contain lowercase letters, digits, and hyphens.`);
+			continue;
+		}
+		const section = {
+			slug: row.slug,
+			title: row.title,
+			content: JSON.parse(row.content)
+		};
+		if (row.description) section.description = row.description;
+		if (row.keywords) section.keywords = JSON.parse(row.keywords);
+		if (isSeedSectionSource(row.source)) section.source = row.source;
+		result.push(section);
+	}
+	return result;
+}
+async function loadRelations(db) {
+	const rows = await db.selectFrom("_emdash_relations").select([
+		"id",
+		"slug",
+		"child_collection",
+		"max_children_per_parent"
+	]).execute();
+	return new Map(rows.map((row) => [row.slug, {
+		id: row.id,
+		childCollection: row.child_collection,
+		maxChildrenPerParent: row.max_children_per_parent
+	}]));
+}
+/** A legacy reference column holds a single entry id or an array of them. */
+function legacyReferenceValues(value) {
 	if (typeof value === "string") return [value];
 	if (Array.isArray(value)) return value.filter((v) => typeof v === "string");
 	return [];
 }
 /**
 * For each exported collection, the other exported collections its entries
-* point into. Read from the values rather than a field's declared target so a
-* `reference` field without `options.collection` is still accounted for.
+* point into.
+*
+* A field bound to a relation names its target in the relation, and its links
+* are not in `data` to be read. A field with no relation still holds entry ids
+* in its own column; those are read from the values rather than from a declared
+* target, so a field without `options.collection` is still accounted for.
 */
-function referenceTargets(collected, collectionsBySlug, entryIdToCollection) {
+function referenceTargets(collected, collectionsBySlug, entryIdToCollection, relations) {
 	const targets = /* @__PURE__ */ new Map();
 	for (const [slug, items] of collected) {
-		const referenceFields = (collectionsBySlug.get(slug)?.fields ?? []).filter((field) => field.type === "reference").map((field) => field.slug);
+		const referenceFields = (collectionsBySlug.get(slug)?.fields ?? []).filter((field) => field.type === "reference");
 		if (referenceFields.length === 0) continue;
 		const found = /* @__PURE__ */ new Set();
-		for (const { item } of items) for (const fieldSlug of referenceFields) for (const value of referenceValues(item.data[fieldSlug])) {
-			const target = entryIdToCollection.get(value);
+		const add = (target) => {
 			if (target && target !== slug) found.add(target);
-		}
+		};
+		for (const field of referenceFields) {
+			const relationSlug = field.validation?.relation;
+			if (typeof relationSlug !== "string") continue;
+			if (field.validation?.relationSide === "child") continue;
+			add(relations.get(relationSlug)?.childCollection);
+		}
+		const columnFields = referenceFields.filter((field) => typeof field.validation?.relation !== "string").map((field) => field.slug);
+		if (columnFields.length > 0) for (const { item } of items) for (const fieldSlug of columnFields) for (const value of legacyReferenceValues(item.data[fieldSlug])) add(entryIdToCollection.get(value));
 		if (found.size > 0) targets.set(slug, found);
 	}
 	return targets;
@@ -1851,8 +1957,9 @@ function orderByReferenceTargets(slugs, targets) {
 /**
 * Export content from collections
 */
-async function exportContent(db, collections, includeCollections, bylineGroupToSeedId, i18nEnabled) {
+async function exportContent(db, collections, includeCollections, bylineGroupToSeedId, i18nEnabled, mediaUrlPrefix) {
 	const content = {};
+	const mediaCounter = { count: 0 };
 	const contentRepo = new ContentRepository(db);
 	const taxonomyRepo = new TaxonomyRepository(db);
 	const mediaRepo = new MediaRepository(db);
@@ -1866,7 +1973,7 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 				status: "all"
 			});
 			for (const media of result.items) mediaMap.set(media.id, {
-				url: `/_emdash/api/media/file/${media.storageKey}`,
+				url: `${mediaUrlPrefix}${media.storageKey}`,
 				filename: media.filename,
 				alt: media.alt || void 0,
 				caption: media.caption || void 0
@@ -1877,6 +1984,8 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 	const collected = /* @__PURE__ */ new Map();
 	const entryIdToSeedId = /* @__PURE__ */ new Map();
 	const entryIdToCollection = /* @__PURE__ */ new Map();
+	const groupToSeedId = /* @__PURE__ */ new Map();
+	const exported = [];
 	for (const collection of collections) {
 		if (includeCollections && !includeCollections.includes(collection.slug)) continue;
 		const items = [];
@@ -1894,13 +2003,16 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 				});
 				entryIdToSeedId.set(item.id, seedId);
 				entryIdToCollection.set(item.id, collection.slug);
+				const group = item.translationGroup ?? item.id;
+				if (!groupToSeedId.has(group)) groupToSeedId.set(group, seedId);
 			}
 			cursor = result.nextCursor;
 		} while (cursor);
 		collected.set(collection.slug, items);
 	}
+	const relations = await loadRelations(db);
 	const collectionsBySlug = new Map(collections.map((c) => [c.slug, c]));
-	const orderedSlugs = orderByReferenceTargets([...collected.keys()], referenceTargets(collected, collectionsBySlug, entryIdToCollection));
+	const orderedSlugs = orderByReferenceTargets([...collected.keys()], referenceTargets(collected, collectionsBySlug, entryIdToCollection, relations));
 	for (const slug of orderedSlugs) {
 		const collection = collectionsBySlug.get(slug);
 		const items = collected.get(slug);
@@ -1908,11 +2020,11 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 		const entries = [];
 		const translationGroupToSeedId = /* @__PURE__ */ new Map();
 		for (const { item, seedId } of items) {
-			const processedData = processDataForExport(item.data, collection.fields, mediaMap, entryIdToSeedId);
+			const processedData = processDataForExport(item.data, collection.fields, mediaMap, mediaCounter);
 			const entry = {
 				id: seedId,
 				slug: item.slug?.trim() ? item.slug : collection.routable === false ? void 0 : item.id,
-				status: item.status === "published" || item.status === "draft" ? item.status : void 0,
+				status: item.status === "published" ? "published" : "draft",
 				data: processedData
 			};
 			if (i18nEnabled && item.locale) {
@@ -1927,6 +2039,12 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 			if (Object.keys(taxonomies).length > 0) entry.taxonomies = taxonomies;
 			const bylines = await getBylineCredits(db, collection.slug, item.id, bylineGroupToSeedId);
 			if (bylines.length > 0) entry.bylines = bylines;
+			exported.push({
+				collection,
+				entry,
+				translationGroup: item.translationGroup ?? null,
+				referenceValues: item.data
+			});
 			entries.push(entry);
 		}
 		if (i18nEnabled && entries.length > 0) entries.sort((a, b) => {
@@ -1936,37 +2054,110 @@ async function exportContent(db, collections, includeCollections, bylineGroupToS
 		});
 		if (entries.length > 0) content[collection.slug] = entries;
 	}
-	return content;
+	await addReferenceLinks(db, exported, relations, groupToSeedId, entryIdToSeedId);
+	return {
+		content,
+		groupSeedIds: groupToSeedId,
+		mediaCount: mediaCounter.count
+	};
 }
 /**
-* Process content data for export, converting image fields to $media syntax
+* Write each entry's reference selection into its `data` as `$ref:` values, which
+* the seed's own content ids resolve on apply.
+*
+* A field bound to a relation takes its selection from the link table. Only the
+* parent side is emitted: both sides view one link set, so a child-side field
+* would restate links the parent side already carries, and `setReferenceChildren`
+* accepts them only from the parent. A field with no relation takes the entry id
+* in its column instead.
+*
+* Runs after every collection has been emitted, so the seed id of any target is
+* known. A target that was not exported has none: a link is then dropped, since
+* nothing in the seed owns it, while a column value keeps its `$ref:` prefix
+* around the raw row id. Stripping the prefix there would write a row id that no
+* restored row carries into the column, and the restore would report success.
+*/
+async function addReferenceLinks(db, exported, relations, groupToSeedId, entryIdToSeedId) {
+	if (exported.length === 0) return;
+	const linksByRelation = /* @__PURE__ */ new Map();
+	if (relations.size > 0) {
+		const edges = await db.selectFrom("_emdash_content_references").select([
+			"relation_id",
+			"parent_group",
+			"child_group"
+		]).orderBy("sort_order", "asc").execute();
+		for (const edge of edges) {
+			const byParent = linksByRelation.get(edge.relation_id) ?? /* @__PURE__ */ new Map();
+			const children = byParent.get(edge.parent_group) ?? [];
+			children.push(edge.child_group);
+			byParent.set(edge.parent_group, children);
+			linksByRelation.set(edge.relation_id, byParent);
+		}
+	}
+	for (const { collection, entry, translationGroup, referenceValues } of exported) for (const field of collection.fields) {
+		if (field.type !== "reference") continue;
+		const slug = field.validation?.relation;
+		if (typeof slug !== "string") {
+			const stored = referenceValues[field.slug];
+			const refs = (Array.isArray(stored) ? stored : [stored]).filter((id) => typeof id === "string" && id.length > 0).map((id) => `$ref:${entryIdToSeedId.get(id) ?? id}`);
+			if (refs.length === 0) continue;
+			entry.data[field.slug] = Array.isArray(stored) ? refs : refs[0];
+			continue;
+		}
+		if (field.validation?.relationSide === "child") continue;
+		const relation = relations.get(slug);
+		if (!relation || !translationGroup) continue;
+		const refs = (linksByRelation.get(relation.id)?.get(translationGroup) ?? []).map((group) => groupToSeedId.get(group)).filter((seedId) => seedId !== void 0).map((seedId) => `$ref:${seedId}`);
+		if (refs.length === 0) continue;
+		entry.data[field.slug] = relation.maxChildrenPerParent === 1 ? refs[0] : refs;
+	}
+}
+/**
+* Convert a stored media value (image or file) to `$media` syntax. Values that
+* don't point at a known media row are kept as they are.
 */
-function processDataForExport(data, fields, mediaMap, entryIdToSeedId) {
+function toSeedMedia(value, mediaMap, mediaCounter) {
+	if (!value || typeof value !== "object") return value;
+	const mediaValue = value;
+	const mediaInfo = typeof mediaValue.id === "string" ? mediaMap.get(mediaValue.id) : void 0;
+	if (!mediaInfo) return value;
+	mediaCounter.count++;
+	return { $media: {
+		url: mediaInfo.url,
+		filename: mediaInfo.filename,
+		alt: typeof mediaValue.alt === "string" && mediaValue.alt || mediaInfo.alt,
+		caption: mediaInfo.caption
+	} };
+}
+/** Slugs of a repeater field's `image` sub-fields. */
+function repeaterImageSubFields(field) {
+	const subFields = field.validation?.subFields;
+	const slugs = /* @__PURE__ */ new Set();
+	if (!Array.isArray(subFields)) return slugs;
+	for (const subField of subFields) if (subField && typeof subField === "object" && subField.type === "image" && typeof subField.slug === "string") slugs.add(subField.slug);
+	return slugs;
+}
+/**
+* Process content data for export: media values become `$media` references
+* and reference values become `$ref:` seed ids.
+*/
+function processDataForExport(data, fields, mediaMap, mediaCounter) {
 	const result = {};
-	const fieldTypes = /* @__PURE__ */ new Map();
-	for (const field of fields) fieldTypes.set(field.slug, field.type);
+	const fieldsBySlug = /* @__PURE__ */ new Map();
+	for (const field of fields) fieldsBySlug.set(field.slug, field);
 	for (const [key, value] of Object.entries(data)) {
-		const fieldType = fieldTypes.get(key);
-		if (fieldType === "image" && value && typeof value === "object") {
-			const imageValue = value;
-			if (imageValue.id) {
-				const mediaInfo = mediaMap.get(imageValue.id);
-				if (mediaInfo) {
-					result[key] = { $media: {
-						url: mediaInfo.url,
-						filename: mediaInfo.filename,
-						alt: imageValue.alt || mediaInfo.alt,
-						caption: mediaInfo.caption
-					} };
-					continue;
-				}
-			}
-			result[key] = value;
-		} else if (fieldType === "reference" && typeof value === "string") result[key] = `$ref:${entryIdToSeedId.get(value) ?? value}`;
-		else if (Array.isArray(value)) result[key] = value.map((item) => {
-			if (typeof item === "string" && fieldType === "reference") return `$ref:${entryIdToSeedId.get(item) ?? item}`;
-			return item;
-		});
+		const field = fieldsBySlug.get(key);
+		const fieldType = field?.type;
+		if (fieldType === "image" || fieldType === "file") result[key] = toSeedMedia(value, mediaMap, mediaCounter);
+		else if (field && fieldType === "repeater" && Array.isArray(value)) {
+			const imageSubFields = repeaterImageSubFields(field);
+			result[key] = value.map((row) => {
+				if (!row || typeof row !== "object" || Array.isArray(row)) return row;
+				const exportedRow = {};
+				for (const [subKey, subValue] of Object.entries(row)) exportedRow[subKey] = imageSubFields.has(subKey) ? toSeedMedia(subValue, mediaMap, mediaCounter) : subValue;
+				return exportedRow;
+			});
+		} else if (fieldType === "reference") continue;
 		else result[key] = value;
 	}
 	return result;
@@ -2011,7 +2202,7 @@ async function getTaxonomyAssignments(taxonomyRepo, collection, entryId) {
 *
 * Initialize database from template config in package.json
 */
-async function fileExists$2(path) {
+async function fileExists$1(path) {
 	try {
 		await access(path);
 		return true;
@@ -2102,7 +2293,7 @@ const initCommand = defineCommand({
 		if (alreadyInitialized && args.force) consola.warn("Re-initializing (--force)...");
 		if (config?.schema) {
 			const schemaPath = resolve(cwd, config.schema);
-			if (await fileExists$2(schemaPath)) {
+			if (await fileExists$1(schemaPath)) {
 				consola.start(`Running schema: ${config.schema}`);
 				try {
 					await runSqlFile(db, schemaPath);
@@ -2820,7 +3011,9 @@ async function loadProjectConfig(projectRoot, configFile) {
 		},
 		configFile,
 		projectRoot,
-		"silent"
+		"silent",
+		void 0,
+		"runner"
 	]);
 	if (!isRecord$1(loaded) || !Object.hasOwn(loaded, "config")) throw new MigrationConfigLoaderError(`Vite could not load Astro config: ${configFile}`);
 	return loaded.config;
@@ -3303,1439 +3496,6 @@ const migrateCommand = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/commands/bundle-utils.ts
-/**
-* Bundle utility functions
-*
-* Shared logic extracted from the bundle command so it can be tested
-* without the CLI harness and tsdown dependency.
-*/
-const MAX_BUNDLE_SIZE = 256 * 1024;
-const MAX_FILE_SIZE = 128 * 1024;
-const MAX_FILE_COUNT = 20;
-const MAX_SCREENSHOTS = 5;
-const MAX_SCREENSHOT_WIDTH = 1920;
-const MAX_SCREENSHOT_HEIGHT = 1080;
-const ICON_SIZE = 256;
-const MCP_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
-/**
-* Matches Node.js built-in imports in bundled output:
-* - require("node:xxx") / require("xxx")
-* - import("node:xxx") / import("xxx")
-* - import X from "node:xxx" / import { X } from "node:xxx"
-* - import * as X from "node:xxx"
-* - export { X } from "node:xxx"
-* Captures the base module name (e.g. "fs" from "node:fs/promises").
-*/
-const NODE_BUILTIN_IMPORT_RE = /(?:import|export|require)\s*(?:\(|[^(]*?\bfrom\s+)["'](?:node:)?([a-z_]+)(?:\/[^"']*)?\s*["']\)?/g;
-const LEADING_DOT_SLASH_RE = /^\.\//;
-const DIST_PREFIX_RE = /^dist\//;
-const MJS_EXT_RE = /\.m?js$/;
-const TS_TO_TSX_RE = /\.ts$/;
-/** Node.js built-in modules that shouldn't appear in sandbox code */
-const NODE_BUILTINS = new Set([
-	"assert",
-	"buffer",
-	"child_process",
-	"cluster",
-	"crypto",
-	"dgram",
-	"dns",
-	"domain",
-	"events",
-	"fs",
-	"http",
-	"http2",
-	"https",
-	"inspector",
-	"module",
-	"net",
-	"os",
-	"path",
-	"perf_hooks",
-	"process",
-	"punycode",
-	"querystring",
-	"readline",
-	"repl",
-	"stream",
-	"string_decoder",
-	"sys",
-	"timers",
-	"tls",
-	"trace_events",
-	"tty",
-	"url",
-	"util",
-	"v8",
-	"vm",
-	"wasi",
-	"worker_threads",
-	"zlib"
-]);
-async function fileExists$1(path) {
-	try {
-		await access(path);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** Convert an absolute build artifact path into a portable ESM import specifier. */
-function toFileImportSpecifier(path) {
-	return pathToFileURL(path).href;
-}
-/**
-* Read image dimensions from a buffer.
-* Returns [width, height] or null if the format is unrecognized.
-*/
-function readImageDimensions(buf) {
-	try {
-		const result = imageSize(buf);
-		if (result.width != null && result.height != null) return [result.width, result.height];
-		return null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Extract manifest metadata from a ResolvedPlugin.
-* Strips functions (hooks, route handlers) and keeps only serializable metadata.
-*/
-function extractManifest(plugin) {
-	if ((plugin.admin.pages?.length ?? 0) > 0 || (plugin.admin.widgets?.length ?? 0) > 0) {
-		const adminRoute = plugin.routes.admin;
-		if (adminRoute && (adminRoute.public === true || !isJsonPostRouteContract(adminRoute))) throw new Error("Block Kit admin route must accept POST JSON requests and return JSON");
-	}
-	const declaredAccess = capabilitiesToDeclaredAccess$1(plugin.capabilities, plugin.allowedHosts);
-	const enforcedAccess = declaredAccessToCapabilities$1(declaredAccess);
-	const hooks = [];
-	for (const [name, resolved] of Object.entries(plugin.hooks)) {
-		if (!resolved) continue;
-		if (resolved.exclusive || resolved.priority !== 100 || resolved.timeout !== 5e3) {
-			const entry = { name };
-			if (resolved.exclusive) entry.exclusive = true;
-			if (resolved.priority !== 100) entry.priority = resolved.priority;
-			if (resolved.timeout !== 5e3) entry.timeout = resolved.timeout;
-			hooks.push(entry);
-		} else hooks.push(name);
-	}
-	const routes = Object.entries(plugin.routes).map(([name, route]) => extractManifestRoute(name, route));
-	const tools = Object.entries(plugin.mcp?.tools ?? {}).map(([name, tool]) => {
-		if (!MCP_TOOL_NAME_PATTERN.test(name)) throw new Error(`Invalid MCP tool name "${name}"`);
-		const route = plugin.routes[tool.route];
-		if (!route?.permission || route.public || route.response === "raw") throw new Error(`MCP tool "${name}" must reference a private route with a permission`);
-		if (!isJsonPostRouteContract(route)) throw new Error(`MCP tool "${name}" must reference a POST-compatible JSON route`);
-		return {
-			name,
-			description: tool.description,
-			route: tool.route,
-			permission: route.permission,
-			destructive: tool.destructive ?? false,
-			inputSchema: z.toJSONSchema(tool.input, { target: "draft-7" }),
-			...tool.output ? { outputSchema: z.toJSONSchema(tool.output, { target: "draft-7" }) } : {}
-		};
-	});
-	return {
-		id: plugin.id,
-		version: plugin.version,
-		declaredAccess,
-		capabilities: enforcedAccess.capabilities,
-		allowedHosts: plugin.allowedHosts,
-		storage: plugin.storage,
-		hooks,
-		routes,
-		...tools.length > 0 ? { mcp: { tools } } : {},
-		admin: {
-			settingsSchema: plugin.admin.settingsSchema,
-			pages: plugin.admin.pages,
-			widgets: plugin.admin.widgets,
-			editorPanels: plugin.admin.editorPanels,
-			editorActions: plugin.admin.editorActions
-		}
-	};
-}
-/**
-* Scan bundled code for Node.js built-in imports.
-* Matches require("node:xxx"), require("xxx"), import("node:xxx") — the patterns
-* that appear in bundled ESM/CJS output (not source-level named imports).
-* Returns deduplicated array of built-in module names found.
-*/
-function findNodeBuiltinImports(code) {
-	const found = [];
-	NODE_BUILTIN_IMPORT_RE.lastIndex = 0;
-	let match;
-	while ((match = NODE_BUILTIN_IMPORT_RE.exec(code)) !== null) {
-		const mod = match[1];
-		if (NODE_BUILTINS.has(mod)) found.push(mod);
-	}
-	return [...new Set(found)];
-}
-/**
-* Find a build output file by base name, checking common extensions.
-* tsdown may output .mjs, .js, or .cjs depending on format and config.
-*/
-async function findBuildOutput(dir, baseName) {
-	for (const ext of [
-		".mjs",
-		".js",
-		".cjs"
-	]) {
-		const candidate = join(dir, `${baseName}${ext}`);
-		if (await fileExists$1(candidate)) return candidate;
-	}
-}
-/**
-* Resolve a dist/built path back to its source .ts/.tsx equivalent.
-* E.g., "./dist/index.mjs" → "src/index.ts"
-*/
-async function resolveSourceEntry(pluginDir, distPath) {
-	const cleaned = distPath.replace(LEADING_DOT_SLASH_RE, "");
-	const srcPath = cleaned.replace(DIST_PREFIX_RE, "src/").replace(MJS_EXT_RE, ".ts");
-	const srcFull = resolve(pluginDir, srcPath);
-	if (await fileExists$1(srcFull)) return srcFull;
-	const tsxFull = resolve(pluginDir, srcPath.replace(TS_TO_TSX_RE, ".tsx"));
-	if (await fileExists$1(tsxFull)) return tsxFull;
-	const direct = resolve(pluginDir, cleaned);
-	if (await fileExists$1(direct)) return direct;
-}
-const TS_SOURCE_EXPORT_RE = /\.(?:ts|tsx|mts|cts|jsx)$/;
-/**
-* Find package.json exports that point to source files instead of built output.
-* Returns an array of `{ exportPath, resolvedPath }` for each offending export.
-*/
-function findSourceExports(exports) {
-	const issues = [];
-	for (const [exportPath, exportValue] of Object.entries(exports)) {
-		const resolved = typeof exportValue === "string" ? exportValue : exportValue && typeof exportValue === "object" && "import" in exportValue ? exportValue.import : null;
-		if (resolved && TS_SOURCE_EXPORT_RE.test(resolved)) issues.push({
-			exportPath,
-			resolvedPath: resolved
-		});
-	}
-	return issues;
-}
-/**
-* Recursively walk a staging directory and return a flat list of all files
-* with sizes. Names are relative to `dir` so they match what would appear
-* as the tarball entry name.
-*/
-async function collectBundleEntries(dir) {
-	const entries = [];
-	await walkBundle(dir, "", entries);
-	return entries;
-}
-async function walkBundle(dir, prefix, into) {
-	const items = await readdir(dir, { withFileTypes: true });
-	for (const item of items) {
-		const fullPath = join(dir, item.name);
-		const relPath = prefix ? `${prefix}/${item.name}` : item.name;
-		if (item.isFile()) {
-			const s = await stat(fullPath);
-			into.push({
-				name: relPath,
-				bytes: s.size
-			});
-		} else if (item.isDirectory()) await walkBundle(fullPath, relPath, into);
-	}
-}
-/**
-* Sum the byte sizes of all entries.
-*/
-function totalBundleBytes(entries) {
-	let total = 0;
-	for (const e of entries) total += e.bytes;
-	return total;
-}
-/**
-* Check a bundle against the three size caps from RFC 0001:
-*   - total decompressed ≤ MAX_BUNDLE_SIZE
-*   - per-file decompressed ≤ MAX_FILE_SIZE
-*   - file count ≤ MAX_FILE_COUNT
-*
-* Returns a list of violation messages (empty if the bundle is within all
-* caps). Messages are deterministic per input — the total/count violations
-* come first, then oversized files in alphabetical order — so the same
-* bundle always produces the same error text.
-*/
-function validateBundleSize(entries) {
-	const violations = [];
-	const total = totalBundleBytes(entries);
-	if (total > MAX_BUNDLE_SIZE) violations.push(`Bundle size ${formatBytes$1(total)} exceeds maximum of ${formatBytes$1(MAX_BUNDLE_SIZE)}.`);
-	if (entries.length > MAX_FILE_COUNT) violations.push(`Bundle contains ${entries.length} files, exceeds maximum of ${MAX_FILE_COUNT}.`);
-	const oversized = entries.filter((e) => e.bytes > MAX_FILE_SIZE).toSorted((a, b) => a.name.localeCompare(b.name));
-	for (const e of oversized) violations.push(`File ${e.name} is ${formatBytes$1(e.bytes)}, exceeds per-file maximum of ${formatBytes$1(MAX_FILE_SIZE)}.`);
-	return violations;
-}
-/**
-* Render a byte count as a human-friendly string (e.g. "256.0 KB").
-*/
-function formatBytes$1(n) {
-	if (n < 1024) return `${n} B`;
-	if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
-	return `${(n / 1024 / 1024).toFixed(2)} MB`;
-}
-/**
-* Create a gzipped tarball from a directory.
-*/
-async function createTarball(sourceDir, outputPath) {
-	const { createGzip } = await import("node:zlib");
-	await pipeline(packTar(sourceDir), createGzip({ level: 9 }), createWriteStream(outputPath));
-}
-
-//#endregion
-//#region src/cli/commands/bundle.ts
-/**
-* emdash plugin bundle
-*
-* Produces a publishable plugin tarball from a plugin source directory.
-*
-* Steps:
-* 1. Resolve plugin entrypoint (finds definePlugin() export)
-* 2. Bundle backend code with tsdown → backend.js (single ES module, tree-shaken)
-* 3. Bundle admin code if present → admin.js
-* 4. Extract manifest from definePlugin() → manifest.json
-* 5. Collect assets (README.md, icon.png, screenshots/)
-* 6. Validate bundle (manifest schema, size limits, no Node.js builtins)
-* 7. Create tarball ({id}-{version}.tar.gz)
-*/
-var bundle_exports = /* @__PURE__ */ __exportAll({ bundleCommand: () => bundleCommand });
-const TS_EXT_RE = /\.(tsx?|[mc]?js)$/;
-const SLASH_RE = /\//g;
-const LEADING_AT_RE = /^@/;
-const emdash_SCOPE_RE = /^@emdash-cms\//;
-const bundleCommand = defineCommand({
-	meta: {
-		name: "bundle",
-		description: "Bundle a plugin for marketplace distribution"
-	},
-	args: {
-		dir: {
-			type: "string",
-			description: "Plugin directory (default: current directory)",
-			default: process.cwd()
-		},
-		outDir: {
-			type: "string",
-			alias: "o",
-			description: "Output directory for the tarball (default: ./dist)",
-			default: "dist"
-		},
-		validateOnly: {
-			type: "boolean",
-			description: "Run validation only, skip tarball creation",
-			default: false
-		}
-	},
-	async run({ args }) {
-		const pluginDir = resolve(args.dir);
-		const outDir = resolve(pluginDir, args.outDir);
-		const validateOnly = args.validateOnly;
-		consola.start(validateOnly ? "Validating plugin..." : "Bundling plugin...");
-		const pkgPath = join(pluginDir, "package.json");
-		if (!await fileExists$1(pkgPath)) {
-			consola.error("No package.json found in", pluginDir);
-			process.exit(1);
-		}
-		const pkg = JSON.parse(await readFile(pkgPath, "utf-8"));
-		let backendEntry;
-		let adminEntry;
-		if (pkg.exports) {
-			const sandboxExport = pkg.exports["./sandbox"];
-			if (typeof sandboxExport === "string") backendEntry = await resolveSourceEntry(pluginDir, sandboxExport);
-			else if (sandboxExport && typeof sandboxExport === "object" && "import" in sandboxExport) backendEntry = await resolveSourceEntry(pluginDir, sandboxExport.import);
-			const adminExport = pkg.exports["./admin"];
-			if (typeof adminExport === "string") adminEntry = await resolveSourceEntry(pluginDir, adminExport);
-			else if (adminExport && typeof adminExport === "object" && "import" in adminExport) adminEntry = await resolveSourceEntry(pluginDir, adminExport.import);
-		}
-		if (!backendEntry) {
-			const defaultSandbox = join(pluginDir, "src/sandbox-entry.ts");
-			if (await fileExists$1(defaultSandbox)) backendEntry = defaultSandbox;
-		}
-		let mainEntry;
-		if (pkg.exports?.["."] !== void 0) {
-			const mainExport = pkg.exports["."];
-			if (typeof mainExport === "string") mainEntry = await resolveSourceEntry(pluginDir, mainExport);
-			else if (mainExport && typeof mainExport === "object" && "import" in mainExport) mainEntry = await resolveSourceEntry(pluginDir, mainExport.import);
-		}
-		if (!mainEntry && pkg.main) mainEntry = await resolveSourceEntry(pluginDir, pkg.main);
-		if (!mainEntry) {
-			const defaultMain = join(pluginDir, "src/index.ts");
-			if (await fileExists$1(defaultMain)) mainEntry = defaultMain;
-		}
-		if (!mainEntry) {
-			consola.error("Cannot find plugin entrypoint. Expected src/index.ts or main/exports in package.json");
-			process.exit(1);
-		}
-		consola.info(`Main entry: ${mainEntry}`);
-		if (backendEntry) consola.info(`Backend entry: ${backendEntry}`);
-		if (adminEntry) consola.info(`Admin entry: ${adminEntry}`);
-		consola.start("Extracting plugin manifest...");
-		const { build } = await import("tsdown");
-		const tmpDir = join(pluginDir, ".emdash-bundle-tmp");
-		try {
-			await rm(tmpDir, {
-				recursive: true,
-				force: true
-			});
-			await mkdir(tmpDir, { recursive: true });
-			const mainOutDir = join(tmpDir, "main");
-			await build({
-				config: false,
-				entry: [mainEntry],
-				format: "esm",
-				outDir: mainOutDir,
-				dts: false,
-				platform: "node",
-				external: ["emdash", emdash_SCOPE_RE]
-			});
-			const pluginNodeModules = join(pluginDir, "node_modules");
-			const tmpNodeModules = join(mainOutDir, "node_modules");
-			if (await fileExists$1(pluginNodeModules)) await symlink(pluginNodeModules, tmpNodeModules, "junction");
-			const mainOutputPath = await findBuildOutput(mainOutDir, basename(mainEntry).replace(TS_EXT_RE, ""));
-			if (!mainOutputPath) {
-				consola.error("Failed to build main entry — no output found in", mainOutDir);
-				process.exit(1);
-			}
-			const pluginModule = await import(toFileImportSpecifier(mainOutputPath));
-			let resolvedPlugin;
-			if (typeof pluginModule.createPlugin === "function") resolvedPlugin = pluginModule.createPlugin();
-			else if (typeof pluginModule.default === "function") resolvedPlugin = pluginModule.default();
-			else if (typeof pluginModule.default === "object" && pluginModule.default !== null) {
-				const defaultExport = pluginModule.default;
-				if ("id" in defaultExport && "version" in defaultExport) resolvedPlugin = defaultExport;
-			}
-			if (!resolvedPlugin) for (const [key, value] of Object.entries(pluginModule)) {
-				if (key === "default" || typeof value !== "function") continue;
-				try {
-					const result = value();
-					if (result && typeof result === "object" && "id" in result && "version" in result) {
-						resolvedPlugin = {
-							id: result.id,
-							version: result.version,
-							capabilities: result.capabilities ?? [],
-							allowedHosts: result.allowedHosts ?? [],
-							storage: result.storage ?? {},
-							hooks: {},
-							routes: {},
-							admin: {
-								pages: result.adminPages,
-								widgets: result.adminWidgets
-							}
-						};
-						if (backendEntry) {
-							const backendProbeDir = join(tmpDir, "backend-probe");
-							const probeShimDir = join(tmpDir, "probe-shims");
-							await mkdir(probeShimDir, { recursive: true });
-							await writeFile(join(probeShimDir, "emdash.mjs"), "export const definePlugin = (d) => d;\n");
-							await build({
-								config: false,
-								entry: [backendEntry],
-								format: "esm",
-								outDir: backendProbeDir,
-								dts: false,
-								platform: "neutral",
-								external: [],
-								alias: { emdash: join(probeShimDir, "emdash.mjs") },
-								treeshake: true
-							});
-							const backendProbePath = await findBuildOutput(backendProbeDir, basename(backendEntry).replace(TS_EXT_RE, ""));
-							if (backendProbePath) {
-								const standardDef = (await import(toFileImportSpecifier(backendProbePath))).default ?? {};
-								const hooks = standardDef.hooks;
-								const routes = standardDef.routes;
-								if (hooks) for (const hookName of Object.keys(hooks)) {
-									const hookEntry = hooks[hookName];
-									const isConfig = typeof hookEntry === "object" && hookEntry !== null && "handler" in hookEntry;
-									const config = isConfig ? hookEntry : {};
-									resolvedPlugin.hooks[hookName] = {
-										handler: isConfig ? hookEntry.handler : hookEntry,
-										priority: config.priority ?? 100,
-										timeout: config.timeout ?? 5e3,
-										dependencies: config.dependencies ?? [],
-										errorPolicy: config.errorPolicy ?? "abort",
-										exclusive: config.exclusive ?? false,
-										pluginId: result.id
-									};
-								}
-								if (routes) for (const [name, route] of Object.entries(routes)) {
-									const routeObj = typeof route === "object" && route !== null ? route : {};
-									resolvedPlugin.routes[name] = {
-										handler: typeof route === "function" ? route : routeObj.handler,
-										...extractRouteOptions(route)
-									};
-								}
-							}
-						}
-						break;
-					}
-				} catch (error) {
-					if (resolvedPlugin) throw error;
-				}
-			}
-			if (!resolvedPlugin?.id || !resolvedPlugin?.version) {
-				consola.error("Could not extract plugin definition. Expected one of:\n  - createPlugin() export (native format)\n  - Descriptor factory function returning { id, version, ... } (standard format)");
-				process.exit(1);
-			}
-			const manifest = extractManifest(resolvedPlugin);
-			if (resolvedPlugin.admin?.entry) {
-				consola.error("Plugin declares adminEntry — React admin components require native/trusted mode. Use Block Kit for sandboxed admin pages, or remove adminEntry.");
-				process.exit(1);
-			}
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) {
-				consola.error("Plugin declares portableTextBlocks — these require native/trusted mode and cannot be bundled for the marketplace.");
-				process.exit(1);
-			}
-			consola.success(`Plugin: ${manifest.id}@${manifest.version}`);
-			consola.info(`  Capabilities: ${manifest.capabilities.length > 0 ? manifest.capabilities.join(", ") : "(none)"}`);
-			consola.info(`  Hooks: ${manifest.hooks.length > 0 ? manifest.hooks.map((h) => typeof h === "string" ? h : h.name).join(", ") : "(none)"}`);
-			consola.info(`  Routes: ${manifest.routes.length > 0 ? manifest.routes.map((r) => typeof r === "string" ? r : r.name).join(", ") : "(none)"}`);
-			const bundleDir = join(tmpDir, "bundle");
-			await mkdir(bundleDir, { recursive: true });
-			if (backendEntry) {
-				consola.start("Bundling backend...");
-				const shimDir = join(tmpDir, "shims");
-				await mkdir(shimDir, { recursive: true });
-				await writeFile(join(shimDir, "emdash.mjs"), "export const definePlugin = (d) => d;\n");
-				await build({
-					config: false,
-					entry: [backendEntry],
-					format: "esm",
-					outDir: join(tmpDir, "backend"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					alias: { emdash: join(shimDir, "emdash.mjs") },
-					minify: true,
-					treeshake: true
-				});
-				const backendBaseName = basename(backendEntry).replace(TS_EXT_RE, "");
-				const backendOutputPath = await findBuildOutput(join(tmpDir, "backend"), backendBaseName);
-				if (backendOutputPath) {
-					await copyFile(backendOutputPath, join(bundleDir, "backend.js"));
-					consola.success("Built backend.js");
-				} else {
-					consola.error("Backend build produced no output");
-					process.exit(1);
-				}
-			} else {
-				consola.warn("No sandbox entry found — bundle will have no backend.js");
-				consola.warn("  Add a \"sandbox-entry.ts\" in src/ or a \"./sandbox\" export in package.json");
-			}
-			if (adminEntry) {
-				consola.start("Bundling admin...");
-				await build({
-					config: false,
-					entry: [adminEntry],
-					format: "esm",
-					outDir: join(tmpDir, "admin"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					minify: true,
-					treeshake: true
-				});
-				const adminBaseName = basename(adminEntry).replace(TS_EXT_RE, "");
-				const adminOutputPath = await findBuildOutput(join(tmpDir, "admin"), adminBaseName);
-				if (adminOutputPath) {
-					await copyFile(adminOutputPath, join(bundleDir, "admin.js"));
-					consola.success("Built admin.js");
-				}
-			}
-			await writeFile(join(bundleDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-			consola.start("Collecting assets...");
-			const readmePath = join(pluginDir, "README.md");
-			if (await fileExists$1(readmePath)) {
-				await copyFile(readmePath, join(bundleDir, "README.md"));
-				consola.success("Included README.md");
-			}
-			const iconPath = join(pluginDir, "icon.png");
-			if (await fileExists$1(iconPath)) {
-				const dims = readImageDimensions(await readFile(iconPath));
-				if (!dims) consola.warn("icon.png is not a valid PNG — skipping");
-				else if (dims[0] !== ICON_SIZE || dims[1] !== ICON_SIZE) {
-					consola.warn(`icon.png is ${dims[0]}x${dims[1]}, expected ${ICON_SIZE}x${ICON_SIZE} — including anyway`);
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-				} else {
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-					consola.success("Included icon.png");
-				}
-			}
-			const screenshotsDir = join(pluginDir, "screenshots");
-			if (await fileExists$1(screenshotsDir)) {
-				const screenshotFiles = (await readdir(screenshotsDir)).filter((f) => {
-					const ext = extname(f).toLowerCase();
-					return ext === ".png" || ext === ".jpg" || ext === ".jpeg";
-				}).toSorted().slice(0, MAX_SCREENSHOTS);
-				if (screenshotFiles.length > 0) {
-					await mkdir(join(bundleDir, "screenshots"), { recursive: true });
-					for (const file of screenshotFiles) {
-						const filePath = join(screenshotsDir, file);
-						const dims = readImageDimensions(await readFile(filePath));
-						if (!dims) {
-							consola.warn(`screenshots/${file} — cannot read dimensions, skipping`);
-							continue;
-						}
-						if (dims[0] > MAX_SCREENSHOT_WIDTH || dims[1] > MAX_SCREENSHOT_HEIGHT) consola.warn(`screenshots/${file} is ${dims[0]}x${dims[1]}, max ${MAX_SCREENSHOT_WIDTH}x${MAX_SCREENSHOT_HEIGHT} — including anyway`);
-						await copyFile(filePath, join(bundleDir, "screenshots", file));
-					}
-					consola.success(`Included ${screenshotFiles.length} screenshot(s)`);
-				}
-			}
-			consola.start("Validating bundle...");
-			let hasErrors = false;
-			if (pkg.exports) for (const issue of findSourceExports(pkg.exports)) {
-				consola.error(`Export "${issue.exportPath}" points to source (${issue.resolvedPath}). Package exports must point to built files (e.g. dist/*.mjs). Add a build step and update the exports map.`);
-				hasErrors = true;
-			}
-			const backendPath = join(bundleDir, "backend.js");
-			if (await fileExists$1(backendPath)) {
-				const builtins = findNodeBuiltinImports(await readFile(backendPath, "utf-8"));
-				if (builtins.length > 0) {
-					consola.error(`backend.js imports Node.js built-in modules: ${builtins.join(", ")}`);
-					consola.error("Sandboxed plugins cannot use Node.js APIs");
-					hasErrors = true;
-				}
-			}
-			const declaresUnrestricted = manifest.capabilities.includes("network:request:unrestricted") || manifest.capabilities.includes("network:fetch:any");
-			const declaresHostRestricted = manifest.capabilities.includes("network:request") || manifest.capabilities.includes("network:fetch");
-			if (declaresUnrestricted) consola.warn("Plugin declares unrestricted network access (network:request:unrestricted) — it can make requests to any host");
-			else if (declaresHostRestricted && manifest.allowedHosts.length === 0) consola.warn("Plugin declares network:request capability but no allowedHosts — all requests will be blocked");
-			const deprecatedCaps = manifest.capabilities.filter(isDeprecatedCapability);
-			if (deprecatedCaps.length > 0) {
-				consola.warn("Plugin uses deprecated capability names. Rename them before publishing:");
-				for (const cap of deprecatedCaps) {
-					const replacement = CAPABILITY_RENAMES[cap];
-					consola.warn(`  ${cap} → ${replacement}`);
-				}
-			}
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) consola.warn("Plugin declares portableTextBlocks — these require trusted mode and will be ignored in sandboxed plugins");
-			if (resolvedPlugin.admin?.entry) consola.warn("Plugin declares admin.entry — custom React components require trusted mode. Use Block Kit for sandboxed admin pages");
-			if (resolvedPlugin.hooks["page:fragments"]) consola.warn("Plugin declares page:fragments hook — this is trusted-only and will not work in sandboxed mode");
-			const hasAdminPages = (manifest.admin?.pages?.length ?? 0) > 0;
-			const hasAdminWidgets = (manifest.admin?.widgets?.length ?? 0) > 0;
-			if (hasAdminPages || hasAdminWidgets) {
-				if (!manifest.routes.map((r) => typeof r === "string" ? r : r.name).includes("admin")) {
-					consola.error(`Plugin declares ${hasAdminPages ? "adminPages" : ""}${hasAdminPages && hasAdminWidgets ? " and " : ""}${hasAdminWidgets ? "adminWidgets" : ""} but the sandbox entry has no "admin" route. Add an admin route handler to serve Block Kit pages.`);
-					hasErrors = true;
-				}
-			}
-			const bundleEntries = await collectBundleEntries(bundleDir);
-			const sizeViolations = validateBundleSize(bundleEntries);
-			if (sizeViolations.length > 0) {
-				for (const v of sizeViolations) consola.error(v);
-				hasErrors = true;
-			} else consola.info(`Bundle size: ${formatBytes$1(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`);
-			if (hasErrors) {
-				consola.error("Bundle validation failed");
-				process.exit(1);
-			}
-			consola.success("Validation passed");
-			if (validateOnly) return;
-			await mkdir(outDir, { recursive: true });
-			const tarballName = `${manifest.id.replace(SLASH_RE, "-").replace(LEADING_AT_RE, "")}-${manifest.version}.tar.gz`;
-			const tarballPath = join(outDir, tarballName);
-			consola.start("Creating tarball...");
-			await createTarball(bundleDir, tarballPath);
-			const tarballSizeKB = ((await stat(tarballPath)).size / 1024).toFixed(1);
-			const tarballBuf = await readFile(tarballPath);
-			const checksum = createHash("sha256").update(tarballBuf).digest("hex");
-			consola.success(`Created ${tarballName} (${tarballSizeKB}KB)`);
-			consola.info(`  SHA-256: ${checksum}`);
-			consola.info(`  Path: ${tarballPath}`);
-		} finally {
-			if (tmpDir.endsWith(".emdash-bundle-tmp")) await rm(tmpDir, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-});
-
-//#endregion
-//#region src/cli/commands/plugin-init.ts
-/**
-* emdash plugin init
-*
-* Scaffold a new EmDash plugin. Generates the sandboxed-format boilerplate:
-*   src/index.ts         -- descriptor factory
-*   src/sandbox-entry.ts -- definePlugin({ hooks, routes })
-*   package.json
-*   tsconfig.json
-*
-* Use --format=native (or --native) to generate native-format boilerplate
-* instead (createPlugin + React admin). When neither is passed and stdout
-* is a TTY, the user is prompted to choose.
-*
-*/
-const SLUG_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
-const SCOPE_RE = /^@[^/]+\//;
-const pluginInitCommand = defineCommand({
-	meta: {
-		name: "init",
-		description: "Scaffold a new plugin"
-	},
-	args: {
-		dir: {
-			type: "string",
-			description: "Directory to create the plugin in (default: current directory)",
-			default: "."
-		},
-		name: {
-			type: "string",
-			description: "Plugin name/id (e.g. my-plugin or @org/my-plugin)"
-		},
-		format: {
-			type: "string",
-			description: "Plugin format: sandboxed or native. Prompts when running interactively if not set.",
-			valueHint: "sandboxed|native"
-		},
-		native: {
-			type: "boolean",
-			description: "Shortcut for --format=native",
-			default: false
-		}
-	},
-	async run({ args }) {
-		const targetDir = resolve(args.dir);
-		const format = await resolveFormat(args.format, args.native);
-		if (!format) {
-			consola.info("Cancelled");
-			return;
-		}
-		const isNative = format === "native";
-		let pluginName = args.name || basename(targetDir);
-		if (!pluginName || pluginName === ".") pluginName = basename(resolve("."));
-		const slug = pluginName.replace(SCOPE_RE, "");
-		if (!SLUG_RE.test(slug)) {
-			consola.error(`Invalid plugin name "${pluginName}". Use lowercase letters, numbers, and hyphens (e.g. my-plugin).`);
-			process.exit(1);
-		}
-		const srcDir = join(targetDir, "src");
-		if (await fileExists$1(join(targetDir, "package.json"))) {
-			consola.error(`package.json already exists in ${targetDir}`);
-			process.exit(1);
-		}
-		consola.start(`Scaffolding ${isNative ? "native" : "sandboxed"} plugin: ${pluginName}`);
-		await mkdir(srcDir, { recursive: true });
-		if (isNative) await scaffoldNative(targetDir, srcDir, pluginName, slug);
-		else await scaffoldStandard(targetDir, srcDir, pluginName, slug);
-		consola.success(`Plugin scaffolded in ${targetDir}`);
-		consola.info("Next steps:");
-		const steps = [];
-		if (args.dir !== ".") steps.push(`cd ${args.dir}`);
-		steps.push("pnpm install");
-		steps.push(isNative ? "Edit src/index.ts to add hooks and routes" : "Edit src/sandbox-entry.ts to add hooks and routes");
-		steps.push("pnpm build");
-		if (!isNative) steps.push("emdash plugin validate --dir .");
-		steps.forEach((step, i) => consola.info(`  ${i + 1}. ${step}`));
-	}
-});
-async function resolveFormat(formatArg, nativeFlag) {
-	if (formatArg) {
-		const normalized = formatArg.toLowerCase();
-		let parsed;
-		if (normalized === "native") parsed = "native";
-		else if (normalized === "sandboxed" || normalized === "standard") parsed = "standard";
-		else {
-			consola.error(`Invalid --format "${formatArg}". Use "sandboxed" or "native".`);
-			process.exit(1);
-		}
-		if (nativeFlag && parsed !== "native") {
-			consola.error(`Conflicting flags: --native and --format=${formatArg}. Pass only one.`);
-			process.exit(1);
-		}
-		return parsed;
-	}
-	if (nativeFlag) return "native";
-	if (!process.stdout.isTTY) return "standard";
-	const choice = await consola.prompt("Which plugin format?", {
-		type: "select",
-		initial: "standard",
-		options: [{
-			label: "Sandboxed",
-			value: "standard",
-			hint: "runs in an isolated sandbox; safe to install from the marketplace"
-		}, {
-			label: "Native",
-			value: "native",
-			hint: "full runtime access; install from npm"
-		}],
-		cancel: "null"
-	});
-	if (choice === null) return null;
-	return choice;
-}
-function camelCase(slug) {
-	return slug.split("-").map((s, i) => i === 0 ? s : s[0].toUpperCase() + s.slice(1)).join("");
-}
-function pascalCase(slug) {
-	return slug.split("-").map((s) => s[0].toUpperCase() + s.slice(1)).join("");
-}
-const TSCONFIG = {
-	compilerOptions: {
-		target: "ES2022",
-		module: "preserve",
-		moduleResolution: "bundler",
-		strict: true,
-		esModuleInterop: true,
-		declaration: true,
-		outDir: "./dist",
-		rootDir: "./src"
-	},
-	include: ["src/**/*"],
-	exclude: ["node_modules", "dist"]
-};
-const TSDOWN_VERSION = "^0.20.0";
-const TYPESCRIPT_VERSION = "^5.9.0";
-async function scaffoldStandard(targetDir, srcDir, pluginName, slug) {
-	const fnName = camelCase(slug);
-	await writeFile(join(targetDir, "package.json"), JSON.stringify({
-		name: pluginName,
-		version: "0.1.0",
-		type: "module",
-		main: "./dist/index.mjs",
-		exports: {
-			".": {
-				types: "./dist/index.d.mts",
-				import: "./dist/index.mjs"
-			},
-			"./sandbox": {
-				types: "./dist/sandbox-entry.d.mts",
-				import: "./dist/sandbox-entry.mjs"
-			}
-		},
-		files: ["dist"],
-		scripts: {
-			build: "tsdown src/index.ts src/sandbox-entry.ts --format esm --dts --clean",
-			dev: "tsdown src/index.ts src/sandbox-entry.ts --format esm --dts --watch",
-			typecheck: "tsc --noEmit"
-		},
-		keywords: ["emdash", "emdash-plugin"],
-		license: "MIT",
-		peerDependencies: { emdash: "*" },
-		devDependencies: {
-			emdash: "*",
-			tsdown: TSDOWN_VERSION,
-			typescript: TYPESCRIPT_VERSION
-		}
-	}, null, "	") + "\n");
-	await writeFile(join(targetDir, "tsconfig.json"), JSON.stringify(TSCONFIG, null, "	") + "\n");
-	await writeFile(join(srcDir, "index.ts"), `import type { PluginDescriptor } from "emdash";
-
-export function ${fnName}Plugin(): PluginDescriptor {
-\treturn {
-\t\tid: "${slug}",
-\t\tversion: "0.1.0",
-\t\tformat: "standard",
-\t\tentrypoint: "${pluginName}/sandbox",
-
-\t\tcapabilities: ["content:read"],
-\t\tstorage: {
-\t\t\tevents: { indexes: ["timestamp"] },
-\t\t},
-\t};
-}
-`);
-	await writeFile(join(srcDir, "sandbox-entry.ts"), `import { definePlugin } from "emdash";
-import type { PluginContext } from "emdash";
-
-interface ContentSaveEvent {
-\tcollection: string;
-\tcontent: { id: string };
-\tisNew: boolean;
-}
-
-export default definePlugin({
-\thooks: {
-\t\t"content:afterSave": {
-\t\t\thandler: async (event: ContentSaveEvent, ctx: PluginContext) => {
-\t\t\t\tctx.log.info("Content saved", {
-\t\t\t\t\tcollection: event.collection,
-\t\t\t\t\tid: event.content.id,
-\t\t\t\t});
-
-\t\t\t\tawait ctx.storage.events.put(\`save-\${Date.now()}\`, {
-\t\t\t\t\ttimestamp: new Date().toISOString(),
-\t\t\t\t\tcollection: event.collection,
-\t\t\t\t\tcontentId: event.content.id,
-\t\t\t\t});
-\t\t\t},
-\t\t},
-\t},
-
-\troutes: {
-\t\trecent: {
-\t\t\thandler: async (_routeCtx, ctx: PluginContext) => {
-\t\t\t\tconst result = await ctx.storage.events.query({
-\t\t\t\t\torderBy: { timestamp: "desc" },
-\t\t\t\t\tlimit: 10,
-\t\t\t\t});
-\t\t\t\treturn { events: result.items };
-\t\t\t},
-\t\t},
-\t},
-});
-`);
-}
-async function scaffoldNative(targetDir, srcDir, pluginName, slug) {
-	const fnName = camelCase(slug);
-	const typeName = pascalCase(slug);
-	await writeFile(join(targetDir, "package.json"), JSON.stringify({
-		name: pluginName,
-		version: "0.1.0",
-		type: "module",
-		main: "./dist/index.mjs",
-		exports: { ".": {
-			types: "./dist/index.d.mts",
-			import: "./dist/index.mjs"
-		} },
-		files: ["dist"],
-		scripts: {
-			build: "tsdown src/index.ts --format esm --dts --clean",
-			dev: "tsdown src/index.ts --format esm --dts --watch",
-			typecheck: "tsc --noEmit"
-		},
-		keywords: ["emdash", "emdash-plugin"],
-		license: "MIT",
-		peerDependencies: { emdash: "*" },
-		devDependencies: {
-			emdash: "*",
-			tsdown: TSDOWN_VERSION,
-			typescript: TYPESCRIPT_VERSION
-		}
-	}, null, "	") + "\n");
-	await writeFile(join(targetDir, "tsconfig.json"), JSON.stringify(TSCONFIG, null, "	") + "\n");
-	await writeFile(join(srcDir, "index.ts"), `import { definePlugin } from "emdash";
-import type { PluginDescriptor } from "emdash";
-
-export interface ${typeName}Options {
-\tenabled?: boolean;
-}
-
-export function ${fnName}Plugin(options: ${typeName}Options = {}): PluginDescriptor<${typeName}Options> {
-\treturn {
-\t\tid: "${slug}",
-\t\tversion: "0.1.0",
-\t\tformat: "native",
-\t\tentrypoint: "${pluginName}",
-\t\toptions,
-\t};
-}
-
-export function createPlugin(options: ${typeName}Options = {}) {
-\treturn definePlugin({
-\t\tid: "${slug}",
-\t\tversion: "0.1.0",
-
-\t\tcapabilities: ["content:read"],
-\t\tstorage: {
-\t\t\tevents: { indexes: ["createdAt"] },
-\t\t},
-
-\t\thooks: {
-\t\t\t"content:afterSave": async (event, ctx) => {
-\t\t\t\tif (options.enabled === false) return;
-\t\t\t\tawait ctx.storage.events.put(\`evt_\${Date.now()}\`, {
-\t\t\t\t\tcollection: event.collection,
-\t\t\t\t\tcontentId: event.content.id,
-\t\t\t\t\tcreatedAt: new Date().toISOString(),
-\t\t\t\t});
-\t\t\t},
-\t\t},
-
-\t\troutes: {
-\t\t\trecent: {
-\t\t\t\thandler: async (ctx) => {
-\t\t\t\t\tconst result = await ctx.storage.events.query({
-\t\t\t\t\t\torderBy: { createdAt: "desc" },
-\t\t\t\t\t\tlimit: 10,
-\t\t\t\t\t});
-\t\t\t\t\treturn { events: result.items };
-\t\t\t\t},
-\t\t\t},
-\t\t},
-\t});
-}
-
-export default createPlugin;
-`);
-}
-
-//#endregion
-//#region src/cli/commands/plugin-validate.ts
-/**
-* emdash plugin validate
-*
-* Runs bundle validation without producing a tarball.
-* Thin wrapper around `emdash plugin bundle --validate-only`.
-*
-*/
-const pluginValidateCommand = defineCommand({
-	meta: {
-		name: "validate",
-		description: "Validate a plugin without producing a tarball (same checks as bundle)"
-	},
-	args: { dir: {
-		type: "string",
-		description: "Plugin directory (default: current directory)",
-		default: "."
-	} },
-	async run({ args }) {
-		await runCommand(bundleCommand, { rawArgs: [
-			"--dir",
-			args.dir,
-			"--validateOnly"
-		] });
-	}
-});
-
-//#endregion
-//#region src/cli/commands/publish.ts
-/**
-* emdash plugin publish
-*
-* Publishes a plugin tarball to the EmDash Marketplace.
-*
-* Flow:
-* 1. Resolve tarball (from --tarball path, or build via `emdash plugin bundle`)
-* 2. Read manifest.json from tarball to show summary
-* 3. Authenticate (stored credential or GitHub device flow)
-* 4. Pre-publish validation (check plugin exists, version not published)
-* 5. Upload via multipart POST
-* 6. Display audit results
-*/
-const DEFAULT_REGISTRY = "https://marketplace.emdashcms.com";
-/**
-* Authenticate with the marketplace via GitHub Device Flow.
-* Returns the marketplace JWT and author info.
-*/
-async function authenticateViaDeviceFlow(registryUrl) {
-	consola.start("Fetching auth configuration...");
-	const discoveryRes = await fetch(new URL("/api/v1/auth/discovery", registryUrl));
-	if (!discoveryRes.ok) throw new Error(`Marketplace unreachable: ${discoveryRes.status} ${discoveryRes.statusText}`);
-	const discovery = await discoveryRes.json();
-	const deviceRes = await fetch(discovery.github.deviceAuthorizationEndpoint, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			Accept: "application/json"
-		},
-		body: JSON.stringify({
-			client_id: discovery.github.clientId,
-			scope: "read:user user:email"
-		})
-	});
-	if (!deviceRes.ok) throw new Error(`GitHub device flow failed: ${deviceRes.status}`);
-	const deviceCode = await deviceRes.json();
-	console.log();
-	consola.info("Open your browser to:");
-	console.log(`  ${pc.cyan(pc.bold(deviceCode.verification_uri))}`);
-	console.log();
-	consola.info(`Enter code: ${pc.yellow(pc.bold(deviceCode.user_code))}`);
-	console.log();
-	try {
-		const { execFile } = await import("node:child_process");
-		if (process.platform === "darwin") execFile("open", [deviceCode.verification_uri]);
-		else if (process.platform === "win32") execFile("cmd", [
-			"/c",
-			"start",
-			"",
-			deviceCode.verification_uri
-		]);
-		else execFile("xdg-open", [deviceCode.verification_uri]);
-	} catch {}
-	consola.start("Waiting for authorization...");
-	const githubToken = await pollGitHubDeviceFlow(discovery.github.tokenEndpoint, discovery.github.clientId, deviceCode.device_code, deviceCode.interval, deviceCode.expires_in);
-	consola.start("Authenticating with marketplace...");
-	const deviceTokenUrl = new URL(discovery.marketplace.deviceTokenEndpoint, registryUrl);
-	const authRes = await fetch(deviceTokenUrl, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ access_token: githubToken })
-	});
-	if (!authRes.ok) {
-		const body = await authRes.json().catch(() => ({}));
-		throw new Error(`Marketplace auth failed: ${body.error ?? authRes.statusText}`);
-	}
-	return await authRes.json();
-}
-async function pollGitHubDeviceFlow(tokenEndpoint, clientId, deviceCode, interval, expiresIn) {
-	const deadline = Date.now() + expiresIn * 1e3;
-	let currentInterval = interval;
-	while (Date.now() < deadline) {
-		await new Promise((r) => setTimeout(r, currentInterval * 1e3));
-		const body = await (await fetch(tokenEndpoint, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Accept: "application/json"
-			},
-			body: JSON.stringify({
-				client_id: clientId,
-				device_code: deviceCode,
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-			})
-		})).json();
-		if (body.access_token) return body.access_token;
-		if (body.error === "authorization_pending") continue;
-		if (body.error === "slow_down") {
-			currentInterval = body.interval ?? currentInterval + 5;
-			continue;
-		}
-		if (body.error === "expired_token") throw new Error("Device code expired. Please try again.");
-		if (body.error === "access_denied") throw new Error("Authorization was denied.");
-		throw new Error(`GitHub token exchange failed: ${body.error ?? "unknown error"}`);
-	}
-	throw new Error("Device code expired (timeout). Please try again.");
-}
-const manifestSummarySchema = pluginManifestBaseSchema.pick({
-	id: true,
-	version: true,
-	capabilities: true,
-	allowedHosts: true
-});
-/**
-* Read manifest.json from a tarball without fully extracting it.
-*/
-async function readManifestFromTarball(tarballPath) {
-	const data = await readFile(tarballPath);
-	const manifest = (await unpackTar(new ReadableStream({ start(controller) {
-		controller.enqueue(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
-		controller.close();
-	} }).pipeThrough(createGzipDecoder()), { filter: (header) => header.name === "manifest.json" })).find((e) => e.header.name === "manifest.json");
-	if (!manifest?.data) throw new Error("Tarball does not contain manifest.json");
-	const content = new TextDecoder().decode(manifest.data);
-	const parsed = JSON.parse(content);
-	const result = manifestSummarySchema.safeParse(parsed);
-	if (!result.success) throw new Error(`Invalid manifest.json: ${result.error.message}`);
-	return result.data;
-}
-const POLL_INTERVAL_MS = 3e3;
-const POLL_TIMEOUT_MS = 12e4;
-/**
-* Poll the version endpoint until status leaves "pending" or timeout.
-* Returns the final version data, or null on timeout.
-*/
-async function pollVersionStatus(versionUrl, token) {
-	const deadline = Date.now() + POLL_TIMEOUT_MS;
-	while (Date.now() < deadline) {
-		await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-		try {
-			const res = await fetch(versionUrl, { headers: { Authorization: `Bearer ${token}` } });
-			if (!res.ok) continue;
-			const data = await res.json();
-			if (data.status !== "pending") return data;
-		} catch {}
-	}
-	return null;
-}
-function displayAuditResults(version) {
-	const statusColor = version.status === "published" ? pc.green : version.status === "flagged" ? pc.yellow : pc.red;
-	consola.info(`  Status: ${statusColor(version.status)}`);
-	if (version.audit_verdict) {
-		const verdictColor = version.audit_verdict === "pass" ? pc.green : version.audit_verdict === "warn" ? pc.yellow : pc.red;
-		consola.info(`  Audit: ${verdictColor(version.audit_verdict)}`);
-	}
-	if (version.image_audit_verdict) {
-		const verdictColor = version.image_audit_verdict === "pass" ? pc.green : version.image_audit_verdict === "warn" ? pc.yellow : pc.red;
-		consola.info(`  Image audit: ${verdictColor(version.image_audit_verdict)}`);
-	}
-}
-function displayInlineAuditResults(audit, imageAudit) {
-	const verdictColor = audit.verdict === "pass" ? pc.green : audit.verdict === "warn" ? pc.yellow : pc.red;
-	consola.info(`  Audit: ${verdictColor(audit.verdict)} (risk: ${audit.riskScore}/100)`);
-	if (audit.findings.length > 0) for (const finding of audit.findings) {
-		const icon = finding.severity === "high" ? pc.red("!") : pc.yellow("~");
-		consola.info(`    ${icon} [${finding.category}] ${finding.description}`);
-	}
-	if (imageAudit) {
-		const imgColor = imageAudit.verdict === "pass" ? pc.green : imageAudit.verdict === "warn" ? pc.yellow : pc.red;
-		consola.info(`  Image audit: ${imgColor(imageAudit.verdict)}`);
-	}
-}
-const publishCommand = defineCommand({
-	meta: {
-		name: "publish",
-		description: "Publish a plugin to the EmDash Marketplace"
-	},
-	args: {
-		tarball: {
-			type: "string",
-			description: "Path to plugin tarball (default: build first via `emdash plugin bundle`)"
-		},
-		dir: {
-			type: "string",
-			description: "Plugin directory (used with --build, default: current directory)",
-			default: process.cwd()
-		},
-		build: {
-			type: "boolean",
-			description: "Build the plugin before publishing",
-			default: false
-		},
-		registry: {
-			type: "string",
-			description: "Marketplace registry URL",
-			default: DEFAULT_REGISTRY
-		},
-		"no-wait": {
-			type: "boolean",
-			description: "Exit immediately after upload without waiting for audit (useful for CI)",
-			default: false
-		}
-	},
-	async run({ args }) {
-		const registryUrl = args.registry;
-		let tarballPath;
-		if (args.tarball) tarballPath = resolve(args.tarball);
-		else if (args.build) {
-			consola.start("Building plugin...");
-			const pluginDir = resolve(args.dir);
-			try {
-				const { runCommand } = await import("citty");
-				const { bundleCommand } = await Promise.resolve().then(() => bundle_exports);
-				await runCommand(bundleCommand, { rawArgs: ["--dir", pluginDir] });
-			} catch {
-				consola.error("Build failed");
-				process.exit(1);
-			}
-			const { readdir } = await import("node:fs/promises");
-			const distDir = resolve(pluginDir, "dist");
-			const tarball = (await readdir(distDir)).find((f) => f.endsWith(".tar.gz"));
-			if (!tarball) {
-				consola.error("Build succeeded but no .tar.gz found in dist/");
-				process.exit(1);
-			}
-			tarballPath = resolve(distDir, tarball);
-		} else {
-			const pluginDir = resolve(args.dir);
-			const { readdir } = await import("node:fs/promises");
-			try {
-				const distDir = resolve(pluginDir, "dist");
-				const tarball = (await readdir(distDir)).find((f) => f.endsWith(".tar.gz"));
-				if (tarball) tarballPath = resolve(distDir, tarball);
-				else {
-					consola.error("No tarball found. Run `emdash plugin bundle` first or use --build.");
-					process.exit(1);
-				}
-			} catch {
-				consola.error("No dist/ directory found. Run `emdash plugin bundle` first or use --build.");
-				process.exit(1);
-			}
-		}
-		const sizeKB = ((await stat(tarballPath)).size / 1024).toFixed(1);
-		consola.info(`Tarball: ${pc.dim(tarballPath)} (${sizeKB}KB)`);
-		const manifest = await readManifestFromTarball(tarballPath);
-		console.log();
-		consola.info(`Plugin: ${pc.bold(`${manifest.id}@${manifest.version}`)}`);
-		if (manifest.capabilities.length > 0) consola.info(`Capabilities: ${manifest.capabilities.join(", ")}`);
-		if (manifest.allowedHosts?.length) consola.info(`Allowed hosts: ${manifest.allowedHosts.join(", ")}`);
-		console.log();
-		const deprecatedCaps = manifest.capabilities.filter(isDeprecatedCapability);
-		if (deprecatedCaps.length > 0) {
-			consola.error("Plugin declares deprecated capability names. Rename them and re-bundle before publishing:");
-			for (const cap of deprecatedCaps) {
-				const replacement = CAPABILITY_RENAMES[cap];
-				consola.error(`  ${cap} → ${replacement}`);
-			}
-			consola.error("See https://emdashcms.com/docs/plugins/overview#capabilities for the full rename table.");
-			process.exit(1);
-		}
-		let token;
-		const envToken = process.env.EMDASH_MARKETPLACE_TOKEN;
-		const stored = !envToken ? getMarketplaceCredential(registryUrl) : null;
-		if (envToken) {
-			token = envToken;
-			consola.info("Using EMDASH_MARKETPLACE_TOKEN for authentication");
-		} else if (stored) {
-			token = stored.token;
-			consola.info(`Authenticated as ${pc.bold(stored.author?.name ?? "unknown")}`);
-		} else {
-			consola.info("Not logged in to marketplace. Starting GitHub authentication...");
-			const result = await authenticateViaDeviceFlow(registryUrl);
-			token = result.token;
-			saveMarketplaceCredential(registryUrl, {
-				token: result.token,
-				expiresAt: new Date(Date.now() + 30 * 86400 * 1e3).toISOString(),
-				author: {
-					id: result.author.id,
-					name: result.author.name
-				}
-			});
-			consola.success(`Authenticated as ${pc.bold(result.author.name)}`);
-		}
-		consola.start("Checking marketplace...");
-		const pluginRes = await fetch(new URL(`/api/v1/plugins/${manifest.id}`, registryUrl));
-		if (pluginRes.status === 404 && !envToken) {
-			consola.info(`Plugin ${pc.bold(manifest.id)} not found in marketplace. Registering...`);
-			const createRes = await fetch(new URL("/api/v1/plugins", registryUrl), {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					Authorization: `Bearer ${token}`
-				},
-				body: JSON.stringify({
-					id: manifest.id,
-					name: manifest.id,
-					capabilities: manifest.capabilities
-				})
-			});
-			if (!createRes.ok) {
-				const body = await createRes.json().catch(() => ({}));
-				if (createRes.status === 401) {
-					removeMarketplaceCredential(registryUrl);
-					consola.error("Authentication expired. Please run `emdash plugin publish` again to re-authenticate.");
-					process.exit(1);
-				}
-				consola.error(`Failed to register plugin: ${body.error ?? createRes.statusText}`);
-				process.exit(1);
-			}
-			consola.success(`Registered ${pc.bold(manifest.id)}`);
-		} else if (pluginRes.status === 404 && envToken) consola.info(`Plugin ${pc.bold(manifest.id)} will be auto-registered on publish`);
-		else if (!pluginRes.ok) {
-			consola.error(`Marketplace error: ${pluginRes.status}`);
-			process.exit(1);
-		}
-		consola.start(`Publishing ${manifest.id}@${manifest.version}...`);
-		const tarballData = await readFile(tarballPath);
-		const formData = new FormData();
-		formData.append("bundle", new Blob([tarballData], { type: "application/gzip" }), basename(tarballPath));
-		const uploadUrl = new URL(`/api/v1/plugins/${manifest.id}/versions`, registryUrl);
-		const uploadRes = await fetch(uploadUrl, {
-			method: "POST",
-			headers: { Authorization: `Bearer ${token}` },
-			body: formData
-		});
-		if (!uploadRes.ok && uploadRes.status !== 202) {
-			const body = await uploadRes.json().catch(() => ({}));
-			if (uploadRes.status === 401) {
-				if (envToken) consola.error("EMDASH_MARKETPLACE_TOKEN was rejected by the marketplace.");
-				else {
-					removeMarketplaceCredential(registryUrl);
-					consola.error("Authentication expired. Please run `emdash plugin publish` again.");
-				}
-				process.exit(1);
-			}
-			if (uploadRes.status === 409) {
-				if (body.latestVersion) consola.error(`Version ${manifest.version} must be greater than ${body.latestVersion}`);
-				else consola.error(body.error ?? "Version conflict");
-				process.exit(1);
-			}
-			if (uploadRes.status === 422 && body.audit) {
-				consola.error("Plugin failed security audit:");
-				consola.error(`  Verdict: ${pc.red(body.audit.verdict)}`);
-				consola.error(`  Summary: ${body.audit.summary}`);
-				process.exit(1);
-			}
-			consola.error(`Publish failed: ${body.error ?? uploadRes.statusText}`);
-			process.exit(1);
-		}
-		const result = await uploadRes.json();
-		console.log();
-		consola.success(`Uploaded ${pc.bold(`${manifest.id}@${result.version}`)}`);
-		consola.info(`  Checksum: ${pc.dim(result.checksum)}`);
-		consola.info(`  Size: ${(result.bundleSize / 1024).toFixed(1)}KB`);
-		if (uploadRes.status === 202) {
-			consola.info(`  Status: ${pc.yellow("pending")} (audit running in background)`);
-			if (args["no-wait"]) {
-				consola.info("Skipping audit wait (--no-wait). Check status later.");
-				console.log();
-				return;
-			}
-			consola.start("Waiting for security audit to complete...");
-			const versionUrl = new URL(`/api/v1/plugins/${manifest.id}/versions/${manifest.version}`, registryUrl);
-			const finalStatus = await pollVersionStatus(versionUrl.toString(), token);
-			if (finalStatus) displayAuditResults(finalStatus);
-			else {
-				consola.warn("Audit did not complete within timeout. Check status later with:");
-				consola.info(`  ${pc.dim(`curl ${versionUrl.toString()}`)}`);
-			}
-		} else {
-			if (result.audit) displayInlineAuditResults(result.audit, result.imageAudit ?? null);
-			consola.info(`  Status: ${pc.green(result.status ?? "published")}`);
-		}
-		console.log();
-	}
-});
-const marketplaceLoginCommand = defineCommand({
-	meta: {
-		name: "login",
-		description: "Log in to the EmDash Marketplace via GitHub"
-	},
-	args: { registry: {
-		type: "string",
-		description: "Marketplace registry URL",
-		default: DEFAULT_REGISTRY
-	} },
-	async run({ args }) {
-		const registryUrl = args.registry;
-		const existing = getMarketplaceCredential(registryUrl);
-		if (existing) {
-			consola.info(`Already logged in as ${pc.bold(existing.author?.name ?? "unknown")}`);
-			consola.info("Use `emdash plugin logout` to log out first.");
-			return;
-		}
-		const result = await authenticateViaDeviceFlow(registryUrl);
-		saveMarketplaceCredential(registryUrl, {
-			token: result.token,
-			expiresAt: new Date(Date.now() + 30 * 86400 * 1e3).toISOString(),
-			author: {
-				id: result.author.id,
-				name: result.author.name
-			}
-		});
-		consola.success(`Logged in as ${pc.bold(result.author.name)}`);
-	}
-});
-const marketplaceLogoutCommand = defineCommand({
-	meta: {
-		name: "logout",
-		description: "Log out of the EmDash Marketplace"
-	},
-	args: { registry: {
-		type: "string",
-		description: "Marketplace registry URL",
-		default: DEFAULT_REGISTRY
-	} },
-	async run({ args }) {
-		if (removeMarketplaceCredential(args.registry)) consola.success("Logged out of marketplace.");
-		else consola.info("No marketplace credentials found.");
-	}
-});
-
-//#endregion
-//#region src/cli/commands/plugin.ts
-/**
-* emdash plugin
-*
-* Plugin management commands grouped under a single namespace.
-*
-* Subcommands:
-* - init: Scaffold a new plugin
-* - bundle: Bundle a plugin for marketplace distribution
-* - validate: Run bundle validation without producing a tarball
-* - publish: Publish a plugin to the marketplace
-* - login: Log in to the marketplace via GitHub
-* - logout: Log out of the marketplace
-*
-*/
-const pluginCommand = defineCommand({
-	meta: {
-		name: "plugin",
-		description: "Manage plugins"
-	},
-	subCommands: {
-		init: pluginInitCommand,
-		bundle: bundleCommand,
-		validate: pluginValidateCommand,
-		publish: publishCommand,
-		login: marketplaceLoginCommand,
-		logout: marketplaceLogoutCommand
-	}
-});
-
 //#endregion
 //#region src/cli/commands/schema.ts
 /**
@@ -5287,6 +4047,7 @@ const seedCommand = defineCommand({
 		};
 		consola.start("Applying seed...");
 		try {
+			await claimExplicitSeedOwnership(db, seed);
 			const result = await applySeed(db, seed, options);
 			consola.success("Seed applied successfully!");
 			consola.log("");
@@ -6884,7 +5645,6 @@ runMain(defineCommand({
 		search: searchCommand,
 		taxonomy: taxonomyCommand,
 		menu: menuCommand,
-		plugin: pluginCommand,
 		site: siteCommand
 	}
 }));