first commit

core/modules/media/css/filter.caption.css

@@ -0,0 +1,10 @@
+/**
+ * @file
+ * Caption filter: default styling for displaying Media Embed captions.
+ */
+
+.caption .media .field,
+.caption .media .field * {
+  float: none;
+  margin: unset;
+}

core/modules/media/css/media.icon.theme.css

@@ -0,0 +1,10 @@
+/*
+ * DO NOT EDIT THIS FILE.
+ * See the following change record for more information,
+ * https://www.drupal.org/node/3084859
+ * @preserve
+ */
+/* cspell:ignore uientity referencemedia */
+.field-icon-field-uientity-referencemedia {
+  background-image: url("data:image/svg+xml,%3csvg height='36' viewBox='0 0 36 36' width='36' xmlns='http://www.w3.org/2000/svg'%3e%3cpath d='m1.02 11.52v10.5h17.46v5.203l-.495-.198a4.21 4.21 0 0 0 -2.493-.23c-.951.194-1.625.559-2.324 1.258-.989.988-1.371 2.274-1.049 3.531.171.672.441 1.137.96 1.658.74.741 1.733 1.138 2.846 1.138 2.017-.002 3.781-1.311 4.26-3.162.082-.317.095-.954.095-4.781v-4.416l2.355-.015 2.355-.016.016-3.06.015-3.06 3.855-.858c2.12-.472 3.874-.857 3.899-.855.05.003.063 11.043.013 11.043-.018 0-.161-.066-.319-.146-.669-.339-1.648-.461-2.5-.313a4.415 4.415 0 0 0 -2.489 1.3c-1.49 1.513-1.514 3.723-.058 5.169.774.768 1.682 1.127 2.853 1.129 1.701.003 3.245-.922 3.957-2.369.4-.812.375-.108.409-11.535.029-9.661.024-10.395-.069-10.395-.055 0-2.21.472-4.79 1.05-2.579.578-4.706 1.05-4.726 1.05s-.036-2.052-.036-4.56v-4.56h-24v10.5m21.96-4.715v3.805l-.555.125-2.265.511-1.71.385-.15-.133-.707-.634c-.306-.275-.565-.49-.575-.477s-1.309 2.03-2.887 4.483l-2.87 4.46-.905-.89-1.85-1.818-.944-.929-.256.243-4.081 3.857-.225.211v-17.004h19.98zm-15.69-2.415c-.545.102-1.263.499-1.703.94-.696.699-1.027 1.507-1.027 2.51 0 1.932 1.531 3.45 3.48 3.45a3.453 3.453 0 0 0 3.479-3.472c.001-.606-.09-.989-.378-1.578-.682-1.399-2.248-2.151-3.851-1.85' fill='%2355565b'/%3e%3c/svg%3e");
+}

core/modules/media/css/media.icon.theme.pcss.css

@@ -0,0 +1,4 @@
+/* cspell:ignore uientity referencemedia */
+.field-icon-field-uientity-referencemedia {
+  background-image: url(../../../misc/icons/55565b/media.svg);
+}

core/modules/media/css/oembed.formatter.css

@@ -0,0 +1,5 @@
+.media-oembed-content {
+  max-width: 100%;
+  border: none;
+  background-color: transparent;
+}

core/modules/media/css/oembed.frame.css

@@ -0,0 +1,8 @@
+iframe {
+  position: absolute;
+  top: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  margin: 0;
+}

core/modules/media/help_topics/media.media_type.html.twig

@@ -0,0 +1,26 @@
+---
+label: 'Adding a new media type'
+related:
+  - core.media
+  - field_ui.add_field
+  - field_ui.reference_field
+---
+{% set content_structure_topic = render_var(help_topic_link('core.content_structure')) %}
+{% set media_topic = render_var(help_topic_link('core.media')) %}
+{% set media_text %}{% trans %}Media types{% endtrans %}{% endset %}
+{% set media_link = render_var(help_route_link(media_text, 'entity.media_type.collection')) %}
+<h2>{% trans %}Goal{% endtrans %}</h2>
+<p>{% trans %}Add a new media type that can be referenced in Media reference fields; media types are a content entity type. See {{ media_topic }} for an overview of media items and media types, and {{ content_structure_topic }} for more information on content entities and fields.{% endtrans %}</p>
+<h2>{% trans %}Steps{% endtrans %}</h2>
+<ol>
+  <li>{% trans %}In the <em>Manage</em> administrative menu, navigate to <em>Structure</em> &gt; {{ media_link }}.{% endtrans %}</li>
+  <li>{% trans %}If there is not already a media type for the type of media you want to use on your site, click <em>Add media type</em>.{% endtrans %}</li>
+  <li>{% trans %}Enter a <em>Name</em> and <em>Description</em> for your media type, and select the <em>Media source</em>.{% endtrans %}</li>
+  <li>{% trans %}For most media sources, there is additional information that will need to be stored with your media item, in a field on your media type. Under <em>Media source configuration</em>, select an existing field to re-use to store this information, or select <em> - Create -</em> to create a new field.{% endtrans %}</li>
+  <li>{% trans %}Note the types of metadata in the <em>Field mapping</em> section that can be mapped to fields on your media type.{% endtrans %}</li>
+  <li>{% trans %}Click <em>Save</em>.{% endtrans %}</li>
+  <li>{% trans %}Optionally, add additional fields for the metadata noted above or for other information that you want to store to your media type by clicking on <em>Manage fields</em> (see related topic below).{% endtrans %}</li>
+  <li>{% trans %}If you have added metadata fields, click <em>Edit</em>. Under <em>Field mapping</em>, select the fields you added for each piece of metadata information.{% endtrans %}</li>
+  <li>{% trans %}Click <em>Save</em>.{% endtrans %}</li>
+  <li>{% trans %}You can now use this media type by adding a Media reference field to any content entity sub-type. See related topic below.{% endtrans %}</li>
+</ol>

core/modules/media/js/form.js

@@ -0,0 +1,40 @@
+/**
+ * @file
+ * Defines JavaScript behaviors for the media form.
+ */
+
+(function ($, Drupal) {
+  /**
+   * Behaviors for summaries for tabs in the media edit form.
+   *
+   * @type {Drupal~behavior}
+   *
+   * @prop {Drupal~behaviorAttach} attach
+   *   Attaches summary behavior for tabs in the media edit form.
+   */
+  Drupal.behaviors.mediaFormSummaries = {
+    attach(context) {
+      $(context)
+        .find('.media-form-author')
+        .drupalSetSummary((context) => {
+          const nameInput = context.querySelector('.field--name-uid input');
+          const name = nameInput && nameInput.value;
+          const dateInput = context.querySelector('.field--name-created input');
+          const date = dateInput && dateInput.value;
+
+          if (name && date) {
+            return Drupal.t('By @name on @date', {
+              '@name': name,
+              '@date': date,
+            });
+          }
+          if (name) {
+            return Drupal.t('By @name', { '@name': name });
+          }
+          if (date) {
+            return Drupal.t('Authored on @date', { '@date': date });
+          }
+        });
+    },
+  };
+})(jQuery, Drupal);

core/modules/media/js/media_embed_ckeditor.theme.js

@@ -0,0 +1,19 @@
+/**
+ * @file
+ * Theme elements for the Media Embed text editor plugins.
+ */
+
+((Drupal) => {
+  /**
+   * Themes the error displayed when the media embed preview fails.
+   *
+   * @return {string}
+   *   A string representing a DOM fragment.
+   *
+   * @see media-embed-error.html.twig
+   */
+  Drupal.theme.mediaEmbedPreviewError = () =>
+    `<div>${Drupal.t(
+      'An error occurred while trying to preview the media. Save your work and reload this page.',
+    )}</div>`;
+})(Drupal);

core/modules/media/js/type_form.js

@@ -0,0 +1,56 @@
+/**
+ * @file
+ * Defines JavaScript behaviors for the media type form.
+ */
+
+(function ($, Drupal) {
+  /**
+   * Behaviors for setting summaries on media type form.
+   *
+   * @type {Drupal~behavior}
+   *
+   * @prop {Drupal~behaviorAttach} attach
+   *   Attaches summary behaviors on media type edit forms.
+   */
+  Drupal.behaviors.mediaTypeFormSummaries = {
+    attach(context) {
+      const $context = $(context);
+      // Provide the vertical tab summaries.
+      $context.find('#edit-workflow').drupalSetSummary((context) => {
+        const values = [];
+        $(context)
+          .find('input[name^="options"]:checked')
+          .parent()
+          .each(function () {
+            values.push(
+              Drupal.checkPlain($(this).find('label')[0].textContent),
+            );
+          });
+        if ($(context).find('#edit-options-status:checked').length === 0) {
+          values.unshift(Drupal.t('Not published'));
+        }
+        return values.join(', ');
+      });
+      $(context)
+        .find('#edit-language')
+        .drupalSetSummary((context) => {
+          const values = [];
+
+          values.push(
+            $(context).find(
+              '.js-form-item-language-configuration-langcode select option:selected',
+            )[0].textContent,
+          );
+
+          $(context)
+            .find('input:checked')
+            .next('label')
+            .each(function () {
+              values.push(Drupal.checkPlain(this.textContent));
+            });
+
+          return values.join(', ');
+        });
+    },
+  };
+})(jQuery, Drupal);

core/modules/media/media.api.php

@@ -0,0 +1,42 @@
+<?php
+
+/**
+ * @file
+ * Hooks related to Media and its plugins.
+ */
+
+/**
+ * @addtogroup hooks
+ * @{
+ */
+
+/**
+ * Alters the information provided in \Drupal\media\Annotation\MediaSource.
+ *
+ * @param array $sources
+ *   The array of media source plugin definitions, keyed by plugin ID.
+ */
+function hook_media_source_info_alter(array &$sources) {
+  $sources['youtube']['label'] = t('Youtube rocks!');
+}
+
+/**
+ * Alters an oEmbed resource URL before it is fetched.
+ *
+ * @param array $parsed_url
+ *   A parsed URL, as returned by \Drupal\Component\Utility\UrlHelper::parse().
+ * @param \Drupal\media\OEmbed\Provider $provider
+ *   The oEmbed provider for the resource.
+ *
+ * @see \Drupal\media\OEmbed\UrlResolverInterface::getResourceUrl()
+ */
+function hook_oembed_resource_url_alter(array &$parsed_url, \Drupal\media\OEmbed\Provider $provider) {
+  // Always serve YouTube videos from youtube-nocookie.com.
+  if ($provider->getName() === 'YouTube') {
+    $parsed_url['path'] = str_replace('://youtube.com/', '://youtube-nocookie.com/', $parsed_url['path']);
+  }
+}
+
+/**
+ * @} End of "addtogroup hooks".
+ */

core/modules/media/media.info.yml

@@ -0,0 +1,15 @@
+name: Media
+description: 'Manages the creation, configuration, and display of media items.'
+type: module
+package: Core
+# version: VERSION
+dependencies:
+  - drupal:file
+  - drupal:image
+  - drupal:user
+configure: media.settings
+
+# Information added by Drupal.org packaging script on 2024-07-04
+version: '10.3.1'
+project: 'drupal'
+datestamp: 1720094222

core/modules/media/media.install

@@ -0,0 +1,183 @@
+<?php
+
+/**
+ * @file
+ * Install, uninstall and update hooks for Media module.
+ */
+
+use Drupal\Core\File\Exception\FileException;
+use Drupal\Core\File\FileExists;
+use Drupal\Core\File\FileSystemInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\Core\Url;
+use Drupal\image\Plugin\Field\FieldType\ImageItem;
+use Drupal\media\Entity\MediaType;
+use Drupal\media\MediaTypeInterface;
+use Drupal\media\Plugin\media\Source\OEmbedInterface;
+use Drupal\user\RoleInterface;
+
+/**
+ * Implements hook_install().
+ */
+function media_install() {
+  $source = \Drupal::service('extension.list.module')->getPath('media') . '/images/icons';
+  $destination = \Drupal::config('media.settings')->get('icon_base_uri');
+  /** @var \Drupal\Core\File\FileSystemInterface $file_system */
+  $file_system = \Drupal::service('file_system');
+  $file_system->prepareDirectory($destination, FileSystemInterface::CREATE_DIRECTORY | FileSystemInterface::MODIFY_PERMISSIONS);
+
+  $files = $file_system->scanDirectory($source, '/.*\.(svg|png|jpg|jpeg|gif)$/');
+  foreach ($files as $file) {
+    // When reinstalling the media module we don't want to copy the icons when
+    // they already exist. The icons could be replaced (by a contrib module or
+    // manually), so we don't want to replace the existing files. Removing the
+    // files when we uninstall could also be a problem if the files are
+    // referenced somewhere else. Since showing an error that it was not
+    // possible to copy the files is also confusing, we silently do nothing.
+    if (!file_exists($destination . DIRECTORY_SEPARATOR . $file->filename)) {
+      try {
+        $file_system->copy($file->uri, $destination, FileExists::Error);
+      }
+      catch (FileException $e) {
+        // Ignore and continue.
+      }
+
+    }
+  }
+
+  // Grant the "view media" permission to all users by default.
+  if (\Drupal::moduleHandler()->moduleExists('user')) {
+    user_role_grant_permissions(RoleInterface::ANONYMOUS_ID, ['view media']);
+    user_role_grant_permissions(RoleInterface::AUTHENTICATED_ID, ['view media']);
+  }
+}
+
+/**
+ * Implements hook_requirements().
+ */
+function media_requirements($phase) {
+  $requirements = [];
+  if ($phase == 'install') {
+    $destination = 'public://media-icons/generic';
+    \Drupal::service('file_system')->prepareDirectory($destination, FileSystemInterface::CREATE_DIRECTORY | FileSystemInterface::MODIFY_PERMISSIONS);
+    $is_writable = is_writable($destination);
+    $is_directory = is_dir($destination);
+    if (!$is_writable || !$is_directory) {
+      if (!$is_directory) {
+        $error = t('The directory %directory does not exist.', ['%directory' => $destination]);
+      }
+      else {
+        $error = t('The directory %directory is not writable.', ['%directory' => $destination]);
+      }
+      $description = t('An automated attempt to create this directory failed, possibly due to a permissions problem. To proceed with the installation, either create the directory and modify its permissions manually or ensure that the installer has the permissions to create it automatically. For more information, see INSTALL.txt or the <a href=":handbook_url">online handbook</a>.', [':handbook_url' => 'https://www.drupal.org/server-permissions']);
+      if (!empty($error)) {
+        $description = $error . ' ' . $description;
+        $requirements['media']['description'] = $description;
+        $requirements['media']['severity'] = REQUIREMENT_ERROR;
+      }
+    }
+  }
+  elseif ($phase === 'runtime') {
+    // Check that oEmbed content is served in an iframe on a different domain,
+    // and complain if it isn't.
+    $domain = \Drupal::config('media.settings')->get('iframe_domain');
+
+    if (!\Drupal::service('media.oembed.iframe_url_helper')->isSecure($domain)) {
+      // Find all media types which use a source plugin that implements
+      // OEmbedInterface.
+      $media_types = \Drupal::entityTypeManager()
+        ->getStorage('media_type')
+        ->loadMultiple();
+
+      $oembed_types = array_filter($media_types, function (MediaTypeInterface $media_type) {
+        return $media_type->getSource() instanceof OEmbedInterface;
+      });
+
+      if ($oembed_types) {
+        // @todo Potentially allow site administrators to suppress this warning
+        // permanently. See https://www.drupal.org/project/drupal/issues/2962753
+        // for more information.
+        $requirements['media_insecure_iframe'] = [
+          'title' => t('Media'),
+          'description' => t('It is potentially insecure to display oEmbed content in a frame that is served from the same domain as your main Drupal site, as this may allow execution of third-party code. <a href=":url">You can specify a different domain for serving oEmbed content here</a>.', [
+            ':url' => Url::fromRoute('media.settings')->setAbsolute()->toString(),
+          ]),
+          'severity' => REQUIREMENT_WARNING,
+        ];
+      }
+    }
+
+    $module_handler = \Drupal::service('module_handler');
+    foreach (MediaType::loadMultiple() as $type) {
+      // Load the default display.
+      $display = \Drupal::service('entity_display.repository')
+        ->getViewDisplay('media', $type->id());
+
+      // Check for missing source field definition.
+      $source_field_definition = $type->getSource()->getSourceFieldDefinition($type);
+      if (empty($source_field_definition)) {
+        $requirements['media_missing_source_field_' . $type->id()] = [
+          'title' => t('Media'),
+          'description' => t('The source field definition for the %type media type is missing.',
+            [
+              '%type' => $type->label(),
+            ]
+          ),
+          'severity' => REQUIREMENT_ERROR,
+        ];
+        continue;
+      }
+
+      // When a new media type with an image source is created we're
+      // configuring the default entity view display using the 'large' image
+      // style. Unfortunately, if a site builder has deleted the 'large' image
+      // style, we need some other image style to use, but at this point, we
+      // can't really know the site builder's intentions. So rather than do
+      // something surprising, we're leaving the embedded media without an
+      // image style and adding a warning that the site builder might want to
+      // add an image style.
+      // @see Drupal\media\Plugin\media\Source\Image::prepareViewDisplay
+      if (!is_a($source_field_definition->getItemDefinition()->getClass(), ImageItem::class, TRUE)) {
+        continue;
+      }
+
+      $component = $display->getComponent($source_field_definition->getName());
+      if (empty($component) || $component['type'] !== 'image' || !empty($component['settings']['image_style'])) {
+        continue;
+      }
+
+      $action_item = '';
+      if ($module_handler->moduleExists('field_ui') && \Drupal::currentUser()->hasPermission('administer media display')) {
+        $url = Url::fromRoute('entity.entity_view_display.media.default', [
+          'media_type' => $type->id(),
+        ])->toString();
+        $action_item = new TranslatableMarkup('If you would like to change this, <a href=":display">add an image style to the %field_name field</a>.',
+          [
+            '%field_name' => $source_field_definition->label(),
+            ':display' => $url,
+          ]);
+      }
+      $requirements['media_default_image_style_' . $type->id()] = [
+        'title' => t('Media'),
+        'description' => new TranslatableMarkup('The default display for the %type media type is not currently using an image style on the %field_name field. Not using an image style can lead to much larger file downloads. @action_item',
+          [
+            '%field_name' => $source_field_definition->label(),
+            '@action_item' => $action_item,
+            '%type' => $type->label(),
+          ]
+        ),
+        'severity' => REQUIREMENT_WARNING,
+      ];
+    }
+
+  }
+
+  return $requirements;
+}
+
+/**
+ * Implements hook_update_last_removed().
+ */
+function media_update_last_removed() {
+  return 8700;
+}

core/modules/media/media.libraries.yml

@@ -0,0 +1,50 @@
+form:
+  version: VERSION
+  js:
+    js/form.js: {}
+  dependencies:
+    - core/drupal.form
+
+type_form:
+  version: VERSION
+  js:
+    js/type_form.js: {}
+  dependencies:
+    - core/drupal.form
+
+oembed.formatter:
+  version: VERSION
+  css:
+    component:
+      css/oembed.formatter.css: {}
+
+oembed.frame:
+  version: VERSION
+  css:
+    component:
+      css/oembed.frame.css: {}
+
+filter.caption:
+  version: VERSION
+  css:
+    component:
+      css/filter.caption.css: {}
+  dependencies:
+    - filter/caption
+
+# Despite the name, this is actually not specific to CKEditor 4, and can be
+# used by all text editor plugins.
+media_embed_ckeditor_theme:
+  version: VERSION
+  js:
+    js/media_embed_ckeditor.theme.js: {}
+  dependencies:
+    - core/drupal
+
+drupal.media-icon:
+  version: VERSION
+  css:
+    theme:
+      css/media.icon.theme.css: {}
+  dependencies:
+    - field_ui/drupal.field_ui.manage_fields

core/modules/media/media.links.action.yml

@@ -0,0 +1,12 @@
+media.bundle_add:
+  route_name: entity.media_type.add_form
+  title: 'Add media type'
+  appears_on:
+    - entity.media_type.collection
+
+media.add:
+  route_name: entity.media.add_page
+  title: 'Add media'
+  weight: 10
+  appears_on:
+    - entity.media.collection

core/modules/media/media.links.contextual.yml

@@ -0,0 +1,10 @@
+entity.media.edit_form:
+  route_name: entity.media.edit_form
+  group: media
+  title: Edit
+
+entity.media.delete_form:
+  route_name: entity.media.delete_form
+  group: media
+  title: Delete
+  weight: 10

core/modules/media/media.links.menu.yml

@@ -0,0 +1,11 @@
+entity.media_type.collection:
+  title: 'Media types'
+  parent: system.admin_structure
+  description: 'Manage media types.'
+  route_name: entity.media_type.collection
+
+media.settings:
+  title: 'Media settings'
+  parent: system.admin_config_media
+  description: 'Manage media settings.'
+  route_name: media.settings

core/modules/media/media.links.task.yml

@@ -0,0 +1,18 @@
+media.tasks:
+  deriver: 'Drupal\media\Plugin\Derivative\DynamicLocalTasks'
+
+entity.media_type.edit_form:
+  title: Edit
+  route_name: entity.media_type.edit_form
+  base_route: entity.media_type.edit_form
+
+entity.media_type.collection:
+  title: List
+  route_name: entity.media_type.collection
+  base_route: entity.media_type.collection
+
+entity.media.collection:
+  title: Media
+  route_name: entity.media.collection
+  base_route: system.admin_content
+  weight: 10

core/modules/media/media.module

@@ -0,0 +1,543 @@
+<?php
+
+/**
+ * @file
+ * Provides media items.
+ */
+
+use Drupal\Component\Plugin\DerivativeInspectionInterface;
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Field\FieldTypeCategoryManagerInterface;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Render\Element;
+use Drupal\Core\Render\Element\RenderElementBase;
+use Drupal\Core\Routing\RouteMatchInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Template\Attribute;
+use Drupal\Core\Url;
+use Drupal\field\FieldConfigInterface;
+use Drupal\media\MediaConfigUpdater;
+use Drupal\media\Plugin\media\Source\OEmbedInterface;
+use Drupal\views\ViewExecutable;
+
+/**
+ * Implements hook_help().
+ */
+function media_help($route_name, RouteMatchInterface $route_match) {
+  switch ($route_name) {
+    case 'help.page.media':
+      $output = '<h2>' . t('About') . '</h2>';
+      $output .= '<p>' . t('The Media module manages the creation, editing, deletion, settings, and display of media. Items are typically images, documents, slideshows, YouTube videos, tweets, Instagram photos, etc. You can reference media items from any other content on your site. For more information, see the <a href=":media">online documentation for the Media module</a>.', [':media' => 'https://www.drupal.org/docs/8/core/modules/media']) . '</p>';
+      $output .= '<h2>' . t('Uses') . '</h2>';
+      $output .= '<dl>';
+      $output .= '<dt>' . t('Creating media items') . '</dt>';
+      $output .= '<dd>' . t('When a new media item is created, the Media module records basic information about it, including the author, date of creation, and the <a href=":media-type">media type</a>. It also manages the <em>publishing options</em>, which define whether or not the item is published. Default settings can be configured for each type of media on your site.', [':media-type' => Url::fromRoute('entity.media_type.collection')->toString()]) . '</dd>';
+      $output .= '<dt>' . t('Listing media items') . '</dt>';
+      $output .= '<dd>' . t('Media items are listed at the <a href=":media-collection">media administration page</a>.', [
+        ':media-collection' => Url::fromRoute('entity.media.collection')->toString(),
+      ]) . '</dd>';
+      $output .= '<dt>' . t('Creating custom media types') . '</dt>';
+      $output .= '<dd>' . t('The Media module gives users with the <em>Administer media types</em> permission the ability to <a href=":media-new">create new media types</a> in addition to the default ones already configured. Each media type has an associated media source (such as the image source) which support thumbnail generation and metadata extraction. Fields managed by the <a href=":field">Field module</a> may be added for storing that metadata, such as width and height, as well as any other associated values.', [
+        ':media-new' => Url::fromRoute('entity.media_type.add_form')->toString(),
+        ':field' => Url::fromRoute('help.page', ['name' => 'field'])->toString(),
+      ]) . '</dd>';
+      $output .= '<dt>' . t('Creating revisions') . '</dt>';
+      $output .= '<dd>' . t('The Media module also enables you to create multiple versions of any media item, and revert to older versions using the <em>Revision information</em> settings.') . '</dd>';
+      $output .= '<dt>' . t('User permissions') . '</dt>';
+      $output .= '<dd>' . t('The Media module makes a number of permissions available, which can be set by role on the <a href=":permissions">permissions page</a>.', [
+        ':permissions' => Url::fromRoute('user.admin_permissions.module', ['modules' => 'media'])->toString(),
+      ]) . '</dd>';
+      $output .= '<dt>' . t('Adding media to other content') . '</dt>';
+      $output .= '<dd>' . t('Users with permission to administer content types can add media support by adding a media reference field to the content type on the content type administration page. (The same is true of block types, taxonomy terms, user profiles, and other content that supports fields.) A media reference field can refer to any configured media type. It is possible to allow multiple media types in the same field.') . '</dd>';
+      $output .= '</dl>';
+      $output .= '<h2>' . t('Differences between Media, File, and Image reference fields') . '</h2>';
+      $output .= '<p>' . t('<em>Media</em> reference fields offer several advantages over basic <em>File</em> and <em>Image</em> references:') . '</p>';
+      $output .= '<ul>';
+      $output .= '<li>' . t('Media reference fields can reference multiple media types in the same field.') . '</li>';
+      $output .= '<li>' . t('Fields can also be added to media types themselves, which means that custom metadata like descriptions and taxonomy tags can be added for the referenced media. (Basic file and image fields do not support this.)') . '</li>';
+      $output .= '<li>' . t('Media types for audio and video files are provided by default, so there is no need for additional configuration to upload these media.') . '</li>';
+      $output .= '<li>' . t('Contributed or custom projects can provide additional media sources (such as third-party websites, Twitter, etc.).') . '</li>';
+      $output .= '<li>' . t('Existing media items can be reused on any other content items with a media reference field.') . '</li>';
+      $output .= '</ul>';
+      $output .= '<p>' . t('Use <em>Media</em> reference fields for most files, images, audio, videos, and remote media. Use <em>File</em> or <em>Image</em> reference fields when creating your own media types, or for legacy files and images created before installing the Media module.') . '</p>';
+      return $output;
+  }
+}
+
+/**
+ * Implements hook_theme().
+ */
+function media_theme() {
+  return [
+    'media' => [
+      'render element' => 'elements',
+    ],
+    'media_reference_help' => [
+      'render element' => 'element',
+      'base hook' => 'field_multiple_value_form',
+    ],
+    'media_oembed_iframe' => [
+      'variables' => [
+        'resource' => NULL,
+        'media' => NULL,
+        'placeholder_token' => '',
+      ],
+    ],
+    'media_embed_error' => [
+      'variables' => [
+        'message' => NULL,
+        'attributes' => [],
+      ],
+    ],
+  ];
+}
+
+/**
+ * Implements hook_entity_access().
+ */
+function media_entity_access(EntityInterface $entity, $operation, AccountInterface $account) {
+  if ($operation === 'delete' && $entity instanceof FieldConfigInterface && $entity->getTargetEntityTypeId() === 'media') {
+    /** @var \Drupal\media\MediaTypeInterface $media_type */
+    $media_type = \Drupal::entityTypeManager()->getStorage('media_type')->load($entity->getTargetBundle());
+    return AccessResult::forbiddenIf($entity->id() === 'media.' . $media_type->id() . '.' . $media_type->getSource()->getConfiguration()['source_field']);
+  }
+  return AccessResult::neutral();
+}
+
+/**
+ * Implements hook_theme_suggestions_HOOK().
+ */
+function media_theme_suggestions_media(array $variables) {
+  $suggestions = [];
+  /** @var \Drupal\media\MediaInterface $media */
+  $media = $variables['elements']['#media'];
+  $sanitized_view_mode = strtr($variables['elements']['#view_mode'], '.', '_');
+
+  $suggestions[] = 'media__' . $sanitized_view_mode;
+  $suggestions[] = 'media__' . $media->bundle();
+  $suggestions[] = 'media__' . $media->bundle() . '__' . $sanitized_view_mode;
+
+  // Add suggestions based on the source plugin ID.
+  $source = $media->getSource();
+  if ($source instanceof DerivativeInspectionInterface) {
+    $source_id = $source->getBaseId();
+    $derivative_id = $source->getDerivativeId();
+    if ($derivative_id) {
+      $source_id .= '__derivative_' . $derivative_id;
+    }
+  }
+  else {
+    $source_id = $source->getPluginId();
+  }
+  $suggestions[] = "media__source_$source_id";
+
+  // If the source plugin uses oEmbed, add a suggestion based on the provider
+  // name, if available.
+  if ($source instanceof OEmbedInterface) {
+    $provider_id = $source->getMetadata($media, 'provider_name');
+    if ($provider_id) {
+      $provider_id = \Drupal::transliteration()->transliterate($provider_id);
+      $provider_id = preg_replace('/[^a-z0-9_]+/', '_', mb_strtolower($provider_id));
+      $suggestions[] = end($suggestions) . "__provider_$provider_id";
+    }
+  }
+
+  return $suggestions;
+}
+
+/**
+ * Prepares variables for media templates.
+ *
+ * Default template: media.html.twig.
+ *
+ * @param array $variables
+ *   An associative array containing:
+ *   - elements: An array of elements to display in view mode.
+ *   - media: The media item.
+ *   - name: The label for the media item.
+ *   - view_mode: View mode; e.g., 'full', 'teaser', etc.
+ */
+function template_preprocess_media(array &$variables) {
+  $variables['media'] = $variables['elements']['#media'];
+  $variables['view_mode'] = $variables['elements']['#view_mode'];
+  $variables['name'] = $variables['media']->label();
+
+  // Helpful $content variable for templates.
+  foreach (Element::children($variables['elements']) as $key) {
+    $variables['content'][$key] = $variables['elements'][$key];
+  }
+}
+
+/**
+ * Implements hook_field_ui_preconfigured_options_alter().
+ */
+function media_field_ui_preconfigured_options_alter(array &$options, $field_type) {
+  // If the field is not an "entity_reference"-based field, bail out.
+  /** @var \Drupal\Core\Field\FieldTypePluginManager $field_type_manager */
+  $field_type_manager = \Drupal::service('plugin.manager.field.field_type');
+  $class = $field_type_manager->getPluginClass($field_type);
+  if (!is_a($class, 'Drupal\Core\Field\Plugin\Field\FieldType\EntityReferenceItem', TRUE)) {
+    return;
+  }
+
+  // Set the default formatter for media in entity reference fields to be the
+  // "Rendered entity" formatter.
+  if (!empty($options['media'])) {
+    $options['media']['description'] = t('Field to reference media. Allows uploading and selecting from uploaded media.');
+    $options['media']['weight'] = -25;
+    $options['media']['category'] = FieldTypeCategoryManagerInterface::FALLBACK_CATEGORY;
+    $options['media']['entity_view_display']['type'] = 'entity_reference_entity_view';
+  }
+}
+
+/**
+ * Implements hook_form_FORM_ID_alter().
+ */
+function media_form_field_ui_field_storage_add_form_alter(&$form, FormStateInterface $form_state, $form_id) {
+  // Provide some help text to aid users decide whether they need a Media,
+  // File, or Image reference field.
+  $description_text = t('Use <em>Media</em> reference fields for most files, images, audio, videos, and remote media. Use <em>File</em> or <em>Image</em> reference fields when creating your own media types, or for legacy files and images created before installing the Media module.');
+  if (\Drupal::moduleHandler()->moduleExists('help')) {
+    $description_text .= ' ' . t('For more information, see the <a href="@help_url">Media help page</a>.', [
+      '@help_url' => Url::fromRoute('help.page', ['name' => 'media'])->toString(),
+    ]);
+  }
+  $field_types = [
+    'file_upload',
+    'field_ui:entity_reference:media',
+  ];
+  if (in_array($form_state->getValue('new_storage_type'), $field_types)) {
+    $form['group_field_options_wrapper']['description_wrapper'] = [
+      '#type' => 'item',
+      '#markup' => $description_text,
+    ];
+  }
+}
+
+/**
+ * Implements hook_field_widget_complete_form_alter().
+ */
+function media_field_widget_complete_form_alter(array &$field_widget_complete_form, FormStateInterface $form_state, array $context) {
+  $elements = &$field_widget_complete_form['widget'];
+  // Do not alter the default settings form.
+  if ($context['default']) {
+    return;
+  }
+
+  // Only act on entity reference fields that reference media.
+  $field_type = $context['items']->getFieldDefinition()->getType();
+  $target_type = $context['items']->getFieldDefinition()->getFieldStorageDefinition()->getSetting('target_type');
+  if ($field_type !== 'entity_reference' ||  $target_type !== 'media') {
+    return;
+  }
+
+  // Autocomplete widgets need different help text than options widgets.
+  $widget_plugin_id = $context['widget']->getPluginId();
+  if (in_array($widget_plugin_id, ['entity_reference_autocomplete', 'entity_reference_autocomplete_tags'])) {
+    $is_autocomplete = TRUE;
+  }
+  else {
+    // @todo We can't yet properly alter non-autocomplete fields. Resolve this
+    //   in https://www.drupal.org/node/2943020 and remove this condition.
+    return;
+  }
+  $elements['#media_help'] = [];
+
+  // Retrieve the media bundle list and add information for the user based on
+  // which bundles are available to be created or referenced.
+  $settings = $context['items']->getFieldDefinition()->getSetting('handler_settings');
+  $allowed_bundles = !empty($settings['target_bundles']) ? $settings['target_bundles'] : [];
+  $add_url = _media_get_add_url($allowed_bundles);
+  if ($add_url) {
+    $elements['#media_help']['#media_add_help'] = t('Create your media on the <a href=":add_page" target="_blank">media add page</a> (opens a new window), then add it by name to the field below.', [':add_page' => $add_url]);
+  }
+
+  $elements['#theme'] = 'media_reference_help';
+  // @todo template_preprocess_field_multiple_value_form() assumes this key
+  //   exists, but it does not exist in the case of a single widget that
+  //   accepts multiple values. This is for some reason necessary to use
+  //   our template for the entity_autocomplete_tags widget.
+  //   Research and resolve this in https://www.drupal.org/node/2943020.
+  if (empty($elements['#cardinality_multiple'])) {
+    $elements['#cardinality_multiple'] = NULL;
+  }
+
+  // Use the title set on the element if it exists, otherwise fall back to the
+  // field label.
+  $elements['#media_help']['#original_label'] = $elements['#title'] ?? $context['items']->getFieldDefinition()->getLabel();
+
+  // Customize the label for the field widget.
+  // @todo Research a better approach https://www.drupal.org/node/2943024.
+  $use_existing_label = t('Use existing media');
+  if (!empty($elements[0]['target_id']['#title'])) {
+    $elements[0]['target_id']['#title'] = $use_existing_label;
+  }
+  if (!empty($elements['#title'])) {
+    $elements['#title'] = $use_existing_label;
+  }
+  if (!empty($elements['target_id']['#title'])) {
+    $elements['target_id']['#title'] = $use_existing_label;
+  }
+
+  // This help text is only relevant for autocomplete widgets. When the user
+  // is presented with options, they don't need to type anything or know what
+  // types of media are allowed.
+  if ($is_autocomplete) {
+    $elements['#media_help']['#media_list_help'] = t('Type part of the media name.');
+
+    $overview_url = Url::fromRoute('entity.media.collection');
+    if ($overview_url->access()) {
+      $elements['#media_help']['#media_list_link'] = t('See the <a href=":list_url" target="_blank">media list</a> (opens a new window) to help locate media.', [':list_url' => $overview_url->toString()]);
+    }
+    $all_bundles = \Drupal::service('entity_type.bundle.info')->getBundleInfo('media');
+    $bundle_labels = array_map(function ($bundle) use ($all_bundles) {
+      return $all_bundles[$bundle]['label'];
+    }, $allowed_bundles);
+    $elements['#media_help']['#allowed_types_help'] = t('Allowed media types: %types', ['%types' => implode(", ", $bundle_labels)]);
+  }
+}
+
+/**
+ * Implements hook_preprocess_HOOK() for media reference widgets.
+ */
+function media_preprocess_media_reference_help(&$variables) {
+  // Most of these attribute checks are copied from
+  // template_preprocess_fieldset(). Our template extends
+  // field-multiple-value-form.html.twig to provide our help text, but also
+  // groups the information within a semantic fieldset with a legend. So, we
+  // incorporate parity for both.
+  $element = $variables['element'];
+  Element::setAttributes($element, ['id']);
+  RenderElementBase::setAttributes($element);
+  $variables['attributes'] = $element['#attributes'] ?? [];
+  $variables['legend_attributes'] = new Attribute();
+  $variables['header_attributes'] = new Attribute();
+  $variables['description']['attributes'] = new Attribute();
+  $variables['legend_span_attributes'] = new Attribute();
+
+  if (!empty($element['#media_help'])) {
+    foreach ($element['#media_help'] as $key => $text) {
+      $variables[substr($key, 1)] = $text;
+    }
+  }
+}
+
+/**
+ * Returns the appropriate URL to add media for the current user.
+ *
+ * @todo Remove in https://www.drupal.org/project/drupal/issues/2938116
+ *
+ * @param string[] $allowed_bundles
+ *   An array of bundles that should be checked for create access.
+ *
+ * @return bool|\Drupal\Core\Url
+ *   The URL to add media, or FALSE if the user cannot create any media.
+ *
+ * @internal
+ *   This function is internal and may be removed in a minor release.
+ */
+function _media_get_add_url($allowed_bundles) {
+  $access_handler = \Drupal::entityTypeManager()->getAccessControlHandler('media');
+  $create_bundles = array_filter($allowed_bundles, [$access_handler, 'createAccess']);
+
+  // Add a section about how to create media if the user has access to do so.
+  if (count($create_bundles) === 1) {
+    return Url::fromRoute('entity.media.add_form', ['media_type' => reset($create_bundles)])->toString();
+  }
+  elseif (count($create_bundles) > 1) {
+    return Url::fromRoute('entity.media.add_page')->toString();
+  }
+
+  return FALSE;
+}
+
+/**
+ * Implements hook_entity_type_alter().
+ */
+function media_entity_type_alter(array &$entity_types) {
+  if (\Drupal::config('media.settings')->get('standalone_url')) {
+    /** @var \Drupal\Core\Entity\ContentEntityTypeInterface $entity_type */
+    $entity_type = $entity_types['media'];
+    $entity_type->setLinkTemplate('canonical', '/media/{media}');
+  }
+}
+
+/**
+ * Implements hook_ENTITY_TYPE_presave() for entity_view_display.
+ */
+function media_entity_view_display_presave(EntityViewDisplayInterface $view_display): void {
+  $config_updater = \Drupal::classResolver(MediaConfigUpdater::class);
+  assert($config_updater instanceof MediaConfigUpdater);
+  $config_updater->processOembedEagerLoadField($view_display);
+}
+
+/**
+ * Implements hook_form_FORM_ID_alter().
+ */
+function media_form_filter_format_edit_form_alter(array &$form, FormStateInterface $form_state, $form_id) {
+  // Add an additional validate callback so we can ensure the order of filters
+  // is correct.
+  $form['#validate'][] = 'media_filter_format_edit_form_validate';
+}
+
+/**
+ * Implements hook_form_FORM_ID_alter().
+ */
+function media_form_filter_format_add_form_alter(array &$form, FormStateInterface $form_state, $form_id) {
+  // Add an additional validate callback so we can ensure the order of filters
+  // is correct.
+  $form['#validate'][] = 'media_filter_format_edit_form_validate';
+}
+
+/**
+ * Validate callback to ensure filter order and allowed_html are compatible.
+ */
+function media_filter_format_edit_form_validate($form, FormStateInterface $form_state) {
+  if ($form_state->getTriggeringElement()['#name'] !== 'op') {
+    return;
+  }
+
+  $allowed_html_path = [
+    'filters',
+    'filter_html',
+    'settings',
+    'allowed_html',
+  ];
+
+  $filter_html_settings_path = [
+    'filters',
+    'filter_html',
+    'settings',
+  ];
+
+  $filter_html_enabled = $form_state->getValue([
+    'filters',
+    'filter_html',
+    'status',
+  ]);
+
+  $media_embed_enabled = $form_state->getValue([
+    'filters',
+    'media_embed',
+    'status',
+  ]);
+
+  if (!$media_embed_enabled) {
+    return;
+  }
+
+  $get_filter_label = function ($filter_plugin_id) use ($form) {
+    return (string) $form['filters']['order'][$filter_plugin_id]['filter']['#markup'];
+  };
+
+  if ($filter_html_enabled && $form_state->getValue($allowed_html_path)) {
+    /** @var \Drupal\filter\Entity\FilterFormat $filter_format */
+    $filter_format = $form_state->getFormObject()->getEntity();
+
+    $filter_html = clone $filter_format->filters()->get('filter_html');
+    $filter_html->setConfiguration(['settings' => $form_state->getValue($filter_html_settings_path)]);
+    $restrictions = $filter_html->getHTMLRestrictions();
+    $allowed = $restrictions['allowed'];
+
+    // Require `<drupal-media>` HTML tag if filter_html is enabled.
+    if (!isset($allowed['drupal-media'])) {
+      $form_state->setError($form['filters']['settings']['filter_html']['allowed_html'], t('The %media-embed-filter-label filter requires <code>&lt;drupal-media&gt;</code> among the allowed HTML tags.', [
+        '%media-embed-filter-label' => $get_filter_label('media_embed'),
+      ]));
+    }
+    else {
+      $required_attributes = [
+        'data-entity-type',
+        'data-entity-uuid',
+      ];
+
+      // If there are no attributes, the allowed item is set to FALSE,
+      // otherwise, it is set to an array.
+      if ($allowed['drupal-media'] === FALSE) {
+        $missing_attributes = $required_attributes;
+      }
+      else {
+        $missing_attributes = array_diff($required_attributes, array_keys($allowed['drupal-media']));
+      }
+
+      if ($missing_attributes) {
+        $form_state->setError($form['filters']['settings']['filter_html']['allowed_html'], t('The <code>&lt;drupal-media&gt;</code> tag in the allowed HTML tags is missing the following attributes: <code>%list</code>.', [
+          '%list' => implode(', ', $missing_attributes),
+        ]));
+      }
+    }
+  }
+
+  $filters = $form_state->getValue('filters');
+
+  // The "media_embed" filter must run after "filter_align", "filter_caption",
+  // and "filter_html_image_secure".
+  $precedents = [
+    'filter_align',
+    'filter_caption',
+    'filter_html_image_secure',
+  ];
+
+  $error_filters = [];
+  foreach ($precedents as $filter_name) {
+    // A filter that should run before media embed filter.
+    $precedent = $filters[$filter_name];
+
+    if (empty($precedent['status']) || !isset($precedent['weight'])) {
+      continue;
+    }
+
+    if ($precedent['weight'] >= $filters['media_embed']['weight']) {
+      $error_filters[$filter_name] = $get_filter_label($filter_name);
+    }
+  }
+
+  if (!empty($error_filters)) {
+    $error_message = \Drupal::translation()->formatPlural(
+      count($error_filters),
+      'The %media-embed-filter-label filter needs to be placed after the %filter filter.',
+      'The %media-embed-filter-label filter needs to be placed after the following filters: %filters.',
+      [
+        '%media-embed-filter-label' => $get_filter_label('media_embed'),
+        '%filter' => reset($error_filters),
+        '%filters' => implode(', ', $error_filters),
+      ]
+    );
+
+    $form_state->setErrorByName('filters', $error_message);
+  }
+}
+
+/**
+ * Implements hook_field_widget_single_element_form_alter().
+ */
+function media_field_widget_single_element_form_alter(&$element, FormStateInterface $form_state, $context) {
+  // Add an attribute so that text editors plugins can pass the host entity's
+  // language to EditorMediaDialog, allowing it to present entities in the same
+  // language.
+  if (!empty($element['#type']) && $element['#type'] == 'text_format') {
+    $element['#attributes']['data-media-embed-host-entity-langcode'] = $context['items']->getLangcode();
+  }
+}
+
+/**
+ * Implements hook_views_query_substitutions().
+ */
+function media_views_query_substitutions(ViewExecutable $view) {
+  $account = \Drupal::currentUser();
+  return [
+    '***VIEW_OWN_UNPUBLISHED_MEDIA***' => (int) $account->hasPermission('view own unpublished media'),
+    '***ADMINISTER_MEDIA***' => (int) $account->hasPermission('administer media'),
+  ];
+}
+
+/**
+ * Implements hook_field_type_category_info_alter().
+ */
+function media_field_type_category_info_alter(&$definitions) {
+  // The `media` field type belongs in the `general` category, so the libraries
+  // need to be attached using an alter hook.
+  $definitions[FieldTypeCategoryManagerInterface::FALLBACK_CATEGORY]['libraries'][] = 'media/drupal.media-icon';
+}

core/modules/media/media.permissions.yml

@@ -0,0 +1,40 @@
+administer media:
+  title: 'Administer media'
+  restrict access: TRUE
+
+administer media types:
+  title: 'Administer media types'
+  restrict access: TRUE
+
+view media:
+  title: 'View media'
+
+# @todo: Deprecate some permissions in https://www.drupal.org/project/drupal/issues/2925459
+update media:
+  title: 'Update own media'
+
+update any media:
+  title: 'Update any media'
+
+delete media:
+  title:  'Delete own media'
+
+delete any media:
+  title:  'Delete any media'
+
+create media:
+  title: 'Create media'
+
+view all media revisions:
+  title: 'View all media revisions'
+  description: 'To view a revision, you also need permission to view the media item.'
+
+access media overview:
+  title: 'Access media overview'
+  description: 'Users with this permission can access the media overview page.'
+
+permission_callbacks:
+  - \Drupal\media\MediaPermissions::mediaTypePermissions
+
+view own unpublished media:
+  title: 'View own unpublished media'

core/modules/media/media.post_update.php

@@ -0,0 +1,76 @@
+<?php
+
+/**
+ * @file
+ * Post update functions for Media.
+ */
+
+use Drupal\Core\Config\Entity\ConfigEntityUpdater;
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\media\MediaConfigUpdater;
+use Drupal\media\MediaTypeInterface;
+
+/**
+ * Implements hook_removed_post_updates().
+ */
+function media_removed_post_updates() {
+  return [
+    'media_post_update_collection_route' => '9.0.0',
+    'media_post_update_storage_handler' => '9.0.0',
+    'media_post_update_enable_standalone_url' => '9.0.0',
+    'media_post_update_add_status_extra_filter' => '9.0.0',
+    'media_post_update_modify_base_field_author_override' => '10.0.0',
+  ];
+}
+
+/**
+ * Add the oEmbed loading attribute setting to field formatter instances.
+ */
+function media_post_update_oembed_loading_attribute(?array &$sandbox = NULL): void {
+  $media_config_updater = \Drupal::classResolver(MediaConfigUpdater::class);
+  assert($media_config_updater instanceof MediaConfigUpdater);
+  $media_config_updater->setDeprecationsEnabled(TRUE);
+  \Drupal::classResolver(ConfigEntityUpdater::class)->update($sandbox, 'entity_view_display', function (EntityViewDisplayInterface $view_display) use ($media_config_updater): bool {
+    return $media_config_updater->processOembedEagerLoadField($view_display);
+  });
+}
+
+/**
+ * Updates media.settings:iframe_domain config if it's still at the default.
+ */
+function media_post_update_set_blank_iframe_domain_to_null() {
+  $media_settings = \Drupal::configFactory()->getEditable('media.settings');
+  if ($media_settings->get('iframe_domain') === '') {
+    $media_settings
+      ->set('iframe_domain', NULL)
+      ->save(TRUE);
+  }
+}
+
+/**
+ * Make sure no Media types are using the source field in the meta mappings.
+ */
+function media_post_update_remove_mappings_targeting_source_field(?array &$sandbox = NULL): void {
+  \Drupal::classResolver(ConfigEntityUpdater::class)
+    ->update($sandbox, 'media_type', function (MediaTypeInterface $media_type): bool {
+      $source_field = $media_type->getSource()
+        ->getSourceFieldDefinition($media_type);
+
+      if ($source_field) {
+        $source_field_name = $source_field->getName();
+
+        $original_field_map = $media_type->getFieldMap();
+        $field_map = array_diff($original_field_map, [$source_field_name]);
+
+        // Check if old field map matches new field map.
+        if (empty(array_diff($original_field_map, $field_map))) {
+          return FALSE;
+        }
+
+        $media_type->setFieldMap($field_map);
+        return TRUE;
+      }
+
+      return FALSE;
+    });
+}

core/modules/media/media.routing.yml

@@ -0,0 +1,32 @@
+media.oembed_iframe:
+  path: '/media/oembed'
+  defaults:
+    _controller: '\Drupal\media\Controller\OEmbedIframeController::render'
+  requirements:
+    _permission: 'view media'
+
+media.settings:
+  path: '/admin/config/media/media-settings'
+  defaults:
+    _form: '\Drupal\media\Form\MediaSettingsForm'
+    _title: 'Media settings'
+  requirements:
+    _permission: 'administer media'
+
+media.filter.preview:
+  path: '/media/{filter_format}/preview'
+  defaults:
+    _controller: '\Drupal\media\Controller\MediaFilterController::preview'
+  methods: [GET]
+  requirements:
+    _entity_access: 'filter_format.use'
+    _custom_access: '\Drupal\media\Controller\MediaFilterController::formatUsesMediaEmbedFilter'
+
+editor.media_dialog:
+  path: '/editor/dialog/media/{editor}'
+  defaults:
+    _form: '\Drupal\media\Form\EditorMediaDialog'
+    _title: 'Edit media'
+  methods: [POST]
+  requirements:
+    _entity_access: 'editor.use'

core/modules/media/media.services.yml

@@ -0,0 +1,25 @@
+services:
+  _defaults:
+    autoconfigure: true
+  plugin.manager.media.source:
+    class: Drupal\media\MediaSourceManager
+    parent: default_plugin_manager
+  media.oembed.url_resolver:
+    class: Drupal\media\OEmbed\UrlResolver
+    arguments: ['@media.oembed.provider_repository', '@media.oembed.resource_fetcher', '@http_client', '@module_handler', '@cache.default']
+  Drupal\media\OEmbed\UrlResolverInterface: '@media.oembed.url_resolver'
+  media.oembed.provider_repository:
+    class: Drupal\media\OEmbed\ProviderRepository
+    arguments: ['@http_client', '@config.factory', '@datetime.time', '@keyvalue', '@logger.factory']
+  Drupal\media\OEmbed\ProviderRepositoryInterface: '@media.oembed.provider_repository'
+  media.oembed.resource_fetcher:
+    class: Drupal\media\OEmbed\ResourceFetcher
+    arguments: ['@http_client', '@media.oembed.provider_repository', '@cache.default']
+  Drupal\media\OEmbed\ResourceFetcherInterface: '@media.oembed.resource_fetcher'
+  media.oembed.iframe_url_helper:
+    class: Drupal\media\IFrameUrlHelper
+    arguments: ['@router.request_context', '@private_key']
+  Drupal\media\IFrameUrlHelper: '@media.oembed.iframe_url_helper'
+  media.config_subscriber:
+    class: Drupal\media\EventSubscriber\MediaConfigSubscriber
+    arguments: ['@router.builder', '@cache_tags.invalidator', '@entity_type.manager']

core/modules/media/src/Annotation/MediaSource.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace Drupal\media\Annotation;
+
+use Drupal\Component\Annotation\Plugin;
+
+/**
+ * Defines a media source plugin annotation object.
+ *
+ * Media sources are responsible for implementing all the logic for dealing
+ * with a particular type of media. They provide various universal and
+ * type-specific metadata about media of the type they handle.
+ *
+ * Plugin namespace: Plugin\media\Source
+ *
+ * For a working example, see \Drupal\media\Plugin\media\Source\File.
+ *
+ * @see \Drupal\media\MediaSourceInterface
+ * @see \Drupal\media\MediaSourceBase
+ * @see \Drupal\media\MediaSourceManager
+ * @see hook_media_source_info_alter()
+ * @see plugin_api
+ *
+ * @Annotation
+ */
+class MediaSource extends Plugin {
+
+  /**
+   * The plugin ID.
+   *
+   * @var string
+   */
+  public $id;
+
+  /**
+   * The human-readable name of the media source.
+   *
+   * @var \Drupal\Core\Annotation\Translation
+   *
+   * @ingroup plugin_translatable
+   */
+  public $label;
+
+  /**
+   * A brief description of the media source.
+   *
+   * @var \Drupal\Core\Annotation\Translation
+   *
+   * @ingroup plugin_translatable
+   */
+  public $description = '';
+
+  /**
+   * The field types that can be used as a source field for this media source.
+   *
+   * @var string[]
+   */
+  public $allowed_field_types = [];
+
+  /**
+   * The classes used to define media source-specific forms.
+   *
+   * An array of form class names, keyed by ID. The ID represents the operation
+   * the form is used for.
+   *
+   * @var string[]
+   */
+  public $forms = [];
+
+  /**
+   * A filename for the default thumbnail.
+   *
+   * The thumbnails are placed in the directory defined by the config setting
+   * 'media.settings.icon_base_uri'. When using custom icons, make sure the
+   * module provides a hook_install() implementation to copy the custom icons
+   * to this directory. The media_install() function provides a clear example
+   * of how to do this.
+   *
+   * @var string
+   *
+   * @see media_install()
+   */
+  public $default_thumbnail_filename = 'generic.png';
+
+  /**
+   * The metadata attribute name to provide the thumbnail URI.
+   *
+   * @var string
+   */
+  public $thumbnail_uri_metadata_attribute = 'thumbnail_uri';
+
+  /**
+   * The metadata attribute name to provide the thumbnail width.
+   *
+   * @var string
+   */
+  public $thumbnail_width_metadata_attribute = 'thumbnail_width';
+
+  /**
+   * The metadata attribute name to provide the thumbnail height.
+   *
+   * @var string
+   */
+  public $thumbnail_height_metadata_attribute = 'thumbnail_height';
+
+  /**
+   * (optional) The metadata attribute name to provide the thumbnail alt.
+   *
+   * "Thumbnail" will be used if the attribute name is not provided.
+   *
+   * @var string|null
+   */
+  public $thumbnail_alt_metadata_attribute;
+
+  /**
+   * (optional) The metadata attribute name to provide the thumbnail title.
+   *
+   * The name of the media item will be used if the attribute name is not
+   * provided.
+   *
+   * @var string|null
+   */
+  public $thumbnail_title_metadata_attribute;
+
+  /**
+   * The metadata attribute name to provide the default name.
+   *
+   * @var string
+   */
+  public $default_name_metadata_attribute = 'default_name';
+
+}

core/modules/media/src/Attribute/MediaSource.php

@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\media\Attribute;
+
+use Drupal\Component\Plugin\Attribute\Plugin;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+
+/**
+ * Defines a MediaSource attribute.
+ *
+ * Media sources are responsible for implementing all the logic for dealing
+ * with a particular type of media. They provide various universal and
+ * type-specific metadata about media of the type they handle.
+ *
+ * Plugin namespace: Plugin\media\Source
+ *
+ * For a working example, see \Drupal\media\Plugin\media\Source\File.
+ *
+ * @see \Drupal\media\MediaSourceInterface
+ * @see \Drupal\media\MediaSourceBase
+ * @see \Drupal\media\MediaSourceManager
+ * @see hook_media_source_info_alter()
+ * @see plugin_api
+ */
+#[\Attribute(\Attribute::TARGET_CLASS)]
+class MediaSource extends Plugin {
+
+  /**
+   * Constructs a new MediaSource attribute.
+   *
+   * @param string $id
+   *   The attribute class ID.
+   * @param \Drupal\Core\StringTranslation\TranslatableMarkup $label
+   *   The human-readable name of the media source.
+   * @param \Drupal\Core\StringTranslation\TranslatableMarkup|null $description
+   *   (optional) A brief description of the media source.
+   * @param string[] $allowed_field_types
+   *   (optional) The field types that can be used as a source field for this
+   *   media source.
+   * @param class-string[] $forms
+   *   (optional) The classes used to define media source-specific forms. An
+   *   array of form class names, keyed by ID. The ID represents the operation
+   *   the form is used for, for example, 'media_library_add'.
+   * @param string $default_thumbnail_filename
+   *   (optional) A filename for the default thumbnail.
+   *   The thumbnails are placed in the directory defined by the config setting
+   *   'media.settings.icon_base_uri'. When using custom icons, make sure the
+   *   module provides a hook_install() implementation to copy the custom icons
+   *   to this directory. The media_install() function provides a clear example
+   *   of how to do this.
+   * @param string $thumbnail_uri_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail URI.
+   * @param string $thumbnail_width_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail width.
+   * @param string $thumbnail_height_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail height.
+   * @param string|null $thumbnail_alt_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail alt.
+   *   "Thumbnail" will be used if the attribute name is not provided.
+   * @param string|null $thumbnail_title_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail title.
+   *   The name of the media item will be used if the attribute name is not
+   *   provided.
+   * @param string $default_name_metadata_attribute
+   *   (optional) The metadata attribute name to provide the default name.
+   * @param class-string|null $deriver
+   *   (optional) The deriver class.
+   */
+  public function __construct(
+    public readonly string $id,
+    public readonly TranslatableMarkup $label,
+    public readonly ?TranslatableMarkup $description = NULL,
+    public readonly array $allowed_field_types = [],
+    public readonly array $forms = [],
+    public readonly string $default_thumbnail_filename = 'generic.png',
+    public readonly string $thumbnail_uri_metadata_attribute = 'thumbnail_uri',
+    public readonly string $thumbnail_width_metadata_attribute = 'thumbnail_width',
+    public readonly string $thumbnail_height_metadata_attribute = 'thumbnail_height',
+    public readonly ?string $thumbnail_alt_metadata_attribute = NULL,
+    public readonly ?string $thumbnail_title_metadata_attribute = NULL,
+    public readonly string $default_name_metadata_attribute = 'default_name',
+    public readonly ?string $deriver = NULL,
+  ) {}
+
+}

core/modules/media/src/Attribute/OEmbedMediaSource.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\media\Attribute;
+
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+
+/**
+ * Defines a OEmbedMediaSource attribute.
+ *
+ * Plugin namespace: Plugin\media\Source
+ *
+ * For a working example, see \Drupal\media\Plugin\media\Source\OEmbed.
+ *
+ * @see \Drupal\media\MediaSourceInterface
+ * @see \Drupal\media\MediaSourceBase
+ * @see \Drupal\media\MediaSourceManager
+ * @see hook_media_source_info_alter()
+ * @see plugin_api
+ */
+#[\Attribute(\Attribute::TARGET_CLASS)]
+class OEmbedMediaSource extends MediaSource {
+
+  /**
+   * Constructs a new OEmbedMediaSource attribute.
+   *
+   * @param string $id
+   *   The attribute class ID.
+   * @param \Drupal\Core\StringTranslation\TranslatableMarkup $label
+   *   The human-readable name of the media source.
+   * @param \Drupal\Core\StringTranslation\TranslatableMarkup|null $description
+   *   (optional) A brief description of the media source.
+   * @param string[] $allowed_field_types
+   *   (optional) The field types that can be used as a source field for this
+   *   media source.
+   * @param class-string[] $forms
+   *   (optional) The classes used to define media source-specific forms. An
+   *   array of form class names, keyed by ID. The ID represents the operation
+   *   the form is used for, for example, 'media_library_add'.
+   * @param string[] $providers
+   *   (optional) A set of provider names, exactly as they appear in the
+   *   canonical oEmbed provider database at https://oembed.com/providers.json.
+   * @param string $default_thumbnail_filename
+   *   (optional) A filename for the default thumbnail.
+   *   The thumbnails are placed in the directory defined by the config setting
+   *   'media.settings.icon_base_uri'. When using custom icons, make sure the
+   *   module provides a hook_install() implementation to copy the custom icons
+   *   to this directory. The media_install() function provides a clear example
+   *   of how to do this.
+   * @param string $thumbnail_uri_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail URI.
+   * @param string $thumbnail_width_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail width.
+   * @param string $thumbnail_height_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail height.
+   * @param string|null $thumbnail_alt_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail alt.
+   *   "Thumbnail" will be used if the attribute name is not provided.
+   * @param string|null $thumbnail_title_metadata_attribute
+   *   (optional) The metadata attribute name to provide the thumbnail title.
+   *   The name of the media item will be used if the attribute name is not
+   *   provided.
+   * @param string $default_name_metadata_attribute
+   *   (optional) The metadata attribute name to provide the default name.
+   * @param class-string|null $deriver
+   *   (optional) The deriver class.
+   */
+  public function __construct(
+    public readonly string $id,
+    public readonly TranslatableMarkup $label,
+    public readonly ?TranslatableMarkup $description = NULL,
+    public readonly array $allowed_field_types = [],
+    public readonly array $forms = [],
+    public readonly array $providers = [],
+    public readonly string $default_thumbnail_filename = 'generic.png',
+    public readonly string $thumbnail_uri_metadata_attribute = 'thumbnail_uri',
+    public readonly string $thumbnail_width_metadata_attribute = 'thumbnail_width',
+    public readonly string $thumbnail_height_metadata_attribute = 'thumbnail_height',
+    public readonly ?string $thumbnail_alt_metadata_attribute = NULL,
+    public readonly ?string $thumbnail_title_metadata_attribute = NULL,
+    public readonly string $default_name_metadata_attribute = 'default_name',
+    public readonly ?string $deriver = NULL,
+  ) {}
+
+}

core/modules/media/src/Controller/MediaFilterController.php

@@ -0,0 +1,173 @@
+<?php
+
+namespace Drupal\media\Controller;
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Entity\ContentEntityStorageInterface;
+use Drupal\Core\Entity\EntityRepositoryInterface;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\filter\FilterFormatInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Controller which renders a preview of the provided text.
+ *
+ * @internal
+ *   This is an internal part of the media system in Drupal core and may be
+ *   subject to change in minor releases. This class should not be
+ *   instantiated or extended by external code.
+ */
+class MediaFilterController implements ContainerInjectionInterface {
+
+  /**
+   * The renderer service.
+   *
+   * @var \Drupal\Core\Render\RendererInterface
+   */
+  protected $renderer;
+
+  /**
+   * The media storage.
+   *
+   * @var \Drupal\Core\Entity\ContentEntityStorageInterface
+   */
+  protected $mediaStorage;
+
+  /**
+   * The entity repository.
+   *
+   * @var \Drupal\Core\Entity\EntityRepositoryInterface
+   */
+  protected $entityRepository;
+
+  /**
+   * Constructs an MediaFilterController instance.
+   *
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   * @param \Drupal\Core\Entity\ContentEntityStorageInterface $media_storage
+   *   The media storage.
+   * @param \Drupal\Core\Entity\EntityRepositoryInterface $entity_repository
+   *   The entity repository.
+   */
+  public function __construct(RendererInterface $renderer, ContentEntityStorageInterface $media_storage, EntityRepositoryInterface $entity_repository) {
+    $this->renderer = $renderer;
+    $this->mediaStorage = $media_storage;
+    $this->entityRepository = $entity_repository;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('renderer'),
+      $container->get('entity_type.manager')->getStorage('media'),
+      $container->get('entity.repository')
+    );
+  }
+
+  /**
+   * Returns a HTML response containing a preview of the text after filtering.
+   *
+   * Applies all of the given text format's filters, not just the `media_embed`
+   * filter, because for example `filter_align` and `filter_caption` may apply
+   * to it as well.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request object.
+   * @param \Drupal\filter\FilterFormatInterface $filter_format
+   *   The text format.
+   *
+   * @return \Symfony\Component\HttpFoundation\Response
+   *   The filtered text.
+   *
+   * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
+   *   Throws an exception if 'text' parameter is not found in the query
+   *   string.
+   *
+   * @see \Drupal\editor\EditorController::getUntransformedText
+   */
+  public function preview(Request $request, FilterFormatInterface $filter_format) {
+    self::checkCsrf($request, \Drupal::currentUser());
+
+    $text = $request->query->get('text');
+    $uuid = $request->query->get('uuid');
+    if ($text == '' || $uuid == '') {
+      throw new NotFoundHttpException();
+    }
+
+    $build = [
+      '#type' => 'processed_text',
+      '#text' => $text,
+      '#format' => $filter_format->id(),
+    ];
+    $html = $this->renderer->renderInIsolation($build);
+
+    // Load the media item so we can embed the label in the response, for use
+    // in an ARIA label.
+    $headers = [];
+    if ($media = $this->entityRepository->loadEntityByUuid('media', $uuid)) {
+      $headers['Drupal-Media-Label'] = $this->entityRepository->getTranslationFromContext($media)->label();
+    }
+
+    // Note that we intentionally do not use:
+    // - \Drupal\Core\Cache\CacheableResponse because caching it on the server
+    //   side is wasteful, hence there is no need for cacheability metadata.
+    // - \Drupal\Core\Render\HtmlResponse because there is no need for
+    //   attachments nor cacheability metadata.
+    return (new Response($html, 200, $headers))
+      // Do not allow any intermediary to cache the response, only the end user.
+      ->setPrivate()
+      // Allow the end user to cache it for up to 5 minutes.
+      ->setMaxAge(300);
+  }
+
+  /**
+   * Checks access based on media_embed filter status on the text format.
+   *
+   * @param \Drupal\filter\FilterFormatInterface $filter_format
+   *   The text format for which to check access.
+   *
+   * @return \Drupal\Core\Access\AccessResultInterface
+   *   The access result.
+   */
+  public static function formatUsesMediaEmbedFilter(FilterFormatInterface $filter_format) {
+    $filters = $filter_format->filters();
+    return AccessResult::allowedIf($filters->has('media_embed') && $filters->get('media_embed')->status)
+      ->addCacheableDependency($filter_format);
+  }
+
+  /**
+   * Throws an AccessDeniedHttpException if the request fails CSRF validation.
+   *
+   * This is used instead of \Drupal\Core\Access\CsrfAccessCheck, in order to
+   * allow access for anonymous users.
+   *
+   * @todo Refactor this to an access checker.
+   */
+  private static function checkCsrf(Request $request, AccountInterface $account) {
+    $header = 'X-Drupal-MediaPreview-CSRF-Token';
+
+    if (!$request->headers->has($header)) {
+      throw new AccessDeniedHttpException();
+    }
+    if ($account->isAnonymous()) {
+      // For anonymous users, just the presence of the custom header is
+      // sufficient protection.
+      return;
+    }
+    // For authenticated users, validate the token value.
+    $token = $request->headers->get($header);
+    if (!\Drupal::csrfToken()->validate($token, $header)) {
+      throw new AccessDeniedHttpException();
+    }
+  }
+
+}

core/modules/media/src/Controller/OEmbedIframeController.php

@@ -0,0 +1,225 @@
+<?php
+
+namespace Drupal\media\Controller;
+
+use Drupal\Component\Utility\Crypt;
+use Drupal\Core\Cache\CacheableMetadata;
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Render\BubbleableMetadata;
+use Drupal\Core\Render\HtmlResponse;
+use Drupal\Core\Render\RenderContext;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Url;
+use Drupal\media\IFrameMarkup;
+use Drupal\media\IFrameUrlHelper;
+use Drupal\media\OEmbed\ResourceException;
+use Drupal\media\OEmbed\ResourceFetcherInterface;
+use Drupal\media\OEmbed\UrlResolverInterface;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+
+/**
+ * Controller which renders an oEmbed resource in a bare page (without blocks).
+ *
+ * This controller is meant to render untrusted third-party HTML returned by
+ * an oEmbed provider in an iframe, so as to mitigate the potential dangers of
+ * of displaying third-party markup (i.e., XSS). The HTML returned by this
+ * controller should not be trusted, and should *never* be displayed outside
+ * of an iframe.
+ *
+ * @internal
+ *   This is an internal part of the media system in Drupal core and may be
+ *   subject to change in minor releases. This class should not be
+ *   instantiated or extended by external code.
+ */
+class OEmbedIframeController implements ContainerInjectionInterface {
+
+  /**
+   * The oEmbed resource fetcher service.
+   *
+   * @var \Drupal\media\OEmbed\ResourceFetcherInterface
+   */
+  protected $resourceFetcher;
+
+  /**
+   * The oEmbed URL resolver service.
+   *
+   * @var \Drupal\media\OEmbed\UrlResolverInterface
+   */
+  protected $urlResolver;
+
+  /**
+   * The renderer service.
+   *
+   * @var \Drupal\Core\Render\RendererInterface
+   */
+  protected $renderer;
+
+  /**
+   * The logger channel.
+   *
+   * @var \Psr\Log\LoggerInterface
+   */
+  protected $logger;
+
+  /**
+   * The iFrame URL helper service.
+   *
+   * @var \Drupal\media\IFrameUrlHelper
+   */
+  protected $iFrameUrlHelper;
+
+  /**
+   * Constructs an OEmbedIframeController instance.
+   *
+   * @param \Drupal\media\OEmbed\ResourceFetcherInterface $resource_fetcher
+   *   The oEmbed resource fetcher service.
+   * @param \Drupal\media\OEmbed\UrlResolverInterface $url_resolver
+   *   The oEmbed URL resolver service.
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   * @param \Psr\Log\LoggerInterface $logger
+   *   The logger channel.
+   * @param \Drupal\media\IFrameUrlHelper $iframe_url_helper
+   *   The iFrame URL helper service.
+   */
+  public function __construct(ResourceFetcherInterface $resource_fetcher, UrlResolverInterface $url_resolver, RendererInterface $renderer, LoggerInterface $logger, IFrameUrlHelper $iframe_url_helper) {
+    $this->resourceFetcher = $resource_fetcher;
+    $this->urlResolver = $url_resolver;
+    $this->renderer = $renderer;
+    $this->logger = $logger;
+    $this->iFrameUrlHelper = $iframe_url_helper;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('media.oembed.resource_fetcher'),
+      $container->get('media.oembed.url_resolver'),
+      $container->get('renderer'),
+      $container->get('logger.factory')->get('media'),
+      $container->get('media.oembed.iframe_url_helper')
+    );
+  }
+
+  /**
+   * Renders an oEmbed resource.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request object.
+   *
+   * @return \Symfony\Component\HttpFoundation\Response
+   *   The response object.
+   *
+   * @throws \Symfony\Component\HttpKernel\Exception\BadRequestHttpException
+   *   Will be thrown if either
+   *   - the 'hash' parameter does not match the expected hash of the 'url'
+   *     parameter;
+   *   - the iframe_domain is set in media.settings and does not match the host
+   *     in the request.
+   */
+  public function render(Request $request) {
+    // @todo Move domain check logic to a separate method.
+    $allowed_domain = \Drupal::config('media.settings')->get('iframe_domain');
+    if ($allowed_domain) {
+      $allowed_host = parse_url($allowed_domain, PHP_URL_HOST);
+      $host = parse_url($request->getSchemeAndHttpHost(), PHP_URL_HOST);
+      if ($allowed_host !== $host) {
+        throw new BadRequestHttpException('This resource is not available');
+      }
+    }
+
+    $url = $request->query->get('url');
+    $max_width = $request->query->getInt('max_width');
+    $max_height = $request->query->getInt('max_height');
+
+    // Hash the URL and max dimensions, and ensure it is equal to the hash
+    // parameter passed in the query string.
+    $hash = $this->iFrameUrlHelper->getHash($url, $max_width, $max_height);
+    if (!hash_equals($hash, $request->query->get('hash', ''))) {
+      throw new BadRequestHttpException('This resource is not available');
+    }
+
+    // Return a response instead of a render array so that the frame content
+    // will not have all the blocks and page elements normally rendered by
+    // Drupal.
+    $response = new HtmlResponse('', HtmlResponse::HTTP_OK, [
+      'Content-Type' => 'text/html; charset=UTF-8',
+    ]);
+    $response->addCacheableDependency(Url::createFromRequest($request));
+
+    try {
+      $resource_url = $this->urlResolver->getResourceUrl($url, $max_width, $max_height);
+      $resource = $this->resourceFetcher->fetchResource($resource_url);
+
+      $placeholder_token = Crypt::randomBytesBase64(55);
+
+      // Render the content in a new render context so that the cacheability
+      // metadata of the rendered HTML will be captured correctly.
+      $element = [
+        '#theme' => 'media_oembed_iframe',
+        '#resource' => $resource,
+        // Even though the resource HTML is untrusted, IFrameMarkup::create()
+        // will create a trusted string. The only reason this is okay is
+        // because we are serving it in an iframe, which will mitigate the
+        // potential dangers of displaying third-party markup.
+        '#media' => IFrameMarkup::create($resource->getHtml()),
+        '#cache' => [
+          // Add the 'rendered' cache tag as this response is not processed by
+          // \Drupal\Core\Render\MainContent\HtmlRenderer::renderResponse().
+          'tags' => ['rendered'],
+        ],
+        '#attached' => [
+          'html_response_attachment_placeholders' => [
+            'styles' => '<css-placeholder token="' . $placeholder_token . '">',
+          ],
+          'library' => [
+            'media/oembed.frame',
+          ],
+        ],
+        '#placeholder_token' => $placeholder_token,
+      ];
+      $context = new RenderContext();
+      $content = $this->renderer->executeInRenderContext($context, function () use ($element) {
+        return $this->renderer->render($element);
+      });
+      $response
+        ->setContent($content)
+        ->setAttachments($element['#attached'])
+        ->addCacheableDependency($resource)
+        ->addCacheableDependency(CacheableMetadata::createFromRenderArray($element));
+
+      // Modules and themes implementing hook_media_oembed_iframe_preprocess()
+      // can add additional #cache and #attachments to a render array. If this
+      // occurs, the render context won't be empty, and we need to ensure the
+      // added metadata is bubbled up to the response.
+      // @see \Drupal\Core\Theme\ThemeManager::render()
+      if (!$context->isEmpty()) {
+        $bubbleable_metadata = $context->pop();
+        assert($bubbleable_metadata instanceof BubbleableMetadata);
+        $response->addCacheableDependency($bubbleable_metadata);
+        $response->addAttachments($bubbleable_metadata->getAttachments());
+      }
+    }
+    catch (ResourceException $e) {
+      // Prevent the response from being cached.
+      $response->setMaxAge(0);
+
+      // The oEmbed system makes heavy use of exception wrapping, so log the
+      // entire exception chain to help with troubleshooting.
+      do {
+        // @todo Log additional information from ResourceException, to help with
+        // debugging, in https://www.drupal.org/project/drupal/issues/2972846.
+        $this->logger->error($e->getMessage());
+        $e = $e->getPrevious();
+      } while ($e);
+    }
+
+    return $response;
+  }
+
+}

core/modules/media/src/Entity/Media.php

@@ -0,0 +1,578 @@
+<?php
+
+namespace Drupal\media\Entity;
+
+use Drupal\Core\Entity\EditorialContentEntityBase;
+use Drupal\Core\Entity\EntityStorageInterface;
+use Drupal\Core\Entity\EntityTypeInterface;
+use Drupal\Core\Field\BaseFieldDefinition;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\media\MediaInterface;
+use Drupal\media\MediaSourceEntityConstraintsInterface;
+use Drupal\media\MediaSourceFieldConstraintsInterface;
+use Drupal\user\EntityOwnerTrait;
+
+/**
+ * Defines the media entity class.
+ *
+ * @todo Remove default/fallback entity form operation when #2006348 is done.
+ * @see https://www.drupal.org/node/2006348.
+ *
+ * @ContentEntityType(
+ *   id = "media",
+ *   label = @Translation("Media"),
+ *   label_singular = @Translation("media item"),
+ *   label_plural = @Translation("media items"),
+ *   label_count = @PluralTranslation(
+ *     singular = "@count media item",
+ *     plural = "@count media items"
+ *   ),
+ *   bundle_label = @Translation("Media type"),
+ *   handlers = {
+ *     "storage" = "Drupal\media\MediaStorage",
+ *     "view_builder" = "Drupal\Core\Entity\EntityViewBuilder",
+ *     "list_builder" = "Drupal\media\MediaListBuilder",
+ *     "access" = "Drupal\media\MediaAccessControlHandler",
+ *     "form" = {
+ *       "default" = "Drupal\media\MediaForm",
+ *       "add" = "Drupal\media\MediaForm",
+ *       "edit" = "Drupal\media\MediaForm",
+ *       "delete" = "Drupal\Core\Entity\ContentEntityDeleteForm",
+ *       "delete-multiple-confirm" = "Drupal\Core\Entity\Form\DeleteMultipleForm",
+ *       "revision-delete" = \Drupal\Core\Entity\Form\RevisionDeleteForm::class,
+ *       "revision-revert" = \Drupal\Core\Entity\Form\RevisionRevertForm::class,
+ *     },
+ *     "views_data" = "Drupal\media\MediaViewsData",
+ *     "route_provider" = {
+ *       "html" = "Drupal\media\Routing\MediaRouteProvider",
+ *       "revision" = \Drupal\Core\Entity\Routing\RevisionHtmlRouteProvider::class,
+ *     }
+ *   },
+ *   base_table = "media",
+ *   data_table = "media_field_data",
+ *   revision_table = "media_revision",
+ *   revision_data_table = "media_field_revision",
+ *   translatable = TRUE,
+ *   show_revision_ui = TRUE,
+ *   entity_keys = {
+ *     "id" = "mid",
+ *     "revision" = "vid",
+ *     "bundle" = "bundle",
+ *     "label" = "name",
+ *     "langcode" = "langcode",
+ *     "uuid" = "uuid",
+ *     "published" = "status",
+ *     "owner" = "uid",
+ *   },
+ *   revision_metadata_keys = {
+ *     "revision_user" = "revision_user",
+ *     "revision_created" = "revision_created",
+ *     "revision_log_message" = "revision_log_message",
+ *   },
+ *   bundle_entity_type = "media_type",
+ *   permission_granularity = "bundle",
+ *   admin_permission = "administer media",
+ *   field_ui_base_route = "entity.media_type.edit_form",
+ *   common_reference_target = TRUE,
+ *   links = {
+ *     "add-page" = "/media/add",
+ *     "add-form" = "/media/add/{media_type}",
+ *     "canonical" = "/media/{media}/edit",
+ *     "collection" = "/admin/content/media",
+ *     "delete-form" = "/media/{media}/delete",
+ *     "delete-multiple-form" = "/media/delete",
+ *     "edit-form" = "/media/{media}/edit",
+ *     "revision" = "/media/{media}/revisions/{media_revision}/view",
+ *     "revision-delete-form" = "/media/{media}/revision/{media_revision}/delete",
+ *     "revision-revert-form" = "/media/{media}/revision/{media_revision}/revert",
+ *     "version-history" = "/media/{media}/revisions",
+ *   }
+ * )
+ */
+class Media extends EditorialContentEntityBase implements MediaInterface {
+
+  use EntityOwnerTrait;
+  use StringTranslationTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getName() {
+    $name = $this->getEntityKey('label');
+
+    if (empty($name)) {
+      $media_source = $this->getSource();
+      return $media_source->getMetadata($this, $media_source->getPluginDefinition()['default_name_metadata_attribute']);
+    }
+
+    return $name;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function label() {
+    return $this->getName();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setName($name) {
+    return $this->set('name', $name);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getCreatedTime() {
+    return $this->get('created')->value;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setCreatedTime($timestamp) {
+    return $this->set('created', $timestamp);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getSource() {
+    return $this->bundle->entity->getSource();
+  }
+
+  /**
+   * Update the thumbnail for the media item.
+   *
+   * @param bool $from_queue
+   *   Specifies whether the thumbnail update is triggered from the queue.
+   *
+   * @return \Drupal\media\MediaInterface
+   *   The updated media item.
+   *
+   * @internal
+   *
+   * @todo There has been some disagreement about how to handle updates to
+   *   thumbnails. We need to decide on what the API will be for this.
+   *   https://www.drupal.org/node/2878119
+   */
+  protected function updateThumbnail($from_queue = FALSE) {
+    $this->thumbnail->target_id = $this->loadThumbnail($this->getThumbnailUri($from_queue))->id();
+    $this->thumbnail->width = $this->getThumbnailWidth($from_queue);
+    $this->thumbnail->height = $this->getThumbnailHeight($from_queue);
+
+    // Set the thumbnail alt.
+    $media_source = $this->getSource();
+    $plugin_definition = $media_source->getPluginDefinition();
+
+    $this->thumbnail->alt = '';
+    if (!empty($plugin_definition['thumbnail_alt_metadata_attribute'])) {
+      $this->thumbnail->alt = $media_source->getMetadata($this, $plugin_definition['thumbnail_alt_metadata_attribute']);
+    }
+
+    return $this;
+  }
+
+  /**
+   * Loads the file entity for the thumbnail.
+   *
+   * If the file entity does not exist, it will be created.
+   *
+   * @param string $thumbnail_uri
+   *   (optional) The URI of the thumbnail, used to load or create the file
+   *   entity. If omitted, the default thumbnail URI will be used.
+   *
+   * @return \Drupal\file\FileInterface
+   *   The thumbnail file entity.
+   */
+  protected function loadThumbnail($thumbnail_uri = NULL) {
+    $values = [
+      'uri' => $thumbnail_uri ?: $this->getDefaultThumbnailUri(),
+    ];
+
+    $file_storage = $this->entityTypeManager()->getStorage('file');
+
+    $existing = $file_storage->loadByProperties($values);
+    if ($existing) {
+      $file = reset($existing);
+    }
+    else {
+      /** @var \Drupal\file\FileInterface $file */
+      $file = $file_storage->create($values);
+      if ($owner = $this->getOwner()) {
+        $file->setOwner($owner);
+      }
+      $file->setPermanent();
+      $file->save();
+    }
+    return $file;
+  }
+
+  /**
+   * Returns the URI of the default thumbnail.
+   *
+   * @return string
+   *   The default thumbnail URI.
+   */
+  protected function getDefaultThumbnailUri() {
+    $default_thumbnail_filename = $this->getSource()->getPluginDefinition()['default_thumbnail_filename'];
+    return \Drupal::config('media.settings')->get('icon_base_uri') . '/' . $default_thumbnail_filename;
+  }
+
+  /**
+   * Updates the queued thumbnail for the media item.
+   *
+   * @return \Drupal\media\MediaInterface
+   *   The updated media item.
+   *
+   * @internal
+   *
+   * @todo If the need arises in contrib, consider making this a public API,
+   *   by adding an interface that extends MediaInterface.
+   */
+  public function updateQueuedThumbnail() {
+    $this->updateThumbnail(TRUE);
+    return $this;
+  }
+
+  /**
+   * Gets the URI for the thumbnail of a media item.
+   *
+   * If thumbnail fetching is queued, new media items will use the default
+   * thumbnail, and existing media items will use the current thumbnail, until
+   * the queue is processed and the updated thumbnail has been fetched.
+   * Otherwise, the new thumbnail will be fetched immediately.
+   *
+   * @param bool $from_queue
+   *   Specifies whether the thumbnail is being fetched from the queue.
+   *
+   * @return string
+   *   The file URI for the thumbnail of the media item.
+   *
+   * @internal
+   */
+  protected function getThumbnailUri($from_queue) {
+    $thumbnails_queued = $this->bundle->entity->thumbnailDownloadsAreQueued();
+    if ($thumbnails_queued && $this->isNew()) {
+      return $this->getDefaultThumbnailUri();
+    }
+    elseif ($thumbnails_queued && !$from_queue) {
+      return $this->get('thumbnail')->entity->getFileUri();
+    }
+
+    $source = $this->getSource();
+    return $source->getMetadata($this, $source->getPluginDefinition()['thumbnail_uri_metadata_attribute']);
+  }
+
+  /**
+   * Gets the width of the thumbnail of a media item.
+   *
+   * @param bool $from_queue
+   *   Specifies whether the thumbnail is being fetched from the queue.
+   *
+   * @return int|null
+   *   The width of the thumbnail of the media item or NULL if the media is new
+   *   and the thumbnails are set to be downloaded in a queue.
+   *
+   * @internal
+   */
+  protected function getThumbnailWidth(bool $from_queue): ?int {
+    $thumbnails_queued = $this->bundle->entity->thumbnailDownloadsAreQueued();
+    if ($thumbnails_queued && $this->isNew()) {
+      return NULL;
+    }
+    elseif ($thumbnails_queued && !$from_queue) {
+      return $this->get('thumbnail')->width;
+    }
+
+    $source = $this->getSource();
+    return $source->getMetadata($this, $source->getPluginDefinition()['thumbnail_width_metadata_attribute']);
+  }
+
+  /**
+   * Gets the height of the thumbnail of a media item.
+   *
+   * @param bool $from_queue
+   *   Specifies whether the thumbnail is being fetched from the queue.
+   *
+   * @return int|null
+   *   The height of the thumbnail of the media item or NULL if the media is new
+   *   and the thumbnails are set to be downloaded in a queue.
+   *
+   * @internal
+   */
+  protected function getThumbnailHeight(bool $from_queue): ?int {
+    $thumbnails_queued = $this->bundle->entity->thumbnailDownloadsAreQueued();
+    if ($thumbnails_queued && $this->isNew()) {
+      return NULL;
+    }
+    elseif ($thumbnails_queued && !$from_queue) {
+      return $this->get('thumbnail')->height;
+    }
+
+    $source = $this->getSource();
+    return $source->getMetadata($this, $source->getPluginDefinition()['thumbnail_height_metadata_attribute']);
+  }
+
+  /**
+   * Determines if the source field value has changed.
+   *
+   * The comparison uses MediaSourceInterface::getSourceFieldValue() to ensure
+   * that the correct property from the source field is used.
+   *
+   * @return bool
+   *   TRUE if the source field value changed, FALSE otherwise.
+   *
+   * @see \Drupal\media\MediaSourceInterface::getSourceFieldValue()
+   *
+   * @internal
+   */
+  protected function hasSourceFieldChanged() {
+    $source = $this->getSource();
+    return isset($this->original) && $source->getSourceFieldValue($this) !== $source->getSourceFieldValue($this->original);
+  }
+
+  /**
+   * Determines if the thumbnail should be updated for a media item.
+   *
+   * @param bool $is_new
+   *   Specifies whether the media item is new.
+   *
+   * @return bool
+   *   TRUE if the thumbnail should be updated, FALSE otherwise.
+   */
+  protected function shouldUpdateThumbnail($is_new = FALSE) {
+    // Update thumbnail if we don't have a thumbnail yet or when the source
+    // field value changes.
+    return !$this->get('thumbnail')->entity || $is_new || $this->hasSourceFieldChanged();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function preSave(EntityStorageInterface $storage) {
+    parent::preSave($storage);
+
+    if (!$this->getOwner()) {
+      $this->setOwnerId(0);
+    }
+
+    // If no thumbnail has been explicitly set, use the default thumbnail.
+    if ($this->get('thumbnail')->isEmpty()) {
+      $this->thumbnail->target_id = $this->loadThumbnail()->id();
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function postSave(EntityStorageInterface $storage, $update = TRUE) {
+    parent::postSave($storage, $update);
+    $is_new = !$update;
+    foreach ($this->translations as $langcode => $data) {
+      if ($this->hasTranslation($langcode)) {
+        $translation = $this->getTranslation($langcode);
+        if ($translation->bundle->entity->thumbnailDownloadsAreQueued() && $translation->shouldUpdateThumbnail($is_new)) {
+          \Drupal::queue('media_entity_thumbnail')->createItem(['id' => $translation->id()]);
+        }
+      }
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function preSaveRevision(EntityStorageInterface $storage, \stdClass $record) {
+    parent::preSaveRevision($storage, $record);
+
+    if (!$this->isNewRevision() && isset($this->original) && empty($record->revision_log_message)) {
+      // If we are updating an existing media item without adding a
+      // new revision, we need to make sure $entity->revision_log_message is
+      // reset whenever it is empty.
+      // Therefore, this code allows us to avoid clobbering an existing log
+      // entry with an empty one.
+      $this->setRevisionLogMessage($this->original->getRevisionLogMessage());
+    }
+  }
+
+  /**
+   * Sets the media entity's field values from the source's metadata.
+   *
+   * Fetching the metadata could be slow (e.g., if requesting it from a remote
+   * API), so this is called by \Drupal\media\MediaStorage::save() prior to it
+   * beginning the database transaction, whereas static::preSave() executes
+   * after the transaction has already started.
+   *
+   * @internal
+   *   Expose this as an API in
+   *   https://www.drupal.org/project/drupal/issues/2992426.
+   */
+  public function prepareSave() {
+    // @todo If the source plugin talks to a remote API (e.g. oEmbed), this code
+    // might be performing a fair number of HTTP requests. This is dangerously
+    // brittle and should probably be handled by a queue, to avoid doing HTTP
+    // operations during entity save. See
+    // https://www.drupal.org/project/drupal/issues/2976875 for more.
+
+    // In order for metadata to be mapped correctly, $this->original must be
+    // set. However, that is only set once parent::save() is called, so work
+    // around that by setting it here.
+    if (!isset($this->original) && $id = $this->id()) {
+      $this->original = $this->entityTypeManager()
+        ->getStorage('media')
+        ->loadUnchanged($id);
+    }
+
+    $media_source = $this->getSource();
+    foreach ($this->translations as $langcode => $data) {
+      if ($this->hasTranslation($langcode)) {
+        $translation = $this->getTranslation($langcode);
+        // Try to set fields provided by the media source and mapped in
+        // media type config.
+        foreach ($translation->bundle->entity->getFieldMap() as $metadata_attribute_name => $entity_field_name) {
+          // Only save value in the entity if the field is empty or if the
+          // source field changed.
+          if ($translation->hasField($entity_field_name) && ($translation->get($entity_field_name)->isEmpty() || $translation->hasSourceFieldChanged())) {
+            $translation->set($entity_field_name, $media_source->getMetadata($translation, $metadata_attribute_name));
+          }
+        }
+
+        // Try to set a default name for this media item if no name is provided.
+        if ($translation->get('name')->isEmpty()) {
+          $translation->setName($translation->getName());
+        }
+
+        // Set thumbnail.
+        if ($translation->shouldUpdateThumbnail($this->isNew())) {
+          $translation->updateThumbnail();
+        }
+      }
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validate() {
+    $media_source = $this->getSource();
+
+    if ($media_source instanceof MediaSourceEntityConstraintsInterface) {
+      $entity_constraints = $media_source->getEntityConstraints();
+      $this->getTypedData()->getDataDefinition()->setConstraints($entity_constraints);
+    }
+
+    if ($media_source instanceof MediaSourceFieldConstraintsInterface) {
+      $source_field_name = $media_source->getConfiguration()['source_field'];
+      $source_field_constraints = $media_source->getSourceFieldConstraints();
+      $this->get($source_field_name)->getDataDefinition()->setConstraints($source_field_constraints);
+    }
+
+    return parent::validate();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function baseFieldDefinitions(EntityTypeInterface $entity_type) {
+    $fields = parent::baseFieldDefinitions($entity_type);
+    $fields += static::ownerBaseFieldDefinitions($entity_type);
+
+    $fields['name'] = BaseFieldDefinition::create('string')
+      ->setLabel(t('Name'))
+      ->setRequired(TRUE)
+      ->setTranslatable(TRUE)
+      ->setRevisionable(TRUE)
+      ->setDefaultValue('')
+      ->setSetting('max_length', 255)
+      ->setDisplayOptions('form', [
+        'type' => 'string_textfield',
+        'weight' => -5,
+      ])
+      ->setDisplayConfigurable('form', TRUE)
+      ->setDisplayConfigurable('view', TRUE);
+
+    $fields['thumbnail'] = BaseFieldDefinition::create('image')
+      ->setLabel(t('Thumbnail'))
+      ->setDescription(t('The thumbnail of the media item.'))
+      ->setRevisionable(TRUE)
+      ->setTranslatable(TRUE)
+      ->setDisplayOptions('view', [
+        'type' => 'image',
+        'weight' => 5,
+        'label' => 'hidden',
+        'settings' => [
+          'image_style' => 'thumbnail',
+        ],
+      ])
+      ->setDisplayConfigurable('view', TRUE)
+      ->setReadOnly(TRUE);
+
+    $fields['uid']
+      ->setLabel(t('Authored by'))
+      ->setDescription(t('The user ID of the author.'))
+      ->setRevisionable(TRUE)
+      ->setDisplayOptions('form', [
+        'type' => 'entity_reference_autocomplete',
+        'weight' => 5,
+        'settings' => [
+          'match_operator' => 'CONTAINS',
+          'size' => '60',
+          'autocomplete_type' => 'tags',
+          'placeholder' => '',
+        ],
+      ])
+      ->setDisplayConfigurable('form', TRUE)
+      ->setDisplayOptions('view', [
+        'label' => 'hidden',
+        'type' => 'author',
+        'weight' => 0,
+      ])
+      ->setDisplayConfigurable('view', TRUE);
+
+    $fields['status']
+      ->setDisplayOptions('form', [
+        'type' => 'boolean_checkbox',
+        'settings' => [
+          'display_label' => TRUE,
+        ],
+        'weight' => 100,
+      ])
+      ->setDisplayConfigurable('form', TRUE);
+
+    $fields['created'] = BaseFieldDefinition::create('created')
+      ->setLabel(t('Authored on'))
+      ->setDescription(t('The time the media item was created.'))
+      ->setTranslatable(TRUE)
+      ->setRevisionable(TRUE)
+      ->setDefaultValueCallback(static::class . '::getRequestTime')
+      ->setDisplayOptions('form', [
+        'type' => 'datetime_timestamp',
+        'weight' => 10,
+      ])
+      ->setDisplayConfigurable('form', TRUE)
+      ->setDisplayOptions('view', [
+        'label' => 'hidden',
+        'type' => 'timestamp',
+        'weight' => 0,
+      ])
+      ->setDisplayConfigurable('view', TRUE);
+
+    $fields['changed'] = BaseFieldDefinition::create('changed')
+      ->setLabel(t('Changed'))
+      ->setDescription(t('The time the media item was last edited.'))
+      ->setTranslatable(TRUE)
+      ->setRevisionable(TRUE);
+
+    return $fields;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getRequestTime() {
+    return \Drupal::time()->getRequestTime();
+  }
+
+}

core/modules/media/src/Entity/MediaType.php

@@ -0,0 +1,244 @@
+<?php
+
+namespace Drupal\media\Entity;
+
+use Drupal\Core\Config\Entity\ConfigEntityBundleBase;
+use Drupal\Core\Entity\EntityWithPluginCollectionInterface;
+use Drupal\Core\Plugin\DefaultSingleLazyPluginCollection;
+use Drupal\media\MediaTypeInterface;
+
+/**
+ * Defines the Media type configuration entity.
+ *
+ * @ConfigEntityType(
+ *   id = "media_type",
+ *   label = @Translation("Media type"),
+ *   label_collection = @Translation("Media types"),
+ *   label_singular = @Translation("media type"),
+ *   label_plural = @Translation("media types"),
+ *   label_count = @PluralTranslation(
+ *     singular = "@count media type",
+ *     plural = "@count media types"
+ *   ),
+ *   handlers = {
+ *     "access" = "Drupal\media\MediaTypeAccessControlHandler",
+ *     "form" = {
+ *       "add" = "Drupal\media\MediaTypeForm",
+ *       "edit" = "Drupal\media\MediaTypeForm",
+ *       "delete" = "Drupal\media\Form\MediaTypeDeleteConfirmForm"
+ *     },
+ *     "list_builder" = "Drupal\media\MediaTypeListBuilder",
+ *     "route_provider" = {
+ *       "html" = "Drupal\Core\Entity\Routing\DefaultHtmlRouteProvider",
+ *       "permissions" = "Drupal\user\Entity\EntityPermissionsRouteProvider",
+ *     }
+ *   },
+ *   admin_permission = "administer media types",
+ *   config_prefix = "type",
+ *   bundle_of = "media",
+ *   entity_keys = {
+ *     "id" = "id",
+ *     "label" = "label",
+ *     "status" = "status",
+ *   },
+ *   config_export = {
+ *     "id",
+ *     "label",
+ *     "description",
+ *     "source",
+ *     "queue_thumbnail_downloads",
+ *     "new_revision",
+ *     "source_configuration",
+ *     "field_map",
+ *     "status",
+ *   },
+ *   links = {
+ *     "add-form" = "/admin/structure/media/add",
+ *     "edit-form" = "/admin/structure/media/manage/{media_type}",
+ *     "delete-form" = "/admin/structure/media/manage/{media_type}/delete",
+ *     "entity-permissions-form" = "/admin/structure/media/manage/{media_type}/permissions",
+ *     "collection" = "/admin/structure/media",
+ *   },
+ *   constraints = {
+ *     "ImmutableProperties" = {"id", "source"},
+ *     "MediaMappingsConstraint" = { },
+ *   }
+ * )
+ */
+class MediaType extends ConfigEntityBundleBase implements MediaTypeInterface, EntityWithPluginCollectionInterface {
+
+  /**
+   * The machine name of this media type.
+   *
+   * @var string
+   */
+  protected $id;
+
+  /**
+   * The human-readable name of the media type.
+   *
+   * @var string
+   */
+  protected $label;
+
+  /**
+   * A brief description of this media type.
+   *
+   * @var string
+   */
+  protected $description;
+
+  /**
+   * The media source ID.
+   *
+   * @var string
+   */
+  protected $source;
+
+  /**
+   * Whether media items should be published by default.
+   *
+   * @var bool
+   */
+  protected $status = TRUE;
+
+  /**
+   * Whether thumbnail downloads are queued.
+   *
+   * @var bool
+   *
+   * @see \Drupal\media\MediaTypeInterface::thumbnailDownloadsAreQueued()
+   */
+  protected $queue_thumbnail_downloads = FALSE;
+
+  /**
+   * Default value of the 'Create new revision' checkbox of this media type.
+   *
+   * @var bool
+   */
+  protected $new_revision = FALSE;
+
+  /**
+   * The media source configuration.
+   *
+   * A media source can provide a configuration form with source plugin-specific
+   * configuration settings, which must at least include a source_field element
+   * containing a the name of the source field for the media type. The source
+   * configuration is defined by, and used to load, the source plugin. See
+   * \Drupal\media\MediaTypeInterface for an explanation of media sources.
+   *
+   * @var array
+   *
+   * @see \Drupal\media\MediaTypeInterface::getSource()
+   */
+  protected $source_configuration = [];
+
+  /**
+   * Lazy collection for the media source.
+   *
+   * @var \Drupal\Core\Plugin\DefaultSingleLazyPluginCollection
+   */
+  protected $sourcePluginCollection;
+
+  /**
+   * The metadata field map.
+   *
+   * @var array
+   *
+   * @see \Drupal\media\MediaTypeInterface::getFieldMap()
+   */
+  protected $field_map = [];
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getPluginCollections() {
+    return [
+      'source_configuration' => $this->sourcePluginCollection(),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getDescription() {
+    return $this->description;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setDescription($description) {
+    return $this->set('description', $description);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function thumbnailDownloadsAreQueued() {
+    return $this->queue_thumbnail_downloads;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setQueueThumbnailDownloadsStatus($queue_thumbnail_downloads) {
+    return $this->set('queue_thumbnail_downloads', $queue_thumbnail_downloads);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getSource() {
+    return $this->sourcePluginCollection()->get($this->source);
+  }
+
+  /**
+   * Returns media source lazy plugin collection.
+   *
+   * @return \Drupal\Core\Plugin\DefaultSingleLazyPluginCollection|null
+   *   The tag plugin collection or NULL if the plugin ID was not set yet.
+   */
+  protected function sourcePluginCollection() {
+    if (!$this->sourcePluginCollection && $this->source) {
+      $this->sourcePluginCollection = new DefaultSingleLazyPluginCollection(\Drupal::service('plugin.manager.media.source'), $this->source, $this->source_configuration);
+    }
+    return $this->sourcePluginCollection;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getStatus() {
+    return $this->status;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function shouldCreateNewRevision() {
+    return $this->new_revision;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setNewRevision($new_revision) {
+    return $this->set('new_revision', $new_revision);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFieldMap() {
+    return $this->field_map;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setFieldMap(array $map) {
+    return $this->set('field_map', $map);
+  }
+
+}

core/modules/media/src/EventSubscriber/MediaConfigSubscriber.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace Drupal\media\EventSubscriber;
+
+use Drupal\Core\Cache\CacheTagsInvalidatorInterface;
+use Drupal\Core\Config\ConfigCrudEvent;
+use Drupal\Core\Config\ConfigEvents;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Routing\RouteBuilderInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Listens to the config save event for media.settings.
+ */
+class MediaConfigSubscriber implements EventSubscriberInterface {
+
+  /**
+   * The route builder.
+   *
+   * @var \Drupal\Core\Routing\RouteBuilderInterface
+   */
+  protected $routeBuilder;
+
+  /**
+   * The cache tags invalidator.
+   *
+   * @var \Drupal\Core\Cache\CacheTagsInvalidatorInterface
+   */
+  protected $cacheTagsInvalidator;
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * Constructs the MediaConfigSubscriber.
+   *
+   * @param \Drupal\Core\Routing\RouteBuilderInterface $router_builder
+   *   The route builder.
+   * @param \Drupal\Core\Cache\CacheTagsInvalidatorInterface $cache_tags_invalidator
+   *   The cache tags invalidator.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+   */
+  public function __construct(RouteBuilderInterface $router_builder, CacheTagsInvalidatorInterface $cache_tags_invalidator, EntityTypeManagerInterface $entity_type_manager) {
+    $this->routeBuilder = $router_builder;
+    $this->cacheTagsInvalidator = $cache_tags_invalidator;
+    $this->entityTypeManager = $entity_type_manager;
+  }
+
+  /**
+   * Updates entity type definitions and ensures routes are rebuilt when needed.
+   *
+   * @param \Drupal\Core\Config\ConfigCrudEvent $event
+   *   The ConfigCrudEvent to process.
+   */
+  public function onSave(ConfigCrudEvent $event) {
+    $saved_config = $event->getConfig();
+    if ($saved_config->getName() === 'media.settings' && $event->isChanged('standalone_url')) {
+      $this->cacheTagsInvalidator->invalidateTags([
+        // The configuration change triggers entity type definition changes,
+        // which in turn triggers routes to appear or disappear.
+        // @see media_entity_type_alter()
+        'entity_types',
+        // The 'rendered' cache tag needs to be explicitly invalidated to ensure
+        // that all links to Media entities are re-rendered. Ideally, this would
+        // not be necessary; invalidating the 'entity_types' cache tag should be
+        // sufficient. But that cache tag would then need to be on nearly
+        // everything, resulting in excessive complexity. We prefer pragmatism.
+        'rendered',
+      ]);
+      // @todo Remove this when invalidating the 'entity_types' cache tag is
+      // respected by the entity type plugin manager. See
+      // https://www.drupal.org/project/drupal/issues/3001284 and
+      // https://www.drupal.org/project/drupal/issues/3013659.
+      $this->entityTypeManager->clearCachedDefinitions();
+      $this->routeBuilder->setRebuildNeeded();
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events[ConfigEvents::SAVE][] = ['onSave'];
+    return $events;
+  }
+
+}

core/modules/media/src/Form/EditorMediaDialog.php

@@ -0,0 +1,338 @@
+<?php
+
+namespace Drupal\media\Form;
+
+use Drupal\Core\Entity\EntityRepositoryInterface;
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\editor\EditorInterface;
+use Drupal\Core\Ajax\AjaxResponse;
+use Drupal\Core\Ajax\HtmlCommand;
+use Drupal\editor\Ajax\EditorDialogSave;
+use Drupal\Core\Ajax\CloseModalDialogCommand;
+use Drupal\filter\Plugin\FilterInterface;
+use Drupal\image\Plugin\Field\FieldType\ImageItem;
+use Drupal\media\MediaInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Drupal\Core\Entity\EntityDisplayRepositoryInterface;
+
+/**
+ * Provides a media embed dialog for text editors.
+ *
+ * Depending on the configuration of the filters associated with the text
+ * editor, this dialog allows users to set the alt text, alignment, and
+ * captioning status for embedded media items.
+ *
+ * @deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. There is no
+ * replacement.
+ *
+ * @see https://www.drupal.org/node/3291493
+ *
+ * @internal
+ *   This is an internal part of the media system in Drupal core and may be
+ *   subject to change in minor releases. This class should not be
+ *   instantiated or extended by external code.
+ */
+class EditorMediaDialog extends FormBase {
+
+  /**
+   * The entity repository.
+   *
+   * @var \Drupal\Core\Entity\EntityRepositoryInterface
+   */
+  protected $entityRepository;
+
+  /**
+   * The entity display repository.
+   *
+   * @var \Drupal\Core\Entity\EntityDisplayRepositoryInterface
+   */
+  protected $entityDisplayRepository;
+
+  /**
+   * Constructs a EditorMediaDialog object.
+   *
+   * @param \Drupal\Core\Entity\EntityRepositoryInterface $entity_repository
+   *   The entity repository.
+   * @param \Drupal\Core\Entity\EntityDisplayRepositoryInterface $entity_display_repository
+   *   The entity display repository.
+   */
+  public function __construct(EntityRepositoryInterface $entity_repository, EntityDisplayRepositoryInterface $entity_display_repository) {
+    @trigger_error(__NAMESPACE__ . '\EditorMediaDialog is deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. There is no replacement. See https://www.drupal.org/node/3291493', E_USER_DEPRECATED);
+    $this->entityRepository = $entity_repository;
+    $this->entityDisplayRepository = $entity_display_repository;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('entity.repository'),
+      $container->get('entity_display.repository')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'editor_media_dialog';
+  }
+
+  /**
+   * {@inheritdoc}
+   *
+   * @param array $form
+   *   A nested array form elements comprising the form.
+   * @param \Drupal\Core\Form\FormStateInterface $form_state
+   *   The current state of the form.
+   * @param \Drupal\editor\EditorInterface $editor
+   *   The text editor to which this dialog corresponds.
+   */
+  public function buildForm(array $form, FormStateInterface $form_state, ?EditorInterface $editor = NULL) {
+    // This form is special, in that the default values do not come from the
+    // server side, but from the client side, from a text editor. We must cache
+    // this data in form state, because when the form is rebuilt, we will be
+    // receiving values from the form, instead of the values from the text
+    // editor. If we don't cache it, this data will be lost. By convention,
+    // the data that the text editor sends to any dialog is in the
+    // 'editor_object' key.
+    if (isset($form_state->getUserInput()['editor_object'])) {
+      $editor_object = $form_state->getUserInput()['editor_object'];
+      // The data that the text editor sends to any dialog is in
+      // the 'editor_object' key.
+      $media_embed_element = $editor_object['attributes'];
+      $form_state->set('media_embed_element', $media_embed_element);
+      $has_caption = $editor_object['hasCaption'];
+      $form_state
+        ->set('hasCaption', $has_caption)
+        ->setCached(TRUE);
+    }
+    else {
+      // Retrieve the user input from form state.
+      $media_embed_element = $form_state->get('media_embed_element');
+      $has_caption = $form_state->get('hasCaption');
+    }
+
+    $form['#tree'] = TRUE;
+    $form['#attached']['library'][] = 'editor/drupal.editor.dialog';
+    $form['#prefix'] = '<div id="editor-media-dialog-form">';
+    $form['#suffix'] = '</div>';
+
+    $filters = $editor->getFilterFormat()->filters();
+    $filter_html = $filters->get('filter_html');
+    $filter_align = $filters->get('filter_align');
+    $filter_caption = $filters->get('filter_caption');
+    $media_embed_filter = $filters->get('media_embed');
+
+    $allowed_attributes = [];
+    if ($filter_html->status) {
+      $restrictions = $filter_html->getHTMLRestrictions();
+      $allowed_attributes = $restrictions['allowed']['drupal-media'];
+    }
+
+    $media = $this->entityRepository->loadEntityByUuid('media', $media_embed_element['data-entity-uuid']);
+
+    if ($image_field_name = $this->getMediaImageSourceFieldName($media)) {
+      // We'll want the alt text from the same language as the host.
+      if (!empty($editor_object['hostEntityLangcode']) && $media->hasTranslation($editor_object['hostEntityLangcode'])) {
+        $media = $media->getTranslation($editor_object['hostEntityLangcode']);
+      }
+      $settings = $media->{$image_field_name}->getItemDefinition()->getSettings();
+      $alt = $media_embed_element['alt'] ?? NULL;
+      $form['alt'] = [
+        '#type' => 'textfield',
+        '#title' => $this->t('Alternate text'),
+        '#default_value' => $alt,
+        '#description' => $this->t('Short description of the image used by screen readers and displayed when the image is not loaded. This is important for accessibility.'),
+        '#required_error' => $this->t('Alternative text is required.<br />(Only in rare cases should this be left empty. To create empty alternative text, enter <code>""</code> — two double quotes without any content).'),
+        '#maxlength' => 2048,
+        '#placeholder' => $media->{$image_field_name}->alt,
+        '#parents' => ['attributes', 'alt'],
+        '#access' => !empty($settings['alt_field']) && ($filter_html->status === FALSE || !empty($allowed_attributes['alt'])),
+      ];
+    }
+
+    // When Drupal core's filter_align is being used, the text editor offers the
+    // ability to change the alignment.
+    $form['align'] = [
+      '#title' => $this->t('Align'),
+      '#type' => 'radios',
+      '#options' => [
+        'none' => $this->t('None'),
+        'left' => $this->t('Left'),
+        'center' => $this->t('Center'),
+        'right' => $this->t('Right'),
+      ],
+      '#default_value' => empty($media_embed_element['data-align']) ? 'none' : $media_embed_element['data-align'],
+      '#attributes' => ['class' => ['container-inline']],
+      '#parents' => ['attributes', 'data-align'],
+      '#access' => $filter_align->status && ($filter_html->status === FALSE || !empty($allowed_attributes['data-align'])),
+    ];
+
+    // When Drupal core's filter_caption is being used, the text editor offers
+    // the ability to in-place edit the media's caption: show a toggle.
+    $form['caption'] = [
+      '#title' => $this->t('Caption'),
+      '#type' => 'checkbox',
+      '#default_value' => $has_caption === 'true',
+      '#parents' => ['hasCaption'],
+      '#access' => $filter_caption->status && ($filter_html->status === FALSE || !empty($allowed_attributes['data-caption'])),
+    ];
+
+    $view_mode_options = array_intersect_key($this->entityDisplayRepository->getViewModeOptionsByBundle('media', $media->bundle()), $media_embed_filter->settings['allowed_view_modes']);
+    $default_view_mode = static::getViewModeDefaultValue($view_mode_options, $media_embed_filter, $media_embed_element['data-view-mode'] ?? NULL);
+
+    $form['view_mode'] = [
+      '#title' => $this->t("Display"),
+      '#type' => 'select',
+      '#options' => $view_mode_options,
+      '#default_value' => $default_view_mode,
+      '#parents' => ['attributes', 'data-view-mode'],
+      '#access' => count($view_mode_options) >= 2,
+    ];
+
+    // Store the default from the MediaEmbed filter, so that if the selected
+    // view mode matches the default, we can drop the 'data-view-mode'
+    // attribute.
+    $form_state->set('filter_default_view_mode', $media_embed_filter->settings['default_view_mode']);
+
+    if ((empty($form['alt']) || $form['alt']['#access'] === FALSE) && $form['align']['#access'] === FALSE && $form['caption']['#access'] === FALSE && $form['view_mode']['#access'] === FALSE) {
+      $format = $editor->getFilterFormat();
+      $warning = $this->t('There is nothing to configure for this media.');
+      $form['no_access_notice'] = ['#markup' => $warning];
+      if ($format->access('update')) {
+        $arguments = [
+          '@warning' => $warning,
+          '@edit_url' => $format->toUrl('edit-form')->toString(),
+          '%format' => $format->label(),
+        ];
+        $form['no_access_notice']['#markup'] = $this->t('@warning <a href="@edit_url">Edit the text format %format</a> to modify the attributes that can be overridden.', $arguments);
+      }
+    }
+
+    $form['actions'] = [
+      '#type' => 'actions',
+    ];
+    $form['actions']['save_modal'] = [
+      '#type' => 'submit',
+      '#value' => $this->t('Save'),
+      // No regular submit-handler. This form only works via JavaScript.
+      '#submit' => [],
+      '#ajax' => [
+        'callback' => '::submitForm',
+        'event' => 'click',
+      ],
+      // Prevent this hidden element from being tabbable.
+      '#attributes' => [
+        'tabindex' => -1,
+      ],
+    ];
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $response = new AjaxResponse();
+
+    // When the `alt` attribute is set to two double quotes, transform it to the
+    // empty string: two double quotes signify "empty alt attribute". See above.
+    if (trim($form_state->getValue(['attributes', 'alt'], '')) === '""') {
+      $form_state->setValue(['attributes', 'alt'], '""');
+    }
+
+    // The `alt` attribute is optional: if it isn't set, the default value
+    // simply will not be overridden. It's important to set it to FALSE
+    // instead of unsetting the value.  This way we explicitly inform
+    // the client side about the new value.
+    if ($form_state->hasValue(['attributes', 'alt']) && trim($form_state->getValue(['attributes', 'alt'])) === '') {
+      $form_state->setValue(['attributes', 'alt'], FALSE);
+    }
+
+    // If the selected view mode matches the default on the filter, remove the
+    // attribute.
+    if (!empty($form_state->get('filter_default_view_mode')) && $form_state->getValue(['attributes', 'data-view-mode']) === $form_state->get('filter_default_view_mode')) {
+      $form_state->setValue(['attributes', 'data-view-mode'], FALSE);
+    }
+
+    if ($form_state->getErrors()) {
+      unset($form['#prefix'], $form['#suffix']);
+      $form['status_messages'] = [
+        '#type' => 'status_messages',
+        '#weight' => -10,
+      ];
+      $response->addCommand(new HtmlCommand('#editor-media-dialog-form', $form));
+    }
+    else {
+      // Only send back the relevant values.
+      $values = [
+        'hasCaption' => $form_state->getValue('hasCaption'),
+        'attributes' => $form_state->getValue('attributes'),
+      ];
+      $response->addCommand(new EditorDialogSave($values));
+      $response->addCommand(new CloseModalDialogCommand());
+    }
+
+    return $response;
+  }
+
+  /**
+   * Gets the default value for the view mode form element.
+   *
+   * @param array $view_mode_options
+   *   The array of options for the view mode form element.
+   * @param \Drupal\filter\Plugin\FilterInterface $media_embed_filter
+   *   The media embed filter.
+   * @param string $media_element_view_mode_attribute
+   *   The data-view-mode attribute on the <drupal-media> element.
+   *
+   * @return string|null
+   *   The default value for the view mode form element.
+   */
+  public static function getViewModeDefaultValue(array $view_mode_options, FilterInterface $media_embed_filter, $media_element_view_mode_attribute) {
+    // The select element won't display without at least two options, so if
+    // that's the case, just return NULL.
+    if (count($view_mode_options) < 2) {
+      return NULL;
+    }
+
+    $filter_default_view_mode = $media_embed_filter->settings['default_view_mode'];
+
+    // If the current media embed ($media_embed_element) has a set view mode,
+    // we want to use that as the default in the select form element,
+    // otherwise we'll want to use the default for all embedded media.
+    if (!empty($media_element_view_mode_attribute) && array_key_exists($media_element_view_mode_attribute, $view_mode_options)) {
+      return $media_element_view_mode_attribute;
+    }
+    elseif (array_key_exists($filter_default_view_mode, $view_mode_options)) {
+      return $filter_default_view_mode;
+    }
+
+    return NULL;
+  }
+
+  /**
+   * Gets the name of an image media item's source field.
+   *
+   * @param \Drupal\media\MediaInterface $media
+   *   The media item being embedded.
+   *
+   * @return string|null
+   *   The name of the image source field configured for the media item, or
+   *   NULL if the source field is not an image field.
+   */
+  protected function getMediaImageSourceFieldName(MediaInterface $media) {
+    $field_definition = $media->getSource()
+      ->getSourceFieldDefinition($media->bundle->entity);
+    $item_class = $field_definition->getItemDefinition()->getClass();
+    if (is_a($item_class, ImageItem::class, TRUE)) {
+      return $field_definition->getName();
+    }
+    return NULL;
+  }
+
+}

core/modules/media/src/Form/MediaSettingsForm.php

@@ -0,0 +1,121 @@
+<?php
+
+namespace Drupal\media\Form;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Config\TypedConfigManagerInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Form\ConfigTarget;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Form\ConfigFormBase;
+use Drupal\media\IFrameUrlHelper;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides a form to configure Media settings.
+ *
+ * @internal
+ */
+class MediaSettingsForm extends ConfigFormBase {
+
+  /**
+   * The iFrame URL helper service.
+   *
+   * @var \Drupal\media\IFrameUrlHelper
+   */
+  protected $iFrameUrlHelper;
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * MediaSettingsForm constructor.
+   *
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory service.
+   * @param \Drupal\Core\Config\TypedConfigManagerInterface $typedConfigManager
+   *   The typed config manager.
+   * @param \Drupal\media\IFrameUrlHelper $iframe_url_helper
+   *   The iFrame URL helper service.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+   */
+  public function __construct(ConfigFactoryInterface $config_factory, TypedConfigManagerInterface $typedConfigManager, IFrameUrlHelper $iframe_url_helper, EntityTypeManagerInterface $entity_type_manager) {
+    parent::__construct($config_factory, $typedConfigManager);
+    $this->iFrameUrlHelper = $iframe_url_helper;
+    $this->entityTypeManager = $entity_type_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('config.factory'),
+      $container->get('config.typed'),
+      $container->get('media.oembed.iframe_url_helper'),
+      $container->get('entity_type.manager')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'media_settings_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getEditableConfigNames() {
+    return ['media.settings'];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state) {
+    $domain = $this->config('media.settings')->get('iframe_domain');
+
+    if (!$this->iFrameUrlHelper->isSecure($domain)) {
+      $message = $this->t('It is potentially insecure to display oEmbed content in a frame that is served from the same domain as your main Drupal site, as this may allow execution of third-party code. Refer to <a href="https://oembed.com/#section3">oEmbed Security Considerations</a>.');
+      $this->messenger()->addWarning($message);
+    }
+
+    $description = '<p>' . $this->t('Displaying media assets from third-party services, such as YouTube or Twitter, can be risky. This is because many of these services return arbitrary HTML to represent those assets, and that HTML may contain executable JavaScript code. If handled improperly, this can increase the risk of your site being compromised.') . '</p>';
+    $description .= '<p>' . $this->t('In order to mitigate the risks, third-party assets are displayed in an iFrame, which effectively sandboxes any executable code running inside it. For even more security, the iFrame can be served from an alternate domain (that also points to your Drupal site), which you can configure on this page. This helps safeguard cookies and other sensitive information.') . '</p>';
+
+    $form['security'] = [
+      '#type' => 'details',
+      '#title' => $this->t('Security'),
+      '#description' => $description,
+      '#open' => TRUE,
+    ];
+    // @todo Figure out how and if we should validate that this domain actually
+    // points back to Drupal.
+    // See https://www.drupal.org/project/drupal/issues/2965979 for more info.
+    $form['security']['iframe_domain'] = [
+      '#type' => 'url',
+      '#title' => $this->t('iFrame domain'),
+      '#size' => 40,
+      '#maxlength' => 255,
+      '#config_target' => new ConfigTarget('media.settings', 'iframe_domain', toConfig: fn(?string $value) => $value ?: NULL),
+      '#description' => $this->t('Enter a different domain from which to serve oEmbed content, including the <em>http://</em> or <em>https://</em> prefix. This domain needs to point back to this site, or existing oEmbed content may not display correctly, or at all.'),
+    ];
+
+    $form['security']['standalone_url'] = [
+      '#prefix' => '<hr>',
+      '#type' => 'checkbox',
+      '#title' => $this->t('Standalone media URL'),
+      '#config_target' => 'media.settings:standalone_url',
+      '#description' => $this->t("Allow users to access @media-entities at /media/{id}.", ['@media-entities' => $this->entityTypeManager->getDefinition('media')->getPluralLabel()]),
+    ];
+    return parent::buildForm($form, $form_state);
+  }
+
+}

core/modules/media/src/Form/MediaTypeDeleteConfirmForm.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace Drupal\media\Form;
+
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Entity\EntityDeleteForm;
+use Drupal\Core\Form\FormStateInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides a form for media type deletion.
+ *
+ * @internal
+ */
+class MediaTypeDeleteConfirmForm extends EntityDeleteForm {
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * Constructs a new MediaTypeDeleteConfirm object.
+   *
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+   */
+  public function __construct(EntityTypeManagerInterface $entity_type_manager) {
+    $this->entityTypeManager = $entity_type_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('entity_type.manager')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state) {
+    $num_entities = $this->entityTypeManager->getStorage('media')->getQuery()
+      ->accessCheck(FALSE)
+      ->condition('bundle', $this->entity->id())
+      ->count()
+      ->execute();
+    if ($num_entities) {
+      $form['#title'] = $this->getQuestion();
+      $form['description'] = [
+        '#type' => 'inline_template',
+        '#template' => '<p>{{ message }}</p>',
+        '#context' => [
+          'message' => $this->formatPlural($num_entities,
+            '%type is used by @count media item on your site. You can not remove this media type until you have removed all of the %type media items.',
+            '%type is used by @count media items on your site. You can not remove this media type until you have removed all of the %type media items.',
+            ['%type' => $this->entity->label()]),
+        ],
+      ];
+
+      return $form;
+    }
+
+    return parent::buildForm($form, $form_state);
+  }
+
+}

core/modules/media/src/IFrameMarkup.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Component\Render\MarkupInterface;
+use Drupal\Component\Render\MarkupTrait;
+
+/**
+ * Defines an object that wraps oEmbed markup for use in an iFrame.
+ *
+ * This object is not constructed with a known safe string as the strings come
+ * from an external site. It must not be used outside the Media module's oEmbed
+ * iframe rendering.
+ *
+ * @internal
+ *   This object is an internal part of the oEmbed system and should only be
+ *   used in \Drupal\media\Controller\OEmbedIframeController.
+ *
+ * @see \Drupal\media\Controller\OEmbedIframeController
+ */
+class IFrameMarkup implements MarkupInterface {
+  use MarkupTrait;
+
+}

core/modules/media/src/IFrameUrlHelper.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Component\Utility\Crypt;
+use Drupal\Core\PrivateKey;
+use Drupal\Core\Routing\RequestContext;
+use Drupal\Core\Site\Settings;
+
+/**
+ * Providers helper functions for displaying oEmbed resources in an iFrame.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+class IFrameUrlHelper {
+
+  /**
+   * The request context service.
+   *
+   * @var \Drupal\Core\Routing\RequestContext
+   */
+  protected $requestContext;
+
+  /**
+   * The private key service.
+   *
+   * @var \Drupal\Core\PrivateKey
+   */
+  protected $privateKey;
+
+  /**
+   * IFrameUrlHelper constructor.
+   *
+   * @param \Drupal\Core\Routing\RequestContext $request_context
+   *   The request context service.
+   * @param \Drupal\Core\PrivateKey $private_key
+   *   The private key service.
+   */
+  public function __construct(RequestContext $request_context, PrivateKey $private_key) {
+    $this->requestContext = $request_context;
+    $this->privateKey = $private_key;
+  }
+
+  /**
+   * Hashes an oEmbed resource URL.
+   *
+   * @param string $url
+   *   The resource URL.
+   * @param int $max_width
+   *   (optional) The maximum width of the resource.
+   * @param int $max_height
+   *   (optional) The maximum height of the resource.
+   *
+   * @return string
+   *   The hashed URL.
+   */
+  public function getHash($url, $max_width = NULL, $max_height = NULL) {
+    return Crypt::hmacBase64("$url:$max_width:$max_height", $this->privateKey->get() . Settings::getHashSalt());
+  }
+
+  /**
+   * Checks if an oEmbed URL can be securely displayed in an frame.
+   *
+   * @param string $url
+   *   The URL to check.
+   *
+   * @return bool
+   *   TRUE if the URL is considered secure, otherwise FALSE.
+   */
+  public function isSecure($url) {
+    if (!$url) {
+      return FALSE;
+    }
+    $url_host = parse_url($url, PHP_URL_HOST);
+    $system_host = parse_url($this->requestContext->getCompleteBaseUrl(), PHP_URL_HOST);
+
+    // The URL is secure if its domain is not the same as the domain of the base
+    // URL of the current request.
+    return $url_host && $system_host && $url_host !== $system_host;
+  }
+
+}

core/modules/media/src/MediaAccessControlHandler.php

@@ -0,0 +1,162 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Entity\EntityAccessControlHandler;
+use Drupal\Core\Entity\EntityHandlerInterface;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Entity\EntityTypeInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Session\AccountInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Defines an access control handler for media items.
+ */
+class MediaAccessControlHandler extends EntityAccessControlHandler implements EntityHandlerInterface {
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * Constructs a MediaAccessControlHandler object.
+   *
+   * @param \Drupal\Core\Entity\EntityTypeInterface $entity_type
+   *   The entity type definition.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+   */
+  public function __construct(EntityTypeInterface $entity_type, EntityTypeManagerInterface $entity_type_manager) {
+    parent::__construct($entity_type);
+    $this->entityTypeManager = $entity_type_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function createInstance(ContainerInterface $container, EntityTypeInterface $entity_type) {
+    return new static(
+      $entity_type,
+      $container->get('entity_type.manager'),
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
+    /** @var \Drupal\media\MediaInterface $entity */
+    // Allow admin permission to override all operations.
+    if ($account->hasPermission($this->entityType->getAdminPermission())) {
+      return AccessResult::allowed()->cachePerPermissions();
+    }
+
+    $type = $entity->bundle();
+    $is_owner = ($account->id() && $account->id() === $entity->getOwnerId());
+    switch ($operation) {
+      case 'view':
+        if ($entity->isPublished()) {
+          $access_result = AccessResult::allowedIf($account->hasPermission('view media'))
+            ->cachePerPermissions()
+            ->addCacheableDependency($entity);
+          if (!$access_result->isAllowed()) {
+            $access_result->setReason("The 'view media' permission is required when the media item is published.");
+          }
+        }
+        elseif ($account->hasPermission('view own unpublished media')) {
+          $access_result = AccessResult::allowedIf($is_owner)
+            ->cachePerPermissions()
+            ->cachePerUser()
+            ->addCacheableDependency($entity);
+          if (!$access_result->isAllowed()) {
+            $access_result->setReason("The user must be the owner and the 'view own unpublished media' permission is required when the media item is unpublished.");
+          }
+        }
+        else {
+          $access_result = AccessResult::neutral()
+            ->cachePerPermissions()
+            ->addCacheableDependency($entity)
+            ->setReason("The user must be the owner and the 'view own unpublished media' permission is required when the media item is unpublished.");
+        }
+        return $access_result;
+
+      case 'update':
+        if ($account->hasPermission('edit any ' . $type . ' media')) {
+          return AccessResult::allowed()->cachePerPermissions();
+        }
+        if ($account->hasPermission('edit own ' . $type . ' media') && $is_owner) {
+          return AccessResult::allowed()->cachePerPermissions()->cachePerUser()->addCacheableDependency($entity);
+        }
+        // @todo Deprecate this permission in
+        // https://www.drupal.org/project/drupal/issues/2925459.
+        if ($account->hasPermission('update any media')) {
+          return AccessResult::allowed()->cachePerPermissions();
+        }
+        if ($account->hasPermission('update media') && $is_owner) {
+          return AccessResult::allowed()->cachePerPermissions()->cachePerUser()->addCacheableDependency($entity);
+        }
+        return AccessResult::neutral("The following permissions are required: 'update any media' OR 'update own media' OR '$type: edit any media' OR '$type: edit own media'.")->cachePerPermissions();
+
+      case 'delete':
+        if ($account->hasPermission('delete any ' . $type . ' media')) {
+          return AccessResult::allowed()->cachePerPermissions();
+        }
+        if ($account->hasPermission('delete own ' . $type . ' media') && $is_owner) {
+          return AccessResult::allowed()->cachePerPermissions()->cachePerUser()->addCacheableDependency($entity);
+        }
+        // @todo Deprecate this permission in
+        // https://www.drupal.org/project/drupal/issues/2925459.
+        if ($account->hasPermission('delete any media')) {
+          return AccessResult::allowed()->cachePerPermissions();
+        }
+        if ($account->hasPermission('delete media') && $is_owner) {
+          return AccessResult::allowed()->cachePerPermissions()->cachePerUser()->addCacheableDependency($entity);
+        }
+        return AccessResult::neutral("The following permissions are required: 'delete any media' OR 'delete own media' OR '$type: delete any media' OR '$type: delete own media'.")->cachePerPermissions();
+
+      case 'view all revisions':
+      case 'view revision':
+        if ($account->hasPermission('view any ' . $type . ' media revisions') || $account->hasPermission("view all media revisions")) {
+          // Check the access to this revision and if the media passed in is not
+          // the default revision then access to that too.
+          $entity_access = $entity->access('view', $account, TRUE);
+          if (!$entity->isDefaultRevision()) {
+            $media_storage = $this->entityTypeManager->getStorage($entity->getEntityTypeId());
+            $entity_access->andIf($this->access($media_storage->load($entity->id()), 'view', $account, TRUE));
+          }
+
+          return AccessResult::allowed()->cachePerPermissions()->andIf($entity_access);
+        }
+        return AccessResult::neutral()->cachePerPermissions();
+
+      case 'revert':
+        return AccessResult::allowedIfHasPermission($account, 'revert any ' . $type . ' media revisions')
+          ->cachePerPermissions()->addCacheableDependency($entity);
+
+      case 'delete revision':
+        return AccessResult::allowedIfHasPermission($account, 'delete any ' . $type . ' media revisions')
+          ->cachePerPermissions()->addCacheableDependency($entity);
+
+      default:
+        return AccessResult::neutral()->cachePerPermissions();
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) {
+    $permissions = [
+      'administer media',
+      'create media',
+      'create ' . $entity_bundle . ' media',
+    ];
+    return AccessResult::allowedIfHasPermissions($account, $permissions, 'OR');
+  }
+
+}

core/modules/media/src/MediaConfigUpdater.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+
+/**
+ * Provides a BC layer for modules providing old configurations.
+ *
+ * @internal
+ *   This class is only meant to fix outdated media configuration and its
+ *   methods should not be invoked directly. It will be removed once all the
+ *   associated updates have been removed.
+ */
+class MediaConfigUpdater {
+
+  /**
+   * Flag determining whether deprecations should be triggered.
+   *
+   * @var bool
+   */
+  private $deprecationsEnabled = FALSE;
+
+  /**
+   * Stores which deprecations were triggered.
+   *
+   * @var bool
+   */
+  private $triggeredDeprecations = [];
+
+  /**
+   * Sets the deprecations enabling status.
+   *
+   * @param bool $enabled
+   *   Whether deprecations should be enabled.
+   */
+  public function setDeprecationsEnabled(bool $enabled): void {
+    $this->deprecationsEnabled = $enabled;
+  }
+
+  /**
+   * Processes oembed type fields.
+   *
+   * @param \Drupal\Core\Entity\Display\EntityViewDisplayInterface $view_display
+   *   The view display.
+   *
+   * @return bool
+   *   Whether the display was updated.
+   */
+  public function processOembedEagerLoadField(EntityViewDisplayInterface $view_display): bool {
+    $changed = FALSE;
+
+    foreach ($view_display->getComponents() as $field => $component) {
+      if (array_key_exists('type', $component)
+        && ($component['type'] === 'oembed')
+        && !array_key_exists('loading', $component['settings'])) {
+        $component['settings']['loading']['attribute'] = 'eager';
+        $view_display->setComponent($field, $component);
+        $changed = TRUE;
+      }
+    }
+
+    $deprecations_triggered = &$this->triggeredDeprecations['3212351'][$view_display->id()];
+    if ($this->deprecationsEnabled && $changed && !$deprecations_triggered) {
+      $deprecations_triggered = TRUE;
+      @trigger_error(sprintf('The oEmbed loading attribute update for view display "%s" is deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. Profile, module and theme provided configuration should be updated. See https://www.drupal.org/node/3275103', $view_display->id()), E_USER_DEPRECATED);
+    }
+
+    return $changed;
+  }
+
+}

core/modules/media/src/MediaForm.php

@@ -0,0 +1,88 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Entity\ContentEntityForm;
+use Drupal\Core\Form\FormStateInterface;
+
+/**
+ * Form controller for the media edit forms.
+ *
+ * @internal
+ */
+class MediaForm extends ContentEntityForm {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function form(array $form, FormStateInterface $form_state) {
+    $form = parent::form($form, $form_state);
+    /** @var \Drupal\media\MediaTypeInterface $media_type */
+    $media_type = $this->entity->bundle->entity;
+
+    if ($this->operation === 'edit') {
+      $form['#title'] = $this->t('Edit %type_label @label', [
+        '%type_label' => $media_type->label(),
+        '@label' => $this->entity->label(),
+      ]);
+    }
+
+    // Media author information for administrators.
+    if (isset($form['uid']) || isset($form['created'])) {
+      $form['author'] = [
+        '#type' => 'details',
+        '#title' => $this->t('Authoring information'),
+        '#group' => 'advanced',
+        '#attributes' => [
+          'class' => ['media-form-author'],
+        ],
+        '#weight' => 90,
+        '#optional' => TRUE,
+      ];
+    }
+
+    if (isset($form['uid'])) {
+      $form['uid']['#group'] = 'author';
+    }
+
+    if (isset($form['created'])) {
+      $form['created']['#group'] = 'author';
+    }
+
+    $form['#attached']['library'][] = 'media/form';
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function save(array $form, FormStateInterface $form_state) {
+    $saved = parent::save($form, $form_state);
+    $context = ['@type' => $this->entity->bundle(), '%label' => $this->entity->label(), 'link' => $this->entity->toLink($this->t('View'))->toString()];
+    $logger = $this->logger('media');
+    $t_args = ['@type' => $this->entity->bundle->entity->label(), '%label' => $this->entity->toLink($this->entity->label())->toString()];
+
+    if ($saved === SAVED_NEW) {
+      $logger->info('@type: added %label.', $context);
+      $this->messenger()->addStatus($this->t('@type %label has been created.', $t_args));
+    }
+    else {
+      $logger->info('@type: updated %label.', $context);
+      $this->messenger()->addStatus($this->t('@type %label has been updated.', $t_args));
+    }
+
+    // Redirect the user to the media overview if the user has the 'access media
+    // overview' permission. If not, redirect to the canonical URL of the media
+    // item.
+    if ($this->currentUser()->hasPermission('access media overview')) {
+      $form_state->setRedirectUrl($this->entity->toUrl('collection'));
+    }
+    else {
+      $form_state->setRedirectUrl($this->entity->toUrl());
+    }
+
+    return $saved;
+  }
+
+}

core/modules/media/src/MediaInterface.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Entity\EntityChangedInterface;
+use Drupal\Core\Entity\ContentEntityInterface;
+use Drupal\Core\Entity\EntityPublishedInterface;
+use Drupal\Core\Entity\RevisionLogInterface;
+use Drupal\user\EntityOwnerInterface;
+
+/**
+ * Provides an interface defining an entity for media items.
+ */
+interface MediaInterface extends ContentEntityInterface, EntityChangedInterface, RevisionLogInterface, EntityOwnerInterface, EntityPublishedInterface {
+
+  /**
+   * Gets the media item name.
+   *
+   * @return string
+   *   The name of the media item.
+   */
+  public function getName();
+
+  /**
+   * Sets the media item name.
+   *
+   * @param string $name
+   *   The name of the media item.
+   *
+   * @return $this
+   */
+  public function setName($name);
+
+  /**
+   * Returns the media item creation timestamp.
+   *
+   * @todo Remove and use the new interface when #2833378 is done.
+   * @see https://www.drupal.org/node/2833378
+   *
+   * @return int
+   *   Creation timestamp of the media item.
+   */
+  public function getCreatedTime();
+
+  /**
+   * Sets the media item creation timestamp.
+   *
+   * @todo Remove and use the new interface when #2833378 is done.
+   * @see https://www.drupal.org/node/2833378
+   *
+   * @param int $timestamp
+   *   The media creation timestamp.
+   *
+   * @return $this
+   *   The called media item.
+   */
+  public function setCreatedTime($timestamp);
+
+  /**
+   * Returns the media source.
+   *
+   * @return \Drupal\media\MediaSourceInterface
+   *   The media source.
+   */
+  public function getSource();
+
+}

core/modules/media/src/MediaListBuilder.php

@@ -0,0 +1,162 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Datetime\DateFormatterInterface;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Entity\EntityListBuilder;
+use Drupal\Core\Entity\EntityStorageInterface;
+use Drupal\Core\Entity\EntityTypeInterface;
+use Drupal\Core\Language\LanguageManagerInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides a listing of media items.
+ */
+class MediaListBuilder extends EntityListBuilder {
+
+  /**
+   * The date formatter service.
+   *
+   * @var \Drupal\Core\Datetime\DateFormatterInterface
+   */
+  protected $dateFormatter;
+
+  /**
+   * The language manager service.
+   *
+   * @var \Drupal\Core\Language\LanguageManagerInterface
+   */
+  protected $languageManager;
+
+  /**
+   * Indicates whether the 'thumbnail' image style exists.
+   *
+   * @var bool
+   */
+  protected $thumbnailStyleExists = FALSE;
+
+  /**
+   * Constructs a new MediaListBuilder object.
+   *
+   * @param \Drupal\Core\Entity\EntityTypeInterface $entity_type
+   *   The entity type definition.
+   * @param \Drupal\Core\Entity\EntityStorageInterface $storage
+   *   The entity storage class.
+   * @param \Drupal\Core\Datetime\DateFormatterInterface $date_formatter
+   *   The date formatter service.
+   * @param \Drupal\Core\Language\LanguageManagerInterface $language_manager
+   *   The language manager service.
+   * @param \Drupal\Core\Entity\EntityStorageInterface $image_style_storage
+   *   The entity storage class for image styles.
+   */
+  public function __construct(EntityTypeInterface $entity_type, EntityStorageInterface $storage, DateFormatterInterface $date_formatter, LanguageManagerInterface $language_manager, EntityStorageInterface $image_style_storage) {
+    parent::__construct($entity_type, $storage);
+
+    $this->dateFormatter = $date_formatter;
+    $this->languageManager = $language_manager;
+    $this->thumbnailStyleExists = !empty($image_style_storage->load('thumbnail'));
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function createInstance(ContainerInterface $container, EntityTypeInterface $entity_type) {
+    $entity_type_manager = $container->get('entity_type.manager');
+    return new static(
+      $entity_type,
+      $entity_type_manager->getStorage($entity_type->id()),
+      $container->get('date.formatter'),
+      $container->get('language_manager'),
+      $entity_type_manager->getStorage('image_style')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildHeader() {
+    $header = [];
+    if ($this->thumbnailStyleExists) {
+      $header['thumbnail'] = [
+        'data' => $this->t('Thumbnail'),
+        'class' => [RESPONSIVE_PRIORITY_LOW],
+      ];
+    }
+    $header += [
+      'name' => $this->t('Media Name'),
+      'type' => [
+        'data' => $this->t('Type'),
+        'class' => [RESPONSIVE_PRIORITY_MEDIUM],
+      ],
+      'author' => [
+        'data' => $this->t('Author'),
+        'class' => [RESPONSIVE_PRIORITY_LOW],
+      ],
+      'status' => $this->t('Status'),
+      'changed' => [
+        'data' => $this->t('Updated'),
+        'class' => [RESPONSIVE_PRIORITY_LOW],
+      ],
+    ];
+    // Enable language column if multiple languages are added.
+    if ($this->languageManager->isMultilingual()) {
+      $header['language'] = [
+        'data' => $this->t('Language'),
+        'class' => [RESPONSIVE_PRIORITY_LOW],
+      ];
+    }
+    return $header + parent::buildHeader();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildRow(EntityInterface $entity) {
+    /** @var \Drupal\media\MediaInterface $entity */
+    if ($this->thumbnailStyleExists) {
+      $row['thumbnail'] = [];
+      if ($thumbnail_uri = $entity->getSource()->getMetadata($entity, 'thumbnail_uri')) {
+        $row['thumbnail']['data'] = [
+          '#theme' => 'image_style',
+          '#style_name' => 'thumbnail',
+          '#uri' => $thumbnail_uri,
+          '#height' => 50,
+        ];
+      }
+    }
+    $row['name']['data'] = [
+      '#type' => 'link',
+      '#title' => $entity->label(),
+      '#url' => $entity->toUrl(),
+    ];
+    $row['type'] = $entity->bundle->entity->label();
+    $row['author']['data'] = [
+      '#theme' => 'username',
+      '#account' => $entity->getOwner(),
+    ];
+    $row['status'] = $entity->isPublished() ? $this->t('Published') : $this->t('Unpublished');
+    $row['changed'] = $this->dateFormatter->format($entity->getChangedTime(), 'short');
+
+    if ($this->languageManager->isMultilingual()) {
+      $row['language'] = $this->languageManager->getLanguageName($entity->language()->getId());
+    }
+    return $row + parent::buildRow($entity);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getEntityIds() {
+    $query = $this->getStorage()->getQuery()
+      ->accessCheck(TRUE)
+      ->sort('changed', 'DESC');
+
+    // Only add the pager if a limit is specified.
+    if ($this->limit) {
+      $query->pager($this->limit);
+    }
+    return $query->execute();
+  }
+
+}

core/modules/media/src/MediaPermissions.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Entity\BundlePermissionHandlerTrait;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides dynamic permissions for each media type.
+ */
+class MediaPermissions implements ContainerInjectionInterface {
+  use BundlePermissionHandlerTrait;
+  use StringTranslationTrait;
+
+  /**
+   * The entity type manager service.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * MediaPermissions constructor.
+   *
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager service.
+   */
+  public function __construct(EntityTypeManagerInterface $entity_type_manager) {
+    $this->entityTypeManager = $entity_type_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static($container->get('entity_type.manager'));
+  }
+
+  /**
+   * Returns an array of media type permissions.
+   *
+   * @return array
+   *   The media type permissions.
+   *
+   * @see \Drupal\user\PermissionHandlerInterface::getPermissions()
+   */
+  public function mediaTypePermissions() {
+    // Generate media permissions for all media types.
+    $media_types = $this->entityTypeManager->getStorage('media_type')->loadMultiple();
+    return $this->generatePermissions($media_types, [$this, 'buildPermissions']);
+  }
+
+  /**
+   * Returns a list of media permissions for a given media type.
+   *
+   * @param \Drupal\media\MediaTypeInterface $type
+   *   The media type.
+   *
+   * @return array
+   *   An associative array of permission names and descriptions.
+   */
+  protected function buildPermissions(MediaTypeInterface $type) {
+    $type_id = $type->id();
+    $type_params = ['%type_name' => $type->label()];
+
+    return [
+      "create $type_id media" => [
+        'title' => $this->t('%type_name: Create new media', $type_params),
+      ],
+      "edit own $type_id media" => [
+        'title' => $this->t('%type_name: Edit own media', $type_params),
+      ],
+      "edit any $type_id media" => [
+        'title' => $this->t('%type_name: Edit any media', $type_params),
+      ],
+      "delete own $type_id media" => [
+        'title' => $this->t('%type_name: Delete own media', $type_params),
+      ],
+      "delete any $type_id media" => [
+        'title' => $this->t('%type_name: Delete any media', $type_params),
+      ],
+      "view any $type_id media revisions" => [
+        'title' => $this->t('%type_name: View any media revision pages', $type_params),
+      ],
+      "revert any $type_id media revisions" => [
+        'title' => $this->t('Revert %type_name: Revert media revisions', $type_params),
+      ],
+      "delete any $type_id media revisions" => [
+        'title' => $this->t('Delete %type_name: Delete media revisions', $type_params),
+      ],
+    ];
+  }
+
+}

core/modules/media/src/MediaSourceBase.php

@@ -0,0 +1,368 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Component\Utility\NestedArray;
+use Drupal\Core\Entity\Display\EntityFormDisplayInterface;
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\Core\Entity\EntityFieldManagerInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Field\FieldTypePluginManagerInterface;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Plugin\PluginBase;
+use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Base implementation of media source plugin.
+ */
+abstract class MediaSourceBase extends PluginBase implements MediaSourceInterface, ContainerFactoryPluginInterface {
+
+  /**
+   * Plugin label.
+   *
+   * @var string
+   */
+  protected $label;
+
+  /**
+   * The entity type manager service.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * The entity field manager service.
+   *
+   * @var \Drupal\Core\Entity\EntityFieldManagerInterface
+   */
+  protected $entityFieldManager;
+
+  /**
+   * The field type plugin manager service.
+   *
+   * @var \Drupal\Core\Field\FieldTypePluginManagerInterface
+   */
+  protected $fieldTypeManager;
+
+  /**
+   * The config factory service.
+   *
+   * @var \Drupal\Core\Config\ConfigFactoryInterface
+   */
+  protected $configFactory;
+
+  /**
+   * Constructs a new class instance.
+   *
+   * @param array $configuration
+   *   A configuration array containing information about the plugin instance.
+   * @param string $plugin_id
+   *   The plugin_id for the plugin instance.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   Entity type manager service.
+   * @param \Drupal\Core\Entity\EntityFieldManagerInterface $entity_field_manager
+   *   Entity field manager service.
+   * @param \Drupal\Core\Field\FieldTypePluginManagerInterface $field_type_manager
+   *   The field type plugin manager service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory service.
+   */
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, EntityTypeManagerInterface $entity_type_manager, EntityFieldManagerInterface $entity_field_manager, FieldTypePluginManagerInterface $field_type_manager, ConfigFactoryInterface $config_factory) {
+    parent::__construct($configuration, $plugin_id, $plugin_definition);
+    $this->entityTypeManager = $entity_type_manager;
+    $this->entityFieldManager = $entity_field_manager;
+    $this->fieldTypeManager = $field_type_manager;
+    $this->configFactory = $config_factory;
+
+    // Add the default configuration of the media source to the plugin.
+    $this->setConfiguration($configuration);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get('entity_type.manager'),
+      $container->get('entity_field.manager'),
+      $container->get('plugin.manager.field.field_type'),
+      $container->get('config.factory')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setConfiguration(array $configuration) {
+    $this->configuration = NestedArray::mergeDeep(
+      $this->defaultConfiguration(),
+      $configuration
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getConfiguration() {
+    return $this->configuration;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function defaultConfiguration() {
+    return [
+      'source_field' => '',
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getMetadata(MediaInterface $media, $attribute_name) {
+    switch ($attribute_name) {
+      case 'default_name':
+        return 'media:' . $media->bundle() . ':' . $media->uuid();
+
+      case 'thumbnail_uri':
+        $default_thumbnail_filename = $this->pluginDefinition['default_thumbnail_filename'];
+        return $this->configFactory->get('media.settings')->get('icon_base_uri') . '/' . $default_thumbnail_filename;
+    }
+
+    return NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function calculateDependencies() {
+    return [];
+  }
+
+  /**
+   * Get the source field options for the media type form.
+   *
+   * This returns all fields related to media entities, filtered by the allowed
+   * field types in the media source annotation.
+   *
+   * @return string[]
+   *   A list of source field options for the media type form.
+   */
+  protected function getSourceFieldOptions() {
+    // If there are existing fields to choose from, allow the user to reuse one.
+    $options = [];
+    foreach ($this->entityFieldManager->getFieldStorageDefinitions('media') as $field_name => $field) {
+      $allowed_type = in_array($field->getType(), $this->pluginDefinition['allowed_field_types'], TRUE);
+      if ($allowed_type && !$field->isBaseField()) {
+        $options[$field_name] = $field->getLabel();
+      }
+    }
+    return $options;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
+    $options = $this->getSourceFieldOptions();
+    $form['source_field'] = [
+      '#type' => 'select',
+      '#title' => $this->t('Field with source information'),
+      '#default_value' => $this->configuration['source_field'],
+      '#empty_option' => $this->t('- Create -'),
+      '#options' => $options,
+      '#description' => $this->t('Select the field that will store essential information about the media item. If "Create" is selected a new field will be automatically created.'),
+    ];
+
+    if (!$options && $form_state->get('operation') === 'add') {
+      $form['source_field']['#access'] = FALSE;
+      $field_definition = $this->fieldTypeManager->getDefinition(reset($this->pluginDefinition['allowed_field_types']));
+      $form['source_field_message'] = [
+        '#markup' => $this->t('%field_type field will be automatically created on this type to store the essential information about the media item.', [
+          '%field_type' => $field_definition['label'],
+        ]),
+      ];
+    }
+    elseif ($form_state->get('operation') === 'edit') {
+      $form['source_field']['#access'] = FALSE;
+      $fields = $this->entityFieldManager->getFieldDefinitions('media', $form_state->get('type')->id());
+      $form['source_field_message'] = [
+        '#markup' => $this->t('%field_name field is used to store the essential information about the media item.', [
+          '%field_name' => $fields[$this->configuration['source_field']]->getLabel(),
+        ]),
+      ];
+    }
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateConfigurationForm(array &$form, FormStateInterface $form_state) {
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitConfigurationForm(array &$form, FormStateInterface $form_state) {
+    foreach (array_intersect_key($form_state->getValues(), $this->configuration) as $config_key => $config_value) {
+      $this->configuration[$config_key] = $config_value;
+    }
+
+    // If no source field is explicitly set, create it now.
+    if (empty($this->configuration['source_field'])) {
+      $field_storage = $this->createSourceFieldStorage();
+      $field_storage->save();
+      $this->configuration['source_field'] = $field_storage->getName();
+    }
+  }
+
+  /**
+   * Creates the source field storage definition.
+   *
+   * By default, the first field type listed in the plugin definition's
+   * allowed_field_types array will be the generated field's type.
+   *
+   * @return \Drupal\field\FieldStorageConfigInterface
+   *   The unsaved field storage definition.
+   */
+  protected function createSourceFieldStorage() {
+    return $this->entityTypeManager
+      ->getStorage('field_storage_config')
+      ->create([
+        'entity_type' => 'media',
+        'field_name' => $this->getSourceFieldName(),
+        'type' => reset($this->pluginDefinition['allowed_field_types']),
+      ]);
+  }
+
+  /**
+   * Returns the source field storage definition.
+   *
+   * @return \Drupal\Core\Field\FieldStorageDefinitionInterface|null
+   *   The field storage definition or NULL if it doesn't exists.
+   */
+  protected function getSourceFieldStorage() {
+    // Nothing to do if no source field is configured yet.
+    $field = $this->configuration['source_field'];
+    if ($field) {
+      // Even if we do know the name of the source field, there's no
+      // guarantee that it exists.
+      $fields = $this->entityFieldManager->getFieldStorageDefinitions('media');
+      return $fields[$field] ?? NULL;
+    }
+    return NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getSourceFieldDefinition(MediaTypeInterface $type) {
+    // Nothing to do if no source field is configured yet.
+    $field = $this->configuration['source_field'];
+    if ($field) {
+      // Even if we do know the name of the source field, there is no
+      // guarantee that it already exists.
+      $fields = $this->entityFieldManager->getFieldDefinitions('media', $type->id());
+      return $fields[$field] ?? NULL;
+    }
+    return NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createSourceField(MediaTypeInterface $type) {
+    $storage = $this->getSourceFieldStorage() ?: $this->createSourceFieldStorage();
+    return $this->entityTypeManager
+      ->getStorage('field_config')
+      ->create([
+        'field_storage' => $storage,
+        'bundle' => $type->id(),
+        'label' => $this->pluginDefinition['label'],
+        'required' => TRUE,
+      ]);
+  }
+
+  /**
+   * Determine the name of the source field.
+   *
+   * @return string
+   *   The source field name. If one is already stored in configuration, it is
+   *   returned. Otherwise, a new, unused one is generated.
+   */
+  protected function getSourceFieldName() {
+    // If the Field UI module is installed, and has a specific prefix
+    // configured, use that. Otherwise, just default to using 'field_' as
+    // a prefix, which is the default that Field UI ships with.
+    $prefix = $this->configFactory->get('field_ui.settings')
+      ->get('field_prefix') ?? 'field_';
+    // Some media sources are using a deriver, so their plugin IDs may contain
+    // a separator (usually ':') which is not allowed in field names.
+    $base_id = $prefix . 'media_' . str_replace(static::DERIVATIVE_SEPARATOR, '_', $this->getPluginId());
+    $tries = 0;
+    $storage = $this->entityTypeManager->getStorage('field_storage_config');
+
+    // Iterate at least once, until no field with the generated ID is found.
+    do {
+      $id = $base_id;
+      // If we've tried before, increment and append the suffix.
+      if ($tries) {
+        $id .= '_' . $tries;
+      }
+      $field = $storage->load('media.' . $id);
+      $tries++;
+    } while ($field);
+
+    return $id;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getSourceFieldValue(MediaInterface $media) {
+    $source_field = $this->configuration['source_field'];
+    if (empty($source_field)) {
+      throw new \RuntimeException('Source field for media source is not defined.');
+    }
+
+    $items = $media->get($source_field);
+    if ($items->isEmpty()) {
+      return NULL;
+    }
+
+    $field_item = $items->first();
+    return $field_item->{$field_item->mainPropertyName()};
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function prepareViewDisplay(MediaTypeInterface $type, EntityViewDisplayInterface $display) {
+    $display->setComponent($this->getSourceFieldDefinition($type)->getName(), [
+      'label' => 'visually_hidden',
+    ]);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function prepareFormDisplay(MediaTypeInterface $type, EntityFormDisplayInterface $display) {
+    // Make sure the source field is placed just after the "name" basefield.
+    $name_component = $display->getComponent('name');
+    $source_field_weight = ($name_component && isset($name_component['weight'])) ? $name_component['weight'] + 5 : -50;
+    $display->setComponent($this->getSourceFieldDefinition($type)->getName(), [
+      'weight' => $source_field_weight,
+    ]);
+  }
+
+}

core/modules/media/src/MediaSourceEntityConstraintsInterface.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Drupal\media;
+
+/**
+ * Defines an interface for a media source with entity constraints.
+ *
+ * This allows a media source to optionally add entity validation constraints
+ * for media items. To add constraints at the source field level, a media source
+ * can also implement MediaSourceFieldConstraintsInterface.
+ *
+ * @see \Drupal\media\MediaSourceInterface
+ * @see \Drupal\media\MediaSourceFieldConstraintsInterface.php
+ * @see \Drupal\media\MediaSourceBase
+ * @see \Drupal\media\Entity\Media
+ */
+interface MediaSourceEntityConstraintsInterface extends MediaSourceInterface {
+
+  /**
+   * Gets media source-specific validation constraints for a media item.
+   *
+   * @return \Symfony\Component\Validator\Constraint[]
+   *   An array of validation constraint definitions, keyed by plugin IDs. The
+   *   corresponding values are options for each validation plugin.
+   *   Each constraint definition can be used for instantiating
+   *   \Symfony\Component\Validator\Constraint objects.
+   */
+  public function getEntityConstraints();
+
+}

core/modules/media/src/MediaSourceFieldConstraintsInterface.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Drupal\media;
+
+/**
+ * Defines an interface for a media source with source field constraints.
+ *
+ * This allows a media source to optionally add source field validation
+ * constraints for media items. To add constraints at the entity level, a
+ * media source can also implement MediaSourceEntityConstraintsInterface.
+ *
+ * @see \Drupal\media\MediaSourceInterface
+ * @see \Drupal\media\MediaSourceEntityConstraintsInterface
+ * @see \Drupal\media\MediaSourceBase
+ * @see \Drupal\media\Entity\Media
+ */
+interface MediaSourceFieldConstraintsInterface extends MediaSourceInterface {
+
+  /**
+   * Gets media source-specific validation constraints for a source field.
+   *
+   * @return \Symfony\Component\Validator\Constraint[]
+   *   An array of validation constraint definitions, keyed by plugin IDs. The
+   *   corresponding values are options for each validation plugin.
+   *   Each constraint definition can be used for instantiating
+   *   \Symfony\Component\Validator\Constraint objects.
+   */
+  public function getSourceFieldConstraints();
+
+}

core/modules/media/src/MediaSourceInterface.php

@@ -0,0 +1,195 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Component\Plugin\ConfigurableInterface;
+use Drupal\Component\Plugin\DependentPluginInterface;
+use Drupal\Component\Plugin\PluginInspectionInterface;
+use Drupal\Core\Entity\Display\EntityFormDisplayInterface;
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\Core\Plugin\PluginFormInterface;
+
+/**
+ * Defines the interface for media source plugins.
+ *
+ * Media sources provide the critical link between media items in Drupal and the
+ * actual media itself, which typically exists independently of Drupal. Each
+ * media source works with a certain kind of media. For example, local files and
+ * YouTube videos can both be catalogued in a similar way as media items, but
+ * they need very different handling to actually display them.
+ *
+ * Each media type needs exactly one source. A single source can be used on many
+ * media types.
+ *
+ * Examples of possible sources are:
+ * - File: handles local files,
+ * - Image: handles local images,
+ * - oEmbed: handles resources that are exposed through the oEmbed standard,
+ * - YouTube: handles YouTube videos,
+ * - SoundCloud: handles SoundCloud audio,
+ * - Instagram: handles Instagram posts,
+ * - Twitter: handles tweets,
+ * - ...
+ *
+ * Their responsibilities are:
+ * - Defining how media is represented (stored). Media sources are not
+ *   responsible for actually storing the media. They only define how it is
+ *   represented on a media item (usually using some kind of a field).
+ * - Providing thumbnails. Media sources that are responsible for remote
+ *   media will generally fetch the image from a third-party API and make
+ *   it available for the local usage. Media sources that represent local
+ *   media (such as images) will usually use some locally provided image.
+ *   Media sources should fall back to a pre-defined default thumbnail if
+ *   everything else fails.
+ * - Validating a media item before it is saved. The entity constraint system
+ *   will be used to ensure the valid structure of the media item.
+ *   For example, media sources that represent remote media might check the
+ *   URL or other identifier, while sources that represent local files might
+ *   check the MIME type of the file.
+ * - Providing a default name for a media item. This will save users from
+ *   manually entering the name when it can be reliably set automatically.
+ *   Media sources for local files will generally use the filename, while media
+ *   sources for remote resources might obtain a title attribute through a
+ *   third-party API. The name can always be overridden by the user.
+ * - Providing metadata specific to the given media type. For example, remote
+ *   media sources generally get information available through a
+ *   third-party API and make it available to Drupal, while local media sources
+ *   can expose things such as EXIF or ID3.
+ * - Mapping metadata to the media item. Metadata that a media source exposes
+ *   can automatically be mapped to the fields on the media item. Media
+ *   sources will be able to define how this is done.
+ *
+ * @see \Drupal\media\Annotation\MediaSource
+ * @see \Drupal\media\MediaSourceBase
+ * @see \Drupal\media\MediaSourceManager
+ * @see \Drupal\media\MediaTypeInterface
+ * @see \Drupal\media\MediaSourceEntityConstraintsInterface
+ * @see \Drupal\media\MediaSourceFieldConstraintsInterface
+ * @see plugin_api
+ */
+interface MediaSourceInterface extends PluginInspectionInterface, ConfigurableInterface, DependentPluginInterface, PluginFormInterface {
+
+  /**
+   * Default empty value for metadata fields.
+   */
+  const METADATA_FIELD_EMPTY = '_none';
+
+  /**
+   * Gets a list of metadata attributes provided by this plugin.
+   *
+   * Most media sources have associated metadata, describing attributes
+   * such as:
+   * - dimensions
+   * - duration
+   * - encoding
+   * - date
+   * - location
+   * - permalink
+   * - licensing information
+   * - ...
+   *
+   * This method should list all metadata attributes that a media source MAY
+   * offer. In other words: it is possible that a particular media item does
+   * not contain a certain attribute. For example: an oEmbed media source can
+   * contain both video and images. Images don't have a duration, but
+   * videos do.
+   *
+   * (The term 'attributes' was chosen because it cannot be confused
+   * with 'fields' and 'properties', both of which are concepts in Drupal's
+   * Entity Field API.)
+   *
+   * @return array
+   *   Associative array with:
+   *   - keys: metadata attribute names
+   *   - values: human-readable labels for those attribute names
+   */
+  public function getMetadataAttributes();
+
+  /**
+   * Gets the value for a metadata attribute for a given media item.
+   *
+   * @param \Drupal\media\MediaInterface $media
+   *   A media item.
+   * @param string $attribute_name
+   *   Name of the attribute to fetch.
+   *
+   * @return mixed|null
+   *   Metadata attribute value or NULL if unavailable.
+   */
+  public function getMetadata(MediaInterface $media, $attribute_name);
+
+  /**
+   * Get the source field definition for a media type.
+   *
+   * @param \Drupal\media\MediaTypeInterface $type
+   *   A media type.
+   *
+   * @return \Drupal\Core\Field\FieldDefinitionInterface|null
+   *   The source field definition, or NULL if it doesn't exist or has not been
+   *   configured yet.
+   */
+  public function getSourceFieldDefinition(MediaTypeInterface $type);
+
+  /**
+   * Creates the source field definition for a type.
+   *
+   * @param \Drupal\media\MediaTypeInterface $type
+   *   The media type.
+   *
+   * @return \Drupal\field\FieldConfigInterface
+   *   The unsaved field definition. The field storage definition, if new,
+   *   should also be unsaved.
+   */
+  public function createSourceField(MediaTypeInterface $type);
+
+  /**
+   * Prepares the media type fields for this source in the view display.
+   *
+   * This method should normally call
+   * \Drupal\Core\Entity\Display\EntityDisplayInterface::setComponent() or
+   * \Drupal\Core\Entity\Display\EntityDisplayInterface::removeComponent() to
+   * configure the media type fields in the view display.
+   *
+   * @param \Drupal\media\MediaTypeInterface $type
+   *   The media type which is using this source.
+   * @param \Drupal\Core\Entity\Display\EntityViewDisplayInterface $display
+   *   The display which should be prepared.
+   *
+   * @see \Drupal\Core\Entity\Display\EntityDisplayInterface::setComponent()
+   * @see \Drupal\Core\Entity\Display\EntityDisplayInterface::removeComponent()
+   */
+  public function prepareViewDisplay(MediaTypeInterface $type, EntityViewDisplayInterface $display);
+
+  /**
+   * Prepares the media type fields for this source in the form display.
+   *
+   * This method should normally call
+   * \Drupal\Core\Entity\Display\EntityDisplayInterface::setComponent() or
+   * \Drupal\Core\Entity\Display\EntityDisplayInterface::removeComponent() to
+   * configure the media type fields in the form display.
+   *
+   * @param \Drupal\media\MediaTypeInterface $type
+   *   The media type which is using this source.
+   * @param \Drupal\Core\Entity\Display\EntityFormDisplayInterface $display
+   *   The display which should be prepared.
+   *
+   * @see \Drupal\Core\Entity\Display\EntityDisplayInterface::setComponent()
+   * @see \Drupal\Core\Entity\Display\EntityDisplayInterface::removeComponent()
+   */
+  public function prepareFormDisplay(MediaTypeInterface $type, EntityFormDisplayInterface $display);
+
+  /**
+   * Get the primary value stored in the source field.
+   *
+   * @param MediaInterface $media
+   *   A media item.
+   *
+   * @return mixed
+   *   The source value, or NULL if the media item's source field is empty.
+   *
+   * @throws \RuntimeException
+   *   If the source field for the media source is not defined.
+   */
+  public function getSourceFieldValue(MediaInterface $media);
+
+}

core/modules/media/src/MediaSourceManager.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Cache\CacheBackendInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\Plugin\DefaultPluginManager;
+use Drupal\media\Attribute\MediaSource;
+
+/**
+ * Manages media source plugins.
+ */
+class MediaSourceManager extends DefaultPluginManager {
+
+  /**
+   * Constructs a new MediaSourceManager.
+   *
+   * @param \Traversable $namespaces
+   *   An object that implements \Traversable which contains the root paths
+   *   keyed by the corresponding namespace to look for plugin implementations.
+   * @param \Drupal\Core\Cache\CacheBackendInterface $cache_backend
+   *   Cache backend instance to use.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+   *   The module handler.
+   */
+  public function __construct(\Traversable $namespaces, CacheBackendInterface $cache_backend, ModuleHandlerInterface $module_handler) {
+    parent::__construct('Plugin/media/Source', $namespaces, $module_handler, MediaSourceInterface::class, MediaSource::class, '\Drupal\media\Annotation\MediaSource');
+
+    $this->alterInfo('media_source_info');
+    $this->setCacheBackend($cache_backend, 'media_source_plugins');
+  }
+
+}

core/modules/media/src/MediaStorage.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Entity\Sql\SqlContentEntityStorage;
+
+/**
+ * Defines the storage handler class for media.
+ *
+ * The default storage is overridden to handle metadata fetching outside of the
+ * database transaction.
+ */
+class MediaStorage extends SqlContentEntityStorage {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function save(EntityInterface $media) {
+    // For backwards compatibility, modules that override the Media entity
+    // class, are not required to implement the prepareSave() method.
+    // @todo For Drupal 8.7, consider throwing a deprecation notice if the
+    //   method doesn't exist. See
+    //   https://www.drupal.org/project/drupal/issues/2992426 for further
+    //   discussion.
+    if (method_exists($media, 'prepareSave')) {
+      $media->prepareSave();
+    }
+    return parent::save($media);
+  }
+
+}

core/modules/media/src/MediaTypeAccessControlHandler.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Entity\EntityAccessControlHandler;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Defines the access control handler for the "Media Type" entity type.
+ *
+ * @see \Drupal\media\Entity\MediaType
+ */
+class MediaTypeAccessControlHandler extends EntityAccessControlHandler {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $viewLabelOperation = TRUE;
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
+    if ($operation === 'view label') {
+      return AccessResult::allowedIfHasPermission($account, 'view media');
+    }
+    else {
+      return parent::checkAccess($entity, $operation, $account);
+    }
+  }
+
+}

core/modules/media/src/MediaTypeForm.php

@@ -0,0 +1,405 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Component\Plugin\PluginManagerInterface;
+use Drupal\Core\Ajax\AjaxResponse;
+use Drupal\Core\Ajax\ReplaceCommand;
+use Drupal\Core\Entity\EntityDisplayRepositoryInterface;
+use Drupal\Core\Entity\EntityFieldManagerInterface;
+use Drupal\Core\Entity\EntityForm;
+use Drupal\Core\Field\BaseFieldDefinition;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Form\SubformState;
+use Drupal\language\Entity\ContentLanguageSettings;
+use Drupal\media\Entity\MediaType;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Form controller for media type forms.
+ *
+ * @internal
+ */
+class MediaTypeForm extends EntityForm {
+
+  /**
+   * Media source plugin manager.
+   *
+   * @var \Drupal\Component\Plugin\PluginManagerInterface
+   */
+  protected $sourceManager;
+
+  /**
+   * Entity field manager service.
+   *
+   * @var \Drupal\Core\Entity\EntityFieldManagerInterface
+   */
+  protected $entityFieldManager;
+
+  /**
+   * Entity display repository service.
+   *
+   * @var \Drupal\Core\Entity\EntityDisplayRepositoryInterface
+   */
+  protected $entityDisplayRepository;
+
+  /**
+   * Constructs a new class instance.
+   *
+   * @param \Drupal\Component\Plugin\PluginManagerInterface $source_manager
+   *   Media source plugin manager.
+   * @param \Drupal\Core\Entity\EntityFieldManagerInterface $entity_field_manager
+   *   Entity field manager service.
+   * @param \Drupal\Core\Entity\EntityDisplayRepositoryInterface $entityDisplayRepository
+   *   Entity display repository service.
+   */
+  public function __construct(PluginManagerInterface $source_manager, EntityFieldManagerInterface $entity_field_manager, EntityDisplayRepositoryInterface $entityDisplayRepository) {
+    $this->sourceManager = $source_manager;
+    $this->entityFieldManager = $entity_field_manager;
+    $this->entityDisplayRepository = $entityDisplayRepository;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('plugin.manager.media.source'),
+      $container->get('entity_field.manager'),
+      $container->get('entity_display.repository')
+    );
+  }
+
+  /**
+   * Ajax callback triggered by the type provider select element.
+   */
+  public function ajaxHandlerData(array $form, FormStateInterface $form_state) {
+    $response = new AjaxResponse();
+    $response->addCommand(new ReplaceCommand('#source-dependent', $form['source_dependent']));
+    return $response;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function form(array $form, FormStateInterface $form_state) {
+    $form = parent::form($form, $form_state);
+
+    // Source is not set when the entity is initially created.
+    /** @var \Drupal\media\MediaSourceInterface $source */
+    $source = $this->entity->get('source') ? $this->entity->getSource() : NULL;
+
+    if ($this->operation === 'add') {
+      $form['#title'] = $this->t('Add media type');
+    }
+
+    $form['label'] = [
+      '#title' => $this->t('Name'),
+      '#type' => 'textfield',
+      '#default_value' => $this->entity->label(),
+      '#description' => $this->t('The human-readable name for this media type, displayed on the <em>Media types</em> page.'),
+      '#required' => TRUE,
+      '#size' => 30,
+    ];
+
+    $form['id'] = [
+      '#type' => 'machine_name',
+      '#default_value' => $this->entity->id(),
+      '#maxlength' => 32,
+      '#disabled' => !$this->entity->isNew(),
+      '#machine_name' => [
+        'exists' => [MediaType::class, 'load'],
+      ],
+      '#description' => $this->t('Unique machine-readable name: lowercase letters, numbers, and underscores only.'),
+    ];
+
+    $form['description'] = [
+      '#title' => $this->t('Description'),
+      '#type' => 'textarea',
+      '#default_value' => $this->entity->getDescription(),
+      '#description' => $this->t('Displays on the <em>Media types</em> page.'),
+    ];
+
+    $plugins = $this->sourceManager->getDefinitions();
+    $options = [];
+    foreach ($plugins as $plugin_id => $definition) {
+      $options[$plugin_id] = $definition['label'];
+    }
+
+    $form['source_dependent'] = [
+      '#type' => 'container',
+      '#attributes' => ['id' => 'source-dependent'],
+    ];
+
+    if (!$this->entity->isNew()) {
+      $source_description = $this->t('<em>The media source cannot be changed after the media type is created.</em>');
+    }
+    else {
+      $source_description = $this->t('Media source that is responsible for additional logic related to this media type.');
+    }
+    $form['source_dependent']['source'] = [
+      '#type' => 'select',
+      '#title' => $this->t('Media source'),
+      '#default_value' => $source ? $source->getPluginId() : NULL,
+      '#options' => $options,
+      '#description' => $source_description,
+      '#ajax' => ['callback' => '::ajaxHandlerData'],
+      '#required' => TRUE,
+      // Once the media type is created, its source plugin cannot be changed
+      // anymore.
+      '#disabled' => !$this->entity->isNew(),
+    ];
+
+    if ($source) {
+      // Media source plugin configuration.
+      $form['source_dependent']['source_configuration'] = [
+        '#type' => 'fieldset',
+        '#title' => $this->t('Media source configuration'),
+        '#tree' => TRUE,
+      ];
+
+      $form['source_dependent']['source_configuration'] = $source->buildConfigurationForm($form['source_dependent']['source_configuration'], $this->getSourceSubFormState($form, $form_state));
+    }
+
+    // Field mapping configuration.
+    $form['source_dependent']['field_map'] = [
+      '#type' => 'fieldset',
+      '#title' => $this->t('Field mapping'),
+      '#tree' => TRUE,
+      'description' => [
+        '#markup' => '<p>' . $this->t('Media sources can provide metadata fields such as title, caption, size information, credits, etc. Media can automatically save this metadata information to entity fields, which can be configured below. Information will only be mapped if the entity field is empty.') . '</p>',
+      ],
+    ];
+
+    if (empty($source) || empty($source->getMetadataAttributes())) {
+      $form['source_dependent']['field_map']['#access'] = FALSE;
+    }
+    else {
+      $options = [MediaSourceInterface::METADATA_FIELD_EMPTY => $this->t('- Skip field -')];
+      $source_field_name = $source->getSourceFieldDefinition($this->entity)?->getName();
+      foreach ($this->entityFieldManager->getFieldDefinitions('media', $this->entity->id()) as $field_name => $field) {
+        // The source field cannot be the target of a field mapping, because
+        // this would cause it to be overwritten, probably with invalid data.
+        if ($field_name === $source_field_name) {
+          continue;
+        }
+        if (!($field instanceof BaseFieldDefinition) || $field_name === 'name') {
+          $options[$field_name] = $field->getLabel();
+        }
+      }
+
+      natcasesort($options);
+
+      $field_map = $this->entity->getFieldMap();
+      foreach ($source->getMetadataAttributes() as $metadata_attribute_name => $metadata_attribute_label) {
+        $form['source_dependent']['field_map'][$metadata_attribute_name] = [
+          '#type' => 'select',
+          '#title' => $metadata_attribute_label,
+          '#options' => $options,
+          '#default_value' => $field_map[$metadata_attribute_name] ?? MediaSourceInterface::METADATA_FIELD_EMPTY,
+        ];
+      }
+    }
+
+    $form['additional_settings'] = [
+      '#type' => 'vertical_tabs',
+      '#attached' => [
+        'library' => ['media/type_form'],
+      ],
+    ];
+
+    $form['workflow'] = [
+      '#type' => 'details',
+      '#title' => $this->t('Publishing options'),
+      '#group' => 'additional_settings',
+    ];
+
+    $form['workflow']['options'] = [
+      '#type' => 'checkboxes',
+      '#title' => $this->t('Default options'),
+      '#default_value' => $this->getWorkflowOptions(),
+      '#options' => [
+        'status' => $this->t('Published'),
+        'new_revision' => $this->t('Create new revision'),
+        'queue_thumbnail_downloads' => $this->t('Queue thumbnail downloads'),
+      ],
+    ];
+
+    $form['workflow']['options']['status']['#description'] = $this->t('Media will be automatically published when created.');
+    $form['workflow']['options']['new_revision']['#description'] = $this->t('Automatically create new revisions. Users with the "Administer media" permission will be able to override this option.');
+    $form['workflow']['options']['queue_thumbnail_downloads']['#description'] = $this->t('Download thumbnails via a queue. When using remote media sources, the thumbnail generation could be a slow process. Using a queue allows for this process to be handled in the background.');
+
+    if ($this->moduleHandler->moduleExists('language')) {
+      $form['language'] = [
+        '#type' => 'details',
+        '#title' => $this->t('Language settings'),
+        '#group' => 'additional_settings',
+      ];
+
+      $language_configuration = ContentLanguageSettings::loadByEntityTypeBundle('media', $this->entity->id());
+      $form['language']['language_configuration'] = [
+        '#type' => 'language_configuration',
+        '#entity_information' => [
+          'entity_type' => 'media',
+          'bundle' => $this->entity->id(),
+        ],
+        '#default_value' => $language_configuration,
+      ];
+    }
+
+    return $form;
+  }
+
+  /**
+   * Prepares workflow options to be used in the 'checkboxes' form element.
+   *
+   * @return array
+   *   Array of options ready to be used in #options.
+   */
+  protected function getWorkflowOptions() {
+    $workflow_options = [
+      'status' => $this->entity->getStatus(),
+      'new_revision' => $this->entity->shouldCreateNewRevision(),
+      'queue_thumbnail_downloads' => $this->entity->thumbnailDownloadsAreQueued(),
+    ];
+    // Prepare workflow options to be used for 'checkboxes' form element.
+    $keys = array_keys(array_filter($workflow_options));
+    return array_combine($keys, $keys);
+  }
+
+  /**
+   * Gets subform state for the media source configuration subform.
+   *
+   * @param array $form
+   *   Full form array.
+   * @param \Drupal\Core\Form\FormStateInterface $form_state
+   *   Parent form state.
+   *
+   * @return \Drupal\Core\Form\SubformStateInterface
+   *   Sub-form state for the media source configuration form.
+   */
+  protected function getSourceSubFormState(array $form, FormStateInterface $form_state) {
+    return SubformState::createForSubform($form['source_dependent']['source_configuration'], $form, $form_state)
+      ->set('operation', $this->operation)
+      ->set('type', $this->entity);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateForm(array &$form, FormStateInterface $form_state) {
+    parent::validateForm($form, $form_state);
+
+    if (isset($form['source_dependent']['source_configuration'])) {
+      // Let the selected plugin validate its settings.
+      $this->entity->getSource()->validateConfigurationForm($form['source_dependent']['source_configuration'], $this->getSourceSubFormState($form, $form_state));
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $form_state->setValue('field_map', array_filter(
+      $form_state->getValue('field_map', []),
+      function ($item) {
+        return $item != MediaSourceInterface::METADATA_FIELD_EMPTY;
+      }
+    ));
+
+    parent::submitForm($form, $form_state);
+
+    $this->entity->setQueueThumbnailDownloadsStatus((bool) $form_state->getValue(['options', 'queue_thumbnail_downloads']))
+      ->setStatus((bool) $form_state->getValue(['options', 'status']))
+      ->setNewRevision((bool) $form_state->getValue(['options', 'new_revision']));
+
+    if (isset($form['source_dependent']['source_configuration'])) {
+      // Let the selected plugin save its settings.
+      $this->entity->getSource()->submitConfigurationForm($form['source_dependent']['source_configuration'], $this->getSourceSubFormState($form, $form_state));
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function actions(array $form, FormStateInterface $form_state) {
+    $actions = parent::actions($form, $form_state);
+
+    // If the media source has not been chosen yet, turn the submit button into
+    // a button. This rebuilds the form with the media source's configuration
+    // form visible, instead of saving the media type. This allows users to
+    // create a media type without JavaScript enabled. With JavaScript enabled,
+    // this rebuild occurs during an AJAX request.
+    // @see \Drupal\media\MediaTypeForm::ajaxHandlerData()
+    if (empty($this->getEntity()->get('source'))) {
+      $actions['submit']['#type'] = 'button';
+    }
+
+    $actions['submit']['#value'] = $this->t('Save');
+    $actions['delete']['#value'] = $this->t('Delete');
+    $actions['delete']['#access'] = $this->entity->access('delete');
+    return $actions;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function save(array $form, FormStateInterface $form_state) {
+    $status = parent::save($form, $form_state);
+    /** @var \Drupal\media\MediaTypeInterface $media_type */
+    $media_type = $this->entity;
+
+    // If the media source is using a source field, ensure it's
+    // properly created.
+    $source = $media_type->getSource();
+    $source_field = $source->getSourceFieldDefinition($media_type);
+    if (!$source_field) {
+      $source_field = $source->createSourceField($media_type);
+      /** @var \Drupal\field\FieldStorageConfigInterface $storage */
+      $storage = $source_field->getFieldStorageDefinition();
+      if ($storage->isNew()) {
+        $storage->save();
+      }
+      $source_field->save();
+
+      // Add the new field to the default form and view displays for this
+      // media type.
+      if ($source_field->isDisplayConfigurable('form')) {
+        $display = $this->entityDisplayRepository->getFormDisplay('media', $media_type->id());
+        $source->prepareFormDisplay($media_type, $display);
+        $display->save();
+      }
+      if ($source_field->isDisplayConfigurable('view')) {
+        $display = $this->entityDisplayRepository->getViewDisplay('media', $media_type->id());
+
+        // Remove all default components.
+        foreach (array_keys($display->getComponents()) as $name) {
+          $display->removeComponent($name);
+        }
+        $source->prepareViewDisplay($media_type, $display);
+        $display->save();
+      }
+    }
+
+    $t_args = ['%name' => $media_type->label()];
+    if ($status === SAVED_UPDATED) {
+      $this->messenger()->addStatus($this->t('The media type %name has been updated.', $t_args));
+    }
+    elseif ($status === SAVED_NEW) {
+      $this->messenger()->addStatus($this->t('The media type %name has been added.', $t_args));
+      $this->logger('media')->notice('Added media type %name.', $t_args);
+    }
+
+    // Override the "status" base field default value, for this media type.
+    $fields = $this->entityFieldManager->getFieldDefinitions('media', $media_type->id());
+    /** @var \Drupal\media\MediaInterface $media */
+    $media = $this->entityTypeManager->getStorage('media')->create(['bundle' => $media_type->id()]);
+    $value = (bool) $form_state->getValue(['options', 'status']);
+    if ($media->status->value != $value) {
+      $fields['status']->getConfig($media_type->id())->setDefaultValue($value)->save();
+    }
+
+    $form_state->setRedirectUrl($media_type->toUrl('collection'));
+  }
+
+}

core/modules/media/src/MediaTypeInterface.php

@@ -0,0 +1,101 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Config\Entity\ConfigEntityInterface;
+use Drupal\Core\Entity\EntityDescriptionInterface;
+use Drupal\Core\Entity\RevisionableEntityBundleInterface;
+
+/**
+ * Provides an interface defining a media type entity.
+ *
+ * Media types are bundles for media items. They are used to group media with
+ * the same semantics. Media types are not about where media comes from. They
+ * are about the semantics that media has in the context of a given Drupal site.
+ *
+ * Media sources, on the other hand, are aware where media comes from and know
+ * how to represent and handle it in Drupal's context. They are aware of the low
+ * level details, while the media types don't care about them at all. That said,
+ * media types can not exist without media sources.
+ *
+ * Consider the following examples:
+ * - oEmbed media source which can represent any oEmbed resource. Media types
+ *   that could be used with this source are "Videos", "Charts", "Music", etc.
+ *   All of them are retrieved using the same protocol, but they represent very
+ *   different things.
+ * - Media sources that represent files could be used with media types like
+ *   "Invoices", "Subtitles", "Meeting notes", etc. They are all files stored on
+ *   some kind of storage, but their meaning and uses in a Drupal site are
+ *   different.
+ *
+ * @see \Drupal\media\MediaSourceInterface
+ */
+interface MediaTypeInterface extends ConfigEntityInterface, EntityDescriptionInterface, RevisionableEntityBundleInterface {
+
+  /**
+   * Returns whether thumbnail downloads are queued.
+   *
+   * When using remote media sources, the thumbnail generation could be a slow
+   * process. Using a queue allows for this process to be handled in the
+   * background.
+   *
+   * @return bool
+   *   TRUE if thumbnails are queued for download later, FALSE if they should be
+   *   downloaded now.
+   */
+  public function thumbnailDownloadsAreQueued();
+
+  /**
+   * Sets a flag to indicate that thumbnails should be downloaded via a queue.
+   *
+   * @param bool $queue_thumbnail_downloads
+   *   The queue downloads flag.
+   *
+   * @return $this
+   */
+  public function setQueueThumbnailDownloadsStatus($queue_thumbnail_downloads);
+
+  /**
+   * Returns the media source plugin.
+   *
+   * @return \Drupal\media\MediaSourceInterface
+   *   The media source.
+   */
+  public function getSource();
+
+  /**
+   * Sets whether new revisions should be created by default.
+   *
+   * @param bool $new_revision
+   *   TRUE if media items of this type should create new revisions by default.
+   *
+   * @return $this
+   */
+  public function setNewRevision($new_revision);
+
+  /**
+   * Returns the metadata field map.
+   *
+   * Field mapping allows site builders to map media item-related metadata to
+   * entity fields. This information will be used when saving a given media item
+   * and if metadata values will be available they are going to be automatically
+   * copied to the corresponding entity fields.
+   *
+   * @return array
+   *   Field mapping array provided by media source with metadata attribute
+   *   names as keys and entity field names as values.
+   */
+  public function getFieldMap();
+
+  /**
+   * Sets the metadata field map.
+   *
+   * @param array $map
+   *   Field mapping array with metadata attribute names as keys and entity
+   *   field names as values.
+   *
+   * @return $this
+   */
+  public function setFieldMap(array $map);
+
+}

core/modules/media/src/MediaTypeListBuilder.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\Core\Config\Entity\ConfigEntityListBuilder;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Url;
+
+/**
+ * Provides a listing of media types.
+ */
+class MediaTypeListBuilder extends ConfigEntityListBuilder {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildHeader() {
+    $header['title'] = $this->t('Name');
+    $header['description'] = [
+      'data' => $this->t('Description'),
+      'class' => [RESPONSIVE_PRIORITY_MEDIUM],
+    ];
+    return $header + parent::buildHeader();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildRow(EntityInterface $entity) {
+    $row['title'] = [
+      'data' => $entity->label(),
+      'class' => ['menu-label'],
+    ];
+    $row['description']['data'] = ['#markup' => $entity->getDescription()];
+    return $row + parent::buildRow($entity);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function render() {
+    $build = parent::render();
+    $build['table']['#empty'] = $this->t('No media types available. <a href=":url">Add media type</a>.', [
+      ':url' => Url::fromRoute('entity.media_type.add_form')->toString(),
+    ]);
+    return $build;
+  }
+
+}

core/modules/media/src/MediaViewsData.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Drupal\media;
+
+use Drupal\views\EntityViewsData;
+
+/**
+ * Provides the Views data for the media entity type.
+ */
+class MediaViewsData extends EntityViewsData {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getViewsData() {
+    $data = parent::getViewsData();
+
+    $data['media_field_data']['table']['wizard_id'] = 'media';
+    $data['media_field_revision']['table']['wizard_id'] = 'media_revision';
+
+    $data['media_field_data']['status_extra'] = [
+      'title' => $this->t('Published status or admin user'),
+      'help' => $this->t('Filters out unpublished media if the current user cannot view it.'),
+      'filter' => [
+        'field' => 'status',
+        'id' => 'media_status',
+        'label' => $this->t('Published status or admin user'),
+      ],
+    ];
+
+    return $data;
+  }
+
+}

core/modules/media/src/OEmbed/Endpoint.php

@@ -0,0 +1,182 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+use Drupal\Component\Utility\UrlHelper;
+
+/**
+ * Value object for oEmbed provider endpoints.
+ *
+ * @internal
+ *   This class is an internal part of the oEmbed system and should only be
+ *   instantiated by instances of Drupal\media\OEmbed\Provider.
+ */
+class Endpoint {
+
+  /**
+   * The endpoint's URL.
+   *
+   * @var string
+   */
+  protected $url;
+
+  /**
+   * The provider this endpoint belongs to.
+   *
+   * @var \Drupal\media\OEmbed\Provider
+   */
+  protected $provider;
+
+  /**
+   * List of URL schemes supported by the provider.
+   *
+   * @var string[]
+   */
+  protected $schemes;
+
+  /**
+   * List of supported formats. Only 'json' and 'xml' are allowed.
+   *
+   * @var string[]
+   *
+   * @see https://oembed.com/#section2
+   */
+  protected $formats;
+
+  /**
+   * Whether the provider supports oEmbed discovery.
+   *
+   * @var bool
+   */
+  protected $supportsDiscovery;
+
+  /**
+   * Endpoint constructor.
+   *
+   * @param string $url
+   *   The endpoint URL. May contain a @code '{format}' @endcode placeholder.
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   The provider this endpoint belongs to.
+   * @param string[] $schemes
+   *   List of URL schemes supported by the provider.
+   * @param string[] $formats
+   *   List of supported formats. Can be "json", "xml" or both.
+   * @param bool $supports_discovery
+   *   Whether the provider supports oEmbed discovery.
+   *
+   * @throws \InvalidArgumentException
+   *   If the endpoint URL is empty.
+   */
+  public function __construct($url, Provider $provider, array $schemes = [], array $formats = [], $supports_discovery = FALSE) {
+    $this->provider = $provider;
+    $this->schemes = $schemes;
+
+    $this->formats = $formats = array_map('mb_strtolower', $formats);
+    // Assert that only the supported formats are present.
+    assert(array_diff($formats, ['json', 'xml']) == []);
+
+    // Use the first provided format to build the endpoint URL. If no formats
+    // are provided, default to JSON.
+    $this->url = str_replace('{format}', reset($this->formats) ?: 'json', $url);
+
+    if (!UrlHelper::isValid($this->url, TRUE) || !UrlHelper::isExternal($this->url)) {
+      throw new \InvalidArgumentException('oEmbed endpoint must have a valid external URL');
+    }
+
+    $this->supportsDiscovery = (bool) $supports_discovery;
+  }
+
+  /**
+   * Returns the endpoint URL.
+   *
+   * The URL will be built with the first available format. If the endpoint
+   * does not provide any formats, JSON will be used.
+   *
+   * @return string
+   *   The endpoint URL.
+   */
+  public function getUrl() {
+    return $this->url;
+  }
+
+  /**
+   * Returns the provider this endpoint belongs to.
+   *
+   * @return \Drupal\media\OEmbed\Provider
+   *   The provider object.
+   */
+  public function getProvider() {
+    return $this->provider;
+  }
+
+  /**
+   * Returns list of URL schemes supported by the provider.
+   *
+   * @return string[]
+   *   List of schemes.
+   */
+  public function getSchemes() {
+    return $this->schemes;
+  }
+
+  /**
+   * Returns list of supported formats.
+   *
+   * @return string[]
+   *   List of formats.
+   */
+  public function getFormats() {
+    return $this->formats;
+  }
+
+  /**
+   * Returns whether the provider supports oEmbed discovery.
+   *
+   * @return bool
+   *   Returns TRUE if the provides discovery, otherwise FALSE.
+   */
+  public function supportsDiscovery() {
+    return $this->supportsDiscovery;
+  }
+
+  /**
+   * Tries to match a URL against the endpoint schemes.
+   *
+   * @param string $url
+   *   Media item URL.
+   *
+   * @return bool
+   *   TRUE if the URL matches against the endpoint schemes, otherwise FALSE.
+   */
+  public function matchUrl($url) {
+    foreach ($this->getSchemes() as $scheme) {
+      // Convert scheme into a valid regular expression.
+      $regexp = str_replace(['.', '*', '?'], ['\.', '.*', '\?'], $scheme);
+      if (preg_match("|^$regexp$|", $url)) {
+        return TRUE;
+      }
+    }
+    return FALSE;
+  }
+
+  /**
+   * Builds and returns the endpoint URL.
+   *
+   * In most situations this function should not be used. Your are probably
+   * looking for \Drupal\media\OEmbed\UrlResolver::getResourceUrl(), because it
+   * is alterable and also cached.
+   *
+   * @param string $url
+   *   The canonical media URL.
+   *
+   * @return string
+   *   URL of the oEmbed endpoint.
+   *
+   * @see \Drupal\media\OEmbed\UrlResolver::getResourceUrl()
+   */
+  public function buildResourceUrl($url) {
+    $query = ['url' => $url];
+    return $this->getUrl() . '?' . UrlHelper::buildQuery($query);
+  }
+
+}

core/modules/media/src/OEmbed/Provider.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+use Drupal\Component\Utility\UrlHelper;
+
+/**
+ * Value object for oEmbed providers.
+ */
+class Provider {
+
+  /**
+   * The provider name.
+   *
+   * @var string
+   */
+  protected $name;
+
+  /**
+   * The provider URL.
+   *
+   * @var string
+   */
+  protected $url;
+
+  /**
+   * The provider endpoints.
+   *
+   * @var \Drupal\media\OEmbed\Endpoint[]
+   */
+  protected $endpoints = [];
+
+  /**
+   * Provider constructor.
+   *
+   * @param string $name
+   *   The provider name.
+   * @param string $url
+   *   The provider URL.
+   * @param array[] $endpoints
+   *   List of endpoints this provider exposes.
+   *
+   * @throws \Drupal\media\OEmbed\ProviderException
+   */
+  public function __construct($name, $url, array $endpoints) {
+    $this->name = $name;
+
+    if (!UrlHelper::isValid($url, TRUE) || !UrlHelper::isExternal($url)) {
+      throw new ProviderException('Provider @name does not define a valid external URL.', $this);
+    }
+    $this->url = $url;
+
+    try {
+      foreach ($endpoints as $endpoint) {
+        $endpoint += ['formats' => [], 'schemes' => [], 'discovery' => FALSE];
+        $this->endpoints[] = new Endpoint($endpoint['url'], $this, $endpoint['schemes'], $endpoint['formats'], $endpoint['discovery']);
+      }
+    }
+    catch (\InvalidArgumentException $e) {
+      // Just skip all the invalid endpoints.
+      // @todo Log the exception message to help with debugging in
+      // https://www.drupal.org/project/drupal/issues/2972846.
+    }
+
+    if (empty($this->endpoints)) {
+      throw new ProviderException('Provider @name does not define any valid endpoints.', $this);
+    }
+  }
+
+  /**
+   * Returns the provider name.
+   *
+   * @return string
+   *   Name of the provider.
+   */
+  public function getName() {
+    return $this->name;
+  }
+
+  /**
+   * Returns the provider URL.
+   *
+   * @return string
+   *   URL of the provider.
+   */
+  public function getUrl() {
+    return $this->url;
+  }
+
+  /**
+   * Returns the provider endpoints.
+   *
+   * @return \Drupal\media\OEmbed\Endpoint[]
+   *   List of endpoints this provider exposes.
+   */
+  public function getEndpoints() {
+    return $this->endpoints;
+  }
+
+}

core/modules/media/src/OEmbed/ProviderException.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+/**
+ * Exception thrown if an oEmbed provider causes an error.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+class ProviderException extends \Exception {
+
+  /**
+   * Information about the oEmbed provider which caused the exception.
+   *
+   * @var \Drupal\media\OEmbed\Provider
+   *
+   * @see \Drupal\media\OEmbed\ProviderRepositoryInterface::get()
+   */
+  protected $provider;
+
+  /**
+   * ProviderException constructor.
+   *
+   * @param string $message
+   *   The exception message. '@name' will be replaced with the provider name
+   *   if available, or '<unknown>' if not.
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   (optional) The provider information.
+   * @param \Exception $previous
+   *   (optional) The previous exception, if any.
+   */
+  public function __construct($message, ?Provider $provider = NULL, ?\Exception $previous = NULL) {
+    $this->provider = $provider;
+    $message = str_replace('@name', $provider ? $provider->getName() : '<unknown>', $message);
+    parent::__construct($message, 0, $previous);
+  }
+
+}

core/modules/media/src/OEmbed/ProviderRepository.php

@@ -0,0 +1,161 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+use Drupal\Component\Datetime\TimeInterface;
+use Drupal\Component\Serialization\Json;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\KeyValueStore\KeyValueFactoryInterface;
+use Drupal\Core\Logger\LoggerChannelFactoryInterface;
+use GuzzleHttp\ClientInterface;
+use Psr\Http\Client\ClientExceptionInterface;
+
+/**
+ * Retrieves and caches information about oEmbed providers.
+ */
+class ProviderRepository implements ProviderRepositoryInterface {
+
+  /**
+   * How long the provider data should be cached, in seconds.
+   *
+   * @var int
+   */
+  protected $maxAge;
+
+  /**
+   * The HTTP client.
+   *
+   * @var \GuzzleHttp\Client
+   */
+  protected $httpClient;
+
+  /**
+   * URL of a JSON document which contains a database of oEmbed providers.
+   *
+   * @var string
+   */
+  protected $providersUrl;
+
+  /**
+   * The time service.
+   *
+   * @var \Drupal\Component\Datetime\TimeInterface
+   */
+  protected $time;
+
+  /**
+   * The key-value store.
+   *
+   * @var \Drupal\Core\KeyValueStore\KeyValueStoreInterface
+   */
+  protected $keyValue;
+
+  /**
+   * The logger channel.
+   *
+   * @var \Drupal\Core\Logger\LoggerChannelInterface
+   */
+  protected $logger;
+
+  /**
+   * Constructs a ProviderRepository instance.
+   *
+   * @param \GuzzleHttp\ClientInterface $http_client
+   *   The HTTP client.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory service.
+   * @param \Drupal\Component\Datetime\TimeInterface $time
+   *   The time service.
+   * @param \Drupal\Core\KeyValueStore\KeyValueFactoryInterface $key_value_factory
+   *   The key-value store factory.
+   * @param \Drupal\Core\Logger\LoggerChannelFactoryInterface $logger_factory
+   *   The logger channel factory.
+   * @param int $max_age
+   *   (optional) How long the cache data should be kept. Defaults to a week.
+   */
+  public function __construct(ClientInterface $http_client, ConfigFactoryInterface $config_factory, TimeInterface $time, KeyValueFactoryInterface $key_value_factory, LoggerChannelFactoryInterface $logger_factory, int $max_age = 604800) {
+    $this->httpClient = $http_client;
+    $this->providersUrl = $config_factory->get('media.settings')->get('oembed_providers_url');
+    $this->time = $time;
+    $this->maxAge = $max_age;
+    $this->keyValue = $key_value_factory->get('media');
+    $this->logger = $logger_factory->get('media');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getAll() {
+    $current_time = $this->time->getCurrentTime();
+    $stored = $this->keyValue->get('oembed_providers');
+    // If we have stored data that hasn't yet expired, return that. We need to
+    // store the data in a key-value store because, if the remote provider
+    // database is unavailable, we'd rather return stale data than throw an
+    // exception. This means we cannot use a normal cache backend or expirable
+    // key-value store, since those could delete the stale data at any time.
+    if ($stored && $stored['expires'] > $current_time) {
+      return $stored['data'];
+    }
+
+    try {
+      $response = $this->httpClient->request('GET', $this->providersUrl);
+    }
+    catch (ClientExceptionInterface  $e) {
+      if (isset($stored['data'])) {
+        // Use the stale data to fall back gracefully, but warn site
+        // administrators that we used stale data.
+        $this->logger->warning('Remote oEmbed providers could not be retrieved due to error: @error. Using previously stored data. This may contain out of date information.', [
+          '@error' => $e->getMessage(),
+        ]);
+        return $stored['data'];
+      }
+      // We have no previous data and the request failed.
+      throw new ProviderException("Could not retrieve the oEmbed provider database from $this->providersUrl", NULL, $e);
+    }
+
+    $providers = Json::decode((string) $response->getBody());
+
+    if (!is_array($providers) || empty($providers)) {
+      if (isset($stored['data'])) {
+        // Use the stale data to fall back gracefully, but as above, warn site
+        // administrators that we used stale data.
+        $this->logger->warning('Remote oEmbed providers database returned invalid or empty list. Using previously stored data. This may contain out of date information.');
+        return $stored['data'];
+      }
+      // We have no previous data and the current data is corrupt.
+      throw new ProviderException('Remote oEmbed providers database returned invalid or empty list.');
+    }
+
+    $keyed_providers = [];
+    foreach ($providers as $provider) {
+      try {
+        $name = (string) $provider['provider_name'];
+        $keyed_providers[$name] = new Provider($provider['provider_name'], $provider['provider_url'], $provider['endpoints']);
+      }
+      catch (ProviderException $e) {
+        // Skip invalid providers, but log the exception message to help with
+        // debugging.
+        $this->logger->warning($e->getMessage());
+      }
+    }
+
+    $this->keyValue->set('oembed_providers', [
+      'data' => $keyed_providers,
+      'expires' => $current_time + $this->maxAge,
+    ]);
+    return $keyed_providers;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function get($provider_name) {
+    $providers = $this->getAll();
+
+    if (!isset($providers[$provider_name])) {
+      throw new \InvalidArgumentException("Unknown provider '$provider_name'");
+    }
+    return $providers[$provider_name];
+  }
+
+}

core/modules/media/src/OEmbed/ProviderRepositoryInterface.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+/**
+ * Defines an interface for a collection of oEmbed provider information.
+ *
+ * The provider repository is responsible for fetching information about all
+ * available oEmbed providers, most likely pulled from the online database at
+ * https://oembed.com/providers.json, and creating \Drupal\media\OEmbed\Provider
+ * value objects for each provider.
+ */
+interface ProviderRepositoryInterface {
+
+  /**
+   * Returns information on all available oEmbed providers.
+   *
+   * @return \Drupal\media\OEmbed\Provider[]
+   *   Returns an array of provider value objects, keyed by provider name.
+   *
+   * @throws \Drupal\media\OEmbed\ProviderException
+   *   If the oEmbed provider information cannot be retrieved.
+   */
+  public function getAll();
+
+  /**
+   * Returns information for a specific oEmbed provider.
+   *
+   * @param string $provider_name
+   *   The name of the provider.
+   *
+   * @return \Drupal\media\OEmbed\Provider
+   *   A value object containing information about the provider.
+   *
+   * @throws \InvalidArgumentException
+   *   If there is no known oEmbed provider with the specified name.
+   */
+  public function get($provider_name);
+
+}

core/modules/media/src/OEmbed/Resource.php

@@ -0,0 +1,529 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+use Drupal\Core\Cache\Cache;
+use Drupal\Core\Cache\CacheableDependencyInterface;
+use Drupal\Core\Cache\CacheableDependencyTrait;
+use Drupal\Core\Url;
+
+/**
+ * Value object representing an oEmbed resource.
+ *
+ * Data received from an oEmbed provider could be insecure. For example,
+ * resources of the 'rich' type provide an HTML representation which is not
+ * sanitized by this object in any way. Any values you retrieve from this object
+ * should be treated as potentially dangerous user input and carefully validated
+ * and sanitized before being displayed or otherwise manipulated by your code.
+ *
+ * Valid resource types are defined in the oEmbed specification and represented
+ * by the TYPE_* constants in this class.
+ *
+ * @see https://oembed.com/#section2
+ *
+ * @internal
+ *   This class is an internal part of the oEmbed system and should only be
+ *   instantiated by
+ *   \Drupal\media\OEmbed\ResourceFetcherInterface::fetchResource().
+ */
+class Resource implements CacheableDependencyInterface {
+
+  use CacheableDependencyTrait;
+
+  /**
+   * The resource type for link resources.
+   */
+  const TYPE_LINK = 'link';
+
+  /**
+   * The resource type for photo resources.
+   */
+  const TYPE_PHOTO = 'photo';
+
+  /**
+   * The resource type for rich resources.
+   */
+  const TYPE_RICH = 'rich';
+
+  /**
+   * The resource type for video resources.
+   */
+  const TYPE_VIDEO = 'video';
+
+  /**
+   * The resource type. Can be one of the static::TYPE_* constants.
+   *
+   * @var string
+   */
+  protected $type;
+
+  /**
+   * The resource provider.
+   *
+   * @var \Drupal\media\OEmbed\Provider
+   */
+  protected $provider;
+
+  /**
+   * A text title, describing the resource.
+   *
+   * @var string
+   */
+  protected $title;
+
+  /**
+   * The name of the author/owner of the resource.
+   *
+   * @var string
+   */
+  protected $authorName;
+
+  /**
+   * A URL for the author/owner of the resource.
+   *
+   * @var string
+   */
+  protected $authorUrl;
+
+  /**
+   * A URL to a thumbnail image representing the resource.
+   *
+   * The thumbnail must respect any maxwidth and maxheight parameters passed
+   * to the oEmbed endpoint. If this parameter is present, thumbnail_width and
+   * thumbnail_height must also be present.
+   *
+   * @var string
+   *
+   * @see \Drupal\media\OEmbed\UrlResolverInterface::getResourceUrl()
+   * @see https://oembed.com/#section2
+   */
+  protected $thumbnailUrl;
+
+  /**
+   * The width of the thumbnail, in pixels.
+   *
+   * If this parameter is present, thumbnail_url and thumbnail_height must also
+   * be present.
+   *
+   * @var int
+   */
+  protected $thumbnailWidth;
+
+  /**
+   * The height of the thumbnail, in pixels.
+   *
+   * If this parameter is present, thumbnail_url and thumbnail_width must also
+   * be present.
+   *
+   * @var int
+   */
+  protected $thumbnailHeight;
+
+  /**
+   * The width of the resource, in pixels.
+   *
+   * @var int
+   */
+  protected $width;
+
+  /**
+   * The height of the resource, in pixels.
+   *
+   * @var int
+   */
+  protected $height;
+
+  /**
+   * The resource URL. Only applies to 'photo' and 'link' resources.
+   *
+   * @var string
+   */
+  protected $url;
+
+  /**
+   * The HTML representation of the resource.
+   *
+   * Only applies to 'rich' and 'video' resources.
+   *
+   * @var string
+   */
+  protected $html;
+
+  /**
+   * Resource constructor.
+   *
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   (optional) The resource provider.
+   * @param string $title
+   *   (optional) A text title, describing the resource.
+   * @param string $author_name
+   *   (optional) The name of the author/owner of the resource.
+   * @param string $author_url
+   *   (optional) A URL for the author/owner of the resource.
+   * @param int $cache_age
+   *   (optional) The suggested cache lifetime for this resource, in seconds.
+   * @param string $thumbnail_url
+   *   (optional) A URL to a thumbnail image representing the resource. If this
+   *   parameter is present, $thumbnail_width and $thumbnail_height must also be
+   *   present.
+   * @param int $thumbnail_width
+   *   (optional) The width of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_height must also be present.
+   * @param int $thumbnail_height
+   *   (optional) The height of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_width must also be present.
+   */
+  protected function __construct(?Provider $provider = NULL, $title = NULL, $author_name = NULL, $author_url = NULL, $cache_age = NULL, $thumbnail_url = NULL, $thumbnail_width = NULL, $thumbnail_height = NULL) {
+    $this->provider = $provider;
+    $this->title = $title;
+    $this->authorName = $author_name;
+    $this->authorUrl = $author_url;
+
+    if (isset($cache_age) && is_numeric($cache_age)) {
+      // If the cache age is too big, it can overflow the 'expire' column of
+      // database cache backends, causing SQL exceptions. To prevent that,
+      // arbitrarily limit the cache age to 5 years. That should be enough.
+      $this->cacheMaxAge = Cache::mergeMaxAges((int) $cache_age, 157680000);
+    }
+
+    if ($thumbnail_url) {
+      $this->thumbnailUrl = $thumbnail_url;
+      $this->setThumbnailDimensions($thumbnail_width, $thumbnail_height);
+    }
+  }
+
+  /**
+   * Creates a link resource.
+   *
+   * @param string $url
+   *   (optional) The URL of the resource.
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   (optional) The resource provider.
+   * @param string $title
+   *   (optional) A text title, describing the resource.
+   * @param string $author_name
+   *   (optional) The name of the author/owner of the resource.
+   * @param string $author_url
+   *   (optional) A URL for the author/owner of the resource.
+   * @param int $cache_age
+   *   (optional) The suggested cache lifetime for this resource, in seconds.
+   * @param string $thumbnail_url
+   *   (optional) A URL to a thumbnail image representing the resource. If this
+   *   parameter is present, $thumbnail_width and $thumbnail_height must also be
+   *   present.
+   * @param int $thumbnail_width
+   *   (optional) The width of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_height must also be present.
+   * @param int $thumbnail_height
+   *   (optional) The height of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_width must also be present.
+   *
+   * @return static
+   */
+  public static function link($url = NULL, ?Provider $provider = NULL, $title = NULL, $author_name = NULL, $author_url = NULL, $cache_age = NULL, $thumbnail_url = NULL, $thumbnail_width = NULL, $thumbnail_height = NULL) {
+    $resource = new static($provider, $title, $author_name, $author_url, $cache_age, $thumbnail_url, $thumbnail_width, $thumbnail_height);
+    $resource->type = self::TYPE_LINK;
+    $resource->url = $url;
+
+    return $resource;
+  }
+
+  /**
+   * Creates a photo resource.
+   *
+   * @param string $url
+   *   The URL of the photo.
+   * @param int $width
+   *   The width of the photo, in pixels.
+   * @param int $height
+   *   (optional) The height of the photo, in pixels.
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   (optional) The resource provider.
+   * @param string $title
+   *   (optional) A text title, describing the resource.
+   * @param string $author_name
+   *   (optional) The name of the author/owner of the resource.
+   * @param string $author_url
+   *   (optional) A URL for the author/owner of the resource.
+   * @param int $cache_age
+   *   (optional) The suggested cache lifetime for this resource, in seconds.
+   * @param string $thumbnail_url
+   *   (optional) A URL to a thumbnail image representing the resource. If this
+   *   parameter is present, $thumbnail_width and $thumbnail_height must also be
+   *   present.
+   * @param int $thumbnail_width
+   *   (optional) The width of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_height must also be present.
+   * @param int $thumbnail_height
+   *   (optional) The height of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_width must also be present.
+   *
+   * @return static
+   */
+  public static function photo($url, $width, $height = NULL, ?Provider $provider = NULL, $title = NULL, $author_name = NULL, $author_url = NULL, $cache_age = NULL, $thumbnail_url = NULL, $thumbnail_width = NULL, $thumbnail_height = NULL) {
+    if (empty($url)) {
+      throw new \InvalidArgumentException('Photo resources must provide a URL.');
+    }
+
+    $resource = static::link($url, $provider, $title, $author_name, $author_url, $cache_age, $thumbnail_url, $thumbnail_width, $thumbnail_height);
+    $resource->type = self::TYPE_PHOTO;
+    $resource->setDimensions($width, $height);
+
+    return $resource;
+  }
+
+  /**
+   * Creates a rich resource.
+   *
+   * @param string $html
+   *   The HTML representation of the resource.
+   * @param int $width
+   *   The width of the resource, in pixels.
+   * @param int $height
+   *   (optional) The height of the resource, in pixels.
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   (optional) The resource provider.
+   * @param string $title
+   *   (optional) A text title, describing the resource.
+   * @param string $author_name
+   *   (optional) The name of the author/owner of the resource.
+   * @param string $author_url
+   *   (optional) A URL for the author/owner of the resource.
+   * @param int $cache_age
+   *   (optional) The suggested cache lifetime for this resource, in seconds.
+   * @param string $thumbnail_url
+   *   (optional) A URL to a thumbnail image representing the resource. If this
+   *   parameter is present, $thumbnail_width and $thumbnail_height must also be
+   *   present.
+   * @param int $thumbnail_width
+   *   (optional) The width of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_height must also be present.
+   * @param int $thumbnail_height
+   *   (optional) The height of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_width must also be present.
+   *
+   * @return static
+   */
+  public static function rich($html, $width, $height = NULL, ?Provider $provider = NULL, $title = NULL, $author_name = NULL, $author_url = NULL, $cache_age = NULL, $thumbnail_url = NULL, $thumbnail_width = NULL, $thumbnail_height = NULL) {
+    if (empty($html)) {
+      throw new \InvalidArgumentException('The resource must provide an HTML representation.');
+    }
+
+    $resource = new static($provider, $title, $author_name, $author_url, $cache_age, $thumbnail_url, $thumbnail_width, $thumbnail_height);
+    $resource->type = self::TYPE_RICH;
+    $resource->html = $html;
+    $resource->setDimensions($width, $height);
+
+    return $resource;
+  }
+
+  /**
+   * Creates a video resource.
+   *
+   * @param string $html
+   *   The HTML required to display the video.
+   * @param int $width
+   *   The width of the video, in pixels.
+   * @param int $height
+   *   (optional) The height of the video, in pixels.
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   (optional) The resource provider.
+   * @param string $title
+   *   (optional) A text title, describing the resource.
+   * @param string $author_name
+   *   (optional) The name of the author/owner of the resource.
+   * @param string $author_url
+   *   (optional) A URL for the author/owner of the resource.
+   * @param int $cache_age
+   *   (optional) The suggested cache lifetime for this resource, in seconds.
+   * @param string $thumbnail_url
+   *   (optional) A URL to a thumbnail image representing the resource. If this
+   *   parameter is present, $thumbnail_width and $thumbnail_height must also be
+   *   present.
+   * @param int $thumbnail_width
+   *   (optional) The width of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_height must also be present.
+   * @param int $thumbnail_height
+   *   (optional) The height of the thumbnail, in pixels. If this parameter is
+   *   present, $thumbnail_url and $thumbnail_width must also be present.
+   *
+   * @return static
+   */
+  public static function video($html, $width, $height = NULL, ?Provider $provider = NULL, $title = NULL, $author_name = NULL, $author_url = NULL, $cache_age = NULL, $thumbnail_url = NULL, $thumbnail_width = NULL, $thumbnail_height = NULL) {
+    $resource = static::rich($html, $width, $height, $provider, $title, $author_name, $author_url, $cache_age, $thumbnail_url, $thumbnail_width, $thumbnail_height);
+    $resource->type = self::TYPE_VIDEO;
+
+    return $resource;
+  }
+
+  /**
+   * Returns the resource type.
+   *
+   * @return string
+   *   The resource type. Will be one of the self::TYPE_* constants.
+   */
+  public function getType() {
+    return $this->type;
+  }
+
+  /**
+   * Returns the title of the resource.
+   *
+   * @return string|null
+   *   The title of the resource, if known.
+   */
+  public function getTitle() {
+    return $this->title;
+  }
+
+  /**
+   * Returns the name of the resource author.
+   *
+   * @return string|null
+   *   The name of the resource author, if known.
+   */
+  public function getAuthorName() {
+    return $this->authorName;
+  }
+
+  /**
+   * Returns the URL of the resource author.
+   *
+   * @return \Drupal\Core\Url|null
+   *   The absolute URL of the resource author, or NULL if none is provided.
+   */
+  public function getAuthorUrl() {
+    return $this->authorUrl ? Url::fromUri($this->authorUrl)->setAbsolute() : NULL;
+  }
+
+  /**
+   * Returns the resource provider, if known.
+   *
+   * @return \Drupal\media\OEmbed\Provider|null
+   *   The resource provider, or NULL if the provider is not known.
+   */
+  public function getProvider() {
+    return $this->provider;
+  }
+
+  /**
+   * Returns the URL of the resource's thumbnail image.
+   *
+   * @return \Drupal\Core\Url|null
+   *   The absolute URL of the thumbnail image, or NULL if there isn't one.
+   */
+  public function getThumbnailUrl() {
+    return $this->thumbnailUrl ? Url::fromUri($this->thumbnailUrl)->setAbsolute() : NULL;
+  }
+
+  /**
+   * Returns the width of the resource's thumbnail image.
+   *
+   * @return int|null
+   *   The thumbnail width in pixels, or NULL if there is no thumbnail.
+   */
+  public function getThumbnailWidth() {
+    return $this->thumbnailWidth;
+  }
+
+  /**
+   * Returns the height of the resource's thumbnail image.
+   *
+   * @return int|null
+   *   The thumbnail height in pixels, or NULL if there is no thumbnail.
+   */
+  public function getThumbnailHeight() {
+    return $this->thumbnailHeight;
+  }
+
+  /**
+   * Returns the width of the resource.
+   *
+   * @return int|null
+   *   The width of the resource in pixels, or NULL if the resource has no
+   *   width.
+   */
+  public function getWidth() {
+    return $this->width;
+  }
+
+  /**
+   * Returns the height of the resource.
+   *
+   * @return int|null
+   *   The height of the resource in pixels, or NULL if the resource has no
+   *   height.
+   */
+  public function getHeight() {
+    return $this->height;
+  }
+
+  /**
+   * Returns the URL of the resource. Only applies to 'photo' resources.
+   *
+   * @return \Drupal\Core\Url|null
+   *   The resource URL, if it has one.
+   */
+  public function getUrl() {
+    if ($this->url) {
+      return Url::fromUri($this->url)->setAbsolute();
+    }
+    return NULL;
+  }
+
+  /**
+   * Returns the HTML representation of the resource.
+   *
+   * Only applies to 'rich' and 'video' resources.
+   *
+   * @return string|null
+   *   The HTML representation of the resource, if it has one.
+   */
+  public function getHtml() {
+    return isset($this->html) ? (string) $this->html : NULL;
+  }
+
+  /**
+   * Sets the thumbnail dimensions.
+   *
+   * @param int $width
+   *   The width of the resource.
+   * @param int $height
+   *   The height of the resource.
+   *
+   * @throws \InvalidArgumentException
+   *   If either $width or $height are not numbers greater than zero.
+   */
+  protected function setThumbnailDimensions($width, $height) {
+    $width = (int) $width;
+    $height = (int) $height;
+
+    if ($width > 0 && $height > 0) {
+      $this->thumbnailWidth = $width;
+      $this->thumbnailHeight = $height;
+    }
+    else {
+      throw new \InvalidArgumentException('The thumbnail dimensions must be numbers greater than zero.');
+    }
+  }
+
+  /**
+   * Sets the dimensions.
+   *
+   * @param int|null $width
+   *   The width of the resource.
+   * @param int|null $height
+   *   The height of the resource.
+   *
+   * @throws \InvalidArgumentException
+   *   If either $width or $height are not numbers greater than zero.
+   */
+  protected function setDimensions($width, $height) {
+    if ((isset($width) && $width <= 0) || (isset($height) && $height <= 0)) {
+      throw new \InvalidArgumentException('The dimensions must be NULL or numbers greater than zero.');
+    }
+    $this->width = isset($width) ? (int) $width : NULL;
+    $this->height = isset($height) ? (int) $height : NULL;
+  }
+
+}

core/modules/media/src/OEmbed/ResourceException.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+/**
+ * Exception thrown if an oEmbed resource cannot be fetched or parsed.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+class ResourceException extends \Exception {
+
+  /**
+   * The URL of the resource.
+   *
+   * @var string
+   */
+  protected $url;
+
+  /**
+   * The resource data.
+   *
+   * @var array
+   */
+  protected $data = [];
+
+  /**
+   * ResourceException constructor.
+   *
+   * @param string $message
+   *   The exception message.
+   * @param string $url
+   *   The URL of the resource. Can be the actual endpoint URL or the canonical
+   *   URL.
+   * @param array $data
+   *   (optional) The raw resource data, if available.
+   * @param \Exception $previous
+   *   (optional) The previous exception, if any.
+   */
+  public function __construct($message, $url, array $data = [], ?\Exception $previous = NULL) {
+    $this->url = $url;
+    $this->data = $data;
+    parent::__construct($message, 0, $previous);
+  }
+
+  /**
+   * Gets the URL of the resource which caused the exception.
+   *
+   * @return string
+   *   The URL of the resource.
+   */
+  public function getUrl() {
+    return $this->url;
+  }
+
+  /**
+   * Gets the raw resource data, if available.
+   *
+   * @return array
+   *   The resource data.
+   */
+  public function getData() {
+    return $this->data;
+  }
+
+}

core/modules/media/src/OEmbed/ResourceFetcher.php

@@ -0,0 +1,246 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+use Drupal\Component\Serialization\Json;
+use Drupal\Core\Cache\CacheBackendInterface;
+use GuzzleHttp\ClientInterface;
+use GuzzleHttp\RequestOptions;
+use Psr\Http\Client\ClientExceptionInterface;
+
+// cspell:ignore nocdata
+
+/**
+ * Fetches and caches oEmbed resources.
+ */
+class ResourceFetcher implements ResourceFetcherInterface {
+
+  /**
+   * The HTTP client.
+   *
+   * @var \GuzzleHttp\Client
+   */
+  protected $httpClient;
+
+  /**
+   * The oEmbed provider repository service.
+   *
+   * @var \Drupal\media\OEmbed\ProviderRepositoryInterface
+   */
+  protected $providers;
+
+  /**
+   * The cache backend.
+   *
+   * @var \Drupal\Core\Cache\CacheBackendInterface
+   */
+  protected $cacheBackend;
+
+  /**
+   * Constructs a ResourceFetcher object.
+   *
+   * @param \GuzzleHttp\ClientInterface $http_client
+   *   The HTTP client.
+   * @param \Drupal\media\OEmbed\ProviderRepositoryInterface $providers
+   *   The oEmbed provider repository service.
+   * @param \Drupal\Core\Cache\CacheBackendInterface $cache_backend
+   *   The cache backend.
+   */
+  public function __construct(ClientInterface $http_client, ProviderRepositoryInterface $providers, CacheBackendInterface $cache_backend) {
+    $this->httpClient = $http_client;
+    $this->providers = $providers;
+    $this->cacheBackend = $cache_backend;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function fetchResource($url) {
+    $cache_id = "media:oembed_resource:$url";
+
+    $cached = $this->cacheBackend->get($cache_id);
+    if ($cached) {
+      return $this->createResource($cached->data, $url);
+    }
+
+    try {
+      $response = $this->httpClient->request('GET', $url, [
+        RequestOptions::TIMEOUT => 5,
+      ]);
+    }
+    catch (ClientExceptionInterface $e) {
+      throw new ResourceException('Could not retrieve the oEmbed resource.', $url, [], $e);
+    }
+
+    [$format] = $response->getHeader('Content-Type');
+    $content = (string) $response->getBody();
+
+    if (strstr($format, 'text/xml') || strstr($format, 'application/xml')) {
+      $data = $this->parseResourceXml($content, $url);
+    }
+    // By default, try to parse the resource data as JSON.
+    else {
+      $data = Json::decode($content);
+
+      if (json_last_error() !== JSON_ERROR_NONE) {
+        throw new ResourceException('Error decoding oEmbed resource: ' . json_last_error_msg(), $url);
+      }
+    }
+    if (empty($data) || !is_array($data)) {
+      throw new ResourceException('The oEmbed resource could not be decoded.', $url);
+    }
+
+    $this->cacheBackend->set($cache_id, $data);
+
+    return $this->createResource($data, $url);
+  }
+
+  /**
+   * Creates a Resource object from raw resource data.
+   *
+   * @param array $data
+   *   The resource data returned by the provider.
+   * @param string $url
+   *   The URL of the resource.
+   *
+   * @return \Drupal\media\OEmbed\Resource
+   *   A value object representing the resource.
+   *
+   * @throws \Drupal\media\OEmbed\ResourceException
+   *   If the resource cannot be created.
+   */
+  protected function createResource(array $data, $url) {
+    $data += [
+      'title' => NULL,
+      'author_name' => NULL,
+      'author_url' => NULL,
+      'provider_name' => NULL,
+      'cache_age' => NULL,
+      'thumbnail_url' => NULL,
+      'thumbnail_width' => NULL,
+      'thumbnail_height' => NULL,
+      'width' => NULL,
+      'height' => NULL,
+      'url' => NULL,
+      'html' => NULL,
+      'version' => NULL,
+    ];
+
+    if ($data['version'] !== '1.0') {
+      throw new ResourceException("Resource version must be '1.0'", $url, $data);
+    }
+
+    // Prepare the arguments to pass to the factory method.
+    $provider = $data['provider_name'] ? $this->providers->get($data['provider_name']) : NULL;
+
+    // The Resource object will validate the data we create it with and throw an
+    // exception if anything looks wrong. For better debugging, catch those
+    // exceptions and wrap them in a more specific and useful exception.
+    try {
+      switch ($data['type']) {
+        case Resource::TYPE_LINK:
+          return Resource::link(
+            $data['url'],
+            $provider,
+            $data['title'],
+            $data['author_name'],
+            $data['author_url'],
+            $data['cache_age'],
+            $data['thumbnail_url'],
+            $data['thumbnail_width'],
+            $data['thumbnail_height']
+          );
+
+        case Resource::TYPE_PHOTO:
+          return Resource::photo(
+            $data['url'],
+            $data['width'],
+            $data['height'],
+            $provider,
+            $data['title'],
+            $data['author_name'],
+            $data['author_url'],
+            $data['cache_age'],
+            $data['thumbnail_url'],
+            $data['thumbnail_width'],
+            $data['thumbnail_height']
+          );
+
+        case Resource::TYPE_RICH:
+          return Resource::rich(
+            $data['html'],
+            $data['width'],
+            $data['height'],
+            $provider,
+            $data['title'],
+            $data['author_name'],
+            $data['author_url'],
+            $data['cache_age'],
+            $data['thumbnail_url'],
+            $data['thumbnail_width'],
+            $data['thumbnail_height']
+          );
+
+        case Resource::TYPE_VIDEO:
+          return Resource::video(
+            $data['html'],
+            $data['width'],
+            $data['height'],
+            $provider,
+            $data['title'],
+            $data['author_name'],
+            $data['author_url'],
+            $data['cache_age'],
+            $data['thumbnail_url'],
+            $data['thumbnail_width'],
+            $data['thumbnail_height']
+          );
+
+        default:
+          throw new ResourceException('Unknown resource type: ' . $data['type'], $url, $data);
+      }
+    }
+    catch (\InvalidArgumentException $e) {
+      throw new ResourceException($e->getMessage(), $url, $data, $e);
+    }
+  }
+
+  /**
+   * Parses XML resource data.
+   *
+   * @param string $data
+   *   The raw XML for the resource.
+   * @param string $url
+   *   The resource URL.
+   *
+   * @return array
+   *   The parsed resource data.
+   *
+   * @throws \Drupal\media\OEmbed\ResourceException
+   *   If the resource data could not be parsed.
+   */
+  protected function parseResourceXml($data, $url) {
+    // Enable userspace error handling.
+    $was_using_internal_errors = libxml_use_internal_errors(TRUE);
+    libxml_clear_errors();
+
+    $content = simplexml_load_string($data, 'SimpleXMLElement', LIBXML_NOCDATA);
+    // Restore the previous error handling behavior.
+    libxml_use_internal_errors($was_using_internal_errors);
+
+    $error = libxml_get_last_error();
+    if ($error) {
+      libxml_clear_errors();
+      throw new ResourceException($error->message, $url);
+    }
+    elseif ($content === FALSE) {
+      throw new ResourceException('The fetched resource could not be parsed.', $url);
+    }
+
+    // Convert XML to JSON so that the parsed resource has a consistent array
+    // structure, regardless of any XML attributes or quirks of the XML parser.
+    $data = Json::encode($content);
+    return Json::decode($data);
+  }
+
+}

core/modules/media/src/OEmbed/ResourceFetcherInterface.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+/**
+ * Defines an interface for an oEmbed resource fetcher service.
+ *
+ * The resource fetcher's only responsibility is to retrieve oEmbed resource
+ * data from an endpoint URL (i.e., as returned by
+ * \Drupal\media\OEmbed\UrlResolverInterface::getResourceUrl()) and return a
+ * \Drupal\media\OEmbed\Resource value object.
+ */
+interface ResourceFetcherInterface {
+
+  /**
+   * Fetches an oEmbed resource.
+   *
+   * @param string $url
+   *   Endpoint-specific URL of the oEmbed resource.
+   *
+   * @return \Drupal\media\OEmbed\Resource
+   *   A resource object built from the oEmbed resource data.
+   *
+   * @see https://oembed.com/#section2
+   *
+   * @throws \Drupal\media\OEmbed\ResourceException
+   *   If the oEmbed endpoint is not reachable or the response returns an
+   *   unexpected Content-Type header.
+   */
+  public function fetchResource($url);
+
+}

core/modules/media/src/OEmbed/UrlResolver.php

@@ -0,0 +1,210 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+use Drupal\Component\Utility\Html;
+use Drupal\Component\Utility\UrlHelper;
+use Drupal\Core\Cache\CacheBackendInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use GuzzleHttp\ClientInterface;
+use Psr\Http\Client\ClientExceptionInterface;
+
+// cspell:ignore omitscript
+
+/**
+ * Converts oEmbed media URLs into endpoint-specific resource URLs.
+ */
+class UrlResolver implements UrlResolverInterface {
+
+  /**
+   * The HTTP client.
+   *
+   * @var \GuzzleHttp\Client
+   */
+  protected $httpClient;
+
+  /**
+   * The OEmbed provider repository service.
+   *
+   * @var \Drupal\media\OEmbed\ProviderRepositoryInterface
+   */
+  protected $providers;
+
+  /**
+   * The OEmbed resource fetcher service.
+   *
+   * @var \Drupal\media\OEmbed\ResourceFetcherInterface
+   */
+  protected $resourceFetcher;
+
+  /**
+   * The module handler service.
+   *
+   * @var \Drupal\Core\Extension\ModuleHandlerInterface
+   */
+  protected $moduleHandler;
+
+  /**
+   * Static cache of discovered oEmbed resource URLs, keyed by canonical URL.
+   *
+   * A discovered resource URL is the actual endpoint URL for a specific media
+   * object, fetched from its canonical URL.
+   *
+   * @var string[]
+   */
+  protected $urlCache = [];
+
+  /**
+   * The cache backend.
+   *
+   * @var \Drupal\Core\Cache\CacheBackendInterface
+   */
+  protected $cacheBackend;
+
+  /**
+   * Constructs a UrlResolver object.
+   *
+   * @param \Drupal\media\OEmbed\ProviderRepositoryInterface $providers
+   *   The oEmbed provider repository service.
+   * @param \Drupal\media\OEmbed\ResourceFetcherInterface $resource_fetcher
+   *   The OEmbed resource fetcher service.
+   * @param \GuzzleHttp\ClientInterface $http_client
+   *   The HTTP client.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+   *   The module handler service.
+   * @param \Drupal\Core\Cache\CacheBackendInterface $cache_backend
+   *   The cache backend.
+   */
+  public function __construct(ProviderRepositoryInterface $providers, ResourceFetcherInterface $resource_fetcher, ClientInterface $http_client, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache_backend) {
+    $this->providers = $providers;
+    $this->resourceFetcher = $resource_fetcher;
+    $this->httpClient = $http_client;
+    $this->moduleHandler = $module_handler;
+    $this->cacheBackend = $cache_backend;
+  }
+
+  /**
+   * Runs oEmbed discovery and returns the endpoint URL if successful.
+   *
+   * @param string $url
+   *   The resource's URL.
+   *
+   * @return string|bool
+   *   URL of the oEmbed endpoint, or FALSE if the discovery was unsuccessful.
+   */
+  protected function discoverResourceUrl($url) {
+    try {
+      $response = $this->httpClient->get($url);
+    }
+    catch (ClientExceptionInterface) {
+      return FALSE;
+    }
+
+    $document = Html::load((string) $response->getBody());
+    $xpath = new \DOMXpath($document);
+
+    return $this->findUrl($xpath, 'json') ?: $this->findUrl($xpath, 'xml');
+  }
+
+  /**
+   * Tries to find the oEmbed URL in a DOM.
+   *
+   * @param \DOMXPath $xpath
+   *   Page HTML as DOMXPath.
+   * @param string $format
+   *   Format of oEmbed resource. Possible values are 'json' and 'xml'.
+   *
+   * @return bool|string
+   *   A URL to an oEmbed resource or FALSE if not found.
+   */
+  protected function findUrl(\DOMXPath $xpath, $format) {
+    $result = $xpath->query("//link[@type='application/$format+oembed']");
+    return $result->length ? $result->item(0)->getAttribute('href') : FALSE;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getProviderByUrl($url) {
+    // Check the URL against every scheme of every endpoint of every provider
+    // until we find a match.
+    foreach ($this->providers->getAll() as $provider_info) {
+      foreach ($provider_info->getEndpoints() as $endpoint) {
+        if ($endpoint->matchUrl($url)) {
+          return $provider_info;
+        }
+      }
+    }
+
+    $resource_url = $this->discoverResourceUrl($url);
+    if ($resource_url) {
+      return $this->resourceFetcher->fetchResource($resource_url)->getProvider();
+    }
+
+    throw new ResourceException('No matching provider found.', $url);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getResourceUrl($url, $max_width = NULL, $max_height = NULL) {
+    // Try to get the resource URL from the static cache.
+    if (isset($this->urlCache[$url])) {
+      return $this->urlCache[$url];
+    }
+
+    // Try to get the resource URL from the persistent cache.
+    $cache_id = "media:oembed_resource_url:$url:$max_width:$max_height";
+
+    $cached = $this->cacheBackend->get($cache_id);
+    if ($cached) {
+      $this->urlCache[$url] = $cached->data;
+      return $this->urlCache[$url];
+    }
+
+    $provider = $this->getProviderByUrl($url);
+
+    $resource_url = $this->getEndpointMatchingUrl($url, $provider);
+    $parsed_url = UrlHelper::parse($resource_url);
+    if ($max_width) {
+      $parsed_url['query']['maxwidth'] = $max_width;
+    }
+    if ($max_height) {
+      $parsed_url['query']['maxheight'] = $max_height;
+    }
+    // Let other modules alter the resource URL, because some oEmbed providers
+    // provide extra parameters in the query string. For example, Instagram also
+    // supports the 'omitscript' parameter.
+    $this->moduleHandler->alter('oembed_resource_url', $parsed_url, $provider);
+    $resource_url = $parsed_url['path'] . '?' . UrlHelper::buildQuery($parsed_url['query']);
+
+    $this->urlCache[$url] = $resource_url;
+    $this->cacheBackend->set($cache_id, $resource_url);
+
+    return $resource_url;
+  }
+
+  /**
+   * For the given media item URL find an endpoint with schemes that match.
+   *
+   * @param string $url
+   *   The media URL used to lookup the matching endpoint.
+   * @param \Drupal\media\OEmbed\Provider $provider
+   *   The oEmbed provider for the asset.
+   *
+   * @return string
+   *   The resource URL.
+   */
+  protected function getEndpointMatchingUrl($url, Provider $provider) {
+    $endpoints = $provider->getEndpoints();
+    $resource_url = reset($endpoints)->buildResourceUrl($url);
+    foreach ($endpoints as $endpoint) {
+      if ($endpoint->matchUrl($url)) {
+        $resource_url = $endpoint->buildResourceUrl($url);
+        break;
+      }
+    }
+    return $resource_url ?? reset($endpoints)->buildResourceUrl($url);
+  }
+
+}

core/modules/media/src/OEmbed/UrlResolverInterface.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Drupal\media\OEmbed;
+
+/**
+ * Defines the interface for the oEmbed URL resolver service.
+ *
+ * The URL resolver is responsible for converting oEmbed-compatible media asset
+ * URLs into canonical resource URLs, at which an oEmbed representation of the
+ * asset can be retrieved.
+ */
+interface UrlResolverInterface {
+
+  /**
+   * Tries to determine the oEmbed provider for a media asset URL.
+   *
+   * @param string $url
+   *   The media asset URL.
+   *
+   * @return \Drupal\media\OEmbed\Provider
+   *   The oEmbed provider for the asset.
+   *
+   * @throws \Drupal\media\OEmbed\ResourceException
+   *   If the provider cannot be determined.
+   * @throws \Drupal\media\OEmbed\ProviderException
+   *   If tne oEmbed provider causes an error.
+   */
+  public function getProviderByUrl($url);
+
+  /**
+   * Builds the resource URL for a media asset URL.
+   *
+   * @param string $url
+   *   The media asset URL.
+   * @param int $max_width
+   *   (optional) Maximum width of the oEmbed resource, in pixels.
+   * @param int $max_height
+   *   (optional) Maximum height of the oEmbed resource, in pixels.
+   *
+   * @return string
+   *   Returns the resource URL corresponding to the given media item URL.
+   */
+  public function getResourceUrl($url, $max_width = NULL, $max_height = NULL);
+
+}

core/modules/media/src/Plugin/Derivative/DynamicLocalTasks.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace Drupal\media\Plugin\Derivative;
+
+use Drupal\Component\Plugin\Derivative\DeriverBase;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Plugin\Discovery\ContainerDeriverInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\StringTranslation\TranslationInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Generates media-related local tasks.
+ */
+class DynamicLocalTasks extends DeriverBase implements ContainerDeriverInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * The media settings config.
+   *
+   * @var \Drupal\Core\Config\ImmutableConfig
+   */
+  protected $config;
+
+  /**
+   * Creates a DynamicLocalTasks object.
+   *
+   * @param \Drupal\Core\StringTranslation\TranslationInterface $string_translation
+   *   The translation manager.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory.
+   */
+  public function __construct(TranslationInterface $string_translation, EntityTypeManagerInterface $entity_type_manager, ConfigFactoryInterface $config_factory) {
+    $this->stringTranslation = $string_translation;
+    $this->entityTypeManager = $entity_type_manager;
+    $this->config = $config_factory->get('media.settings');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, $base_plugin_id) {
+    return new static(
+      $container->get('string_translation'),
+      $container->get('entity_type.manager'),
+      $container->get('config.factory')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getDerivativeDefinitions($base_plugin_definition) {
+    // Provide an edit_form task if standalone media URLs are enabled.
+    $this->derivatives["entity.media.canonical"] = [
+      'route_name' => "entity.media.canonical",
+      'title' => $this->t('Edit'),
+      'base_route' => "entity.media.canonical",
+      'weight' => 1,
+    ] + $base_plugin_definition;
+
+    if ($this->config->get('standalone_url')) {
+      $this->derivatives["entity.media.canonical"]['title'] = $this->t('View');
+
+      $this->derivatives["entity.media.edit_form"] = [
+        'route_name' => "entity.media.edit_form",
+        'title' => $this->t('Edit'),
+        'base_route' => 'entity.media.canonical',
+        'weight' => 2,
+      ] + $base_plugin_definition;
+    }
+
+    $this->derivatives["entity.media.delete_form"] = [
+      'route_name' => "entity.media.delete_form",
+      'title' => $this->t('Delete'),
+      'base_route' => "entity.media.canonical",
+      'weight' => 10,
+    ] + $base_plugin_definition;
+
+    return $this->derivatives;
+  }
+
+}

core/modules/media/src/Plugin/EntityReferenceSelection/MediaSelection.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Drupal\media\Plugin\EntityReferenceSelection;
+
+use Drupal\Core\Entity\Attribute\EntityReferenceSelection;
+use Drupal\Core\Entity\Plugin\EntityReferenceSelection\DefaultSelection;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+
+/**
+ * Provides specific access control for the media entity type.
+ */
+#[EntityReferenceSelection(
+  id: "default:media",
+  label: new TranslatableMarkup("Media selection"),
+  entity_types: ["media"],
+  group: "default",
+  weight: 1
+)]
+class MediaSelection extends DefaultSelection {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function buildEntityQuery($match = NULL, $match_operator = 'CONTAINS') {
+    $query = parent::buildEntityQuery($match, $match_operator);
+
+    // Ensure that users with insufficient permission cannot see unpublished
+    // entities.
+    if (!$this->currentUser->hasPermission('administer media')) {
+      $query->condition('status', 1);
+    }
+    return $query;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createNewEntity($entity_type_id, $bundle, $label, $uid) {
+    $media = parent::createNewEntity($entity_type_id, $bundle, $label, $uid);
+
+    // In order to create a referenceable media, it needs to published.
+    /** @var \Drupal\media\MediaInterface $media */
+    $media->setPublished();
+
+    return $media;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateReferenceableNewEntities(array $entities) {
+    $entities = parent::validateReferenceableNewEntities($entities);
+    // Mirror the conditions checked in buildEntityQuery().
+    if (!$this->currentUser->hasPermission('administer media')) {
+      $entities = array_filter($entities, function ($media) {
+        /** @var \Drupal\media\MediaInterface $media */
+        return $media->isPublished();
+      });
+    }
+    return $entities;
+  }
+
+}

core/modules/media/src/Plugin/Field/FieldFormatter/MediaThumbnailFormatter.php

@@ -0,0 +1,212 @@
+<?php
+
+namespace Drupal\media\Plugin\Field\FieldFormatter;
+
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Field\Attribute\FieldFormatter;
+use Drupal\Core\Field\FieldItemListInterface;
+use Drupal\Core\File\FileUrlGeneratorInterface;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\image\ImageStyleStorageInterface;
+use Drupal\image\Plugin\Field\FieldFormatter\ImageFormatter;
+use Drupal\Core\Field\Plugin\Field\FieldType\EntityReferenceItem;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\media\MediaInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Drupal\Core\Field\FieldDefinitionInterface;
+
+/**
+ * Plugin implementation of the 'media_thumbnail' formatter.
+ */
+#[FieldFormatter(
+  id: 'media_thumbnail',
+  label: new TranslatableMarkup('Thumbnail'),
+  field_types: [
+    'entity_reference',
+  ],
+)]
+class MediaThumbnailFormatter extends ImageFormatter {
+
+  /**
+   * The renderer service.
+   *
+   * @var \Drupal\Core\Render\RendererInterface
+   */
+  protected $renderer;
+
+  /**
+   * Constructs a MediaThumbnailFormatter object.
+   *
+   * @param string $plugin_id
+   *   The plugin_id for the formatter.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Field\FieldDefinitionInterface $field_definition
+   *   The definition of the field to which the formatter is associated.
+   * @param array $settings
+   *   The formatter settings.
+   * @param string $label
+   *   The formatter label display setting.
+   * @param string $view_mode
+   *   The view mode.
+   * @param array $third_party_settings
+   *   Any third party settings.
+   * @param \Drupal\Core\Session\AccountInterface $current_user
+   *   The current user.
+   * @param \Drupal\image\ImageStyleStorageInterface $image_style_storage
+   *   The image style entity storage handler.
+   * @param \Drupal\Core\File\FileUrlGeneratorInterface $file_url_generator
+   *   The file URL generator.
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   */
+  public function __construct($plugin_id, $plugin_definition, FieldDefinitionInterface $field_definition, array $settings, $label, $view_mode, array $third_party_settings, AccountInterface $current_user, ImageStyleStorageInterface $image_style_storage, FileUrlGeneratorInterface $file_url_generator, RendererInterface $renderer) {
+    parent::__construct($plugin_id, $plugin_definition, $field_definition, $settings, $label, $view_mode, $third_party_settings, $current_user, $image_style_storage, $file_url_generator);
+    $this->renderer = $renderer;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $plugin_id,
+      $plugin_definition,
+      $configuration['field_definition'],
+      $configuration['settings'],
+      $configuration['label'],
+      $configuration['view_mode'],
+      $configuration['third_party_settings'],
+      $container->get('current_user'),
+      $container->get('entity_type.manager')->getStorage('image_style'),
+      $container->get('file_url_generator'),
+      $container->get('renderer')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   *
+   * This has to be overridden because FileFormatterBase expects $item to be
+   * of type \Drupal\file\Plugin\Field\FieldType\FileItem and calls
+   * isDisplayed() which is not in FieldItemInterface.
+   */
+  protected function needsEntityLoad(EntityReferenceItem $item) {
+    return !$item->hasNewEntity();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function settingsForm(array $form, FormStateInterface $form_state) {
+    $element = parent::settingsForm($form, $form_state);
+    $link_types = [
+      'content' => $this->t('Content'),
+      'media' => $this->t('Media item'),
+    ];
+    $element['image_link']['#options'] = $link_types;
+
+    return $element;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function settingsSummary() {
+    $summary = parent::settingsSummary();
+
+    // The parent class adds summary text if the image_link setting is
+    // 'content'. Here we only have to add summary text if the setting
+    // is 'media'.
+    if ($this->getSetting('image_link') === 'media') {
+      $summary[] = $this->t('Linked to media item');
+    }
+
+    return $summary;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function viewElements(FieldItemListInterface $items, $langcode) {
+    $elements = [];
+    $media_items = $this->getEntitiesToView($items, $langcode);
+
+    // Early opt-out if the field is empty.
+    if (empty($media_items)) {
+      return $elements;
+    }
+
+    $image_style_setting = $this->getSetting('image_style');
+
+    /** @var \Drupal\media\MediaInterface[] $media_items */
+    foreach ($media_items as $delta => $media) {
+      $elements[$delta] = [
+        '#theme' => 'image_formatter',
+        '#item' => $media->get('thumbnail')->first(),
+        '#item_attributes' => [
+          'loading' => $this->getSetting('image_loading')['attribute'],
+        ],
+        '#image_style' => $this->getSetting('image_style'),
+        '#url' => $this->getMediaThumbnailUrl($media, $items->getEntity()),
+      ];
+
+      // Add cacheability of each item in the field.
+      $this->renderer->addCacheableDependency($elements[$delta], $media);
+    }
+
+    // Add cacheability of the image style setting.
+    if ($this->getSetting('image_link') && ($image_style = $this->imageStyleStorage->load($image_style_setting))) {
+      $this->renderer->addCacheableDependency($elements, $image_style);
+    }
+
+    return $elements;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function isApplicable(FieldDefinitionInterface $field_definition) {
+    // This formatter is only available for entity types that reference
+    // media items.
+    return ($field_definition->getFieldStorageDefinition()->getSetting('target_type') == 'media');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkAccess(EntityInterface $entity) {
+    return $entity->access('view', NULL, TRUE)
+      ->andIf(parent::checkAccess($entity));
+  }
+
+  /**
+   * Get the URL for the media thumbnail.
+   *
+   * @param \Drupal\media\MediaInterface $media
+   *   The media item.
+   * @param \Drupal\Core\Entity\EntityInterface $entity
+   *   The entity that the field belongs to.
+   *
+   * @return \Drupal\Core\Url|null
+   *   The URL object for the media item or null if we don't want to add
+   *   a link.
+   */
+  protected function getMediaThumbnailUrl(MediaInterface $media, EntityInterface $entity) {
+    $url = NULL;
+    $image_link_setting = $this->getSetting('image_link');
+    // Check if the formatter involves a link.
+    if ($image_link_setting == 'content') {
+      if (!$entity->isNew()) {
+        $url = $entity->toUrl();
+      }
+    }
+    elseif ($image_link_setting === 'media') {
+      $url = $media->toUrl();
+    }
+    return $url;
+  }
+
+}

core/modules/media/src/Plugin/Field/FieldFormatter/OEmbedFormatter.php

@@ -0,0 +1,353 @@
+<?php
+
+namespace Drupal\media\Plugin\Field\FieldFormatter;
+
+use Drupal\Core\Cache\CacheableMetadata;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Field\Attribute\FieldFormatter;
+use Drupal\Core\Field\FieldDefinitionInterface;
+use Drupal\Core\Field\FieldItemListInterface;
+use Drupal\Core\Field\FormatterBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Logger\LoggerChannelFactoryInterface;
+use Drupal\Core\Messenger\MessengerInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\Core\Url;
+use Drupal\media\Entity\MediaType;
+use Drupal\media\IFrameUrlHelper;
+use Drupal\media\OEmbed\Resource;
+use Drupal\media\OEmbed\ResourceException;
+use Drupal\media\OEmbed\ResourceFetcherInterface;
+use Drupal\media\OEmbed\UrlResolverInterface;
+use Drupal\media\Plugin\media\Source\OEmbedInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Plugin implementation of the 'oembed' formatter.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+#[FieldFormatter(
+  id: 'oembed',
+  label: new TranslatableMarkup('oEmbed content'),
+  field_types: [
+    'link',
+    'string',
+    'string_long',
+  ],
+)]
+class OEmbedFormatter extends FormatterBase {
+
+  /**
+   * The messenger service.
+   *
+   * @var \Drupal\Core\Messenger\MessengerInterface
+   */
+  protected $messenger;
+
+  /**
+   * The oEmbed resource fetcher.
+   *
+   * @var \Drupal\media\OEmbed\ResourceFetcherInterface
+   */
+  protected $resourceFetcher;
+
+  /**
+   * The oEmbed URL resolver service.
+   *
+   * @var \Drupal\media\OEmbed\UrlResolverInterface
+   */
+  protected $urlResolver;
+
+  /**
+   * The logger service.
+   *
+   * @var \Psr\Log\LoggerInterface
+   */
+  protected $logger;
+
+  /**
+   * The media settings config.
+   *
+   * @var \Drupal\Core\Config\ImmutableConfig
+   */
+  protected $config;
+
+  /**
+   * The iFrame URL helper service.
+   *
+   * @var \Drupal\media\IFrameUrlHelper
+   */
+  protected $iFrameUrlHelper;
+
+  /**
+   * Constructs an OEmbedFormatter instance.
+   *
+   * @param string $plugin_id
+   *   The plugin ID for the formatter.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Field\FieldDefinitionInterface $field_definition
+   *   The definition of the field to which the formatter is associated.
+   * @param array $settings
+   *   The formatter settings.
+   * @param string $label
+   *   The formatter label display setting.
+   * @param string $view_mode
+   *   The view mode.
+   * @param array $third_party_settings
+   *   Any third party settings.
+   * @param \Drupal\Core\Messenger\MessengerInterface $messenger
+   *   The messenger service.
+   * @param \Drupal\media\OEmbed\ResourceFetcherInterface $resource_fetcher
+   *   The oEmbed resource fetcher service.
+   * @param \Drupal\media\OEmbed\UrlResolverInterface $url_resolver
+   *   The oEmbed URL resolver service.
+   * @param \Drupal\Core\Logger\LoggerChannelFactoryInterface $logger_factory
+   *   The logger factory service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory service.
+   * @param \Drupal\media\IFrameUrlHelper $iframe_url_helper
+   *   The iFrame URL helper service.
+   */
+  public function __construct($plugin_id, $plugin_definition, FieldDefinitionInterface $field_definition, array $settings, $label, $view_mode, array $third_party_settings, MessengerInterface $messenger, ResourceFetcherInterface $resource_fetcher, UrlResolverInterface $url_resolver, LoggerChannelFactoryInterface $logger_factory, ConfigFactoryInterface $config_factory, IFrameUrlHelper $iframe_url_helper) {
+    parent::__construct($plugin_id, $plugin_definition, $field_definition, $settings, $label, $view_mode, $third_party_settings);
+    $this->messenger = $messenger;
+    $this->resourceFetcher = $resource_fetcher;
+    $this->urlResolver = $url_resolver;
+    $this->logger = $logger_factory->get('media');
+    $this->config = $config_factory->get('media.settings');
+    $this->iFrameUrlHelper = $iframe_url_helper;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $plugin_id,
+      $plugin_definition,
+      $configuration['field_definition'],
+      $configuration['settings'],
+      $configuration['label'],
+      $configuration['view_mode'],
+      $configuration['third_party_settings'],
+      $container->get('messenger'),
+      $container->get('media.oembed.resource_fetcher'),
+      $container->get('media.oembed.url_resolver'),
+      $container->get('logger.factory'),
+      $container->get('config.factory'),
+      $container->get('media.oembed.iframe_url_helper')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function defaultSettings() {
+    return [
+      'max_width' => 0,
+      'max_height' => 0,
+      'loading' => [
+        'attribute' => 'lazy',
+      ],
+    ] + parent::defaultSettings();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function viewElements(FieldItemListInterface $items, $langcode) {
+    $element = [];
+    $max_width = $this->getSetting('max_width');
+    $max_height = $this->getSetting('max_height');
+
+    foreach ($items as $delta => $item) {
+      $main_property = $item->getFieldDefinition()->getFieldStorageDefinition()->getMainPropertyName();
+      $value = $item->{$main_property};
+
+      if (empty($value)) {
+        continue;
+      }
+
+      try {
+        $resource_url = $this->urlResolver->getResourceUrl($value, $max_width, $max_height);
+        $resource = $this->resourceFetcher->fetchResource($resource_url);
+      }
+      catch (ResourceException $exception) {
+        $this->logger->error("Could not retrieve the remote URL (@url): %error", [
+          '@url' => $value,
+          '%error' => $exception->getPrevious() ? $exception->getPrevious()->getMessage() : $exception->getMessage(),
+          'exception' => $exception,
+        ]);
+        continue;
+      }
+
+      if ($resource->getType() === Resource::TYPE_LINK) {
+        $element[$delta] = [
+          '#title' => $resource->getTitle(),
+          '#type' => 'link',
+          '#url' => Url::fromUri($value),
+        ];
+      }
+      elseif ($resource->getType() === Resource::TYPE_PHOTO) {
+        $element[$delta] = [
+          '#theme' => 'image',
+          '#uri' => $resource->getUrl()->toString(),
+          '#width' => $resource->getWidth(),
+          '#height' => $resource->getHeight(),
+          '#attributes' => [
+            'loading' => $this->getSetting('loading')['attribute'],
+          ],
+        ];
+      }
+      else {
+        $url = Url::fromRoute('media.oembed_iframe', [], [
+          'absolute' => TRUE,
+          'query' => [
+            'url' => $value,
+            'max_width' => $max_width,
+            'max_height' => $max_height,
+            'hash' => $this->iFrameUrlHelper->getHash($value, $max_width, $max_height),
+          ],
+        ]);
+
+        $domain = $this->config->get('iframe_domain');
+        if ($domain) {
+          $url->setOption('base_url', $domain);
+        }
+
+        // Render videos and rich content in an iframe for security reasons.
+        // @see: https://oembed.com/#section3
+        $element[$delta] = [
+          '#type' => 'html_tag',
+          '#tag' => 'iframe',
+          '#attributes' => [
+            'src' => $url->toString(),
+            'scrolling' => FALSE,
+            // External service is not supposed to send something larger
+            // than the max width or max height, so those values should be used.
+            'width' => $resource->getWidth() ?: $max_width,
+            'height' => $resource->getHeight() ?: $max_height,
+            'class' => ['media-oembed-content'],
+            'loading' => $this->getSetting('loading')['attribute'],
+          ],
+          '#attached' => [
+            'library' => [
+              'media/oembed.formatter',
+            ],
+          ],
+        ];
+
+        // An empty title attribute will disable title inheritance, so only
+        // add it if the resource has a title.
+        $title = $resource->getTitle();
+        if ($title) {
+          $element[$delta]['#attributes']['title'] = $title;
+        }
+
+        CacheableMetadata::createFromObject($resource)
+          ->addCacheTags($this->config->getCacheTags())
+          ->applyTo($element[$delta]);
+      }
+    }
+    return $element;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function settingsForm(array $form, FormStateInterface $form_state) {
+    $form = parent::settingsForm($form, $form_state) + [
+      'max_width' => [
+        '#type' => 'number',
+        '#title' => $this->t('Maximum width'),
+        '#default_value' => $this->getSetting('max_width'),
+        '#size' => 5,
+        '#maxlength' => 5,
+        '#field_suffix' => $this->t('pixels'),
+        '#min' => 0,
+      ],
+      'max_height' => [
+        '#type' => 'number',
+        '#title' => $this->t('Maximum height'),
+        '#default_value' => $this->getSetting('max_height'),
+        '#size' => 5,
+        '#maxlength' => 5,
+        '#field_suffix' => $this->t('pixels'),
+        '#min' => 0,
+      ],
+      'loading' => [
+        '#type' => 'details',
+        '#title' => $this->t('oEmbed loading'),
+        '#description' => $this->t('Lazy render oEmbed with native loading attribute (<em>loading="lazy"</em>). This improves performance by allowing browsers to lazily load assets.'),
+        'attribute' => [
+          '#title' => $this->t('oEmbed loading attribute'),
+          '#type' => 'radios',
+          '#default_value' => $this->getSetting('loading')['attribute'],
+          '#options' => [
+            'lazy' => $this->t('Lazy (<em>loading="lazy"</em>)'),
+            'eager' => $this->t('Eager (<em>loading="eager"</em>)'),
+          ],
+          '#description' => $this->t('Select the loading attribute for oEmbed. <a href=":link">Learn more about the loading attribute for oEmbed.</a>', [
+            ':link' => 'https://html.spec.whatwg.org/multipage/urls-and-fetching.html#lazy-loading-attributes',
+          ]),
+        ],
+      ],
+    ];
+    $form['loading']['attribute']['lazy']['#description'] = $this->t('Delays loading the resource until that section of the page is visible in the browser. When in doubt, lazy loading is recommended.');
+    $form['loading']['attribute']['eager']['#description'] = $this->t('Force browsers to download a resource as soon as possible. This is the browser default for legacy reasons. Only use this option when the resource is always expected to render.');
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function settingsSummary() {
+    $summary = parent::settingsSummary();
+    if ($this->getSetting('max_width') && $this->getSetting('max_height')) {
+      $summary[] = $this->t('Maximum size: %max_width x %max_height pixels', [
+        '%max_width' => $this->getSetting('max_width'),
+        '%max_height' => $this->getSetting('max_height'),
+      ]);
+    }
+    elseif ($this->getSetting('max_width')) {
+      $summary[] = $this->t('Maximum width: %max_width pixels', [
+        '%max_width' => $this->getSetting('max_width'),
+      ]);
+    }
+    elseif ($this->getSetting('max_height')) {
+      $summary[] = $this->t('Maximum height: %max_height pixels', [
+        '%max_height' => $this->getSetting('max_height'),
+      ]);
+    }
+    $summary[] = $this->t('Loading attribute: @attribute', [
+      '@attribute' => $this->getSetting('loading')['attribute'],
+    ]);
+
+    return $summary;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function isApplicable(FieldDefinitionInterface $field_definition) {
+    if ($field_definition->getTargetEntityTypeId() !== 'media') {
+      return FALSE;
+    }
+
+    if (parent::isApplicable($field_definition)) {
+      $media_type = $field_definition->getTargetBundle();
+
+      if ($media_type) {
+        $media_type = MediaType::load($media_type);
+        return $media_type && $media_type->getSource() instanceof OEmbedInterface;
+      }
+    }
+    return FALSE;
+  }
+
+}

core/modules/media/src/Plugin/Field/FieldWidget/OEmbedWidget.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Drupal\media\Plugin\Field\FieldWidget;
+
+use Drupal\Core\Field\Attribute\FieldWidget;
+use Drupal\Core\Field\FieldDefinitionInterface;
+use Drupal\Core\Field\FieldItemListInterface;
+use Drupal\Core\Field\Plugin\Field\FieldWidget\StringTextfieldWidget;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\media\Entity\MediaType;
+use Drupal\media\Plugin\media\Source\OEmbedInterface;
+
+/**
+ * Plugin implementation of the 'oembed_textfield' widget.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+#[FieldWidget(
+  id: 'oembed_textfield',
+  label: new TranslatableMarkup('oEmbed URL'),
+  field_types: ['string'],
+)]
+class OEmbedWidget extends StringTextfieldWidget {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function formElement(FieldItemListInterface $items, $delta, array $element, array &$form, FormStateInterface $form_state) {
+    $element = parent::formElement($items, $delta, $element, $form, $form_state);
+
+    /** @var \Drupal\media\Plugin\media\Source\OEmbedInterface $source */
+    $source = $items->getEntity()->getSource();
+    $message = $this->t('You can link to media from the following services: @providers', ['@providers' => implode(', ', $source->getProviders())]);
+
+    if (!empty($element['value']['#description'])) {
+      $element['value']['#description'] = [
+        '#theme' => 'item_list',
+        '#items' => [$element['value']['#description'], $message],
+      ];
+    }
+    else {
+      $element['value']['#description'] = $message;
+    }
+
+    return $element;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function isApplicable(FieldDefinitionInterface $field_definition) {
+    $target_bundle = $field_definition->getTargetBundle();
+
+    if (!parent::isApplicable($field_definition) || $field_definition->getTargetEntityTypeId() !== 'media' || !$target_bundle) {
+      return FALSE;
+    }
+    return MediaType::load($target_bundle)->getSource() instanceof OEmbedInterface;
+  }
+
+}

core/modules/media/src/Plugin/Filter/MediaEmbed.php

@@ -0,0 +1,536 @@
+<?php
+
+namespace Drupal\media\Plugin\Filter;
+
+use Drupal\Component\Utility\Html;
+use Drupal\Core\Entity\EntityDisplayRepositoryInterface;
+use Drupal\Core\Entity\EntityRepositoryInterface;
+use Drupal\Core\Entity\EntityTypeBundleInfoInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Field\Plugin\Field\FieldFormatter\EntityReferenceEntityFormatter;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Logger\LoggerChannelFactoryInterface;
+use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\Render\BubbleableMetadata;
+use Drupal\Core\Render\RenderContext;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Security\TrustedCallbackInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\filter\Attribute\Filter;
+use Drupal\filter\FilterProcessResult;
+use Drupal\filter\Plugin\FilterBase;
+use Drupal\filter\Plugin\FilterInterface;
+use Drupal\image\Plugin\Field\FieldType\ImageItem;
+use Drupal\media\MediaInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides a filter to embed media items using a custom tag.
+ *
+ * @internal
+ */
+#[Filter(
+  id: "media_embed",
+  title: new TranslatableMarkup("Embed media"),
+  description: new TranslatableMarkup("Embeds media items using a custom tag, <code>&lt;drupal-media&gt;</code>. If used in conjunction with the 'Align/Caption' filters, make sure this filter is configured to run after them."),
+  type: FilterInterface::TYPE_TRANSFORM_REVERSIBLE,
+  weight: 100,
+  settings: [
+    "default_view_mode" => "default",
+    "allowed_view_modes" => [],
+    "allowed_media_types" => [],
+  ],
+)]
+class MediaEmbed extends FilterBase implements ContainerFactoryPluginInterface, TrustedCallbackInterface {
+
+  /**
+   * The entity repository.
+   *
+   * @var \Drupal\Core\Entity\EntityRepositoryInterface
+   */
+  protected $entityRepository;
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * The entity display repository.
+   *
+   * @var \Drupal\Core\Entity\EntityDisplayRepositoryInterface
+   */
+  protected $entityDisplayRepository;
+
+  /**
+   * The entity type bundle info service.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeBundleInfoInterface
+   */
+  protected $entityTypeBundleInfo;
+
+  /**
+   * The renderer.
+   *
+   * @var \Drupal\Core\Render\RendererInterface
+   */
+  protected $renderer;
+
+  /**
+   * The logger factory.
+   *
+   * @var \Drupal\Core\Logger\LoggerChannelFactoryInterface
+   */
+  protected $loggerFactory;
+
+  /**
+   * An array of counters for the recursive rendering protection.
+   *
+   * Each counter takes into account all the relevant information about the
+   * field and the referenced entity that is being rendered.
+   *
+   * @var array
+   *
+   * @see \Drupal\Core\Field\Plugin\Field\FieldFormatter\EntityReferenceEntityFormatter::$recursiveRenderDepth
+   */
+  protected static $recursiveRenderDepth = [];
+
+  /**
+   * Constructs a MediaEmbed object.
+   *
+   * @param array $configuration
+   *   A configuration array containing information about the plugin instance.
+   * @param string $plugin_id
+   *   The plugin ID for the plugin instance.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Entity\EntityRepositoryInterface $entity_repository
+   *   The entity repository.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager.
+   * @param \Drupal\Core\Entity\EntityDisplayRepositoryInterface $entity_display_repository
+   *   The entity display repository.
+   * @param \Drupal\Core\Entity\EntityTypeBundleInfoInterface $bundle_info
+   *   The entity type bundle info service.
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer.
+   * @param \Drupal\Core\Logger\LoggerChannelFactoryInterface $logger_factory
+   *   The logger factory.
+   */
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, EntityRepositoryInterface $entity_repository, EntityTypeManagerInterface $entity_type_manager, EntityDisplayRepositoryInterface $entity_display_repository, EntityTypeBundleInfoInterface $bundle_info, RendererInterface $renderer, LoggerChannelFactoryInterface $logger_factory) {
+    parent::__construct($configuration, $plugin_id, $plugin_definition);
+    $this->entityRepository = $entity_repository;
+    $this->entityTypeManager = $entity_type_manager;
+    $this->entityDisplayRepository = $entity_display_repository;
+    $this->entityTypeBundleInfo = $bundle_info;
+    $this->renderer = $renderer;
+    $this->loggerFactory = $logger_factory;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get('entity.repository'),
+      $container->get('entity_type.manager'),
+      $container->get('entity_display.repository'),
+      $container->get('entity_type.bundle.info'),
+      $container->get('renderer'),
+      $container->get('logger.factory')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function settingsForm(array $form, FormStateInterface $form_state) {
+    $view_mode_options = $this->entityDisplayRepository->getViewModeOptions('media');
+
+    $form['default_view_mode'] = [
+      '#type' => 'select',
+      '#options' => $view_mode_options,
+      '#title' => $this->t('Default view mode'),
+      '#default_value' => $this->settings['default_view_mode'],
+      '#description' => $this->t('The view mode that an embedded media item should be displayed in by default. This can be overridden using the <code>data-view-mode</code> attribute.'),
+    ];
+
+    $bundles = $this->entityTypeBundleInfo->getBundleInfo('media');
+    $bundle_options = array_map(function ($item) {
+      return $item['label'];
+    }, $bundles);
+    $form['allowed_media_types'] = [
+      '#title' => $this->t('Media types selectable in the Media Library'),
+      '#type' => 'checkboxes',
+      '#options' => $bundle_options,
+      '#default_value' => $this->settings['allowed_media_types'],
+      '#description' => $this->t('If none are selected, all will be allowed.'),
+      '#element_validate' => [[static::class, 'validateOptions']],
+    ];
+
+    $form['allowed_view_modes'] = [
+      '#title' => $this->t("View modes selectable in the 'Edit media' dialog"),
+      '#type' => 'checkboxes',
+      '#options' => $view_mode_options,
+      '#default_value' => $this->settings['allowed_view_modes'],
+      '#description' => $this->t("If two or more view modes are selected, users will be able to update the view mode that an embedded media item should be displayed in after it has been embedded.  If less than two view modes are selected, media will be embedded using the default view mode and no view mode options will appear after a media item has been embedded."),
+      '#element_validate' => [[static::class, 'validateOptions']],
+    ];
+
+    return $form;
+  }
+
+  /**
+   * Form element validation handler.
+   *
+   * @param array $element
+   *   The allowed_view_modes form element.
+   * @param \Drupal\Core\Form\FormStateInterface $form_state
+   *   The form state.
+   */
+  public static function validateOptions(array &$element, FormStateInterface $form_state) {
+    // Filters the #value property so only selected values appear in the
+    // config.
+    $form_state->setValueForElement($element, array_filter($element['#value']));
+  }
+
+  /**
+   * Builds the render array for the given media entity in the given langcode.
+   *
+   * @param \Drupal\media\MediaInterface $media
+   *   A media entity to render.
+   * @param string $view_mode
+   *   The view mode to render it in.
+   * @param string $langcode
+   *   Language code in which the media entity should be rendered.
+   *
+   * @return array
+   *   A render array.
+   */
+  protected function renderMedia(MediaInterface $media, $view_mode, $langcode) {
+    // Due to render caching and delayed calls, filtering happens later
+    // in the rendering process through a '#pre_render' callback, so we
+    // need to generate a counter for the media entity that is being embedded.
+    // @see \Drupal\filter\Element\ProcessedText::preRenderText()
+    $recursive_render_id = $media->uuid();
+    if (isset(static::$recursiveRenderDepth[$recursive_render_id])) {
+      static::$recursiveRenderDepth[$recursive_render_id]++;
+    }
+    else {
+      static::$recursiveRenderDepth[$recursive_render_id] = 1;
+    }
+    // Protect ourselves from recursive rendering: return an empty render array.
+    if (static::$recursiveRenderDepth[$recursive_render_id] > EntityReferenceEntityFormatter::RECURSIVE_RENDER_LIMIT) {
+      $this->loggerFactory->get('media')->error('During rendering of embedded media: recursive rendering detected for %entity_id. Aborting rendering.', [
+        '%entity_id' => $media->id(),
+      ]);
+      return [];
+    }
+
+    $build = $this->entityTypeManager
+      ->getViewBuilder('media')
+      ->view($media, $view_mode, $langcode);
+
+    // Allows other modules to treat embedded media items differently.
+    $build['#embed'] = TRUE;
+
+    // There are a few concerns when rendering an embedded media entity:
+    // - entity access checking happens not during rendering but during routing,
+    //   and therefore we have to do it explicitly here for the embedded entity.
+    $build['#access'] = $media->access('view', NULL, TRUE);
+    // - caching an embedded media entity separately is unnecessary; the host
+    //   entity is already render cached.
+    unset($build['#cache']['keys']);
+    // - Contextual Links do not make sense for embedded entities; we only allow
+    //   the host entity to be contextually managed.
+    $build['#pre_render'][] = static::class . '::disableContextualLinks';
+    // - default styling may break captioned media embeds; attach asset library
+    //   to ensure captions behave as intended. Do not set this at the root
+    //   level of the render array, otherwise it will be attached always,
+    //   instead of only when #access allows this media to be viewed and hence
+    //   only when media is actually rendered.
+    $build[':media_embed']['#attached']['library'][] = 'media/filter.caption';
+
+    return $build;
+  }
+
+  /**
+   * Builds the render array for the indicator when media cannot be loaded.
+   *
+   * @return array
+   *   A render array.
+   */
+  protected function renderMissingMediaIndicator() {
+    return [
+      '#theme' => 'media_embed_error',
+      '#message' => $this->t('The referenced media source is missing and needs to be re-embedded.'),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function process($text, $langcode) {
+    $result = new FilterProcessResult($text);
+
+    if (stristr($text, '<drupal-media') === FALSE) {
+      return $result;
+    }
+
+    $dom = Html::load($text);
+    $xpath = new \DOMXPath($dom);
+
+    foreach ($xpath->query('//drupal-media[@data-entity-type="media" and normalize-space(@data-entity-uuid)!=""]') as $node) {
+      /** @var \DOMElement $node */
+      $uuid = $node->getAttribute('data-entity-uuid');
+      $view_mode_id = $node->getAttribute('data-view-mode') ?: $this->settings['default_view_mode'];
+
+      // Delete the consumed attributes.
+      $node->removeAttribute('data-entity-type');
+      $node->removeAttribute('data-entity-uuid');
+      $node->removeAttribute('data-view-mode');
+
+      $media = $this->entityRepository->loadEntityByUuid('media', $uuid);
+      assert($media === NULL || $media instanceof MediaInterface);
+      if (!$media) {
+        $this->loggerFactory->get('media')->error('During rendering of embedded media: the media item with UUID "@uuid" does not exist.', ['@uuid' => $uuid]);
+      }
+      else {
+        $media = $this->entityRepository->getTranslationFromContext($media, $langcode);
+        $media = clone $media;
+        $this->applyPerEmbedMediaOverrides($node, $media);
+      }
+
+      $view_mode = NULL;
+      if ($view_mode_id !== EntityDisplayRepositoryInterface::DEFAULT_DISPLAY_MODE) {
+        $view_mode = $this->entityRepository->loadEntityByConfigTarget('entity_view_mode', "media.$view_mode_id");
+        if (!$view_mode) {
+          $this->loggerFactory->get('media')->error('During rendering of embedded media: the view mode "@view-mode-id" does not exist.', ['@view-mode-id' => $view_mode_id]);
+        }
+      }
+
+      $build = $media && ($view_mode || $view_mode_id === EntityDisplayRepositoryInterface::DEFAULT_DISPLAY_MODE)
+        ? $this->renderMedia($media, $view_mode_id, $langcode)
+        : $this->renderMissingMediaIndicator();
+
+      if (empty($build['#attributes']['class'])) {
+        $build['#attributes']['class'] = [];
+      }
+      // Any attributes not consumed by the filter should be carried over to the
+      // rendered embedded entity. For example, `data-align` and `data-caption`
+      // should be carried over, so that even when embedded media goes missing,
+      // at least the caption and visual structure won't get lost.
+      foreach ($node->attributes as $attribute) {
+        if ($attribute->nodeName == 'class') {
+          // We don't want to overwrite the existing CSS class of the embedded
+          // media (or if the media entity can't be loaded, the missing media
+          // indicator). But, we need to merge in CSS classes added by other
+          // filters, such as filter_align, in order for those filters to work
+          // properly.
+          $build['#attributes']['class'] = array_unique(array_merge($build['#attributes']['class'], explode(' ', $attribute->nodeValue)));
+        }
+        else {
+          $build['#attributes'][$attribute->nodeName] = $attribute->nodeValue;
+        }
+      }
+
+      $this->renderIntoDomNode($build, $node, $result);
+    }
+
+    $result->setProcessedText(Html::serialize($dom));
+
+    return $result;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function tips($long = FALSE) {
+    if ($long) {
+      return $this->t('
+      <p>You can embed media items:</p>
+      <ul>
+        <li>Choose which media item to embed: <code>&lt;drupal-media data-entity-uuid="07bf3a2e-1941-4a44-9b02-2d1d7a41ec0e" /&gt;</code></li>
+        <li>Optionally also choose a view mode: <code>data-view-mode="tiny_embed"</code>, otherwise the default view mode is used.</li>
+        <li>The <code>data-entity-type="media"</code> attribute is required for consistency.</li>
+      </ul>');
+    }
+    else {
+      return $this->t('You can embed media items (using the <code>&lt;drupal-media&gt;</code> tag).');
+    }
+  }
+
+  /**
+   * Renders the given render array into the given DOM node.
+   *
+   * @param array $build
+   *   The render array to render in isolation.
+   * @param \DOMNode $node
+   *   The DOM node to render into.
+   * @param \Drupal\filter\FilterProcessResult $result
+   *   The accumulated result of filter processing, updated with the metadata
+   *   bubbled during rendering.
+   */
+  protected function renderIntoDomNode(array $build, \DOMNode $node, FilterProcessResult &$result) {
+    // We need to render the embedded entity:
+    // - without replacing placeholders, so that the placeholders are
+    //   only replaced at the last possible moment. Hence we cannot use
+    //   either renderInIsolation() or renderRoot(), so we must use render().
+    // - without bubbling beyond this filter, because filters must
+    //   ensure that the bubbleable metadata for the changes they make
+    //   when filtering text makes it onto the FilterProcessResult
+    //   object that they return ($result). To prevent that bubbling, we
+    //   must wrap the call to render() in a render context.
+    $markup = $this->renderer->executeInRenderContext(new RenderContext(), function () use (&$build) {
+      return $this->renderer->render($build);
+    });
+    $result = $result->merge(BubbleableMetadata::createFromRenderArray($build));
+    static::replaceNodeContent($node, $markup);
+  }
+
+  /**
+   * Replaces the contents of a DOMNode.
+   *
+   * @param \DOMNode $node
+   *   A DOMNode object.
+   * @param string $content
+   *   The text or HTML that will replace the contents of $node.
+   */
+  protected static function replaceNodeContent(\DOMNode &$node, $content) {
+    if (strlen($content)) {
+      // Load the content into a new DOMDocument and retrieve the DOM nodes.
+      $replacement_nodes = Html::load($content)->getElementsByTagName('body')
+        ->item(0)
+        ->childNodes;
+    }
+    else {
+      $replacement_nodes = [$node->ownerDocument->createTextNode('')];
+    }
+
+    foreach ($replacement_nodes as $replacement_node) {
+      // Import the replacement node from the new DOMDocument into the original
+      // one, importing also the child nodes of the replacement node.
+      $replacement_node = $node->ownerDocument->importNode($replacement_node, TRUE);
+      $node->parentNode->insertBefore($replacement_node, $node);
+    }
+    $node->parentNode->removeChild($node);
+  }
+
+  /**
+   * Disables Contextual Links for the embedded media by removing its property.
+   *
+   * @param array $build
+   *   The render array for the embedded media.
+   *
+   * @return array
+   *   The updated render array.
+   *
+   * @see \Drupal\Core\Entity\EntityViewBuilder::addContextualLinks()
+   */
+  public static function disableContextualLinks(array $build) {
+    unset($build['#contextual_links']);
+    return $build;
+  }
+
+  /**
+   * Applies attribute-based per-media embed overrides of media information.
+   *
+   * Currently, this only supports overriding an image media source's `alt` and
+   * `title`. Support for more overrides may be added in the future.
+   *
+   * @param \DOMElement $node
+   *   The HTML tag whose attributes may contain overrides, and if such
+   *   attributes are applied, they will be considered consumed and will
+   *   therefore be removed from the HTML.
+   * @param \Drupal\media\MediaInterface $media
+   *   The media entity to apply attribute-based overrides to, if any.
+   *
+   * @see \Drupal\media\Plugin\media\Source\Image
+   */
+  protected function applyPerEmbedMediaOverrides(\DOMElement $node, MediaInterface $media) {
+    if ($image_field = $this->getMediaImageSourceField($media)) {
+      $settings = $media->{$image_field}->getItemDefinition()->getSettings();
+
+      if (!empty($settings['alt_field']) && $node->hasAttribute('alt')) {
+        // Allow the display of the image without an alt tag in special cases.
+        // Since setting the value in the EditorMediaDialog to an empty string
+        // restores the default value, this allows special cases where the alt
+        // text should not be set to the default value, but should be
+        // explicitly empty instead so it can be ignored by assistive
+        // technologies, such as screen readers.
+        if ($node->getAttribute('alt') === '""') {
+          $node->setAttribute('alt', '');
+        }
+        $media->{$image_field}->alt = $node->getAttribute('alt');
+        // All media entities have a thumbnail. In the case of image media, it
+        // is conceivable that a particular view mode chooses to display the
+        // thumbnail instead of the image field itself since the thumbnail
+        // simply shows a smaller version of the actual media. So we must update
+        // its `alt` too. Because its `alt` already is inherited from the image
+        // field's `alt` at entity save time.
+        // @see \Drupal\media\Plugin\media\Source\Image::getMetadata()
+        $media->thumbnail->alt = $node->getAttribute('alt');
+        // Delete the consumed attribute.
+        $node->removeAttribute('alt');
+      }
+
+      if (!empty($settings['title_field']) && $node->hasAttribute('title')) {
+        // See above, the explanations for `alt` also apply to `title`.
+        $media->{$image_field}->title = $node->getAttribute('title');
+        $media->thumbnail->title = $node->getAttribute('title');
+        // Delete the consumed attribute.
+        $node->removeAttribute('title');
+      }
+    }
+  }
+
+  /**
+   * Get image field from source config.
+   *
+   * @param \Drupal\media\MediaInterface $media
+   *   A media entity.
+   *
+   * @return string|null
+   *   String of image field name.
+   */
+  protected function getMediaImageSourceField(MediaInterface $media) {
+    $field_definition = $media->getSource()
+      ->getSourceFieldDefinition($media->bundle->entity);
+    $item_class = $field_definition->getItemDefinition()->getClass();
+    if ($item_class == ImageItem::class || is_subclass_of($item_class, ImageItem::class)) {
+      return $field_definition->getName();
+    }
+    return NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function trustedCallbacks() {
+    return ['disableContextualLinks'];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function calculateDependencies() {
+    $dependencies = [];
+    // Combine the view modes from both config parameters.
+    $view_modes = $this->settings['allowed_view_modes'] + [$this->settings['default_view_mode']];
+    $view_modes = array_unique(array_values($view_modes));
+    $dependencies += ['config' => []];
+    $storage = $this->entityTypeManager->getStorage('entity_view_mode');
+    foreach ($view_modes as $view_mode) {
+      if ($entity_view_mode = $storage->load('media.' . $view_mode)) {
+        $dependencies[$entity_view_mode->getConfigDependencyKey()][] = $entity_view_mode->getConfigDependencyName();
+      }
+    }
+    return $dependencies;
+  }
+
+}

core/modules/media/src/Plugin/QueueWorker/ThumbnailDownloader.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace Drupal\media\Plugin\QueueWorker;
+
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\Queue\Attribute\QueueWorker;
+use Drupal\Core\Queue\QueueWorkerBase;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Process a queue of media items to fetch their thumbnails.
+ */
+#[QueueWorker(
+  id: 'media_entity_thumbnail',
+  title: new TranslatableMarkup('Thumbnail downloader'),
+  cron: ['time' => 60]
+)]
+class ThumbnailDownloader extends QueueWorkerBase implements ContainerFactoryPluginInterface {
+
+  /**
+   * The entity type manager service.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected $entityTypeManager;
+
+  /**
+   * Constructs a new class instance.
+   *
+   * @param array $configuration
+   *   A configuration array containing information about the plugin instance.
+   * @param string $plugin_id
+   *   The plugin_id for the plugin instance.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   Entity type manager service.
+   */
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, EntityTypeManagerInterface $entity_type_manager) {
+    parent::__construct($configuration, $plugin_id, $plugin_definition);
+    $this->entityTypeManager = $entity_type_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get('entity_type.manager')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function processItem($data) {
+    /** @var \Drupal\media\Entity\Media $media */
+    if ($media = $this->entityTypeManager->getStorage('media')->load($data['id'])) {
+      $media->updateQueuedThumbnail();
+      $media->save();
+    }
+  }
+
+}

core/modules/media/src/Plugin/Validation/Constraint/MediaMappingsConstraint.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Drupal\media\Plugin\Validation\Constraint;
+
+use Symfony\Component\Validator\Constraint;
+
+/**
+ * Validates media mappings.
+ *
+ * @internal
+ *
+ * @Constraint(
+ *   id = "MediaMappingsConstraint",
+ *   label = @Translation("Media Mapping Constraint", context = "Validation"),
+ *   type = {"string"}
+ * )
+ */
+class MediaMappingsConstraint extends Constraint {
+
+  /**
+   * The error message if source is used in media mapping.
+   *
+   * @var string
+   */
+  public string $invalidMappingMessage = 'It is not possible to map the source field @source_field_name of a media type.';
+
+}

core/modules/media/src/Plugin/Validation/Constraint/MediaMappingsConstraintValidator.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Drupal\media\Plugin\Validation\Constraint;
+
+use Drupal\Component\Plugin\Exception\PluginException;
+use Drupal\media\MediaTypeInterface;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidator;
+use Symfony\Component\Validator\Exception\UnexpectedTypeException;
+
+/**
+ * Validates media mappings.
+ */
+class MediaMappingsConstraintValidator extends ConstraintValidator {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validate($value, Constraint $constraint): void {
+    if (!$constraint instanceof MediaMappingsConstraint) {
+      throw new UnexpectedTypeException($constraint, __NAMESPACE__ . '\MediaMappingsConstraint');
+    }
+    if (!$value instanceof MediaTypeInterface) {
+      throw new UnexpectedTypeException($value, MediaTypeInterface::class);
+    }
+    // The source field cannot be the target of a field mapping because that
+    // would cause it to be overwritten, possibly with invalid data. This is
+    // also enforced in the UI.
+    if (is_array($value->getFieldMap())) {
+      try {
+        $source_field_name = $value->getSource()
+          ->getSourceFieldDefinition($value)
+          ?->getName();
+
+        if (in_array($source_field_name, $value->getFieldMap(), TRUE)) {
+          $this->context->addViolation($constraint->invalidMappingMessage, [
+            '@source_field_name' => $source_field_name,
+          ]);
+        }
+      }
+      catch (PluginException) {
+        // The source references an invalid plugin.
+      }
+    }
+  }
+
+}

core/modules/media/src/Plugin/Validation/Constraint/OEmbedResourceConstraint.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Drupal\media\Plugin\Validation\Constraint;
+
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\Core\Validation\Attribute\Constraint;
+use Symfony\Component\Validator\Constraint as SymfonyConstraint;
+
+/**
+ * Checks if a value represents a valid oEmbed resource URL.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+#[Constraint(
+  id: 'oembed_resource',
+  label: new TranslatableMarkup('oEmbed resource', [], ['context' => 'Validation']),
+  type: ['link', 'string', 'string_long']
+)]
+class OEmbedResourceConstraint extends SymfonyConstraint {
+
+  /**
+   * The error message if the URL does not match any known provider.
+   *
+   * @var string
+   */
+  public $unknownProviderMessage = 'The given URL does not match any known oEmbed providers.';
+
+  /**
+   * The error message if the URL matches a disallowed provider.
+   *
+   * @var string
+   */
+  public $disallowedProviderMessage = 'Sorry, the @name provider is not allowed.';
+
+  /**
+   * The error message if the URL is not a valid oEmbed resource.
+   *
+   * @var string
+   */
+  public $invalidResourceMessage = 'The provided URL does not represent a valid oEmbed resource.';
+
+  /**
+   * The error message if an unexpected behavior occurs.
+   *
+   * @var string
+   */
+  public $providerErrorMessage = 'An error occurred while trying to retrieve the oEmbed provider database.';
+
+}

core/modules/media/src/Plugin/Validation/Constraint/OEmbedResourceConstraintValidator.php

@@ -0,0 +1,148 @@
+<?php
+
+namespace Drupal\media\Plugin\Validation\Constraint;
+
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Logger\LoggerChannelFactoryInterface;
+use Drupal\media\OEmbed\ProviderException;
+use Drupal\media\OEmbed\ResourceException;
+use Drupal\media\OEmbed\ResourceFetcherInterface;
+use Drupal\media\OEmbed\UrlResolverInterface;
+use Drupal\media\Plugin\media\Source\OEmbedInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidator;
+
+/**
+ * Validates oEmbed resource URLs.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+class OEmbedResourceConstraintValidator extends ConstraintValidator implements ContainerInjectionInterface {
+
+  /**
+   * The oEmbed URL resolver service.
+   *
+   * @var \Drupal\media\OEmbed\UrlResolverInterface
+   */
+  protected $urlResolver;
+
+  /**
+   * The resource fetcher service.
+   *
+   * @var \Drupal\media\OEmbed\ResourceFetcherInterface
+   */
+  protected $resourceFetcher;
+
+  /**
+   * The logger service.
+   *
+   * @var \Drupal\Core\Logger\LoggerChannelInterface
+   */
+  protected $logger;
+
+  /**
+   * Constructs a new OEmbedResourceConstraintValidator.
+   *
+   * @param \Drupal\media\OEmbed\UrlResolverInterface $url_resolver
+   *   The oEmbed URL resolver service.
+   * @param \Drupal\media\OEmbed\ResourceFetcherInterface $resource_fetcher
+   *   The resource fetcher service.
+   * @param \Drupal\Core\Logger\LoggerChannelFactoryInterface $logger_factory
+   *   The logger service.
+   */
+  public function __construct(UrlResolverInterface $url_resolver, ResourceFetcherInterface $resource_fetcher, LoggerChannelFactoryInterface $logger_factory) {
+    $this->urlResolver = $url_resolver;
+    $this->resourceFetcher = $resource_fetcher;
+    $this->logger = $logger_factory->get('media');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('media.oembed.url_resolver'),
+      $container->get('media.oembed.resource_fetcher'),
+      $container->get('logger.factory')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validate($value, Constraint $constraint) {
+    /** @var \Drupal\media\MediaInterface $media */
+    $media = $value->getEntity();
+    /** @var \Drupal\media\Plugin\media\Source\OEmbedInterface $source */
+    $source = $media->getSource();
+
+    if (!($source instanceof OEmbedInterface)) {
+      throw new \LogicException('Media source must implement ' . OEmbedInterface::class);
+    }
+    $url = $source->getSourceFieldValue($media);
+    // The URL may be NULL if the source field is empty, which is invalid input.
+    if (empty($url)) {
+      $this->context->addViolation($constraint->invalidResourceMessage);
+      return;
+    }
+
+    // Ensure that the URL matches a provider.
+    try {
+      $provider = $this->urlResolver->getProviderByUrl($url);
+    }
+    catch (ResourceException $e) {
+      $this->handleException($e, $constraint->unknownProviderMessage);
+      return;
+    }
+    catch (ProviderException $e) {
+      $this->handleException($e, $constraint->providerErrorMessage);
+      return;
+    }
+
+    // Ensure that the provider is allowed.
+    if (!in_array($provider->getName(), $source->getProviders(), TRUE)) {
+      $this->context->addViolation($constraint->disallowedProviderMessage, [
+        '@name' => $provider->getName(),
+      ]);
+      return;
+    }
+
+    // Verify that resource fetching works, because some URLs might match
+    // the schemes but don't support oEmbed.
+    try {
+      $resource_url = $this->urlResolver->getResourceUrl($url);
+      $this->resourceFetcher->fetchResource($resource_url);
+    }
+    catch (ResourceException $e) {
+      $this->handleException($e, $constraint->invalidResourceMessage);
+    }
+  }
+
+  /**
+   * Handles exceptions that occur during validation.
+   *
+   * @param \Exception $e
+   *   The caught exception.
+   * @param string $error_message
+   *   (optional) The error message to set as a constraint violation.
+   */
+  protected function handleException(\Exception $e, $error_message = NULL) {
+    if ($error_message) {
+      $this->context->addViolation($error_message);
+    }
+
+    // The oEmbed system makes heavy use of exception wrapping, so log the
+    // entire exception chain to help with troubleshooting.
+    do {
+      // @todo If $e is a ProviderException or ResourceException, log additional
+      // debugging information contained in those exceptions in
+      // https://www.drupal.org/project/drupal/issues/2972846.
+      $this->logger->error($e->getMessage());
+      $e = $e->getPrevious();
+    } while ($e);
+  }
+
+}

core/modules/media/src/Plugin/media/Source/AudioFile.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Drupal\media\Plugin\media\Source;
+
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\media\Attribute\MediaSource;
+use Drupal\media\MediaTypeInterface;
+
+/**
+ * Media source wrapping around an audio file.
+ *
+ * @see \Drupal\file\FileInterface
+ */
+#[MediaSource(
+  id: "audio_file",
+  label: new TranslatableMarkup("Audio file"),
+  description: new TranslatableMarkup("Use audio files for reusable media."),
+  allowed_field_types: ["file"],
+  default_thumbnail_filename: "audio.png"
+)]
+class AudioFile extends File {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createSourceField(MediaTypeInterface $type) {
+    return parent::createSourceField($type)->set('settings', ['file_extensions' => 'mp3 wav aac']);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function prepareViewDisplay(MediaTypeInterface $type, EntityViewDisplayInterface $display) {
+    $display->setComponent($this->getSourceFieldDefinition($type)->getName(), [
+      'type' => 'file_audio',
+      'label' => 'visually_hidden',
+    ]);
+  }
+
+}

core/modules/media/src/Plugin/media/Source/File.php

@@ -0,0 +1,127 @@
+<?php
+
+namespace Drupal\media\Plugin\media\Source;
+
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\file\FileInterface;
+use Drupal\media\Attribute\MediaSource;
+use Drupal\media\MediaInterface;
+use Drupal\media\MediaTypeInterface;
+use Drupal\media\MediaSourceBase;
+
+/**
+ * File entity media source.
+ *
+ * @see \Drupal\file\FileInterface
+ */
+#[MediaSource(
+  id: "file",
+  label: new TranslatableMarkup("File"),
+  description: new TranslatableMarkup("Use local files for reusable media."),
+  allowed_field_types: ["file"],
+)]
+class File extends MediaSourceBase {
+
+  /**
+   * Key for "Name" metadata attribute.
+   *
+   * @var string
+   */
+  const METADATA_ATTRIBUTE_NAME = 'name';
+
+  /**
+   * Key for "MIME type" metadata attribute.
+   *
+   * @var string
+   */
+  const METADATA_ATTRIBUTE_MIME = 'mimetype';
+
+  /**
+   * Key for "File size" metadata attribute.
+   *
+   * @var string
+   */
+  const METADATA_ATTRIBUTE_SIZE = 'filesize';
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getMetadataAttributes() {
+    return [
+      static::METADATA_ATTRIBUTE_NAME => $this->t('Name'),
+      static::METADATA_ATTRIBUTE_MIME => $this->t('MIME type'),
+      static::METADATA_ATTRIBUTE_SIZE => $this->t('File size'),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getMetadata(MediaInterface $media, $attribute_name) {
+    /** @var \Drupal\file\FileInterface $file */
+    $file = $media->get($this->configuration['source_field'])->entity;
+    // If the source field is not required, it may be empty.
+    if (!$file) {
+      return parent::getMetadata($media, $attribute_name);
+    }
+    switch ($attribute_name) {
+      case static::METADATA_ATTRIBUTE_NAME:
+      case 'default_name':
+        return $file->getFilename();
+
+      case static::METADATA_ATTRIBUTE_MIME:
+        return $file->getMimeType();
+
+      case static::METADATA_ATTRIBUTE_SIZE:
+        return $file->getSize();
+
+      case 'thumbnail_uri':
+        return $this->getThumbnail($file) ?: parent::getMetadata($media, $attribute_name);
+
+      default:
+        return parent::getMetadata($media, $attribute_name);
+    }
+  }
+
+  /**
+   * Gets the thumbnail image URI based on a file entity.
+   *
+   * @param \Drupal\file\FileInterface $file
+   *   A file entity.
+   *
+   * @return string
+   *   File URI of the thumbnail image or NULL if there is no specific icon.
+   */
+  protected function getThumbnail(FileInterface $file) {
+    $icon_base = $this->configFactory->get('media.settings')->get('icon_base_uri');
+
+    // We try to automatically use the most specific icon present in the
+    // $icon_base directory, based on the MIME type. For instance, if an
+    // icon file named "pdf.png" is present, it will be used if the file
+    // matches this MIME type.
+    $mimetype = $file->getMimeType();
+    $mimetype = explode('/', $mimetype);
+
+    $icon_names = [
+      $mimetype[0] . '--' . $mimetype[1],
+      $mimetype[1],
+      $mimetype[0],
+    ];
+    foreach ($icon_names as $icon_name) {
+      $thumbnail = $icon_base . '/' . $icon_name . '.png';
+      if (is_file($thumbnail)) {
+        return $thumbnail;
+      }
+    }
+
+    return NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createSourceField(MediaTypeInterface $type) {
+    return parent::createSourceField($type)->set('settings', ['file_extensions' => 'txt doc docx pdf']);
+  }
+
+}

core/modules/media/src/Plugin/media/Source/Image.php

@@ -0,0 +1,187 @@
+<?php
+
+namespace Drupal\media\Plugin\media\Source;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\Core\Entity\EntityFieldManagerInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Field\FieldTypePluginManagerInterface;
+use Drupal\Core\File\FileSystemInterface;
+use Drupal\Core\Image\ImageFactory;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\media\Attribute\MediaSource;
+use Drupal\media\MediaInterface;
+use Drupal\media\MediaTypeInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Image entity media source.
+ *
+ * @see \Drupal\Core\Image\ImageInterface
+ */
+#[MediaSource(
+  id: "image",
+  label: new TranslatableMarkup("Image"),
+  description: new TranslatableMarkup("Use local images for reusable media."),
+  allowed_field_types: ["image"],
+  default_thumbnail_filename: "no-thumbnail.png",
+  thumbnail_alt_metadata_attribute: "thumbnail_alt_value"
+)]
+class Image extends File {
+
+  /**
+   * Key for "image width" metadata attribute.
+   *
+   * @var string
+   */
+  const METADATA_ATTRIBUTE_WIDTH = 'width';
+
+  /**
+   * Key for "image height" metadata attribute.
+   *
+   * @var string
+   */
+  const METADATA_ATTRIBUTE_HEIGHT = 'height';
+
+  /**
+   * The image factory service.
+   *
+   * @var \Drupal\Core\Image\ImageFactory
+   */
+  protected $imageFactory;
+
+  /**
+   * The file system service.
+   *
+   * @var \Drupal\Core\File\FileSystemInterface
+   */
+  protected $fileSystem;
+
+  /**
+   * Constructs a new class instance.
+   *
+   * @param array $configuration
+   *   A configuration array containing information about the plugin instance.
+   * @param string $plugin_id
+   *   The plugin_id for the plugin instance.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   Entity type manager service.
+   * @param \Drupal\Core\Entity\EntityFieldManagerInterface $entity_field_manager
+   *   Entity field manager service.
+   * @param \Drupal\Core\Field\FieldTypePluginManagerInterface $field_type_manager
+   *   The field type plugin manager service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory service.
+   * @param \Drupal\Core\Image\ImageFactory $image_factory
+   *   The image factory.
+   * @param \Drupal\Core\File\FileSystemInterface $file_system
+   *   The file system service.
+   */
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, EntityTypeManagerInterface $entity_type_manager, EntityFieldManagerInterface $entity_field_manager, FieldTypePluginManagerInterface $field_type_manager, ConfigFactoryInterface $config_factory, ImageFactory $image_factory, FileSystemInterface $file_system) {
+    parent::__construct($configuration, $plugin_id, $plugin_definition, $entity_type_manager, $entity_field_manager, $field_type_manager, $config_factory);
+
+    $this->imageFactory = $image_factory;
+    $this->fileSystem = $file_system;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get('entity_type.manager'),
+      $container->get('entity_field.manager'),
+      $container->get('plugin.manager.field.field_type'),
+      $container->get('config.factory'),
+      $container->get('image.factory'),
+      $container->get('file_system')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getMetadataAttributes() {
+    $attributes = parent::getMetadataAttributes();
+
+    $attributes += [
+      static::METADATA_ATTRIBUTE_WIDTH => $this->t('Width'),
+      static::METADATA_ATTRIBUTE_HEIGHT => $this->t('Height'),
+    ];
+
+    return $attributes;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getMetadata(MediaInterface $media, $name) {
+    // Get the file and image data.
+    /** @var \Drupal\file\FileInterface $file */
+    $file = $media->get($this->configuration['source_field'])->entity;
+    // If the source field is not required, it may be empty.
+    if (!$file) {
+      return parent::getMetadata($media, $name);
+    }
+
+    $uri = $file->getFileUri();
+    switch ($name) {
+      case static::METADATA_ATTRIBUTE_WIDTH:
+        $image = $this->imageFactory->get($uri);
+        return $image->getWidth() ?: NULL;
+
+      case static::METADATA_ATTRIBUTE_HEIGHT:
+        $image = $this->imageFactory->get($uri);
+        return $image->getHeight() ?: NULL;
+
+      case 'thumbnail_uri':
+        return $uri;
+
+      case 'thumbnail_alt_value':
+        return $media->get($this->configuration['source_field'])->alt ?: parent::getMetadata($media, $name);
+    }
+
+    return parent::getMetadata($media, $name);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createSourceField(MediaTypeInterface $type) {
+    /** @var \Drupal\field\FieldConfigInterface $field */
+    $field = parent::createSourceField($type);
+
+    // Reset the field to its default settings so that we don't inherit the
+    // settings from the parent class' source field.
+    $settings = $this->fieldTypeManager->getDefaultFieldSettings($field->getType());
+
+    return $field->set('settings', $settings);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function prepareViewDisplay(MediaTypeInterface $type, EntityViewDisplayInterface $display) {
+    parent::prepareViewDisplay($type, $display);
+
+    // Use the `large` image style and do not link the image to anything.
+    // This will prevent the out-of-the-box configuration from outputting very
+    // large raw images. If the `large` image style has been deleted, do not
+    // set an image style.
+    $field_name = $this->getSourceFieldDefinition($type)->getName();
+    $component = $display->getComponent($field_name);
+    $component['settings']['image_link'] = '';
+    $component['settings']['image_style'] = '';
+    if ($this->entityTypeManager->getStorage('image_style')->load('large')) {
+      $component['settings']['image_style'] = 'large';
+    }
+    $display->setComponent($field_name, $component);
+  }
+
+}

core/modules/media/src/Plugin/media/Source/OEmbed.php

@@ -0,0 +1,562 @@
+<?php
+
+namespace Drupal\media\Plugin\media\Source;
+
+use Drupal\Component\Render\PlainTextOutput;
+use Drupal\Component\Utility\Crypt;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Entity\Display\EntityFormDisplayInterface;
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\Core\Entity\EntityFieldManagerInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Field\FieldTypePluginManagerInterface;
+use Drupal\Core\File\Exception\FileException;
+use Drupal\Core\File\FileExists;
+use Drupal\Core\File\FileSystemInterface;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Messenger\MessengerInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\Core\Url;
+use Drupal\Core\Utility\Token;
+use Drupal\media\Attribute\OEmbedMediaSource;
+use Drupal\media\IFrameUrlHelper;
+use Drupal\media\MediaInterface;
+use Drupal\media\MediaSourceBase;
+use Drupal\media\MediaTypeInterface;
+use Drupal\media\OEmbed\Resource;
+use Drupal\media\OEmbed\ResourceException;
+use Drupal\media\OEmbed\ResourceFetcherInterface;
+use Drupal\media\OEmbed\UrlResolverInterface;
+use GuzzleHttp\ClientInterface;
+use Psr\Http\Client\ClientExceptionInterface;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\Mime\MimeTypes;
+
+/**
+ * Provides a media source plugin for oEmbed resources.
+ *
+ * For security reasons, the oEmbed source (and, therefore, anything that
+ * extends it) obeys a hard-coded list of allowed third-party oEmbed providers
+ * set in its plugin definition's providers array. This array is a set of
+ * provider names, exactly as they appear in the canonical oEmbed provider
+ * database at https://oembed.com/providers.json.
+ *
+ * You can implement support for additional providers by defining a new plugin
+ * that uses this class. This can be done in hook_media_source_info_alter().
+ * For example:
+ * @code
+ * <?php
+ *
+ * function example_media_source_info_alter(array &$sources) {
+ *   $sources['artwork'] = [
+ *     'id' => 'artwork',
+ *     'label' => $this->t('Artwork'),
+ *     'description' => $this->t('Use artwork from Flickr and DeviantArt.'),
+ *     'allowed_field_types' => ['string'],
+ *     'default_thumbnail_filename' => 'no-thumbnail.png',
+ *     'providers' => ['Deviantart.com', 'Flickr'],
+ *     'class' => 'Drupal\media\Plugin\media\Source\OEmbed',
+ *   ];
+ * }
+ * @endcode
+ * The "Deviantart.com" and "Flickr" provider names are specified in
+ * https://oembed.com/providers.json. The
+ * \Drupal\media\Plugin\media\Source\OEmbed class already knows how to handle
+ * standard interactions with third-party oEmbed APIs, so there is no need to
+ * define a new class which extends it. With the code above, you will able to
+ * create media types which use the "Artwork" source plugin, and use those media
+ * types to link to assets on Deviantart and Flickr.
+ */
+#[OEmbedMediaSource(
+  id: "oembed",
+  label: new TranslatableMarkup("oEmbed source"),
+  description: new TranslatableMarkup("Use oEmbed URL for reusable media."),
+  allowed_field_types: ["string"],
+  default_thumbnail_filename: "no-thumbnail.png",
+  deriver: OEmbedDeriver::class,
+)]
+class OEmbed extends MediaSourceBase implements OEmbedInterface {
+
+  /**
+   * The logger channel for media.
+   *
+   * @var \Psr\Log\LoggerInterface
+   */
+  protected $logger;
+
+  /**
+   * The messenger service.
+   *
+   * @var \Drupal\Core\Messenger\MessengerInterface
+   */
+  protected $messenger;
+
+  /**
+   * The HTTP client.
+   *
+   * @var \GuzzleHttp\Client
+   */
+  protected $httpClient;
+
+  /**
+   * The oEmbed resource fetcher service.
+   *
+   * @var \Drupal\media\OEmbed\ResourceFetcherInterface
+   */
+  protected $resourceFetcher;
+
+  /**
+   * The OEmbed manager service.
+   *
+   * @var \Drupal\media\OEmbed\UrlResolverInterface
+   */
+  protected $urlResolver;
+
+  /**
+   * The iFrame URL helper service.
+   *
+   * @var \Drupal\media\IFrameUrlHelper
+   */
+  protected $iFrameUrlHelper;
+
+  /**
+   * The file system.
+   *
+   * @var \Drupal\Core\File\FileSystemInterface
+   */
+  protected $fileSystem;
+
+  /**
+   * The token replacement service.
+   *
+   * @var \Drupal\Core\Utility\Token
+   */
+  protected $token;
+
+  /**
+   * Constructs a new OEmbed instance.
+   *
+   * @param array $configuration
+   *   A configuration array containing information about the plugin instance.
+   * @param string $plugin_id
+   *   The plugin_id for the plugin instance.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\Entity\EntityTypeManagerInterface $entity_type_manager
+   *   The entity type manager service.
+   * @param \Drupal\Core\Entity\EntityFieldManagerInterface $entity_field_manager
+   *   The entity field manager service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory service.
+   * @param \Drupal\Core\Field\FieldTypePluginManagerInterface $field_type_manager
+   *   The field type plugin manager service.
+   * @param \Psr\Log\LoggerInterface $logger
+   *   The logger channel for media.
+   * @param \Drupal\Core\Messenger\MessengerInterface $messenger
+   *   The messenger service.
+   * @param \GuzzleHttp\ClientInterface $http_client
+   *   The HTTP client.
+   * @param \Drupal\media\OEmbed\ResourceFetcherInterface $resource_fetcher
+   *   The oEmbed resource fetcher service.
+   * @param \Drupal\media\OEmbed\UrlResolverInterface $url_resolver
+   *   The oEmbed URL resolver service.
+   * @param \Drupal\media\IFrameUrlHelper $iframe_url_helper
+   *   The iFrame URL helper service.
+   * @param \Drupal\Core\File\FileSystemInterface $file_system
+   *   The file system.
+   * @param \Drupal\Core\Utility\Token $token
+   *   The token replacement service.
+   */
+  public function __construct(array $configuration, $plugin_id, $plugin_definition, EntityTypeManagerInterface $entity_type_manager, EntityFieldManagerInterface $entity_field_manager, ConfigFactoryInterface $config_factory, FieldTypePluginManagerInterface $field_type_manager, LoggerInterface $logger, MessengerInterface $messenger, ClientInterface $http_client, ResourceFetcherInterface $resource_fetcher, UrlResolverInterface $url_resolver, IFrameUrlHelper $iframe_url_helper, FileSystemInterface $file_system, Token $token) {
+    parent::__construct($configuration, $plugin_id, $plugin_definition, $entity_type_manager, $entity_field_manager, $field_type_manager, $config_factory);
+    $this->logger = $logger;
+    $this->messenger = $messenger;
+    $this->httpClient = $http_client;
+    $this->resourceFetcher = $resource_fetcher;
+    $this->urlResolver = $url_resolver;
+    $this->iFrameUrlHelper = $iframe_url_helper;
+    $this->fileSystem = $file_system;
+    $this->token = $token;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get('entity_type.manager'),
+      $container->get('entity_field.manager'),
+      $container->get('config.factory'),
+      $container->get('plugin.manager.field.field_type'),
+      $container->get('logger.factory')->get('media'),
+      $container->get('messenger'),
+      $container->get('http_client'),
+      $container->get('media.oembed.resource_fetcher'),
+      $container->get('media.oembed.url_resolver'),
+      $container->get('media.oembed.iframe_url_helper'),
+      $container->get('file_system'),
+      $container->get('token')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getMetadataAttributes() {
+    return [
+      'type' => $this->t('Resource type'),
+      'title' => $this->t('Resource title'),
+      'author_name' => $this->t('Author/owner name'),
+      'author_url' => $this->t('Author/owner URL'),
+      'provider_name' => $this->t('Provider name'),
+      'provider_url' => $this->t('Provider URL'),
+      'cache_age' => $this->t('Suggested cache lifetime'),
+      'default_name' => $this->t('Media item default name'),
+      'thumbnail_uri' => $this->t('Thumbnail local URI'),
+      'thumbnail_width' => $this->t('Thumbnail width'),
+      'thumbnail_height' => $this->t('Thumbnail height'),
+      'url' => $this->t('Resource source URL'),
+      'width' => $this->t('Resource width'),
+      'height' => $this->t('Resource height'),
+      'html' => $this->t('Resource HTML representation'),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getMetadata(MediaInterface $media, $name) {
+    $media_url = $this->getSourceFieldValue($media);
+    // The URL may be NULL if the source field is empty, in which case just
+    // return NULL.
+    if (empty($media_url)) {
+      return NULL;
+    }
+
+    try {
+      $resource_url = $this->urlResolver->getResourceUrl($media_url);
+      $resource = $this->resourceFetcher->fetchResource($resource_url);
+    }
+    catch (ResourceException $e) {
+      $this->messenger->addError($e->getMessage());
+      return NULL;
+    }
+
+    switch ($name) {
+      case 'default_name':
+        if ($title = $this->getMetadata($media, 'title')) {
+          return $title;
+        }
+        elseif ($url = $this->getMetadata($media, 'url')) {
+          return $url;
+        }
+        return parent::getMetadata($media, 'default_name');
+
+      case 'thumbnail_uri':
+        return $this->getLocalThumbnailUri($resource, $media) ?: parent::getMetadata($media, 'thumbnail_uri');
+
+      case 'type':
+        return $resource->getType();
+
+      case 'title':
+        return $resource->getTitle();
+
+      case 'author_name':
+        return $resource->getAuthorName();
+
+      case 'author_url':
+        return $resource->getAuthorUrl();
+
+      case 'provider_name':
+        $provider = $resource->getProvider();
+        return $provider ? $provider->getName() : '';
+
+      case 'provider_url':
+        $provider = $resource->getProvider();
+        return $provider ? $provider->getUrl() : NULL;
+
+      case 'cache_age':
+        return $resource->getCacheMaxAge();
+
+      case 'thumbnail_width':
+        return $resource->getThumbnailWidth();
+
+      case 'thumbnail_height':
+        return $resource->getThumbnailHeight();
+
+      case 'url':
+        $url = $resource->getUrl();
+        return $url ? $url->toString() : NULL;
+
+      case 'width':
+        return $resource->getWidth();
+
+      case 'height':
+        return $resource->getHeight();
+
+      case 'html':
+        return $resource->getHtml();
+
+      default:
+        break;
+    }
+    return NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
+    $form = parent::buildConfigurationForm($form, $form_state);
+
+    $domain = $this->configFactory->get('media.settings')->get('iframe_domain');
+    if (!$this->iFrameUrlHelper->isSecure($domain)) {
+      array_unshift($form, [
+        '#markup' => '<p>' . $this->t('It is potentially insecure to display oEmbed content in a frame that is served from the same domain as your main Drupal site, as this may allow execution of third-party code. <a href=":url">You can specify a different domain for serving oEmbed content in the Media settings</a>.', [
+          ':url' => Url::fromRoute('media.settings')->setAbsolute()->toString(),
+        ]) . '</p>',
+      ]);
+    }
+
+    $form['thumbnails_directory'] = [
+      '#type' => 'textfield',
+      '#title' => $this->t('Thumbnails location'),
+      '#default_value' => $this->configuration['thumbnails_directory'],
+      '#description' => $this->t('Thumbnails will be fetched from the provider for local usage. This is the URI of the directory where they will be placed.'),
+      '#required' => TRUE,
+    ];
+
+    $configuration = $this->getConfiguration();
+    $plugin_definition = $this->getPluginDefinition();
+
+    $form['providers'] = [
+      '#type' => 'checkboxes',
+      '#title' => $this->t('Allowed providers'),
+      '#default_value' => $configuration['providers'],
+      '#options' => array_combine($plugin_definition['providers'], $plugin_definition['providers']),
+      '#description' => $this->t('Optionally select the allowed oEmbed providers for this media type. If left blank, all providers will be allowed.'),
+    ];
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitConfigurationForm(array &$form, FormStateInterface $form_state) {
+    parent::submitConfigurationForm($form, $form_state);
+    $configuration = $this->getConfiguration();
+    $configuration['providers'] = array_filter(array_values($configuration['providers']));
+    $this->setConfiguration($configuration);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateConfigurationForm(array &$form, FormStateInterface $form_state) {
+    $thumbnails_directory = $form_state->getValue('thumbnails_directory');
+
+    /** @var \Drupal\Core\StreamWrapper\StreamWrapperManagerInterface $stream_wrapper_manager */
+    $stream_wrapper_manager = \Drupal::service('stream_wrapper_manager');
+
+    if (!$stream_wrapper_manager->isValidUri($thumbnails_directory)) {
+      $form_state->setErrorByName('thumbnails_directory', $this->t('@path is not a valid path.', [
+        '@path' => $thumbnails_directory,
+      ]));
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function defaultConfiguration() {
+    return parent::defaultConfiguration() + [
+      'thumbnails_directory' => 'public://oembed_thumbnails/[date:custom:Y-m]',
+      'providers' => [],
+    ];
+  }
+
+  /**
+   * Returns the local URI for a resource thumbnail.
+   *
+   * If the thumbnail is not already locally stored, this method will attempt
+   * to download it.
+   *
+   * @param \Drupal\media\OEmbed\Resource $resource
+   *   The oEmbed resource.
+   * @param \Drupal\media\MediaInterface|null $media
+   *   The media entity that contains the resource.
+   *
+   * @return string|null
+   *   The local thumbnail URI, or NULL if it could not be downloaded, or if the
+   *   resource has no thumbnail at all.
+   *
+   * @todo Determine whether or not oEmbed media thumbnails should be stored
+   * locally at all, and if so, whether that functionality should be
+   * toggle-able. See https://www.drupal.org/project/drupal/issues/2962751 for
+   * more information.
+   */
+  protected function getLocalThumbnailUri(Resource $resource, ?MediaInterface $media = NULL) {
+    if (is_null($media)) {
+      @trigger_error('Calling ' . __METHOD__ . '() without the $media argument is deprecated in drupal:10.3.0 and it will be required in drupal:11.0.0. See https://www.drupal.org/node/3432920', E_USER_DEPRECATED);
+      $token_data = [];
+    }
+    else {
+      $token_data = ['date' => $media->getCreatedTime()];
+    }
+
+    // If there is no remote thumbnail, there's nothing for us to fetch here.
+    $remote_thumbnail_url = $resource->getThumbnailUrl();
+    if (!$remote_thumbnail_url) {
+      return NULL;
+    }
+
+    // Use the configured directory to store thumbnails. The directory can
+    // contain basic (i.e., global) tokens. If any of the replaced tokens
+    // contain HTML, the tags will be removed and XML entities will be decoded.
+    $configuration = $this->getConfiguration();
+    $directory = $configuration['thumbnails_directory'];
+    // The thumbnail directory might contain a date token, so we pass in the
+    // creation date of the media entity so that the token won't rely on the
+    // current request time, making the current request have a max-age of 0.
+    // @see system_tokens() for $type == 'date'.
+    $directory = $this->token->replace($directory, $token_data);
+    $directory = PlainTextOutput::renderFromHtml($directory);
+
+    // The local thumbnail doesn't exist yet, so try to download it. First,
+    // ensure that the destination directory is writable, and if it's not,
+    // log an error and bail out.
+    if (!$this->fileSystem->prepareDirectory($directory, FileSystemInterface::CREATE_DIRECTORY | FileSystemInterface::MODIFY_PERMISSIONS)) {
+      $this->logger->warning('Could not prepare thumbnail destination directory @dir for oEmbed media.', [
+        '@dir' => $directory,
+      ]);
+      return NULL;
+    }
+
+    // The local filename of the thumbnail is always a hash of its remote URL.
+    // If a file with that name already exists in the thumbnails directory,
+    // regardless of its extension, return its URI.
+    $remote_thumbnail_url = $remote_thumbnail_url->toString();
+    $hash = Crypt::hashBase64($remote_thumbnail_url);
+    $files = $this->fileSystem->scanDirectory($directory, "/^$hash\..*/");
+    if (count($files) > 0) {
+      return reset($files)->uri;
+    }
+
+    // The local thumbnail doesn't exist yet, so we need to download it.
+    try {
+      $response = $this->httpClient->request('GET', $remote_thumbnail_url);
+      if ($response->getStatusCode() === 200) {
+        $local_thumbnail_uri = $directory . DIRECTORY_SEPARATOR . $hash . '.' . $this->getThumbnailFileExtensionFromUrl($remote_thumbnail_url, $response);
+        $this->fileSystem->saveData((string) $response->getBody(), $local_thumbnail_uri, FileExists::Replace);
+        return $local_thumbnail_uri;
+      }
+    }
+    catch (ClientExceptionInterface $e) {
+      $this->logger->warning('Failed to download remote thumbnail file due to "%error".', [
+        '%error' => $e->getMessage(),
+      ]);
+    }
+    catch (FileException $e) {
+      $this->logger->warning('Could not download remote thumbnail from {url}.', [
+        'url' => $remote_thumbnail_url,
+      ]);
+    }
+    return NULL;
+  }
+
+  /**
+   * Tries to determine the file extension of a thumbnail.
+   *
+   * @param string $thumbnail_url
+   *   The remote URL of the thumbnail.
+   * @param \Psr\Http\Message\ResponseInterface $response
+   *   The response for the downloaded thumbnail.
+   *
+   * @return string|null
+   *   The file extension, or NULL if it could not be determined.
+   */
+  protected function getThumbnailFileExtensionFromUrl(string $thumbnail_url, ResponseInterface $response): ?string {
+    // First, try to glean the extension from the URL path.
+    $path = parse_url($thumbnail_url, PHP_URL_PATH);
+    if ($path) {
+      $extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));
+      if ($extension) {
+        return $extension;
+      }
+    }
+
+    // If the URL didn't give us any clues about the file extension, see if the
+    // response headers will give us a MIME type.
+    $content_type = $response->getHeader('Content-Type');
+    // If there was no Content-Type header, there's nothing else we can do.
+    if (empty($content_type)) {
+      return NULL;
+    }
+    $extensions = MimeTypes::getDefault()->getExtensions(reset($content_type));
+    if ($extensions) {
+      return reset($extensions);
+    }
+    // If no file extension could be determined from the Content-Type header,
+    // we're stumped.
+    return NULL;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getSourceFieldConstraints() {
+    return [
+      'oembed_resource' => [],
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function prepareViewDisplay(MediaTypeInterface $type, EntityViewDisplayInterface $display) {
+    $display->setComponent($this->getSourceFieldDefinition($type)->getName(), [
+      'type' => 'oembed',
+      'label' => 'visually_hidden',
+    ]);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function prepareFormDisplay(MediaTypeInterface $type, EntityFormDisplayInterface $display) {
+    parent::prepareFormDisplay($type, $display);
+    $source_field = $this->getSourceFieldDefinition($type)->getName();
+
+    $display->setComponent($source_field, [
+      'type' => 'oembed_textfield',
+      'weight' => $display->getComponent($source_field)['weight'],
+    ]);
+    $display->removeComponent('name');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getProviders() {
+    $configuration = $this->getConfiguration();
+    return $configuration['providers'] ?: $this->getPluginDefinition()['providers'];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createSourceField(MediaTypeInterface $type) {
+    $plugin_definition = $this->getPluginDefinition();
+
+    $label = (string) $this->t('@type URL', [
+      '@type' => $plugin_definition['label'],
+    ]);
+    return parent::createSourceField($type)->set('label', $label);
+  }
+
+}

core/modules/media/src/Plugin/media/Source/OEmbedDeriver.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace Drupal\media\Plugin\media\Source;
+
+use Drupal\Component\Plugin\Derivative\DeriverBase;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+
+/**
+ * Derives media source plugin definitions for supported oEmbed providers.
+ *
+ * @internal
+ *   This is an internal part of the oEmbed system and should only be used by
+ *   oEmbed-related code in Drupal core.
+ */
+class OEmbedDeriver extends DeriverBase {
+
+  use StringTranslationTrait;
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getDerivativeDefinitions($base_plugin_definition) {
+    $this->derivatives = [
+      'video' => [
+        'id' => 'video',
+        'label' => $this->t('Remote video'),
+        'description' => $this->t('Use remote video URL for reusable media.'),
+        'providers' => ['YouTube', 'Vimeo'],
+        'default_thumbnail_filename' => 'video.png',
+      ] + $base_plugin_definition,
+    ];
+    return parent::getDerivativeDefinitions($base_plugin_definition);
+  }
+
+}

core/modules/media/src/Plugin/media/Source/OEmbedInterface.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace Drupal\media\Plugin\media\Source;
+
+use Drupal\media\MediaSourceFieldConstraintsInterface;
+
+/**
+ * Defines additional functionality for source plugins that use oEmbed.
+ */
+interface OEmbedInterface extends MediaSourceFieldConstraintsInterface {
+
+  /**
+   * Returns the oEmbed provider names.
+   *
+   * The allowed providers can be configured by the user. If it is not
+   * configured, all providers supported by the plugin are returned.
+   *
+   * @return string[]
+   *   A list of oEmbed provider names.
+   */
+  public function getProviders();
+
+}

core/modules/media/src/Plugin/media/Source/VideoFile.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Drupal\media\Plugin\media\Source;
+
+use Drupal\Core\Entity\Display\EntityViewDisplayInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\media\Attribute\MediaSource;
+use Drupal\media\MediaTypeInterface;
+
+/**
+ * Media source wrapping around a video file.
+ *
+ * @see \Drupal\file\FileInterface
+ */
+#[MediaSource(
+  id: "video_file",
+  label: new TranslatableMarkup("Video file"),
+  description: new TranslatableMarkup("Use video files for reusable media."),
+  allowed_field_types: ["file"],
+  default_thumbnail_filename: "video.png"
+)]
+class VideoFile extends File {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createSourceField(MediaTypeInterface $type) {
+    return parent::createSourceField($type)->set('settings', ['file_extensions' => 'mp4']);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function prepareViewDisplay(MediaTypeInterface $type, EntityViewDisplayInterface $display) {
+    $display->setComponent($this->getSourceFieldDefinition($type)->getName(), [
+      'type' => 'file_video',
+      'label' => 'visually_hidden',
+    ]);
+  }
+
+}

core/modules/media/src/Plugin/views/filter/Status.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace Drupal\media\Plugin\views\filter;
+
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\views\Attribute\ViewsFilter;
+use Drupal\views\Plugin\views\filter\FilterPluginBase;
+
+/**
+ * Filter by published status.
+ *
+ * @ingroup views_filter_handlers
+ */
+#[ViewsFilter("media_status")]
+class Status extends FilterPluginBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function adminSummary() {}
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function operatorForm(&$form, FormStateInterface $form_state) {}
+
+  /**
+   * {@inheritdoc}
+   */
+  public function canExpose() {
+    return FALSE;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function query() {
+    $table = $this->ensureMyTable();
+    $snippet = "$table.status = 1 OR ($table.uid = ***CURRENT_USER*** AND ***CURRENT_USER*** <> 0 AND ***VIEW_OWN_UNPUBLISHED_MEDIA*** = 1) OR ***ADMINISTER_MEDIA*** = 1";
+    if ($this->moduleHandler->moduleExists('content_moderation')) {
+      $snippet .= ' OR ***VIEW_ANY_UNPUBLISHED_NODES*** = 1';
+    }
+    $this->query->addWhereExpression($this->options['group'], $snippet);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getCacheContexts() {
+    $contexts = parent::getCacheContexts();
+    $contexts[] = 'user';
+    return $contexts;
+  }
+
+}

core/modules/media/src/Plugin/views/wizard/Media.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace Drupal\media\Plugin\views\wizard;
+
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\views\Attribute\ViewsWizard;
+use Drupal\views\Plugin\views\wizard\WizardPluginBase;
+
+/**
+ * Provides Views creation wizard for Media.
+ */
+#[ViewsWizard(
+  id: 'media',
+  base_table: 'media_field_data',
+  title: new TranslatableMarkup('Media')
+)]
+class Media extends WizardPluginBase {
+
+  /**
+   * Set the created column.
+   *
+   * @var string
+   */
+  protected $createdColumn = 'media_field_data-created';
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getAvailableSorts() {
+    return [
+      'media_field_data-name:DESC' => $this->t('Media name'),
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function defaultDisplayOptions() {
+    $display_options = parent::defaultDisplayOptions();
+
+    // Add permission-based access control.
+    $display_options['access']['type'] = 'perm';
+    $display_options['access']['options']['perm'] = 'view media';
+
+    // Remove the default fields, since we are customizing them here.
+    unset($display_options['fields']);
+
+    // Add the name field, so that the display has content if the user switches
+    // to a row style that uses fields.
+    $display_options['fields']['name']['id'] = 'name';
+    $display_options['fields']['name']['table'] = 'media_field_data';
+    $display_options['fields']['name']['field'] = 'name';
+    $display_options['fields']['name']['entity_type'] = 'media';
+    $display_options['fields']['name']['entity_field'] = 'media';
+    $display_options['fields']['name']['label'] = '';
+    $display_options['fields']['name']['alter']['alter_text'] = 0;
+    $display_options['fields']['name']['alter']['make_link'] = 0;
+    $display_options['fields']['name']['alter']['absolute'] = 0;
+    $display_options['fields']['name']['alter']['trim'] = 0;
+    $display_options['fields']['name']['alter']['word_boundary'] = 0;
+    $display_options['fields']['name']['alter']['ellipsis'] = 0;
+    $display_options['fields']['name']['alter']['strip_tags'] = 0;
+    $display_options['fields']['name']['alter']['html'] = 0;
+    $display_options['fields']['name']['hide_empty'] = 0;
+    $display_options['fields']['name']['empty_zero'] = 0;
+    $display_options['fields']['name']['settings']['link_to_entity'] = 1;
+    $display_options['fields']['name']['plugin_id'] = 'field';
+
+    return $display_options;
+  }
+
+}

core/modules/media/src/Plugin/views/wizard/MediaRevision.php

@@ -0,0 +1,84 @@
+<?php
+
+namespace Drupal\media\Plugin\views\wizard;
+
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\views\Attribute\ViewsWizard;
+use Drupal\views\Plugin\views\wizard\WizardPluginBase;
+
+/**
+ * Provides Views creation wizard for Media revisions.
+ */
+#[ViewsWizard(
+  id: 'media_revision',
+  title: new TranslatableMarkup('Media revisions'),
+  base_table: 'media_field_revision'
+)]
+class MediaRevision extends WizardPluginBase {
+
+  /**
+   * Set the created column.
+   *
+   * @var string
+   */
+  protected $createdColumn = 'media_field_revision-created';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function defaultDisplayOptions() {
+    $display_options = parent::defaultDisplayOptions();
+
+    // Add permission-based access control.
+    $display_options['access']['type'] = 'perm';
+    $display_options['access']['options']['perm'] = 'view all revisions';
+
+    // Remove the default fields, since we are customizing them here.
+    unset($display_options['fields']);
+
+    // Add the changed field.
+    $display_options['fields']['changed']['id'] = 'changed';
+    $display_options['fields']['changed']['table'] = 'media_field_revision';
+    $display_options['fields']['changed']['field'] = 'changed';
+    $display_options['fields']['changed']['entity_type'] = 'media';
+    $display_options['fields']['changed']['entity_field'] = 'changed';
+    $display_options['fields']['changed']['alter']['alter_text'] = FALSE;
+    $display_options['fields']['changed']['alter']['make_link'] = FALSE;
+    $display_options['fields']['changed']['alter']['absolute'] = FALSE;
+    $display_options['fields']['changed']['alter']['trim'] = FALSE;
+    $display_options['fields']['changed']['alter']['word_boundary'] = FALSE;
+    $display_options['fields']['changed']['alter']['ellipsis'] = FALSE;
+    $display_options['fields']['changed']['alter']['strip_tags'] = FALSE;
+    $display_options['fields']['changed']['alter']['html'] = FALSE;
+    $display_options['fields']['changed']['hide_empty'] = FALSE;
+    $display_options['fields']['changed']['empty_zero'] = FALSE;
+    $display_options['fields']['changed']['plugin_id'] = 'field';
+    $display_options['fields']['changed']['type'] = 'timestamp';
+    $display_options['fields']['changed']['settings']['date_format'] = 'medium';
+    $display_options['fields']['changed']['settings']['custom_date_format'] = '';
+    $display_options['fields']['changed']['settings']['timezone'] = '';
+
+    // Add the name field.
+    $display_options['fields']['name']['id'] = 'name';
+    $display_options['fields']['name']['table'] = 'media_field_revision';
+    $display_options['fields']['name']['field'] = 'name';
+    $display_options['fields']['name']['entity_type'] = 'media';
+    $display_options['fields']['name']['entity_field'] = 'name';
+    $display_options['fields']['name']['label'] = '';
+    $display_options['fields']['name']['alter']['alter_text'] = 0;
+    $display_options['fields']['name']['alter']['make_link'] = 0;
+    $display_options['fields']['name']['alter']['absolute'] = 0;
+    $display_options['fields']['name']['alter']['trim'] = 0;
+    $display_options['fields']['name']['alter']['word_boundary'] = 0;
+    $display_options['fields']['name']['alter']['ellipsis'] = 0;
+    $display_options['fields']['name']['alter']['strip_tags'] = 0;
+    $display_options['fields']['name']['alter']['html'] = 0;
+    $display_options['fields']['name']['hide_empty'] = 0;
+    $display_options['fields']['name']['empty_zero'] = 0;
+    $display_options['fields']['name']['settings']['link_to_entity'] = 0;
+    $display_options['fields']['name']['plugin_id'] = 'field';
+
+    return $display_options;
+  }
+
+}

core/modules/media/src/Routing/MediaRouteProvider.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace Drupal\media\Routing;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\Entity\EntityFieldManagerInterface;
+use Drupal\Core\Entity\EntityTypeInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Entity\Routing\AdminHtmlRouteProvider;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Provides HTML routes for media pages.
+ */
+class MediaRouteProvider extends AdminHtmlRouteProvider {
+
+  /**
+   * The media settings config.
+   *
+   * @var \Drupal\Core\Config\ImmutableConfig
+   */
+  protected $config;
+
+  /**
+   * {@inheritdoc}
+   */
+  public function __construct(EntityTypeManagerInterface $entity_type_manager, EntityFieldManagerInterface $entity_field_manager, ConfigFactoryInterface $config_factory) {
+    parent::__construct($entity_type_manager, $entity_field_manager);
+    $this->config = $config_factory->get('media.settings');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function createInstance(ContainerInterface $container, EntityTypeInterface $entity_type) {
+    return new static(
+      $container->get('entity_type.manager'),
+      $container->get('entity_field.manager'),
+      $container->get('config.factory')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getCanonicalRoute(EntityTypeInterface $entity_type) {
+    if ($this->config->get('standalone_url')) {
+      return parent::getCanonicalRoute($entity_type);
+    }
+    else {
+      return parent::getEditFormRoute($entity_type);
+    }
+  }
+
+}

core/modules/media/templates/media-embed-error.html.twig

@@ -0,0 +1,20 @@
+{#
+/**
+ * @file
+ * Default theme implementation for a missing media error.
+ *
+ * Available variables
+ * - message: The message text.
+ * - attributes: HTML attributes for the containing element.
+ *
+ * When a response from the back end can't be returned, a related error message
+ * is displayed from JavaScript.
+ *
+ * @see Drupal.theme.mediaEmbedPreviewError
+ *
+ * @ingroup themeable
+ */
+#}
+<div{{ attributes }}>
+  {{ message }}
+</div>

core/modules/media/templates/media-oembed-iframe.html.twig

@@ -0,0 +1,17 @@
+{#
+/**
+ * @file
+ * Default theme implementation to display an oEmbed resource in an iframe.
+ *
+ * @ingroup themeable
+ */
+#}
+<!DOCTYPE html>
+<html>
+  <head>
+    <css-placeholder token="{{ placeholder_token }}">
+  </head>
+  <body style="margin: 0">
+    {{ media|raw }}
+  </body>
+</html>

core/modules/media/templates/media-reference-help.html.twig

@@ -0,0 +1,65 @@
+{#
+/**
+ * @file
+ * Theme override for media reference fields.
+ *
+ * @see template_preprocess_field_multiple_value_form()
+ */
+#}
+{%
+  set classes = [
+    'js-form-item',
+    'form-item',
+    'js-form-wrapper',
+    'form-wrapper',
+  ]
+%}
+<fieldset{{ attributes.addClass(classes) }}>
+  {%
+    set legend_span_classes = [
+      'fieldset-legend',
+      required ? 'js-form-required',
+      required ? 'form-required',
+    ]
+  %}
+  {# Always wrap fieldset legends in a <span> for CSS positioning. #}
+  <legend{{ legend_attributes }}>
+    <span{{ legend_span_attributes.addClass(legend_span_classes) }}>{{ original_label }}</span>
+  </legend>
+
+  <div class="js-form-item form-item">
+    {% if media_add_help %}
+      <h4{{ header_attributes.addClass('label') }}>
+        {% trans %}
+          Create new media
+        {% endtrans %}
+      </h4><br />
+      <div class="description">
+        {{ media_add_help }}
+      </div>
+    {% endif %}
+
+    {% if multiple %}
+      {{ table }}
+    {% else %}
+      {% for element in elements %}
+        {{ element }}
+      {% endfor %}
+    {% endif %}
+
+    <div{{ description.attributes.addClass('description') }}>
+      {% if multiple and description.content %}
+        <ul>
+          <li>{{ media_list_help }} {{ media_list_link }} {{ allowed_types_help }}</li>
+          <li>{{ description.content }}</li>
+        </ul>
+      {% else %}
+        {{ media_list_help }} {{ media_list_link }} {{ allowed_types_help }}
+      {% endif %}
+      {% if multiple and button %}
+        <div class="clearfix">{{ button }}</div>
+      {% endif %}
+    </div>
+
+  </div>
+</fieldset>

core/modules/media/templates/media.html.twig

@@ -0,0 +1,37 @@
+{#
+/**
+ * @file
+ * Default theme implementation to present a media item.
+ *
+ * Available variables:
+ * - media: The media item, with limited access to object properties and
+ *   methods. Only method names starting with "get", "has", or "is" and
+ *   a few common methods such as "id", "label", and "bundle" are available.
+ *   For example:
+ *   - entity.getEntityTypeId() will return the entity type ID.
+ *   - entity.hasField('field_example') returns TRUE if the entity includes
+ *     field_example. (This does not indicate the presence of a value in this
+ *     field.)
+ *   Calling other methods, such as entity.delete(), will result in
+ *   an exception.
+ *   See \Drupal\Core\Entity\EntityInterface for a full list of methods.
+ * - name: Name of the media item.
+ * - content: Media content.
+ * - title_prefix: Additional output populated by modules, intended to be
+ *   displayed in front of the main title tag that appears in the template.
+ * - title_suffix: Additional output populated by modules, intended to be
+ *   displayed after the main title tag that appears in the template.
+ * - view_mode: View mode; for example, "teaser" or "full".
+ * - attributes: HTML attributes for the containing element.
+ * - title_attributes: Same as attributes, except applied to the main title
+ *   tag that appears in the template.
+ *
+ * @see template_preprocess_media()
+ *
+ * @ingroup themeable
+ */
+#}
+<div{{ attributes }}>
+  {{ title_suffix.contextual_links }}
+  {{ content }}
+</div>

core/modules/media/tests/fixtures/oembed/photo_flickr.html

@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html lang="de">
+<head>
+  <link rel="alternate" href="photo_flickr.json"
+        type="application/json+oembed" title="Druplicon FTW!">
+</head>
+<body></body>
+</html>

core/modules/media/tests/fixtures/oembed/photo_flickr.json

@@ -0,0 +1,12 @@
+{
+  "type": "photo",
+  "title": "Druplicon FTW!",
+  "width": "88",
+  "height": "100",
+  "url": "internal:\/core\/misc\/druplicon.png",
+  "thumbnail_url": "internal:\/core\/misc\/druplicon.png",
+  "thumbnail_width": 88,
+  "thumbnail_height": 100,
+  "provider_name": "Flickr",
+  "version": "1.0"
+}

core/modules/media/tests/fixtures/oembed/photo_flickr_no_dimensions.json

@@ -0,0 +1,10 @@
+{
+  "type": "photo",
+  "title": "Druplicon FTW!",
+  "url": "internal:\/core\/misc\/druplicon.png",
+  "thumbnail_url": "internal:\/core\/misc\/druplicon.png",
+  "thumbnail_width": 88,
+  "thumbnail_height": 100,
+  "provider_name": "Flickr",
+  "version": "1.0"
+}

core/modules/media/tests/fixtures/oembed/providers.json

@@ -0,0 +1,105 @@
+[
+  {
+    "provider_name": "Vimeo",
+    "provider_url": "https:\/\/vimeo.com\/",
+    "endpoints": [
+      {
+        "schemes": [
+          "https:\/\/vimeo.com\/*",
+          "https:\/\/vimeo.com\/album\/*\/video\/*",
+          "https:\/\/vimeo.com\/channels\/*\/*",
+          "https:\/\/vimeo.com\/groups\/*\/videos\/*",
+          "https:\/\/vimeo.com\/ondemand\/*\/*",
+          "https:\/\/player.vimeo.com\/video\/*"
+        ],
+        "url": "https:\/\/vimeo.com\/api\/oembed.{format}",
+        "discovery": true
+      }
+    ]
+  },
+  {
+    "provider_name": "Twitter",
+    "provider_url": "http:\/\/www.twitter.com\/",
+    "endpoints": [
+      {
+        "schemes": [
+          "https:\/\/twitter.com\/*\/status\/*",
+          "https:\/\/*.twitter.com\/*\/status\/*"
+        ],
+        "url": "https:\/\/publish.twitter.com\/oembed"
+      }
+    ]
+  },
+  {
+    "provider_name": "Dailymotion",
+    "provider_url": "https:\/\/www.dailymotion.com\/",
+    "endpoints": [
+      {
+        "schemes": [
+          "https:\/\/www.dailymotion.com\/video\/*"
+        ],
+        "url": "https:\/\/www.dailymotion.com\/services\/oembed",
+        "discovery": true
+      }
+    ]
+  },
+  {
+    "provider_name": "Flickr",
+    "provider_url": "http:\/\/www.flickr.com\/",
+    "endpoints": [
+      {
+        "schemes": [
+          "http:\/\/*.flickr.com\/photos\/*",
+          "http:\/\/flic.kr\/p\/*"
+        ],
+        "url": "http:\/\/www.flickr.com\/services\/oembed\/",
+        "discovery": true
+      }
+    ]
+  },
+  {
+    "provider_name": "YouTube",
+    "provider_url": "https://www.youtube.com/",
+    "endpoints": [
+      {
+        "schemes": [
+          "https://*.youtube.com/watch*",
+          "https://*.youtube.com/v/*\"",
+          "https://youtu.be/*"
+        ],
+        "url": "https://www.youtube.com/oembed",
+        "discovery": true
+      }
+    ]
+  },
+  {
+    "provider_name": "Facebook",
+    "provider_url": "https:\/\/www.facebook.com\/",
+    "endpoints": [
+      {
+        "schemes": [
+          "https:\/\/www.facebook.com\/*\/posts\/*",
+          "https:\/\/www.facebook.com\/photos\/*",
+          "https:\/\/www.facebook.com\/*\/photos\/*",
+          "https:\/\/www.facebook.com\/photo.php*",
+          "https:\/\/www.facebook.com\/photo.php",
+          "https:\/\/www.facebook.com\/*\/activity\/*",
+          "https:\/\/www.facebook.com\/permalink.php",
+          "https:\/\/www.facebook.com\/media\/set?set=*",
+          "https:\/\/www.facebook.com\/questions\/*",
+          "https:\/\/www.facebook.com\/notes\/*\/*\/*"
+        ],
+        "url": "https:\/\/www.facebook.com\/plugins\/post\/oembed.json",
+        "discovery": true
+      },
+      {
+        "schemes": [
+          "https:\/\/www.facebook.com\/*\/videos\/*",
+          "https:\/\/www.facebook.com\/video.php"
+        ],
+        "url": "https:\/\/www.facebook.com\/plugins\/video\/oembed.json",
+        "discovery": true
+      }
+    ]
+  }
+]

core/modules/media/tests/fixtures/oembed/rich_twitter.json

@@ -0,0 +1,13 @@
+{
+  "url": "https:\/\/twitter.com\/drupaldevdays\/status\/935643039741202432",
+  "author_name": "Drupal Dev Days",
+  "author_url": "https:\/\/twitter.com\/drupaldevdays",
+  "html": "<h1>Twitter works!</h1>",
+  "width": 550,
+  "height": null,
+  "type": "rich",
+  "cache_age": "3153600000",
+  "provider_name": "Twitter",
+  "provider_url": "https:\/\/twitter.com",
+  "version": "1.0"
+}