emdash-cms/emdash @emdash-cms/registry-lexicons@0.6.0

on GitHub

Minor Changes

• #3171 80ccfaf Thanks @ascorbic! - Adds capability-gated schema, translation, public URL, and content revision discovery for plugins.

  Declare schema:read to list collection and field definitions through ctx.schema. Existing content:read access can inspect safe content identity, discover locale siblings with getTranslations(), and resolve published routes with getPublicUrl(). Public URL resolution follows the site's collection pattern, locale routing, and trailing-slash policy and returns null for content without a public route.

  Revision snapshots require the separate content:revisions:read capability because retained history can contain field values that an administrator removed later. This capability implies ordinary content:read access. Installation and plugin updates show both new authorities for consent, and the native, Cloudflare Worker Loader, and Node.js workerd runtimes expose the same methods.

• #3184 46784e1 Thanks @ascorbic! - Adds capability-gated redirect access for sandboxed plugins. Declare redirects:read to list redirect rules with cursor pagination and read a rule with an opaque _rev. Declare redirects:write to create, update, and delete redirect rules; write access implies read access and installation consent states that the plugin can change where visitors are sent.

  Redirect mutations use EmDash's redirect validation and cache invalidation path. Writes are serialized across runtimes so duplicate-source and loop validation use a consistent rule graph. The expanded redirect schema remains compatible with writes from previous host processes during rolling deployments. Loop validation runs when a rule is created or its source or destination changes; enabled-only updates retain the host API's existing behavior. Updates and deletes require the latest _rev, reject concurrent changes with CONFLICT, and do not let plugins set the host-owned automatic redirect marker. The Cloudflare Worker Loader and Node.js workerd runners expose the same API, and createPluginRuntimeTestHost() includes redirect fixtures and inspection for production-boundary tests.

• #3170 3538bb8 Thanks @ascorbic! - Adds comments:read and comments:moderate for sandboxed plugins. ctx.comments can get, count, and cursor-page through non-trashed comments, and can change a comment between approved, pending, and spam when the caller supplies the status it previously observed.

  comments:read exposes comment bodies, author names and email addresses, pseudonymous IP hashes, user agents, and moderation metadata. It does not expose the linked EmDash user-account ID. comments:moderate implies that read access, and installation or an update that requests either capability requires operator consent.

  Status changes use the core moderation path. A stale expected status rejects with COMMENT_STATUS_CONFLICT, and an overlapping transition can reject with COMMENT_MODERATION_IN_PROGRESS; a successful transition runs comment:afterModerate once with the calling plugin's origin and preserves approval notifications. Hard deletion and bulk status replacement are not included.

• #3251 dbd77ef Thanks @ascorbic! - Adds explicit, consented access to selected unsaved content for sandboxed editor panels and actions.

  Plugins can request admin.editor-draft:read to receive extension-selected field values after an editor invokes them, and admin.editor-draft:patch to propose atomic whole-field set or clear operations. Patch access does not imply read access. Each extension must declare explicit collection scope and narrow its access to field slugs, translatable fields, or both.

  EmDash authenticates and authorizes the saved entry, reloads its schema and revision, validates snapshot and patch limits, and rejects stale or invalid responses. The admin shows a host-rendered before-and-after preview, applies accepted changes to the visible form, marks it dirty, and leaves saving to the editor. Panel load and ordinary typing do not expose draft data or invoke the plugin.

  createPluginRuntimeTestHost() now provides draft capture and host-validated patch application helpers for production-boundary plugin tests.

• #3172 2818e66 Thanks @ascorbic! - Adds separate sandboxed-plugin capabilities for reading media bytes and editing media metadata.

  Declare media:bytes:read to use ctx.media.readBytes(). Reads are available only for ready media, default to a 10 MiB limit, enforce the caller's limit while consuming the storage stream, and cannot request more than 16 MiB. The result includes the content hash; ordinary media:read metadata excludes content hashes, storage keys, and author identity.

  Ready-media metadata URLs use an authenticated media ID route. Authenticated callers with the media:read permission can fetch the asset without receiving its storage key; logged-out requests are rejected before the route queries media.

  Declare media:metadata:write to use ctx.media.updateMetadata() for alt text, captions, and focal points. This capability cannot upload, replace, move, or delete media. It does not imply media:read or media:bytes:read.

  @emdash-cms/plugin-test also provides binary media fixtures and inspection through the runtime-backed host so plugin tests can exercise the production Worker Loader bridge.

• #3194 1e13daa Thanks @ascorbic! - Adds separately consented publication and restore actions to native and sandboxed plugin contexts.

  Plugins with content:publish can read an entry with an opaque revision and publish, unpublish, schedule, or unschedule it through the same runtime behavior as REST and MCP. Each mutation requires the revision returned by the read or preceding action, and a plugin cannot recursively run the same action for the same entry. The capability implies content:read but not content:write.

  Plugins with content:restore can read and restore trashed entries without receiving ordinary content-read or write authority. Restore is revision-fenced and returns the next revision. Existing plugin installations receive neither capability unless a new version declares it and the administrator approves the expanded access.

• #3185 c029134 Thanks @ascorbic! - Adds hooks.content-policy:register for sandboxed and native plugins that need to inspect and reject publication, scheduling, or unpublication without receiving content read, write, or publication-action access.

  Policy plugins can register content:beforePublish, content:beforeSchedule, and content:beforeUnpublish. Each event identifies the API, MCP, visual editor, plugin, scheduler, or system origin and includes the authenticated actor when one exists. Return { cancel: true, reason } to reject the action with a stable error code. EmDash validates the reason as 1–500 plain-text characters. For allowed actions, the revision read before policy evaluation becomes the mutation precondition.

  Scheduled content runs content:beforePublish again when it becomes due. A policy rejection unschedules the entry, lists its public-safe reason and entry link on the dashboard, and avoids retrying the same permanent rejection on every scheduler tick. Successful rescheduling, publication, or deletion clears the record; administrators can dismiss stale records. @emdash-cms/plugin-test exposes stored scheduler rejections through inspect.scheduledPolicyRejections().

• #3169 8ad06e9 Thanks @ascorbic! - Adds the taxonomies:write sandboxed-plugin capability for creating taxonomy terms and adding or removing term assignments through ctx.taxonomies.

  Assignment methods accept term row IDs or translation-group IDs and apply idempotent deltas, so they do not replace existing assignments and concurrent additions are preserved. EmDash validates collection attachment, entry existence, term ownership, configured locales, translation identity, and hierarchy before changing taxonomy state. Sandboxed createTerm() rejects parentId for a non-hierarchical taxonomy instead of ignoring it. The capability implies taxonomies:read and requires renewed consent when an installed plugin first declares it.

  Existing REST and MCP term mutations also reject creating or updating a term with a parent in a non-hierarchical taxonomy. Callers that assign parents must mark the taxonomy as hierarchical before creating or reparenting terms.

  This release includes migration 082_taxonomy_translation_locale_unique, which enforces one term per translation group and locale. If an existing database contains duplicate rows, the migration preserves them as independent term groups and copies their assignments before adding the unique index. It can restart safely after any completed statement.

  @emdash-cms/plugin-test adds taxonomy fixtures and an assignment inspector for production-boundary tests. Taxonomy definition management, assignment replacement, term updates, and term deletion remain unavailable to sandboxed plugins.

Patch Changes

• #3120 71901fc Thanks @ascorbic! - Adds registryLoader() for reading the moderated EmDash plugin registry through Astro live content collections. Collection loads support free-text and exact publisher/package searches, capability filters, and limits. Single-entry loads resolve a publisher handle or DID and include the latest visible release when one exists.

  Registry searches recognize exact handles, DIDs, and identity/slug pairs. Package views include the publisher's current verified handle when available.