emdash-cms/emdash @emdash-cms/registry-client@0.4.0

on GitHub

Minor Changes

• #2765 9d92b55 Thanks @ascorbic! - Updates plugin publishing to host package bundles, icons, banners, and screenshots as blobs on the publisher's Personal Data Server by default. Run emdash-plugin publish from the plugin directory; the CLI builds the bundle, checks the stored OAuth grant, uploads the artifacts, and writes CID-bound checksums into the release record.

  Existing scripts can keep externally hosted package bundles with emdash-plugin publish --url <https-url>. The CLI still downloads that URL to validate and hash the served bytes. Listing images are uploaded as publisher blobs on both paths.

  The experimental aggregator release envelope replaces mirrors with typed artifactCaches. The field is optional during rolling upgrades, and updated clients treat an omitted field as an empty cache list. A record-scoped cache descriptor supplies its service endpoint; clients derive /r/{did}/{collection}/{rkey}/{recordCid}/{blobCid} so cache admission is bound to the exact release revision.

  Install and update verify raw cache, PDS, and external fallback bytes against the signed checksum and blob metadata. The authenticated image proxy may serve a transformed record-scoped cache rendition; if that cache is unavailable, it falls back to checksum-verified PDS or external bytes. Listing images remain capped at 1 MiB.

  Sites must upgrade EmDash before installing a release whose package artifact is available only as a PDS blob. Older EmDash versions require an external package URL.

  What should I do?

  Remove --artifact-base-url from publish scripts and stop pre-uploading listing images. The CLI rejects the removed option with migration guidance. Replace any experimental releaseView.mirrors access with releaseView.artifactCaches ?? []. If an existing granular login reports MISSING_BLOB_SCOPE, run emdash-plugin logout and log in again to grant blob:application/gzip and blob:image/*.

• #2647 e3ad082 Thanks @ascorbic! - Adds signed-label policy and listing-status support to the plugin registry client. Registry requests use the aggregator's required listing policy with an optional accepted-labeler declaration, and withdrawn releases are excluded from install and update results.

  The EmDash admin waits for a fresh listing-policy response before rendering registry metadata, uses the approved author name or publisher DID instead of a mutable handle, and does not request media for an unapproved release. Install, update, and media-proxy checks enforce listing withdrawal independently from the existing plugin-code and capability checks.

  Registry artifact downloads and proxied media connect only to the public IP addresses validated for each URL, preventing DNS changes between validation and connection from reaching private services.

Patch Changes

• Updated dependencies [9d92b55, 6178888]:
  • @emdash-cms/registry-lexicons@0.4.0
  • @emdash-cms/registry-moderation@0.1.0