diff --git a/.changeset/admin-published-links-locale.md b/.changeset/admin-published-links-locale.md deleted file mode 100644 index aa5f9a26ea..0000000000 --- a/.changeset/admin-published-links-locale.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"emdash": patch -"@emdash-cms/admin": patch ---- - -Fixes admin “View published” and “Live View” links so translated entries include the locale prefix required by the site’s Astro i18n routing configuration. diff --git a/.changeset/archives-published-at-dates.md b/.changeset/archives-published-at-dates.md deleted file mode 100644 index bd0acbd9c6..0000000000 --- a/.changeset/archives-published-at-dates.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes the Archives widget so monthly and yearly lists include posts whose `publishedAt` value is a `Date` object instead of rendering an empty list. diff --git a/.changeset/atomic-expected-publish.md b/.changeset/atomic-expected-publish.md deleted file mode 100644 index c0235a8087..0000000000 --- a/.changeset/atomic-expected-publish.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes publication workflows so callers can pass the approved `_rev` to publish, unpublish, or discard a draft and receive a `CONFLICT` response when the entry changed. diff --git a/.changeset/audit-log-hook-capabilities.md b/.changeset/audit-log-hook-capabilities.md deleted file mode 100644 index 0777224c68..0000000000 --- a/.changeset/audit-log-hook-capabilities.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@emdash-cms/plugin-audit-log": patch ---- - -Fixes the audit log never recording media uploads or the previous state of updated content. The plugin declared only `content:read`, so EmDash skipped its `content:beforeSave` and `media:afterUpload` hooks and logged `[hooks] Plugin "audit-log" declares content:beforeSave hook without content:write capability — skipping` on every boot. - -The manifest now also declares `content:write` and `media:read`. EmDash requires `content:write` from any plugin that registers a `content:beforeSave` hook, because such a hook can rewrite the draft; the audit log returns the draft unchanged and only reads the stored item to record a before/after diff. Sites that installed the plugin from the marketplace are asked to approve the new capabilities when they update it. Recording the previous state of an update also needs an EmDash release that includes the item ID in the `content:beforeSave` event; on earlier EmDash releases the update entry is recorded without the previous state. diff --git a/.changeset/before-save-event-id.md b/.changeset/before-save-event-id.md deleted file mode 100644 index 5d2b44a657..0000000000 --- a/.changeset/before-save-event-id.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": minor ---- - -Adds `id` to the `content:beforeSave` hook event when an existing item is updated, for both trusted and sandboxed plugins. `event.content` holds only the submitted field values, so a hook that needs the stored item, for example to audit or validate a change against it, can call `ctx.content.get(event.collection, event.id)`. The field is absent on creates. diff --git a/.changeset/bounded-media-usage-gc-scan.md b/.changeset/bounded-media-usage-gc-scan.md deleted file mode 100644 index cda8c48f91..0000000000 --- a/.changeset/bounded-media-usage-gc-scan.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes scheduled media-usage cleanup reading far more rows than its batch size on large sites. A cleanup run that had lost its lease scanned the whole occurrence table before returning nothing, so cron ticks could spike into the hundreds of thousands of rows read. Sites on Cloudflare D1 will see those spikes disappear. diff --git a/.changeset/bright-images-replace.md b/.changeset/bright-images-replace.md deleted file mode 100644 index 9fcdc99c4c..0000000000 --- a/.changeset/bright-images-replace.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"emdash": minor -"@emdash-cms/admin": minor ---- - -Adds **Replace image** to the Media Library for ready JPEG, PNG, and WebP files stored by EmDash. - -Choose a same-format file to update every existing use of an image while preserving its media ID, filename, URL, alt text, caption, and location. The replacement can use different dimensions or an aspect ratio from the original. EmDash overwrites the original bytes and clears the focal point; it does not retain the previous file. The action works with local disk, R2, and S3-compatible storage. diff --git a/.changeset/bright-otters-edit.md b/.changeset/bright-otters-edit.md deleted file mode 100644 index 6ab8ab29d8..0000000000 --- a/.changeset/bright-otters-edit.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@emdash-cms/admin": minor ---- - -Adds in-context Media Library asset editing to admin image pickers, image fields, and rich text -images and galleries. Editors can update asset metadata and focal points, create and select cropped -copies, or replace original image data while staying in the content editor. Gallery images also -support keyboard reordering. diff --git a/.changeset/bright-zebras-validate.md b/.changeset/bright-zebras-validate.md deleted file mode 100644 index 6874a78c47..0000000000 --- a/.changeset/bright-zebras-validate.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"emdash": patch -"@emdash-cms/auth": patch -"@emdash-cms/plugin-cli": patch -"@emdash-cms/plugin-types": patch -"@emdash-cms/plugin-embeds": patch -"@emdash-cms/plugin-forms": patch ---- - -Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules. diff --git a/.changeset/byline-finder-avatar-join.md b/.changeset/byline-finder-avatar-join.md deleted file mode 100644 index d97ec57275..0000000000 --- a/.changeset/byline-finder-avatar-join.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -"emdash": patch ---- - -Fixes byline profile pages having no way to render the byline's avatar ([#2613](https://github.com/emdash-cms/emdash/issues/2613)). `getByline`, `getBylineBySlug`, and the underlying single-row `BylineRepository` finders now resolve the avatar's media row in the same query, so `avatarStorageKey`, `avatarAlt`, `avatarBlurhash`, and `avatarDominantColor` are populated alongside `avatarMediaId`: - -```astro ---- -import { getBylineBySlug } from "emdash"; - -const byline = await getBylineBySlug(Astro.params.slug, { locale: Astro.currentLocale }); -const avatar = byline?.avatarStorageKey - ? Astro.locals.emdash.getPublicMediaUrl(byline.avatarStorageKey) - : null; ---- -{avatar && {byline.avatarAlt} -``` - -Previously these fields were populated only when a byline was hydrated as a credit on a content entry, so a page keyed on the byline itself — `/authors/` and the like — held a bare media id with no public API to turn it into a URL. Nothing else changes: the lookup still costs one query (the avatar is a `LEFT JOIN`, not a second round trip), and `findMany` still skips the join, so byline list pages are unaffected. diff --git a/.changeset/calm-drafts-remember.md b/.changeset/calm-drafts-remember.md deleted file mode 100644 index a108b9d458..0000000000 --- a/.changeset/calm-drafts-remember.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes unpublishing content resetting its publication date. Previously published drafts keep their date visible and editable in the admin, and republishing them without a date override reuses it. diff --git a/.changeset/calm-images-fit.md b/.changeset/calm-images-fit.md deleted file mode 100644 index 0ad347b302..0000000000 --- a/.changeset/calm-images-fit.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@emdash-cms/admin": patch -"emdash": patch ---- - -Fixes the editor image settings panel overflowing at narrow widths and aligns its fields, help, and actions with the standard editor sidebar. - -Changing image alignment or text preserves the existing display size. Reset clears custom dimensions, constrained editor images retain their aspect ratio, floated images stay visible, and None and Center have distinct positions. - -Preserves image alignment through the exported Portable Text converters. Image settings offer None, Left, Center, and Right; existing imported Wide and Full values and public theme hooks are retained. diff --git a/.changeset/calm-media-crops.md b/.changeset/calm-media-crops.md deleted file mode 100644 index 87467f2d00..0000000000 --- a/.changeset/calm-media-crops.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"emdash": minor -"@emdash-cms/admin": minor -"@emdash-cms/cloudflare": patch ---- - -Adds cropping for JPEG, PNG, and WebP images stored by EmDash on local disk, Cloudflare R2, or S3-compatible storage. - -Move and resize a rule-of-thirds crop frame with corner handles for fixed ratios and eight handles for Freeform. Choose the original ratio, Freeform, or a common aspect ratio. **Create cropped copy** creates a separate media item with any ratio and names it for the selected ratio or output dimensions. **Replace original** uses the original ratio and replaces the existing item under the same ID and URL, so every reference uses the cropped image without rewriting or republishing content. Local media and responsive renditions revalidate their stable URLs so sites load the replacement instead of keeping a stale cached image. The original bytes and crop history are not retained. diff --git a/.changeset/calm-ravens-prepare.md b/.changeset/calm-ravens-prepare.md deleted file mode 100644 index 4e453d4be7..0000000000 --- a/.changeset/calm-ravens-prepare.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@emdash-cms/plugin-cli": minor -"@emdash-cms/registry-client": minor -"@emdash-cms/registry-verification": minor ---- - -Adds interactive package-profile setup for delegated plugin releases. `emdash-plugin release setup` now creates a missing profile or adds delegated-release settings to an existing valid profile before writing the GitHub Actions workflow. Run `emdash-plugin profile setup` to prepare only the profile. - -Interactive setup asks for the GitHub repository when it is absent from `emdash-plugin.jsonc`, lets you choose when releases require approval, and confirms the profile write. Non-interactive callers must pass `--yes` when a profile change is required. - -The release service returns `PACKAGE_PROFILE_REQUIRED` before accepting artifact uploads when the signed profile is missing, lacks delegated-release settings, or names a different GitHub repository. Existing release intents also terminate with an actionable reason if their authoritative profile becomes invalid. diff --git a/.changeset/calm-seals-verify.md b/.changeset/calm-seals-verify.md deleted file mode 100644 index 60602ab085..0000000000 --- a/.changeset/calm-seals-verify.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/registry-verification": patch ---- - -Fixes delegated-release provenance verification so verified GitHub attestations include the repository, workflow, commit, and run identity needed to enforce an exact authorized workload. diff --git a/.changeset/chrome-cache-invalidation.md b/.changeset/chrome-cache-invalidation.md deleted file mode 100644 index ef9357459a..0000000000 --- a/.changeset/chrome-cache-invalidation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Chrome subsystems (site settings, menus, taxonomies and widget areas) now invalidate the Workers edge cache when mutated through the admin API, and public read helpers gained additive `*WithCacheHint` variants that return page-level cache hints. Stable invalidation tags are `emdash:settings`, `emdash:menu:`, `emdash:taxonomy:` and `emdash:widget-area:`. diff --git a/.changeset/clean-booleans-load.md b/.changeset/clean-booleans-load.md deleted file mode 100644 index dc6e18ec39..0000000000 --- a/.changeset/clean-booleans-load.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes `getEmDashCollection()` and `getEmDashEntry()` returning SQLite-backed boolean fields as `0` or `1`. Boolean fields now return `true` or `false`, matching their generated TypeScript types, while integer fields retain numeric values. diff --git a/.changeset/clean-otters-prove.md b/.changeset/clean-otters-prove.md deleted file mode 100644 index 6c9bdaf758..0000000000 --- a/.changeset/clean-otters-prove.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@emdash-cms/registry-client": minor ---- - -Adds `DirectPdsClient.getPackageRepository()` for reading a package profile and every package release from one proof-verified AT Protocol repository export. - -Use the method when authorization or version selection requires a complete signed package snapshot: - -```ts -const { profile, releases } = await directPdsClient.getPackageRepository("gallery"); -``` - -The client verifies the repository commit signature, record blocks, and complete Merkle search tree before returning records. Unsigned `repo.getRecord` and `repo.listRecords` envelopes cannot substitute or omit package data. Repository exports use the client's `maxResponseBytes` limit, which defaults to 5 MiB, and a missing export reports `REPOSITORY_NOT_FOUND`. diff --git a/.changeset/clean-rivers-browse.md b/.changeset/clean-rivers-browse.md deleted file mode 100644 index 6ea047ccdb..0000000000 --- a/.changeset/clean-rivers-browse.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@emdash-cms/admin": minor ---- - -Adds Media Library browsing and inline uploads to admin media pickers. Editors can search, filter -by type, browse folders, switch between grid and list views, use numbered pages, and select media -from configured providers or a direct URL without leaving the content editor. - -Uploads appear in the picker with an uploading or failed status. Successful uploads become -selected media cards, and gallery selections can be reordered before they are added. diff --git a/.changeset/clear-editor-paragraph-spacing.md b/.changeset/clear-editor-paragraph-spacing.md deleted file mode 100644 index 68ae043d8f..0000000000 --- a/.changeset/clear-editor-paragraph-spacing.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Updates admin editor paragraphs with tighter line spacing, clearer paragraph breaks, and 16px text on mobile. Wrapped writing hints no longer overlap following content and use softer colours in both themes. diff --git a/.changeset/clear-media-usage-tabs.md b/.changeset/clear-media-usage-tabs.md deleted file mode 100644 index 5d7d2377cc..0000000000 --- a/.changeset/clear-media-usage-tabs.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Adds a dedicated **Used in** tab to media details, keeping file information and focal-point controls separate from usage references. diff --git a/.changeset/complete-german-translations.md b/.changeset/complete-german-translations.md deleted file mode 100644 index 91906a4d5c..0000000000 --- a/.changeset/complete-german-translations.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Completes the German admin translations: every string in the admin catalog now has a German translation, so German-speaking editors no longer see English in the media, publishing, byline, editor and plugin screens. diff --git a/.changeset/delegated-release-client.md b/.changeset/delegated-release-client.md deleted file mode 100644 index f7673a7bac..0000000000 --- a/.changeset/delegated-release-client.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@emdash-cms/registry-client": minor -"@emdash-cms/plugin-cli": minor ---- - -Adds typed clients for the experimental delegated release service. `ReleaseServiceClient` submits, polls, and cancels GitHub OpenID Connect release intents; manages publisher workload policies and retained delegation; and lets publishers check whether profile-listed approvers have an active passkey and inspect publisher-scoped audit events through a publisher session. `ReleaseServiceOperatorClient` exposes the Cloudflare Access status and sanitized audit, sharded publisher and approver inventory, pause, suspension, revocation, cancellation, reconciliation, resumable encryption-key rotation, Workflow-backed fleet verification, audited key retirement, encrypted R2 archive, and fail-safe publisher restore and abort operations. - -`ReleaseServiceClient` can request, poll, list, and confirm GitHub workflow connections. The first permanent release run records GitHub's signed repository, workflow, ref, and environment as a pending request and returns a browser approval URL. The publisher must confirm those details before the service creates a workload policy. Tag-based connections can cover the current tag or all version tags while keeping the repository and workflow path exact. - -Both clients validate response envelopes and return stable `ReleaseServiceError` codes with retry metadata. Mutation helpers require idempotency keys, and workload polling requests a fresh token from the configured provider for each call. - -The plugin CLI adds `emdash-plugin release dry-run`, `release submit`, `release status`, and `release cancel` for GitHub Actions jobs. The first `release submit` requests browser approval for the permanent workflow and waits for confirmation before creating an intent. Dry-run verifies existing workload admission without creating a connection request, intent, consuming rate budget, or reserving a version. The commands request audience-bound OIDC tokens from the runner, support JSON output, and use the GitHub run identity as the default idempotency key where a mutation occurs. - -Delegated submissions use a URL-source release record: each package or listing-image artifact supplies a checksum-bound HTTPS URL and no blob. The service stages and uploads those bytes through the publisher's delegation, then creates a blob-only release record. Submit and dry-run reject mixed or blob-backed source inputs before requesting GitHub OIDC. - -Interactive `release delegate`, `revoke`, `workload`, `enrol`, `approve`, and `reject` commands print validated browser handoffs. Publisher application sessions, OAuth credentials, and passkey assertions remain at the release-service origin instead of entering the terminal process. diff --git a/.changeset/dev-typegen-refresh.md b/.changeset/dev-typegen-refresh.md deleted file mode 100644 index 23ce4ce0d5..0000000000 --- a/.changeset/dev-typegen-refresh.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Regenerate `emdash-env.d.ts` immediately when the schema changes during `astro dev`, so newly added fields and collections are available in types without reloading the dev server. diff --git a/.changeset/draft-overwrite-rev-2121.md b/.changeset/draft-overwrite-rev-2121.md deleted file mode 100644 index 655a00cd5d..0000000000 --- a/.changeset/draft-overwrite-rev-2121.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Fixes a silent draft-overwrite in the page editor. The editor now echoes the entry's `_rev` token on save and autosave, so the server rejects a save that is based on a stale read with a 409 conflict instead of silently replacing a newer draft revision. Editors who hit a conflict now see a clear error and can reload instead of losing work. diff --git a/.changeset/easy-delegated-releases.md b/.changeset/easy-delegated-releases.md deleted file mode 100644 index 82672d9bd1..0000000000 --- a/.changeset/easy-delegated-releases.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@emdash-cms/plugin-cli": minor -"@emdash-cms/registry-client": minor ---- - -Adds `emdash-plugin release setup` to create the permanent GitHub Actions workflow for delegated plugin releases. The generated workflow builds and attests the plugin, waits for first-run browser authorization, and uploads its exact bundle and provenance through GitHub OIDC before publishing. - -`ReleaseServiceClient.uploadReleaseArtifact()` supports custom workflows that need to stage checksum-bound bundle, image, or provenance bytes. Existing URL-source `release submit` workflows remain supported. diff --git a/.changeset/editor-image-drop-targets.md b/.changeset/editor-image-drop-targets.md deleted file mode 100644 index ce4eb4edc2..0000000000 --- a/.changeset/editor-image-drop-targets.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": minor ---- - -Adds drag-and-drop uploads to empty Featured Image and OG Image fields in the content editor. Drop one image to upload and select it, or click the dashed control to choose an image from the media picker. Upload progress and errors appear inline. diff --git a/.changeset/editor-save-conflict-recovery.md b/.changeset/editor-save-conflict-recovery.md deleted file mode 100644 index e320051113..0000000000 --- a/.changeset/editor-save-conflict-recovery.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Fixes the content editor refusing every later save once another writer changed the same entry, so what you typed is kept and can be saved over the newer version. Autosave pauses for that entry until you decide, so your copy never goes over the other version without you choosing it. diff --git a/.changeset/fair-otters-refresh.md b/.changeset/fair-otters-refresh.md deleted file mode 100644 index 2fd7e6ebc4..0000000000 --- a/.changeset/fair-otters-refresh.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@emdash-cms/plugin-cli": patch ---- - -Fixes saved OAuth sessions failing to refresh or revoke after the original loopback callback server closes. New logins retain the loopback client registration needed to recreate the same OAuth client. - -Sessions created before this fix do not contain that registration metadata and cannot be resumed. Sign in again after upgrading. diff --git a/.changeset/fix-create-install-flow.md b/.changeset/fix-create-install-flow.md deleted file mode 100644 index 2d566eb7bd..0000000000 --- a/.changeset/fix-create-install-flow.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"create-emdash": patch ---- - -Fixes `create-emdash --install` failing for Cloudflare templates whose Wrangler version requires `@cloudflare/workers-types` 5. Package-manager output is streamed; any remaining install failure keeps the generated files, prints a retry command, and exits nonzero. diff --git a/.changeset/fix-empty-d1-migration-status.md b/.changeset/fix-empty-d1-migration-status.md deleted file mode 100644 index 30be476453..0000000000 --- a/.changeset/fix-empty-d1-migration-status.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/cloudflare": patch ---- - -Fixes deployment-managed D1 migrations failing on a completely empty database before Kysely can create its migration tables. Migration status now reports empty history without writing, and apply can initialize and run the pending migrations. diff --git a/.changeset/fix-openapi-content-terms.md b/.changeset/fix-openapi-content-terms.md deleted file mode 100644 index 94555b4ebd..0000000000 --- a/.changeset/fix-openapi-content-terms.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes the OpenAPI document for content taxonomy terms so it matches the shipped route. The documented `PUT /_emdash/api/content/{collection}/{id}/terms` path has been removed; use `GET` or `POST /_emdash/api/content/{collection}/{id}/terms/{taxonomy}` instead. The `taxonomy` path parameter is required, and `POST` validates that every term id belongs to that taxonomy. diff --git a/.changeset/fresh-astro-loggers.md b/.changeset/fresh-astro-loggers.md deleted file mode 100644 index 3a924bdc20..0000000000 --- a/.changeset/fresh-astro-loggers.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes Cloudflare development servers failing during cold start with Astro 7.3.1 after Vite discovers `astro/logger/console` and invalidates prebundled server chunks. diff --git a/.changeset/fresh-icons-fill.md b/.changeset/fresh-icons-fill.md deleted file mode 100644 index 2569f7b12c..0000000000 --- a/.changeset/fresh-icons-fill.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Updates sidebar navigation icons to use Phosphor's filled style for the active page. diff --git a/.changeset/inline-portable-text-hydration.md b/.changeset/inline-portable-text-hydration.md deleted file mode 100644 index 59d78a9382..0000000000 --- a/.changeset/inline-portable-text-hydration.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes the inline Portable Text editor failing to hydrate in development when visual editing is enabled. The editor's code-block extension loads lowlight, which default-imports a CommonJS highlight.js module. The Vite client optimizer now pre-bundles `lowlight`, `highlight.js`, and `highlight.js/lib/core` so the deep CJS import is wrapped with ESM interop before it reaches the browser. diff --git a/.changeset/large-media-cards.md b/.changeset/large-media-cards.md deleted file mode 100644 index 580e40859e..0000000000 --- a/.changeset/large-media-cards.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Updates Media Library grid cards to show filenames and file formats below larger previews. diff --git a/.changeset/lucky-donkeys-attack.md b/.changeset/lucky-donkeys-attack.md deleted file mode 100644 index 5e520b473a..0000000000 --- a/.changeset/lucky-donkeys-attack.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Fixes editor changes being silently discarded when the publication date of a published entry is saved. Unsaved changes are now written first, so the entry keeps them and the save indicator no longer reports "Saved" over lost work. diff --git a/.changeset/lucky-parrots-repeat.md b/.changeset/lucky-parrots-repeat.md deleted file mode 100644 index 95d5d76561..0000000000 --- a/.changeset/lucky-parrots-repeat.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes media-usage cleanup reading the entire backlog on every run instead of only the rows it cleans, which made the scheduled cleanup task steadily more expensive as a site's backlog grew. diff --git a/.changeset/manifest-field-mapping.md b/.changeset/manifest-field-mapping.md deleted file mode 100644 index bd4bfb79a1..0000000000 --- a/.changeset/manifest-field-mapping.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes admin manifest field mapping so database-backed collections expose field IDs, widget hints, selected validation, SEO flags, and URL patterns with matching public types. diff --git a/.changeset/mcp-require-rev-on-writes.md b/.changeset/mcp-require-rev-on-writes.md deleted file mode 100644 index e10dcabd57..0000000000 --- a/.changeset/mcp-require-rev-on-writes.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -"emdash": minor ---- - -**Breaking (MCP clients):** Requires `_rev` on the MCP `content_update`, `content_publish`, `content_unpublish` and `content_discard_draft` tools, so an agent can no longer write over changes it never read. The CLI has always required the token on `content update`; the MCP surface now matches it. - -The four tools previously accepted `_rev` as an optional parameter and performed the write when it was omitted. Such a call now fails validation with a message naming `content_get`. To migrate, read the item first and pass back the token from the response: - -```json -{ - "collection": "posts", - "id": "01K4EXAMPLEID0000000000", - "data": { "title": "New title" }, - "_rev": "MzoyMDI2LTA5LTA0IDEyOjMwOjAw" -} -``` - -The token is opaque; pass it through unchanged. A write built on a stale token fails with `CONFLICT`, so read the item again and retry with the new token. There is no option to restore the previous behavior. The tool descriptions state the same protocol, so an agent reading the schema follows it without being told. diff --git a/.changeset/object-cache-init-timeout.md b/.changeset/object-cache-init-timeout.md deleted file mode 100644 index f0be480326..0000000000 --- a/.changeset/object-cache-init-timeout.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes Cloudflare Workers requests hanging indefinitely after another request is cancelled while the object cache backend is loading. A timed-out request now bypasses the cache and loads the requested data directly, while later requests can initialize the cache again. diff --git a/.changeset/olive-terms-rest.md b/.changeset/olive-terms-rest.md deleted file mode 100644 index 452d0df8d5..0000000000 --- a/.changeset/olive-terms-rest.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Adds an `includeCounts` option to `getTerm()`, matching `getTaxonomyTerms()`. Pass `includeCounts: false` to get a term's label, slug and children without its entry count, which skips the aggregate over the taxonomy's assignments. Counts are still included by default. The built-in category and tag archive pages, which render only the label, opt out. diff --git a/.changeset/passkey-uv-context.md b/.changeset/passkey-uv-context.md deleted file mode 100644 index 5d1011c695..0000000000 --- a/.changeset/passkey-uv-context.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@emdash-cms/auth": minor -"emdash": patch ---- - -Adds `PasskeyConfig.userVerification` so sites can require, prefer, or discourage passkey user verification. Existing callers keep the `preferred` behavior. - -Adds typed, versioned challenge contexts for registration and authentication. Declare a codec with `defineChallengeContext()`, bind data with `bindChallengeContext()` when generating options, and pass the codec with an `AtomicChallengeStore` to `verifyAuthenticationResponse()` or `verifyRegistrationResponse()` to recover the typed value after verification. - -Atomic challenge stores declare `readonly atomic: true`, so an unrelated `consume()` method on an existing challenge store cannot silently change its behavior. EmDash retains optional challenge context data in its database-backed challenge store. - -Authentication rejects assertions whose signature counter drops from a nonzero value to zero because the counter change can indicate a cloned authenticator. diff --git a/.changeset/plugin-storage-cursor-order.md b/.changeset/plugin-storage-cursor-order.md deleted file mode 100644 index 8c22e9f480..0000000000 --- a/.changeset/plugin-storage-cursor-order.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"emdash": patch ---- - -Fixes plugin storage cursor pagination returning duplicate rows and skipping others whenever `query()` is called with `orderBy`. The cursor stepped through the `created_at` column while the results were sorted by the requested `data` field, so the two disagreed: paging newest-first re-returned page one and never reached older rows, and paging ascending broke too whenever the sort field did not happen to match insertion order. Pages now seek on the same expression they are sorted by, and `id` is appended as a tiebreaker so a page boundary cannot fall inside a group of equal sort values. - -Documents that omit the sorted field are also paged correctly now. A missing key extracts as NULL, which made every comparison against it UNKNOWN and dropped those rows from later pages. NULLs are given an explicit position in the sort — last when ascending, first when descending — so they land in the same place on SQLite and Postgres instead of following each dialect's own default, and they page through like any other value. If you relied on the previous per-dialect NULL placement for a collection whose documents omit an indexed field, the order of those rows changes. - -Paginating with a cursor while sorting several fields in different directions now throws `StorageQueryError` instead of silently returning wrong pages. Sort every field the same way, or read the collection without a cursor. diff --git a/.changeset/preserve-custom-block-round-trips.md b/.changeset/preserve-custom-block-round-trips.md deleted file mode 100644 index 2f486c4804..0000000000 --- a/.changeset/preserve-custom-block-round-trips.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@emdash-cms/admin": patch -"emdash": patch ---- - -Fixes the admin rich-text editor replacing payload-less custom blocks with an `[Unknown block type: …]` paragraph during autosave. Custom blocks, existing block and span keys, supported marks, and link definitions survive editor round trips, and the editor does not save a synthetic trailing paragraph. - -Applications using the exported converters can pass `{ preserveIdentity: true }` to `portableTextToProsemirror()` and add `portableTextIdentityExtensions` to their TipTap schema for the same lossless behavior. The default conversion remains compatible with standard ProseMirror schemas. diff --git a/.changeset/preserve-media-source-identity.md b/.changeset/preserve-media-source-identity.md deleted file mode 100644 index 053e6d2af5..0000000000 --- a/.changeset/preserve-media-source-identity.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@emdash-cms/admin": patch -"emdash": patch ---- - -Fixes image fields and Portable Text editors so they preserve direct image URLs and external provider identities, allowing selected images to continue rendering after saving or replacement. diff --git a/.changeset/quiet-publish-flush.md b/.changeset/quiet-publish-flush.md deleted file mode 100644 index 5ed01f1982..0000000000 --- a/.changeset/quiet-publish-flush.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Fixes Publish saving and awaiting the editor's latest changes before making content live. Validation errors, failed saves, and revision conflicts now stop publishing instead of promoting stale draft data. diff --git a/.changeset/release-service-custom-domain.md b/.changeset/release-service-custom-domain.md deleted file mode 100644 index 1703063acb..0000000000 --- a/.changeset/release-service-custom-domain.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/plugin-cli": patch ---- - -Updates `emdash-plugin release setup` to generate workflows that use the hosted release service at `https://releases.emdashcms.com`. diff --git a/.changeset/restore-playground-stepper-timing.md b/.changeset/restore-playground-stepper-timing.md deleted file mode 100644 index 9eb8be6e4d..0000000000 --- a/.changeset/restore-playground-stepper-timing.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/cloudflare": patch ---- - -Updates the Playground setup stepper to use slower completion transitions: 900 ms for checkmarks and color changes, 750 ms for connector fills, and a 300 ms handoff to the next step. Progress remains timer-based. diff --git a/.changeset/safe-postgres-pools.md b/.changeset/safe-postgres-pools.md deleted file mode 100644 index 4a8a018b0c..0000000000 --- a/.changeset/safe-postgres-pools.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"emdash": patch ---- - -Fixes PostgreSQL deployments crashing when an idle pooled connection fails. EmDash now logs the idle-client error without exposing connection credentials while node-postgres discards the failed client and keeps the pool available. - -The `postgres()` adapter's `pool` option also accepts `connectionTimeoutMillis` and `idleTimeoutMillis`. Set `connectionTimeoutMillis` to bound how long a request waits for a connection when PostgreSQL is unreachable. Both options remain unset by default, preserving node-postgres's existing timeout behavior. diff --git a/.changeset/sandboxed-save-rejection.md b/.changeset/sandboxed-save-rejection.md deleted file mode 100644 index d80dd425e2..0000000000 --- a/.changeset/sandboxed-save-rejection.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -"emdash": patch -"@emdash-cms/admin": patch ---- - -Fixes sandboxed `content:beforeSave` hooks being unable to reject content creation or updates. - -Return a version 1 sandbox hook result with a `SAVE_REJECTED` error to stop the save and show the reason to the editor: - -```ts -return { - __emdashSandboxHookResult: true, - version: 1, - error: { - code: "SAVE_REJECTED", - reason: "Add a title before saving.", - }, -}; -``` - -The reason must contain 1–500 characters of plain text. Invalid error results and unexpected sandbox exceptions stop the save with a generic hook error instead of exposing internal details. diff --git a/.changeset/schedule-utc-normalization.md b/.changeset/schedule-utc-normalization.md deleted file mode 100644 index 755848c82f..0000000000 --- a/.changeset/schedule-utc-normalization.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes `content.schedule()` and content updates so offset dates are stored as canonical UTC ISO 8601 timestamps. Positive and negative offsets now publish at the represented instant instead of several hours late or early. diff --git a/.changeset/scheduled-sweep-index.md b/.changeset/scheduled-sweep-index.md deleted file mode 100644 index e8ecb7afcb..0000000000 --- a/.changeset/scheduled-sweep-index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes scheduled publishing so its recurring check no longer reads every content entry on each run. Sites running the scheduler on a frequent cron trigger, as the Cloudflare deployment guide recommends, previously saw database reads grow with the size of their content library rather than with the amount of scheduled work — a cost that is directly billable on D1 and was paid even when nothing was scheduled. Existing sites pick up the fix when migrations run on upgrade; no configuration or code changes are needed. diff --git a/.changeset/schema-update-title-date-fields.md b/.changeset/schema-update-title-date-fields.md deleted file mode 100644 index 8b527feb8a..0000000000 --- a/.changeset/schema-update-title-date-fields.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes `PUT /_emdash/api/schema/collections/{slug}` so `titleField` and `dateField` are no longer silently dropped from the request body. Both fields are now validated, persisted, and returned in the collection response, restoring parity with `UpdateCollectionInput` and the in-process `SchemaRegistry` path. diff --git a/.changeset/secure-workflow-invitations.md b/.changeset/secure-workflow-invitations.md deleted file mode 100644 index 739da3b541..0000000000 --- a/.changeset/secure-workflow-invitations.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@emdash-cms/registry-client": minor -"@emdash-cms/plugin-cli": patch ---- - -Adds publisher-created workflow connection invitations to delegated releases. First-time or unmatched GitHub workflows must use a package-bound, single-use invitation before they can request publisher approval; connected workflows continue without one. - -Create the invitation in the publisher dashboard or with `createWorkflowConnectionInvitation()`, then save its value as the repository's `EMDASH_CONNECTION_INVITATION` GitHub Actions secret. The generated release workflow passes this secret to the release Action automatically. Custom workflows can pass `invitationToken` to `requestWorkflowConnection()`, and publishers can reject pending requests with `rejectWorkflowConnection()`. diff --git a/.changeset/soft-days-publish.md b/.changeset/soft-days-publish.md deleted file mode 100644 index 7f6afb426d..0000000000 --- a/.changeset/soft-days-publish.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@emdash-cms/admin": patch -"emdash": patch ---- - -Updates the content editor's Publish section so authors can distinguish the live version from draft changes and choose immediate or scheduled publishing from one contextual action menu. - -Publishing dates and schedules display in the browser's local time zone while stored timestamp values remain unchanged. - -Schedule and unschedule responses now return the current revision token so subsequent editor saves retain optimistic-concurrency protection. diff --git a/.changeset/sticky-media-pagination.md b/.changeset/sticky-media-pagination.md deleted file mode 100644 index f23d483b9e..0000000000 --- a/.changeset/sticky-media-pagination.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Fixes Media Library pagination scrolling out of view by keeping its controls visible at the bottom while browsing media. diff --git a/.changeset/subtle-media-transparency.md b/.changeset/subtle-media-transparency.md deleted file mode 100644 index 14e123ba67..0000000000 --- a/.changeset/subtle-media-transparency.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Updates image previews to show a theme-aware checkerboard behind transparent areas. diff --git a/.changeset/swift-verifiers-match.md b/.changeset/swift-verifiers-match.md deleted file mode 100644 index 5c33420e08..0000000000 --- a/.changeset/swift-verifiers-match.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@emdash-cms/registry-verification": minor ---- - -Adds optional artifact digest candidates to `GitHubProvenanceVerifier`, allowing callers that compute several supported digest algorithms in one isolated artifact fetch to verify the digest selected by a signed SLSA provenance subject. - -Existing callers can continue passing only `artifactDigest`. Successful results return the candidate that matched the signed subject. - -Fixes `@emdash-cms/registry-verification` when it is rebundled into an Astro Cloudflare application, preventing requests from failing during Worker startup. - -Adds `@emdash-cms/registry-verification/records` for Worker callers that supply an explicit `ProvenanceVerifier`. The runtime-neutral entry does not load the Node-oriented default Sigstore verifier, while the package root keeps the existing default-verifier behavior. - -Fixes `@emdash-cms/registry-verification` when it is rebundled into an Astro Cloudflare application, preventing requests from failing during Worker startup. diff --git a/.changeset/taxonomy-definition-mcp-tools.md b/.changeset/taxonomy-definition-mcp-tools.md deleted file mode 100644 index 8fb1199ad2..0000000000 --- a/.changeset/taxonomy-definition-mcp-tools.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"emdash": minor ---- - -Adds MCP tools for managing taxonomy definitions: `taxonomy_get`, `taxonomy_create`, `taxonomy_update`, and `taxonomy_delete`. - -These mirror the REST endpoints added in #2431, so MCP clients can now create taxonomies before adding terms instead of dropping out to a hand-rolled API call. `taxonomy_create` accepts `name`, `label`, `labelSingular`, `hierarchical`, `collections`, `locale`, and `translationOf`. When `translationOf` is used and `hierarchical` or `collections` are omitted, the new definition inherits them from the source taxonomy, fixing the defaulting trap described in #2525. diff --git a/.changeset/taxonomy-get-locale-description.md b/.changeset/taxonomy-get-locale-description.md deleted file mode 100644 index 34b779b9f0..0000000000 --- a/.changeset/taxonomy-get-locale-description.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes the OpenAPI description for `GET /_emdash/api/taxonomies/{name}`, which said that omitting `locale` returns the lowest-locale definition. The endpoint returns the configured default locale's definition and only falls back to the lowest locale code when the default locale has none. Behavior is unchanged; only the generated API description was wrong. diff --git a/.changeset/tidy-editor-image-spacing.md b/.changeset/tidy-editor-image-spacing.md deleted file mode 100644 index 22eee4abb4..0000000000 --- a/.changeset/tidy-editor-image-spacing.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@emdash-cms/admin": patch ---- - -Fixes excessive vertical space between images and surrounding text in the admin editor. diff --git a/.changeset/tough-pans-repeat.md b/.changeset/tough-pans-repeat.md deleted file mode 100644 index df1ed89d5e..0000000000 --- a/.changeset/tough-pans-repeat.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"emdash": patch ---- - -Fixes Cloudflare D1 sites that could never finish migrating after migration 017 was interrupted. Every retry failed with `table "_emdash_authorization_codes" already exists`; the migration now skips the statements that already ran. diff --git a/.changeset/trash-locale-filter.md b/.changeset/trash-locale-filter.md deleted file mode 100644 index 204239fd59..0000000000 --- a/.changeset/trash-locale-filter.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"emdash": patch -"@emdash-cms/admin": patch ---- - -Fixes the admin Trash tab on multilingual sites, where it listed trashed entries from every locale regardless of the locale picker. Trash now follows the same locale filter as the All tab and shows a Locale column, so switching locales narrows the trash to that locale's entries. - -`GET /_emdash/api/content/{collection}/trash` accepts an optional `locale` query parameter to scope the listing, and each item in the response now carries `locale` and `translationGroup`. Omitting `locale` still returns every locale, so existing API callers are unaffected. diff --git a/.changeset/verify-registry-bundles.md b/.changeset/verify-registry-bundles.md deleted file mode 100644 index a25da46430..0000000000 --- a/.changeset/verify-registry-bundles.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -"emdash": minor -"@emdash-cms/admin": minor -"@emdash-cms/registry-client": minor -"@emdash-cms/registry-verification": minor ---- - -Adds `DirectPdsClient` for reading package profiles and releases with AT Protocol repository proofs, and updates experimental decentralized registry installs and updates to verify current signed records directly from the publisher's PDS. - -#### Aggregator record integrity - -Install and update reject aggregator-supplied profile or release metadata whose URI or CID does not match the publisher's signed records. The server returns `AGGREGATOR_RECORD_MISMATCH` before fetching the artifact or requesting consent. - -#### Publisher identity display - -The admin treats handle resolution as an advisory identity signal. It keeps the install button disabled while attempting to resolve the package DID back to a handle, then blocks installation when `resolveDidToHandle()` conclusively returns `"invalid"`. An indeterminate result caused by a network failure, unsupported DID method, or missing handle displays the publisher DID and does not block installation. - -Install and update trust the publisher DID and the signed repository proofs for the profile and release records. A handle is display metadata and is not an authorization or record-integrity input. - -#### Provenance and release policy - -The installer applies the signed profile's release policy, independently fetches and verifies supplied Sigstore/SLSA provenance, and binds moderation labels to the exact profile or release CID. Missing required provenance and any supplied provenance that is unavailable, malformed, mismatched, or unsupported block installation and updates. Artifact checksums, archive paths, bundle limits, manifest identity, and version use the same verification rules as the registry release tooling. - -The verification package also exports `inspectPackageReleaseRecords` for validating signed records and policy before artifact and provenance evidence is available. - -Registry install and update consent now show the exact verified profile and release CIDs, signed publisher policy, and provenance status. Install consent uses permissions and MCP tools read from the verified bundle rather than the aggregator's record copy. - -Install, update, and delegated-release verification require lowercase base32 multibase `sha2-256` multihashes for package artifacts and provenance documents. The plugin CLI already produces this format. The authenticated image-artifact proxy still accepts legacy bare hexadecimal SHA-256 checksums for display-only images. diff --git a/apps/labeler/CHANGELOG.md b/apps/labeler/CHANGELOG.md index d2a56de11b..197d89bd1c 100644 --- a/apps/labeler/CHANGELOG.md +++ b/apps/labeler/CHANGELOG.md @@ -1,5 +1,12 @@ # @emdash-cms/labeler +## 0.0.2 + +### Patch Changes + +- Updated dependencies [[`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`529b28b`](https://github.com/emdash-cms/emdash/commit/529b28bd1c0e4257eaa4436721b110beb09d5ba3), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - @emdash-cms/registry-verification@0.3.0 + ## 0.0.1 ### Patch Changes diff --git a/apps/labeler/package.json b/apps/labeler/package.json index b53916c836..8aede94518 100644 --- a/apps/labeler/package.json +++ b/apps/labeler/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/labeler", - "version": "0.0.1", + "version": "0.0.2", "private": true, "description": "Metadata-only moderation labeler for the EmDash plugin registry.", "type": "module", diff --git a/apps/release-action/CHANGELOG.md b/apps/release-action/CHANGELOG.md new file mode 100644 index 0000000000..ec1f8c4454 --- /dev/null +++ b/apps/release-action/CHANGELOG.md @@ -0,0 +1,9 @@ +# @emdash-cms/release-action + +## 0.0.1 + +### Patch Changes + +- Updated dependencies [[`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`529b28b`](https://github.com/emdash-cms/emdash/commit/529b28bd1c0e4257eaa4436721b110beb09d5ba3), [`52fffdc`](https://github.com/emdash-cms/emdash/commit/52fffdc3556396f48a5320a0213da1a03337f642), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - @emdash-cms/registry-client@0.5.0 + - @emdash-cms/registry-verification@0.3.0 diff --git a/apps/release-action/package.json b/apps/release-action/package.json index 7b4d12e5a8..0e229ea197 100644 --- a/apps/release-action/package.json +++ b/apps/release-action/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/release-action", - "version": "0.0.0", + "version": "0.0.1", "private": true, "description": "GitHub Action for delegated EmDash plugin releases.", "type": "module", diff --git a/apps/release-service/CHANGELOG.md b/apps/release-service/CHANGELOG.md new file mode 100644 index 0000000000..b261d46ad2 --- /dev/null +++ b/apps/release-service/CHANGELOG.md @@ -0,0 +1,11 @@ +# @emdash-cms/release-service + +## 0.0.1 + +### Patch Changes + +- Updated dependencies [[`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`529b28b`](https://github.com/emdash-cms/emdash/commit/529b28bd1c0e4257eaa4436721b110beb09d5ba3), [`52fffdc`](https://github.com/emdash-cms/emdash/commit/52fffdc3556396f48a5320a0213da1a03337f642), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - @emdash-cms/auth@0.37.0 + - @emdash-cms/plugin-types@0.3.1 + - @emdash-cms/registry-client@0.5.0 + - @emdash-cms/registry-verification@0.3.0 diff --git a/apps/release-service/package.json b/apps/release-service/package.json index 3da5e5ea5b..c8fa8ccd91 100644 --- a/apps/release-service/package.json +++ b/apps/release-service/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/release-service", - "version": "0.0.0", + "version": "0.0.1", "private": true, "description": "Cloudflare Worker for delegated EmDash registry releases.", "type": "module", diff --git a/apps/release-verifier/CHANGELOG.md b/apps/release-verifier/CHANGELOG.md new file mode 100644 index 0000000000..8424e9b1e5 --- /dev/null +++ b/apps/release-verifier/CHANGELOG.md @@ -0,0 +1,8 @@ +# @emdash-cms/release-verifier + +## 0.0.1 + +### Patch Changes + +- Updated dependencies [[`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`529b28b`](https://github.com/emdash-cms/emdash/commit/529b28bd1c0e4257eaa4436721b110beb09d5ba3), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - @emdash-cms/registry-verification@0.3.0 diff --git a/apps/release-verifier/package.json b/apps/release-verifier/package.json index eb1c70d856..dbad7311b9 100644 --- a/apps/release-verifier/package.json +++ b/apps/release-verifier/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/release-verifier", - "version": "0.0.0", + "version": "0.0.1", "private": true, "description": "Isolated Cloudflare Worker for delegated release artifact verification.", "type": "module", diff --git a/fixtures/perf-site/CHANGELOG.md b/fixtures/perf-site/CHANGELOG.md index 0afcb1c250..d0532bf657 100644 --- a/fixtures/perf-site/CHANGELOG.md +++ b/fixtures/perf-site/CHANGELOG.md @@ -1,5 +1,13 @@ # @emdash-cms/fixture-perf-site +## 0.0.40 + +### Patch Changes + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922), [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c), [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50), [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab), [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7), [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658), [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e), [`c4286bc`](https://github.com/emdash-cms/emdash/commit/c4286bc5c418396956d9c66c05a52641e6aa7d51), [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34), [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0), [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118), [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42), [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162), [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`ab26518`](https://github.com/emdash-cms/emdash/commit/ab26518533e7b255196ab9277f907b5a7deabba3), [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513), [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8), [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7), [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0), [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - emdash@0.37.0 + - @emdash-cms/cloudflare@0.37.0 + ## 0.0.39 ### Patch Changes diff --git a/fixtures/perf-site/package.json b/fixtures/perf-site/package.json index 6fca44cb93..18c66ca779 100644 --- a/fixtures/perf-site/package.json +++ b/fixtures/perf-site/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/fixture-perf-site", - "version": "0.0.39", + "version": "0.0.40", "private": true, "type": "module", "description": "Fixture site for query-count perf snapshots. Runs under sqlite+node or d1+cloudflare based on EMDASH_FIXTURE_TARGET.", diff --git a/infra/blog-demo/CHANGELOG.md b/infra/blog-demo/CHANGELOG.md index a8653b059c..8a8ec6e311 100644 --- a/infra/blog-demo/CHANGELOG.md +++ b/infra/blog-demo/CHANGELOG.md @@ -1,5 +1,16 @@ # @emdash-cms/perf-demo-site +## 0.0.40 + +### Patch Changes + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922), [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c), [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50), [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab), [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7), [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`d99a0e8`](https://github.com/emdash-cms/emdash/commit/d99a0e835628edca896e304700746707e1bf56e7), [`c4286bc`](https://github.com/emdash-cms/emdash/commit/c4286bc5c418396956d9c66c05a52641e6aa7d51), [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34), [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0), [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118), [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42), [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162), [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`3b106f6`](https://github.com/emdash-cms/emdash/commit/3b106f6f87e24a665ecd9007e4001905700b1554), [`ab26518`](https://github.com/emdash-cms/emdash/commit/ab26518533e7b255196ab9277f907b5a7deabba3), [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513), [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8), [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7), [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0), [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - emdash@0.37.0 + - @emdash-cms/plugin-cli@0.10.0 + - @emdash-cms/plugin-forms@0.2.6 + - @emdash-cms/cloudflare@0.37.0 + - @emdash-cms/plugin-webhook-notifier@0.2.0 + ## 0.0.39 ### Patch Changes diff --git a/infra/blog-demo/package.json b/infra/blog-demo/package.json index 933c82e931..20f3bbfd3d 100644 --- a/infra/blog-demo/package.json +++ b/infra/blog-demo/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/perf-demo-site", - "version": "0.0.39", + "version": "0.0.40", "private": true, "type": "module", "scripts": { diff --git a/infra/cache-demo/CHANGELOG.md b/infra/cache-demo/CHANGELOG.md index f555e93635..15c5e598f4 100644 --- a/infra/cache-demo/CHANGELOG.md +++ b/infra/cache-demo/CHANGELOG.md @@ -1,5 +1,16 @@ # @emdash-cms/cache-demo-site +## 0.0.40 + +### Patch Changes + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922), [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c), [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50), [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab), [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7), [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`d99a0e8`](https://github.com/emdash-cms/emdash/commit/d99a0e835628edca896e304700746707e1bf56e7), [`c4286bc`](https://github.com/emdash-cms/emdash/commit/c4286bc5c418396956d9c66c05a52641e6aa7d51), [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34), [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0), [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118), [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42), [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162), [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`3b106f6`](https://github.com/emdash-cms/emdash/commit/3b106f6f87e24a665ecd9007e4001905700b1554), [`ab26518`](https://github.com/emdash-cms/emdash/commit/ab26518533e7b255196ab9277f907b5a7deabba3), [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513), [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8), [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7), [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0), [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - emdash@0.37.0 + - @emdash-cms/plugin-cli@0.10.0 + - @emdash-cms/plugin-forms@0.2.6 + - @emdash-cms/cloudflare@0.37.0 + - @emdash-cms/plugin-webhook-notifier@0.2.0 + ## 0.0.39 ### Patch Changes diff --git a/infra/cache-demo/package.json b/infra/cache-demo/package.json index a8778eb30b..00fd0bc6d8 100644 --- a/infra/cache-demo/package.json +++ b/infra/cache-demo/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/cache-demo-site", - "version": "0.0.39", + "version": "0.0.40", "private": true, "type": "module", "scripts": { diff --git a/infra/do-demo/CHANGELOG.md b/infra/do-demo/CHANGELOG.md index 37c7b6c605..85c8355950 100644 --- a/infra/do-demo/CHANGELOG.md +++ b/infra/do-demo/CHANGELOG.md @@ -1,5 +1,16 @@ # @emdash-cms/do-demo-site +## 0.0.40 + +### Patch Changes + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922), [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c), [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50), [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab), [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7), [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`d99a0e8`](https://github.com/emdash-cms/emdash/commit/d99a0e835628edca896e304700746707e1bf56e7), [`c4286bc`](https://github.com/emdash-cms/emdash/commit/c4286bc5c418396956d9c66c05a52641e6aa7d51), [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34), [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0), [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118), [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42), [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162), [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`3b106f6`](https://github.com/emdash-cms/emdash/commit/3b106f6f87e24a665ecd9007e4001905700b1554), [`ab26518`](https://github.com/emdash-cms/emdash/commit/ab26518533e7b255196ab9277f907b5a7deabba3), [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513), [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8), [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7), [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0), [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - emdash@0.37.0 + - @emdash-cms/plugin-cli@0.10.0 + - @emdash-cms/plugin-forms@0.2.6 + - @emdash-cms/cloudflare@0.37.0 + - @emdash-cms/plugin-webhook-notifier@0.2.0 + ## 0.0.39 ### Patch Changes diff --git a/infra/do-demo/package.json b/infra/do-demo/package.json index 52d9620201..52fef834bb 100644 --- a/infra/do-demo/package.json +++ b/infra/do-demo/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/do-demo-site", - "version": "0.0.39", + "version": "0.0.40", "private": true, "type": "module", "scripts": { diff --git a/infra/do-solo-demo/CHANGELOG.md b/infra/do-solo-demo/CHANGELOG.md index c1464efbc7..a678dfc0a2 100644 --- a/infra/do-solo-demo/CHANGELOG.md +++ b/infra/do-solo-demo/CHANGELOG.md @@ -1,5 +1,16 @@ # @emdash-cms/do-solo-demo-site +## 0.0.40 + +### Patch Changes + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922), [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c), [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50), [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab), [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7), [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`d99a0e8`](https://github.com/emdash-cms/emdash/commit/d99a0e835628edca896e304700746707e1bf56e7), [`c4286bc`](https://github.com/emdash-cms/emdash/commit/c4286bc5c418396956d9c66c05a52641e6aa7d51), [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34), [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0), [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118), [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42), [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162), [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`3b106f6`](https://github.com/emdash-cms/emdash/commit/3b106f6f87e24a665ecd9007e4001905700b1554), [`ab26518`](https://github.com/emdash-cms/emdash/commit/ab26518533e7b255196ab9277f907b5a7deabba3), [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513), [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8), [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7), [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0), [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - emdash@0.37.0 + - @emdash-cms/plugin-cli@0.10.0 + - @emdash-cms/plugin-forms@0.2.6 + - @emdash-cms/cloudflare@0.37.0 + - @emdash-cms/plugin-webhook-notifier@0.2.0 + ## 0.0.39 ### Patch Changes diff --git a/infra/do-solo-demo/package.json b/infra/do-solo-demo/package.json index 951f428c63..db0b3e04d4 100644 --- a/infra/do-solo-demo/package.json +++ b/infra/do-solo-demo/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/do-solo-demo-site", - "version": "0.0.39", + "version": "0.0.40", "private": true, "type": "module", "scripts": { diff --git a/packages/admin/CHANGELOG.md b/packages/admin/CHANGELOG.md index 735f48e5e2..7a3e2a563f 100644 --- a/packages/admin/CHANGELOG.md +++ b/packages/admin/CHANGELOG.md @@ -1,5 +1,125 @@ # @emdash-cms/admin +## 0.37.0 + +### Minor Changes + +- [#2899](https://github.com/emdash-cms/emdash/pull/2899) [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds **Replace image** to the Media Library for ready JPEG, PNG, and WebP files stored by EmDash. + + Choose a same-format file to update every existing use of an image while preserving its media ID, filename, URL, alt text, caption, and location. The replacement can use different dimensions or an aspect ratio from the original. EmDash overwrites the original bytes and clears the focal point; it does not retain the previous file. The action works with local disk, R2, and S3-compatible storage. + +- [#2905](https://github.com/emdash-cms/emdash/pull/2905) [`de8b03a`](https://github.com/emdash-cms/emdash/commit/de8b03a47330341f9e6d0c397f312fca27fba0ae) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds in-context Media Library asset editing to admin image pickers, image fields, and rich text + images and galleries. Editors can update asset metadata and focal points, create and select cropped + copies, or replace original image data while staying in the content editor. Gallery images also + support keyboard reordering. + +- [#2861](https://github.com/emdash-cms/emdash/pull/2861) [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds cropping for JPEG, PNG, and WebP images stored by EmDash on local disk, Cloudflare R2, or S3-compatible storage. + + Move and resize a rule-of-thirds crop frame with corner handles for fixed ratios and eight handles for Freeform. Choose the original ratio, Freeform, or a common aspect ratio. **Create cropped copy** creates a separate media item with any ratio and names it for the selected ratio or output dimensions. **Replace original** uses the original ratio and replaces the existing item under the same ID and URL, so every reference uses the cropped image without rewriting or republishing content. Local media and responsive renditions revalidate their stable URLs so sites load the replacement instead of keeping a stale cached image. The original bytes and crop history are not retained. + +- [#2900](https://github.com/emdash-cms/emdash/pull/2900) [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds Media Library browsing and inline uploads to admin media pickers. Editors can search, filter + by type, browse folders, switch between grid and list views, use numbered pages, and select media + from configured providers or a direct URL without leaving the content editor. + + Uploads appear in the picker with an uploading or failed status. Successful uploads become + selected media cards, and gallery selections can be reordered before they are added. + +- [#2969](https://github.com/emdash-cms/emdash/pull/2969) [`9a66ff0`](https://github.com/emdash-cms/emdash/commit/9a66ff0bdec007c5161407720a40b718248fce82) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds drag-and-drop uploads to empty Featured Image and OG Image fields in the content editor. Drop one image to upload and select it, or click the dashed control to choose an image from the media picker. Upload progress and errors appear inline. + +- [#2746](https://github.com/emdash-cms/emdash/pull/2746) [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `DirectPdsClient` for reading package profiles and releases with AT Protocol repository proofs, and updates experimental decentralized registry installs and updates to verify current signed records directly from the publisher's PDS. + + #### Aggregator record integrity + + Install and update reject aggregator-supplied profile or release metadata whose URI or CID does not match the publisher's signed records. The server returns `AGGREGATOR_RECORD_MISMATCH` before fetching the artifact or requesting consent. + + #### Publisher identity display + + The admin treats handle resolution as an advisory identity signal. It keeps the install button disabled while attempting to resolve the package DID back to a handle, then blocks installation when `resolveDidToHandle()` conclusively returns `"invalid"`. An indeterminate result caused by a network failure, unsupported DID method, or missing handle displays the publisher DID and does not block installation. + + Install and update trust the publisher DID and the signed repository proofs for the profile and release records. A handle is display metadata and is not an authorization or record-integrity input. + + #### Provenance and release policy + + The installer applies the signed profile's release policy, independently fetches and verifies supplied Sigstore/SLSA provenance, and binds moderation labels to the exact profile or release CID. Missing required provenance and any supplied provenance that is unavailable, malformed, mismatched, or unsupported block installation and updates. Artifact checksums, archive paths, bundle limits, manifest identity, and version use the same verification rules as the registry release tooling. + + The verification package also exports `inspectPackageReleaseRecords` for validating signed records and policy before artifact and provenance evidence is available. + + Registry install and update consent now show the exact verified profile and release CIDs, signed publisher policy, and provenance status. Install consent uses permissions and MCP tools read from the verified bundle rather than the aggregator's record copy. + + Install, update, and delegated-release verification require lowercase base32 multibase `sha2-256` multihashes for package artifacts and provenance documents. The plugin CLI already produces this format. The authenticated image-artifact proxy still accepts legacy bare hexadecimal SHA-256 checksums for display-only images. + +### Patch Changes + +- [#2895](https://github.com/emdash-cms/emdash/pull/2895) [`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff) Thanks [@ismail-rt](https://github.com/ismail-rt)! - Fixes admin “View published” and “Live View” links so translated entries include the locale prefix required by the site’s Astro i18n routing configuration. + +- [#2931](https://github.com/emdash-cms/emdash/pull/2931) [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Fixes the editor image settings panel overflowing at narrow widths and aligns its fields, help, and actions with the standard editor sidebar. + + Changing image alignment or text preserves the existing display size. Reset clears custom dimensions, constrained editor images retain their aspect ratio, floated images stay visible, and None and Center have distinct positions. + + Preserves image alignment through the exported Portable Text converters. Image settings offer None, Left, Center, and Right; existing imported Wide and Full values and public theme hooks are retained. + +- [#2963](https://github.com/emdash-cms/emdash/pull/2963) [`85f8b5a`](https://github.com/emdash-cms/emdash/commit/85f8b5a4322de83a89607bb7718e727f11e4d9b7) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Updates admin editor paragraphs with tighter line spacing, clearer paragraph breaks, and 16px text on mobile. Wrapped writing hints no longer overlap following content and use softer colours in both themes. + +- [#2761](https://github.com/emdash-cms/emdash/pull/2761) [`8fb13cf`](https://github.com/emdash-cms/emdash/commit/8fb13cf7a6bdabab8e9a4288c685be4715febd63) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds a dedicated **Used in** tab to media details, keeping file information and focal-point controls separate from usage references. + +- [#2922](https://github.com/emdash-cms/emdash/pull/2922) [`096cd91`](https://github.com/emdash-cms/emdash/commit/096cd91299629467b0cd5ee24829da17b0d3d624) Thanks [@danielmlr](https://github.com/danielmlr)! - Completes the German admin translations: every string in the admin catalog now has a German translation, so German-speaking editors no longer see English in the media, publishing, byline, editor and plugin screens. + +- [#2126](https://github.com/emdash-cms/emdash/pull/2126) [`7887577`](https://github.com/emdash-cms/emdash/commit/788757761732ca691d73f7f8c99e7d3d66bf9dec) Thanks [@swissky](https://github.com/swissky)! - Fixes a silent draft-overwrite in the page editor. The editor now echoes the entry's `_rev` token on save and autosave, so the server rejects a save that is based on a stale read with a 409 conflict instead of silently replacing a newer draft revision. Editors who hit a conflict now see a clear error and can reload instead of losing work. + +- [#2902](https://github.com/emdash-cms/emdash/pull/2902) [`87c7884`](https://github.com/emdash-cms/emdash/commit/87c7884a9bc42efecdea687fc0a58aa71b2ecc4d) Thanks [@danielmlr](https://github.com/danielmlr)! - Fixes the content editor refusing every later save once another writer changed the same entry, so what you typed is kept and can be saved over the newer version. Autosave pauses for that entry until you decide, so your copy never goes over the other version without you choosing it. + +- [#2865](https://github.com/emdash-cms/emdash/pull/2865) [`5f9eb67`](https://github.com/emdash-cms/emdash/commit/5f9eb67440cf89ec473d608e99d8b19272a20e96) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Updates sidebar navigation icons to use Phosphor's filled style for the active page. + +- [#2761](https://github.com/emdash-cms/emdash/pull/2761) [`8fb13cf`](https://github.com/emdash-cms/emdash/commit/8fb13cf7a6bdabab8e9a4288c685be4715febd63) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Updates Media Library grid cards to show filenames and file formats below larger previews. + +- [#2972](https://github.com/emdash-cms/emdash/pull/2972) [`d267a2c`](https://github.com/emdash-cms/emdash/commit/d267a2c7f6f33b64cde8e4acc723b6ee7779c444) Thanks [@danielmlr](https://github.com/danielmlr)! - Fixes editor changes being silently discarded when the publication date of a published entry is saved. Unsaved changes are now written first, so the entry keeps them and the save indicator no longer reports "Saved" over lost work. + +- [#2939](https://github.com/emdash-cms/emdash/pull/2939) [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes the admin rich-text editor replacing payload-less custom blocks with an `[Unknown block type: …]` paragraph during autosave. Custom blocks, existing block and span keys, supported marks, and link definitions survive editor round trips, and the editor does not save a synthetic trailing paragraph. + + Applications using the exported converters can pass `{ preserveIdentity: true }` to `portableTextToProsemirror()` and add `portableTextIdentityExtensions` to their TipTap schema for the same lossless behavior. The default conversion remains compatible with standard ProseMirror schemas. + +- [#2830](https://github.com/emdash-cms/emdash/pull/2830) [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Fixes image fields and Portable Text editors so they preserve direct image URLs and external provider identities, allowing selected images to continue rendering after saving or replacement. + +- [#2860](https://github.com/emdash-cms/emdash/pull/2860) [`afa81c5`](https://github.com/emdash-cms/emdash/commit/afa81c5e847f1492f7b5eba134d97d0bbbb3aed7) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes Publish saving and awaiting the editor's latest changes before making content live. Validation errors, failed saves, and revision conflicts now stop publishing instead of promoting stale draft data. + +- [#2858](https://github.com/emdash-cms/emdash/pull/2858) [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes sandboxed `content:beforeSave` hooks being unable to reject content creation or updates. + + Return a version 1 sandbox hook result with a `SAVE_REJECTED` error to stop the save and show the reason to the editor: + + ```ts + return { + __emdashSandboxHookResult: true, + version: 1, + error: { + code: "SAVE_REJECTED", + reason: "Add a title before saving.", + }, + }; + ``` + + The reason must contain 1–500 characters of plain text. Invalid error results and unexpected sandbox exceptions stop the save with a generic hook error instead of exposing internal details. + +- [#2891](https://github.com/emdash-cms/emdash/pull/2891) [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Updates the content editor's Publish section so authors can distinguish the live version from draft changes and choose immediate or scheduled publishing from one contextual action menu. + + Publishing dates and schedules display in the browser's local time zone while stored timestamp values remain unchanged. + + Schedule and unschedule responses now return the current revision token so subsequent editor saves retain optimistic-concurrency protection. + +- [#2952](https://github.com/emdash-cms/emdash/pull/2952) [`b2da4f2`](https://github.com/emdash-cms/emdash/commit/b2da4f2973539055d1fa79157adc3414a5b46546) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Fixes Media Library pagination scrolling out of view by keeping its controls visible at the bottom while browsing media. + +- [#2761](https://github.com/emdash-cms/emdash/pull/2761) [`8fb13cf`](https://github.com/emdash-cms/emdash/commit/8fb13cf7a6bdabab8e9a4288c685be4715febd63) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Updates image previews to show a theme-aware checkerboard behind transparent areas. + +- [#2961](https://github.com/emdash-cms/emdash/pull/2961) [`8efac35`](https://github.com/emdash-cms/emdash/commit/8efac3583310d81a711a6333d7a9113c2d5c008f) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Fixes excessive vertical space between images and surrounding text in the admin editor. + +- [#2807](https://github.com/emdash-cms/emdash/pull/2807) [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36) Thanks [@LeanderG](https://github.com/LeanderG)! - Fixes the admin Trash tab on multilingual sites, where it listed trashed entries from every locale regardless of the locale picker. Trash now follows the same locale filter as the All tab and shows a Locale column, so switching locales narrows the trash to that locale's entries. + + `GET /_emdash/api/content/{collection}/trash` accepts an optional `locale` query parameter to scope the listing, and each item in the response now carries `locale` and `translationGroup`. Omitting `locale` still returns every locale, so existing API callers are unaffected. + +- Updated dependencies [[`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`52fffdc`](https://github.com/emdash-cms/emdash/commit/52fffdc3556396f48a5320a0213da1a03337f642), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - @emdash-cms/plugin-types@0.3.1 + - @emdash-cms/registry-client@0.5.0 + - @emdash-cms/blocks@0.37.0 + ## 0.36.0 ### Minor Changes diff --git a/packages/admin/package.json b/packages/admin/package.json index 63ec63973c..acf03d3cb4 100644 --- a/packages/admin/package.json +++ b/packages/admin/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/admin", - "version": "0.36.0", + "version": "0.37.0", "description": "Admin UI for EmDash CMS", "type": "module", "main": "dist/index.js", diff --git a/packages/auth-atproto/CHANGELOG.md b/packages/auth-atproto/CHANGELOG.md index 8cdb7cfea1..dac96b9429 100644 --- a/packages/auth-atproto/CHANGELOG.md +++ b/packages/auth-atproto/CHANGELOG.md @@ -1,5 +1,12 @@ # @emdash-cms/auth-atproto +## 0.2.37 + +### Patch Changes + +- Updated dependencies [[`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a)]: + - @emdash-cms/auth@0.37.0 + ## 0.2.36 ### Patch Changes diff --git a/packages/auth-atproto/package.json b/packages/auth-atproto/package.json index 5ae25060ef..5aa7a2c7e8 100644 --- a/packages/auth-atproto/package.json +++ b/packages/auth-atproto/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/auth-atproto", - "version": "0.2.36", + "version": "0.2.37", "description": "AT Protocol / Atmosphere authentication provider for EmDash CMS", "type": "module", "main": "src/auth.ts", diff --git a/packages/auth/CHANGELOG.md b/packages/auth/CHANGELOG.md index c7f122e4ef..c55de8f43f 100644 --- a/packages/auth/CHANGELOG.md +++ b/packages/auth/CHANGELOG.md @@ -1,5 +1,21 @@ # @emdash-cms/auth +## 0.37.0 + +### Minor Changes + +- [#2745](https://github.com/emdash-cms/emdash/pull/2745) [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `PasskeyConfig.userVerification` so sites can require, prefer, or discourage passkey user verification. Existing callers keep the `preferred` behavior. + + Adds typed, versioned challenge contexts for registration and authentication. Declare a codec with `defineChallengeContext()`, bind data with `bindChallengeContext()` when generating options, and pass the codec with an `AtomicChallengeStore` to `verifyAuthenticationResponse()` or `verifyRegistrationResponse()` to recover the typed value after verification. + + Atomic challenge stores declare `readonly atomic: true`, so an unrelated `consume()` method on an existing challenge store cannot silently change its behavior. EmDash retains optional challenge context data in its database-backed challenge store. + + Authentication rejects assertions whose signature counter drops from a nonzero value to zero because the counter change can indicate a cloned authenticator. + +### Patch Changes + +- [#2864](https://github.com/emdash-cms/emdash/pull/2864) [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636) Thanks [@camc314](https://github.com/camc314)! - Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules. + ## 0.36.0 ## 0.35.0 diff --git a/packages/auth/package.json b/packages/auth/package.json index 367fab603d..76521f474e 100644 --- a/packages/auth/package.json +++ b/packages/auth/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/auth", - "version": "0.36.0", + "version": "0.37.0", "description": "Passkey-first authentication for EmDash", "type": "module", "main": "dist/index.mjs", diff --git a/packages/blocks/CHANGELOG.md b/packages/blocks/CHANGELOG.md index a07ffac9fb..155dc157da 100644 --- a/packages/blocks/CHANGELOG.md +++ b/packages/blocks/CHANGELOG.md @@ -1,5 +1,7 @@ # @emdash-cms/blocks +## 0.37.0 + ## 0.36.0 ## 0.35.0 diff --git a/packages/blocks/package.json b/packages/blocks/package.json index 4d7450b593..f62569bbbf 100644 --- a/packages/blocks/package.json +++ b/packages/blocks/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/blocks", - "version": "0.36.0", + "version": "0.37.0", "description": "Declarative plugin UI blocks for EmDash CMS", "type": "module", "main": "dist/index.js", diff --git a/packages/cloudflare/CHANGELOG.md b/packages/cloudflare/CHANGELOG.md index 061023d41c..f9fff21825 100644 --- a/packages/cloudflare/CHANGELOG.md +++ b/packages/cloudflare/CHANGELOG.md @@ -1,5 +1,20 @@ # @emdash-cms/cloudflare +## 0.37.0 + +### Patch Changes + +- [#2861](https://github.com/emdash-cms/emdash/pull/2861) [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds cropping for JPEG, PNG, and WebP images stored by EmDash on local disk, Cloudflare R2, or S3-compatible storage. + + Move and resize a rule-of-thirds crop frame with corner handles for fixed ratios and eight handles for Freeform. Choose the original ratio, Freeform, or a common aspect ratio. **Create cropped copy** creates a separate media item with any ratio and names it for the selected ratio or output dimensions. **Replace original** uses the original ratio and replaces the existing item under the same ID and URL, so every reference uses the cropped image without rewriting or republishing content. Local media and responsive renditions revalidate their stable URLs so sites load the replacement instead of keeping a stale cached image. The original bytes and crop history are not retained. + +- [#2756](https://github.com/emdash-cms/emdash/pull/2756) [`c4286bc`](https://github.com/emdash-cms/emdash/commit/c4286bc5c418396956d9c66c05a52641e6aa7d51) Thanks [@yumam0815](https://github.com/yumam0815)! - Fixes deployment-managed D1 migrations failing on a completely empty database before Kysely can create its migration tables. Migration status now reports empty history without writing, and apply can initialize and run the pending migrations. + +- [#2932](https://github.com/emdash-cms/emdash/pull/2932) [`ab26518`](https://github.com/emdash-cms/emdash/commit/ab26518533e7b255196ab9277f907b5a7deabba3) Thanks [@nocdn](https://github.com/nocdn)! - Updates the Playground setup stepper to use slower completion transitions: 900 ms for checkmarks and color changes, 750 ms for connector fills, and a 300 ms handoff to the next step. Progress remains timer-based. + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922), [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c), [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50), [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab), [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7), [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658), [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e), [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34), [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0), [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118), [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42), [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162), [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513), [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8), [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7), [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0), [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - emdash@0.37.0 + ## 0.36.0 ### Minor Changes diff --git a/packages/cloudflare/package.json b/packages/cloudflare/package.json index 46a116f54a..a2833b0267 100644 --- a/packages/cloudflare/package.json +++ b/packages/cloudflare/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/cloudflare", - "version": "0.36.0", + "version": "0.37.0", "description": "Cloudflare adapters for EmDash - D1, R2, Access, and Worker Loader sandbox", "type": "module", "main": "dist/index.mjs", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 2ab73b355d..e898629148 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,188 @@ # emdash +## 0.37.0 + +### Minor Changes + +- [#2897](https://github.com/emdash-cms/emdash/pull/2897) [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `id` to the `content:beforeSave` hook event when an existing item is updated, for both trusted and sandboxed plugins. `event.content` holds only the submitted field values, so a hook that needs the stored item, for example to audit or validate a change against it, can call `ctx.content.get(event.collection, event.id)`. The field is absent on creates. + +- [#2899](https://github.com/emdash-cms/emdash/pull/2899) [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds **Replace image** to the Media Library for ready JPEG, PNG, and WebP files stored by EmDash. + + Choose a same-format file to update every existing use of an image while preserving its media ID, filename, URL, alt text, caption, and location. The replacement can use different dimensions or an aspect ratio from the original. EmDash overwrites the original bytes and clears the focal point; it does not retain the previous file. The action works with local disk, R2, and S3-compatible storage. + +- [#2861](https://github.com/emdash-cms/emdash/pull/2861) [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Adds cropping for JPEG, PNG, and WebP images stored by EmDash on local disk, Cloudflare R2, or S3-compatible storage. + + Move and resize a rule-of-thirds crop frame with corner handles for fixed ratios and eight handles for Freeform. Choose the original ratio, Freeform, or a common aspect ratio. **Create cropped copy** creates a separate media item with any ratio and names it for the selected ratio or output dimensions. **Replace original** uses the original ratio and replaces the existing item under the same ID and URL, so every reference uses the cropped image without rewriting or republishing content. Local media and responsive renditions revalidate their stable URLs so sites load the replacement instead of keeping a stale cached image. The original bytes and crop history are not retained. + +- [#2912](https://github.com/emdash-cms/emdash/pull/2912) [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42) Thanks [@danielmlr](https://github.com/danielmlr)! - **Breaking (MCP clients):** Requires `_rev` on the MCP `content_update`, `content_publish`, `content_unpublish` and `content_discard_draft` tools, so an agent can no longer write over changes it never read. The CLI has always required the token on `content update`; the MCP surface now matches it. + + The four tools previously accepted `_rev` as an optional parameter and performed the write when it was omitted. Such a call now fails validation with a message naming `content_get`. To migrate, read the item first and pass back the token from the response: + + ```json + { + "collection": "posts", + "id": "01K4EXAMPLEID0000000000", + "data": { "title": "New title" }, + "_rev": "MzoyMDI2LTA5LTA0IDEyOjMwOjAw" + } + ``` + + The token is opaque; pass it through unchanged. A write built on a stale token fails with `CONFLICT`, so read the item again and retry with the new token. There is no option to restore the previous behavior. The tool descriptions state the same protocol, so an agent reading the schema follows it without being told. + +- [#2926](https://github.com/emdash-cms/emdash/pull/2926) [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7) Thanks [@emdashbot](https://github.com/apps/emdashbot)! - Adds MCP tools for managing taxonomy definitions: `taxonomy_get`, `taxonomy_create`, `taxonomy_update`, and `taxonomy_delete`. + + These mirror the REST endpoints added in [#2431](https://github.com/emdash-cms/emdash/issues/2431), so MCP clients can now create taxonomies before adding terms instead of dropping out to a hand-rolled API call. `taxonomy_create` accepts `name`, `label`, `labelSingular`, `hierarchical`, `collections`, `locale`, and `translationOf`. When `translationOf` is used and `hierarchical` or `collections` are omitted, the new definition inherits them from the source taxonomy, fixing the defaulting trap described in [#2525](https://github.com/emdash-cms/emdash/issues/2525). + +- [#2746](https://github.com/emdash-cms/emdash/pull/2746) [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `DirectPdsClient` for reading package profiles and releases with AT Protocol repository proofs, and updates experimental decentralized registry installs and updates to verify current signed records directly from the publisher's PDS. + + #### Aggregator record integrity + + Install and update reject aggregator-supplied profile or release metadata whose URI or CID does not match the publisher's signed records. The server returns `AGGREGATOR_RECORD_MISMATCH` before fetching the artifact or requesting consent. + + #### Publisher identity display + + The admin treats handle resolution as an advisory identity signal. It keeps the install button disabled while attempting to resolve the package DID back to a handle, then blocks installation when `resolveDidToHandle()` conclusively returns `"invalid"`. An indeterminate result caused by a network failure, unsupported DID method, or missing handle displays the publisher DID and does not block installation. + + Install and update trust the publisher DID and the signed repository proofs for the profile and release records. A handle is display metadata and is not an authorization or record-integrity input. + + #### Provenance and release policy + + The installer applies the signed profile's release policy, independently fetches and verifies supplied Sigstore/SLSA provenance, and binds moderation labels to the exact profile or release CID. Missing required provenance and any supplied provenance that is unavailable, malformed, mismatched, or unsupported block installation and updates. Artifact checksums, archive paths, bundle limits, manifest identity, and version use the same verification rules as the registry release tooling. + + The verification package also exports `inspectPackageReleaseRecords` for validating signed records and policy before artifact and provenance evidence is available. + + Registry install and update consent now show the exact verified profile and release CIDs, signed publisher policy, and provenance status. Install consent uses permissions and MCP tools read from the verified bundle rather than the aggregator's record copy. + + Install, update, and delegated-release verification require lowercase base32 multibase `sha2-256` multihashes for package artifacts and provenance documents. The plugin CLI already produces this format. The authenticated image-artifact proxy still accepts legacy bare hexadecimal SHA-256 checksums for display-only images. + +### Patch Changes + +- [#2895](https://github.com/emdash-cms/emdash/pull/2895) [`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff) Thanks [@ismail-rt](https://github.com/ismail-rt)! - Fixes admin “View published” and “Live View” links so translated entries include the locale prefix required by the site’s Astro i18n routing configuration. + +- [#2876](https://github.com/emdash-cms/emdash/pull/2876) [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922) Thanks [@ismail-rt](https://github.com/ismail-rt)! - Fixes the Archives widget so monthly and yearly lists include posts whose `publishedAt` value is a `Date` object instead of rendering an empty list. + +- [#2783](https://github.com/emdash-cms/emdash/pull/2783) [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c) Thanks [@yumam0815](https://github.com/yumam0815)! - Fixes publication workflows so callers can pass the approved `_rev` to publish, unpublish, or discard a draft and receive a `CONFLICT` response when the entry changed. + +- [#2852](https://github.com/emdash-cms/emdash/pull/2852) [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5) Thanks [@MA2153](https://github.com/MA2153)! - Fixes scheduled media-usage cleanup reading far more rows than its batch size on large sites. A cleanup run that had lost its lease scanned the whole occurrence table before returning nothing, so cron ticks could spike into the hundreds of thousands of rows read. Sites on Cloudflare D1 will see those spikes disappear. + +- [#2864](https://github.com/emdash-cms/emdash/pull/2864) [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636) Thanks [@camc314](https://github.com/camc314)! - Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules. + +- [#2885](https://github.com/emdash-cms/emdash/pull/2885) [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab) Thanks [@MA2153](https://github.com/MA2153)! - Fixes byline profile pages having no way to render the byline's avatar ([#2613](https://github.com/emdash-cms/emdash/issues/2613)). `getByline`, `getBylineBySlug`, and the underlying single-row `BylineRepository` finders now resolve the avatar's media row in the same query, so `avatarStorageKey`, `avatarAlt`, `avatarBlurhash`, and `avatarDominantColor` are populated alongside `avatarMediaId`: + + ```astro + --- + import { getBylineBySlug } from "emdash"; + + const byline = await getBylineBySlug(Astro.params.slug, { + locale: Astro.currentLocale, + }); + const avatar = byline?.avatarStorageKey + ? Astro.locals.emdash.getPublicMediaUrl(byline.avatarStorageKey) + : null; + --- + + {avatar && {byline.avatarAlt} + ``` + + Previously these fields were populated only when a byline was hydrated as a credit on a content entry, so a page keyed on the byline itself — `/authors/` and the like — held a bare media id with no public API to turn it into a URL. Nothing else changes: the lookup still costs one query (the avatar is a `LEFT JOIN`, not a second round trip), and `findMany` still skips the join, so byline list pages are unaffected. + +- [#2886](https://github.com/emdash-cms/emdash/pull/2886) [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes unpublishing content resetting its publication date. Previously published drafts keep their date visible and editable in the admin, and republishing them without a date override reuses it. + +- [#2931](https://github.com/emdash-cms/emdash/pull/2931) [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Fixes the editor image settings panel overflowing at narrow widths and aligns its fields, help, and actions with the standard editor sidebar. + + Changing image alignment or text preserves the existing display size. Reset clears custom dimensions, constrained editor images retain their aspect ratio, floated images stay visible, and None and Center have distinct positions. + + Preserves image alignment through the exported Portable Text converters. Image settings offer None, Left, Center, and Right; existing imported Wide and Full values and public theme hooks are retained. + +- [#2945](https://github.com/emdash-cms/emdash/pull/2945) [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7) Thanks [@emdashbot](https://github.com/apps/emdashbot)! - Chrome subsystems (site settings, menus, taxonomies and widget areas) now invalidate the Workers edge cache when mutated through the admin API, and public read helpers gained additive `*WithCacheHint` variants that return page-level cache hints. Stable invalidation tags are `emdash:settings`, `emdash:menu:`, `emdash:taxonomy:` and `emdash:widget-area:`. + +- [#2822](https://github.com/emdash-cms/emdash/pull/2822) [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658) Thanks [@jcheese1](https://github.com/jcheese1)! - Fixes `getEmDashCollection()` and `getEmDashEntry()` returning SQLite-backed boolean fields as `0` or `1`. Boolean fields now return `true` or `false`, matching their generated TypeScript types, while integer fields retain numeric values. + +- [#2936](https://github.com/emdash-cms/emdash/pull/2936) [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e) Thanks [@emdashbot](https://github.com/apps/emdashbot)! - Regenerate `emdash-env.d.ts` immediately when the schema changes during `astro dev`, so newly added fields and collections are available in types without reloading the dev server. + +- [#2925](https://github.com/emdash-cms/emdash/pull/2925) [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9) Thanks [@emdashbot](https://github.com/apps/emdashbot)! - Fixes the OpenAPI document for content taxonomy terms so it matches the shipped route. The documented `PUT /_emdash/api/content/{collection}/{id}/terms` path has been removed; use `GET` or `POST /_emdash/api/content/{collection}/{id}/terms/{taxonomy}` instead. The `taxonomy` path parameter is required, and `POST` validates that every term id belongs to that taxonomy. + +- [#2900](https://github.com/emdash-cms/emdash/pull/2900) [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Fixes Cloudflare development servers failing during cold start with Astro 7.3.1 after Vite discovers `astro/logger/console` and invalidates prebundled server chunks. + +- [#2921](https://github.com/emdash-cms/emdash/pull/2921) [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34) Thanks [@emdashbot](https://github.com/apps/emdashbot)! - Fixes the inline Portable Text editor failing to hydrate in development when visual editing is enabled. The editor's code-block extension loads lowlight, which default-imports a CommonJS highlight.js module. The Vite client optimizer now pre-bundles `lowlight`, `highlight.js`, and `highlight.js/lib/core` so the deep CJS import is wrapped with ESM interop before it reaches the browser. + +- [#2910](https://github.com/emdash-cms/emdash/pull/2910) [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0) Thanks [@MA2153](https://github.com/MA2153)! - Fixes media-usage cleanup reading the entire backlog on every run instead of only the rows it cleans, which made the scheduled cleanup task steadily more expensive as a site's backlog grew. + +- [#1645](https://github.com/emdash-cms/emdash/pull/1645) [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118) Thanks [@mvanhorn](https://github.com/mvanhorn)! - Fixes admin manifest field mapping so database-backed collections expose field IDs, widget hints, selected validation, SEO flags, and URL patterns with matching public types. + +- [#2937](https://github.com/emdash-cms/emdash/pull/2937) [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes Cloudflare Workers requests hanging indefinitely after another request is cancelled while the object cache backend is loading. A timed-out request now bypasses the cache and loads the requested data directly, while later requests can initialize the cache again. + +- [#2812](https://github.com/emdash-cms/emdash/pull/2812) [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74) Thanks [@iNerdStack](https://github.com/iNerdStack)! - Adds an `includeCounts` option to `getTerm()`, matching `getTaxonomyTerms()`. Pass `includeCounts: false` to get a term's label, slug and children without its entry count, which skips the aggregate over the taxonomy's assignments. Counts are still included by default. The built-in category and tag archive pages, which render only the label, opt out. + +- [#2745](https://github.com/emdash-cms/emdash/pull/2745) [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `PasskeyConfig.userVerification` so sites can require, prefer, or discourage passkey user verification. Existing callers keep the `preferred` behavior. + + Adds typed, versioned challenge contexts for registration and authentication. Declare a codec with `defineChallengeContext()`, bind data with `bindChallengeContext()` when generating options, and pass the codec with an `AtomicChallengeStore` to `verifyAuthenticationResponse()` or `verifyRegistrationResponse()` to recover the typed value after verification. + + Atomic challenge stores declare `readonly atomic: true`, so an unrelated `consume()` method on an existing challenge store cannot silently change its behavior. EmDash retains optional challenge context data in its database-backed challenge store. + + Authentication rejects assertions whose signature counter drops from a nonzero value to zero because the counter change can indicate a cloned authenticator. + +- [#2699](https://github.com/emdash-cms/emdash/pull/2699) [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd) Thanks [@hossein-webdev](https://github.com/hossein-webdev)! - Fixes plugin storage cursor pagination returning duplicate rows and skipping others whenever `query()` is called with `orderBy`. The cursor stepped through the `created_at` column while the results were sorted by the requested `data` field, so the two disagreed: paging newest-first re-returned page one and never reached older rows, and paging ascending broke too whenever the sort field did not happen to match insertion order. Pages now seek on the same expression they are sorted by, and `id` is appended as a tiebreaker so a page boundary cannot fall inside a group of equal sort values. + + Documents that omit the sorted field are also paged correctly now. A missing key extracts as NULL, which made every comparison against it UNKNOWN and dropped those rows from later pages. NULLs are given an explicit position in the sort — last when ascending, first when descending — so they land in the same place on SQLite and Postgres instead of following each dialect's own default, and they page through like any other value. If you relied on the previous per-dialect NULL placement for a collection whose documents omit an indexed field, the order of those rows changes. + + Paginating with a cursor while sorting several fields in different directions now throws `StorageQueryError` instead of silently returning wrong pages. Sort every field the same way, or read the collection without a cursor. + +- [#2939](https://github.com/emdash-cms/emdash/pull/2939) [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes the admin rich-text editor replacing payload-less custom blocks with an `[Unknown block type: …]` paragraph during autosave. Custom blocks, existing block and span keys, supported marks, and link definitions survive editor round trips, and the editor does not save a synthetic trailing paragraph. + + Applications using the exported converters can pass `{ preserveIdentity: true }` to `portableTextToProsemirror()` and add `portableTextIdentityExtensions` to their TipTap schema for the same lossless behavior. The default conversion remains compatible with standard ProseMirror schemas. + +- [#2830](https://github.com/emdash-cms/emdash/pull/2830) [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Fixes image fields and Portable Text editors so they preserve direct image URLs and external provider identities, allowing selected images to continue rendering after saving or replacement. + +- [#2935](https://github.com/emdash-cms/emdash/pull/2935) [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes PostgreSQL deployments crashing when an idle pooled connection fails. EmDash now logs the idle-client error without exposing connection credentials while node-postgres discards the failed client and keeps the pool available. + + The `postgres()` adapter's `pool` option also accepts `connectionTimeoutMillis` and `idleTimeoutMillis`. Set `connectionTimeoutMillis` to bound how long a request waits for a connection when PostgreSQL is unreachable. Both options remain unset by default, preserving node-postgres's existing timeout behavior. + +- [#2858](https://github.com/emdash-cms/emdash/pull/2858) [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes sandboxed `content:beforeSave` hooks being unable to reject content creation or updates. + + Return a version 1 sandbox hook result with a `SAVE_REJECTED` error to stop the save and show the reason to the editor: + + ```ts + return { + __emdashSandboxHookResult: true, + version: 1, + error: { + code: "SAVE_REJECTED", + reason: "Add a title before saving.", + }, + }; + ``` + + The reason must contain 1–500 characters of plain text. Invalid error results and unexpected sandbox exceptions stop the save with a generic hook error instead of exposing internal details. + +- [#2913](https://github.com/emdash-cms/emdash/pull/2913) [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513) Thanks [@htdtkshi](https://github.com/htdtkshi)! - Fixes `content.schedule()` and content updates so offset dates are stored as canonical UTC ISO 8601 timestamps. Positive and negative offsets now publish at the represented instant instead of several hours late or early. + +- [#2890](https://github.com/emdash-cms/emdash/pull/2890) [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8) Thanks [@MA2153](https://github.com/MA2153)! - Fixes scheduled publishing so its recurring check no longer reads every content entry on each run. Sites running the scheduler on a frequent cron trigger, as the Cloudflare deployment guide recommends, previously saw database reads grow with the size of their content library rather than with the amount of scheduled work — a cost that is directly billable on D1 and was paid even when nothing was scheduled. Existing sites pick up the fix when migrations run on upgrade; no configuration or code changes are needed. + +- [#2581](https://github.com/emdash-cms/emdash/pull/2581) [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded) Thanks [@emdashbot](https://github.com/apps/emdashbot)! - Fixes `PUT /_emdash/api/schema/collections/{slug}` so `titleField` and `dateField` are no longer silently dropped from the request body. Both fields are now validated, persisted, and returned in the collection response, restoring parity with `UpdateCollectionInput` and the in-process `SchemaRegistry` path. + +- [#2891](https://github.com/emdash-cms/emdash/pull/2891) [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0) Thanks [@khoinguyenpham04](https://github.com/khoinguyenpham04)! - Updates the content editor's Publish section so authors can distinguish the live version from draft changes and choose immediate or scheduled publishing from one contextual action menu. + + Publishing dates and schedules display in the browser's local time zone while stored timestamp values remain unchanged. + + Schedule and unschedule responses now return the current revision token so subsequent editor saves retain optimistic-concurrency protection. + +- [#2884](https://github.com/emdash-cms/emdash/pull/2884) [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0) Thanks [@MA2153](https://github.com/MA2153)! - Fixes the OpenAPI description for `GET /_emdash/api/taxonomies/{name}`, which said that omitting `locale` returns the lowest-locale definition. The endpoint returns the configured default locale's definition and only falls back to the lowest locale code when the default locale has none. Behavior is unchanged; only the generated API description was wrong. + +- [#2875](https://github.com/emdash-cms/emdash/pull/2875) [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975) Thanks [@danielmlr](https://github.com/danielmlr)! - Fixes Cloudflare D1 sites that could never finish migrating after migration 017 was interrupted. Every retry failed with `table "_emdash_authorization_codes" already exists`; the migration now skips the statements that already ran. + +- [#2807](https://github.com/emdash-cms/emdash/pull/2807) [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36) Thanks [@LeanderG](https://github.com/LeanderG)! - Fixes the admin Trash tab on multilingual sites, where it listed trashed entries from every locale regardless of the locale picker. Trash now follows the same locale filter as the All tab and shows a Locale column, so switching locales narrows the trash to that locale's entries. + + `GET /_emdash/api/content/{collection}/trash` accepts an optional `locale` query parameter to scope the listing, and each item in the response now carries `locale` and `translationGroup`. Omitting `locale` still returns every locale, so existing API callers are unaffected. + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`de8b03a`](https://github.com/emdash-cms/emdash/commit/de8b03a47330341f9e6d0c397f312fca27fba0ae), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`529b28b`](https://github.com/emdash-cms/emdash/commit/529b28bd1c0e4257eaa4436721b110beb09d5ba3), [`52fffdc`](https://github.com/emdash-cms/emdash/commit/52fffdc3556396f48a5320a0213da1a03337f642), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`85f8b5a`](https://github.com/emdash-cms/emdash/commit/85f8b5a4322de83a89607bb7718e727f11e4d9b7), [`8fb13cf`](https://github.com/emdash-cms/emdash/commit/8fb13cf7a6bdabab8e9a4288c685be4715febd63), [`096cd91`](https://github.com/emdash-cms/emdash/commit/096cd91299629467b0cd5ee24829da17b0d3d624), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`7887577`](https://github.com/emdash-cms/emdash/commit/788757761732ca691d73f7f8c99e7d3d66bf9dec), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`9a66ff0`](https://github.com/emdash-cms/emdash/commit/9a66ff0bdec007c5161407720a40b718248fce82), [`87c7884`](https://github.com/emdash-cms/emdash/commit/87c7884a9bc42efecdea687fc0a58aa71b2ecc4d), [`5f9eb67`](https://github.com/emdash-cms/emdash/commit/5f9eb67440cf89ec473d608e99d8b19272a20e96), [`8fb13cf`](https://github.com/emdash-cms/emdash/commit/8fb13cf7a6bdabab8e9a4288c685be4715febd63), [`d267a2c`](https://github.com/emdash-cms/emdash/commit/d267a2c7f6f33b64cde8e4acc723b6ee7779c444), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`afa81c5`](https://github.com/emdash-cms/emdash/commit/afa81c5e847f1492f7b5eba134d97d0bbbb3aed7), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`b2da4f2`](https://github.com/emdash-cms/emdash/commit/b2da4f2973539055d1fa79157adc3414a5b46546), [`8fb13cf`](https://github.com/emdash-cms/emdash/commit/8fb13cf7a6bdabab8e9a4288c685be4715febd63), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145), [`8efac35`](https://github.com/emdash-cms/emdash/commit/8efac3583310d81a711a6333d7a9113c2d5c008f), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - @emdash-cms/admin@0.37.0 + - @emdash-cms/auth@0.37.0 + - @emdash-cms/plugin-types@0.3.1 + - @emdash-cms/registry-client@0.5.0 + - @emdash-cms/registry-verification@0.3.0 + - @emdash-cms/gutenberg-to-portable-text@0.37.0 + ## 0.36.0 ### Minor Changes diff --git a/packages/core/package.json b/packages/core/package.json index aa287e9514..4d39eb7e50 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "emdash", - "version": "0.36.0", + "version": "0.37.0", "description": "Astro-native CMS with WordPress migration support", "type": "module", "main": "dist/index.mjs", diff --git a/packages/create-emdash/CHANGELOG.md b/packages/create-emdash/CHANGELOG.md index 129af8296a..9f3feac6c3 100644 --- a/packages/create-emdash/CHANGELOG.md +++ b/packages/create-emdash/CHANGELOG.md @@ -1,5 +1,11 @@ # create-emdash +## 0.37.0 + +### Patch Changes + +- [#2627](https://github.com/emdash-cms/emdash/pull/2627) [`c841796`](https://github.com/emdash-cms/emdash/commit/c841796f90765ac1ebce72f8df42ae33a3a136ca) Thanks [@scottbuscemi](https://github.com/scottbuscemi)! - Fixes `create-emdash --install` failing for Cloudflare templates whose Wrangler version requires `@cloudflare/workers-types` 5. Package-manager output is streamed; any remaining install failure keeps the generated files, prints a retry command, and exits nonzero. + ## 0.36.0 ## 0.35.0 diff --git a/packages/create-emdash/package.json b/packages/create-emdash/package.json index 085c4d2fcd..2e87aa99cc 100644 --- a/packages/create-emdash/package.json +++ b/packages/create-emdash/package.json @@ -1,6 +1,6 @@ { "name": "create-emdash", - "version": "0.36.0", + "version": "0.37.0", "description": "Create a new EmDash CMS project", "type": "module", "bin": "./dist/index.mjs", diff --git a/packages/gutenberg-to-portable-text/CHANGELOG.md b/packages/gutenberg-to-portable-text/CHANGELOG.md index 926bc902e5..c2f13f6a50 100644 --- a/packages/gutenberg-to-portable-text/CHANGELOG.md +++ b/packages/gutenberg-to-portable-text/CHANGELOG.md @@ -1,5 +1,7 @@ # @emdash-cms/gutenberg-to-portable-text +## 0.37.0 + ## 0.36.0 ## 0.35.0 diff --git a/packages/gutenberg-to-portable-text/package.json b/packages/gutenberg-to-portable-text/package.json index b57d06ff1a..536f4d48cd 100644 --- a/packages/gutenberg-to-portable-text/package.json +++ b/packages/gutenberg-to-portable-text/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/gutenberg-to-portable-text", - "version": "0.36.0", + "version": "0.37.0", "description": "Convert WordPress Gutenberg blocks to Portable Text", "type": "module", "main": "dist/index.mjs", diff --git a/packages/plugin-cli/CHANGELOG.md b/packages/plugin-cli/CHANGELOG.md index 3684f31672..16cdfda3c5 100644 --- a/packages/plugin-cli/CHANGELOG.md +++ b/packages/plugin-cli/CHANGELOG.md @@ -1,5 +1,49 @@ # @emdash-cms/registry-cli +## 0.10.0 + +### Minor Changes + +- [#2892](https://github.com/emdash-cms/emdash/pull/2892) [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds interactive package-profile setup for delegated plugin releases. `emdash-plugin release setup` now creates a missing profile or adds delegated-release settings to an existing valid profile before writing the GitHub Actions workflow. Run `emdash-plugin profile setup` to prepare only the profile. + + Interactive setup asks for the GitHub repository when it is absent from `emdash-plugin.jsonc`, lets you choose when releases require approval, and confirms the profile write. Non-interactive callers must pass `--yes` when a profile change is required. + + The release service returns `PACKAGE_PROFILE_REQUIRED` before accepting artifact uploads when the signed profile is missing, lacks delegated-release settings, or names a different GitHub repository. Existing release intents also terminate with an actionable reason if their authoritative profile becomes invalid. + +- [#2747](https://github.com/emdash-cms/emdash/pull/2747) [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds typed clients for the experimental delegated release service. `ReleaseServiceClient` submits, polls, and cancels GitHub OpenID Connect release intents; manages publisher workload policies and retained delegation; and lets publishers check whether profile-listed approvers have an active passkey and inspect publisher-scoped audit events through a publisher session. `ReleaseServiceOperatorClient` exposes the Cloudflare Access status and sanitized audit, sharded publisher and approver inventory, pause, suspension, revocation, cancellation, reconciliation, resumable encryption-key rotation, Workflow-backed fleet verification, audited key retirement, encrypted R2 archive, and fail-safe publisher restore and abort operations. + + `ReleaseServiceClient` can request, poll, list, and confirm GitHub workflow connections. The first permanent release run records GitHub's signed repository, workflow, ref, and environment as a pending request and returns a browser approval URL. The publisher must confirm those details before the service creates a workload policy. Tag-based connections can cover the current tag or all version tags while keeping the repository and workflow path exact. + + Both clients validate response envelopes and return stable `ReleaseServiceError` codes with retry metadata. Mutation helpers require idempotency keys, and workload polling requests a fresh token from the configured provider for each call. + + The plugin CLI adds `emdash-plugin release dry-run`, `release submit`, `release status`, and `release cancel` for GitHub Actions jobs. The first `release submit` requests browser approval for the permanent workflow and waits for confirmation before creating an intent. Dry-run verifies existing workload admission without creating a connection request, intent, consuming rate budget, or reserving a version. The commands request audience-bound OIDC tokens from the runner, support JSON output, and use the GitHub run identity as the default idempotency key where a mutation occurs. + + Delegated submissions use a URL-source release record: each package or listing-image artifact supplies a checksum-bound HTTPS URL and no blob. The service stages and uploads those bytes through the publisher's delegation, then creates a blob-only release record. Submit and dry-run reject mixed or blob-backed source inputs before requesting GitHub OIDC. + + Interactive `release delegate`, `revoke`, `workload`, `enrol`, `approve`, and `reject` commands print validated browser handoffs. Publisher application sessions, OAuth credentials, and passkey assertions remain at the release-service origin instead of entering the terminal process. + +- [#2749](https://github.com/emdash-cms/emdash/pull/2749) [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `emdash-plugin release setup` to create the permanent GitHub Actions workflow for delegated plugin releases. The generated workflow builds and attests the plugin, waits for first-run browser authorization, and uploads its exact bundle and provenance through GitHub OIDC before publishing. + + `ReleaseServiceClient.uploadReleaseArtifact()` supports custom workflows that need to stage checksum-bound bundle, image, or provenance bytes. Existing URL-source `release submit` workflows remain supported. + +### Patch Changes + +- [#2864](https://github.com/emdash-cms/emdash/pull/2864) [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636) Thanks [@camc314](https://github.com/camc314)! - Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules. + +- [#2743](https://github.com/emdash-cms/emdash/pull/2743) [`d99a0e8`](https://github.com/emdash-cms/emdash/commit/d99a0e835628edca896e304700746707e1bf56e7) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes saved OAuth sessions failing to refresh or revoke after the original loopback callback server closes. New logins retain the loopback client registration needed to recreate the same OAuth client. + + Sessions created before this fix do not contain that registration metadata and cannot be resumed. Sign in again after upgrading. + +- [#2894](https://github.com/emdash-cms/emdash/pull/2894) [`3b106f6`](https://github.com/emdash-cms/emdash/commit/3b106f6f87e24a665ecd9007e4001905700b1554) Thanks [@ascorbic](https://github.com/ascorbic)! - Updates `emdash-plugin release setup` to generate workflows that use the hosted release service at `https://releases.emdashcms.com`. + +- [#2848](https://github.com/emdash-cms/emdash/pull/2848) [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds publisher-created workflow connection invitations to delegated releases. First-time or unmatched GitHub workflows must use a package-bound, single-use invitation before they can request publisher approval; connected workflows continue without one. + + Create the invitation in the publisher dashboard or with `createWorkflowConnectionInvitation()`, then save its value as the repository's `EMDASH_CONNECTION_INVITATION` GitHub Actions secret. The generated release workflow passes this secret to the release Action automatically. Custom workflows can pass `invitationToken` to `requestWorkflowConnection()`, and publishers can reject pending requests with `rejectWorkflowConnection()`. + +- Updated dependencies [[`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92), [`52fffdc`](https://github.com/emdash-cms/emdash/commit/52fffdc3556396f48a5320a0213da1a03337f642), [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3), [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243), [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - @emdash-cms/plugin-types@0.3.1 + - @emdash-cms/registry-client@0.5.0 + ## 0.9.0 ### Minor Changes diff --git a/packages/plugin-cli/package.json b/packages/plugin-cli/package.json index 8d65290833..51e0bdd722 100644 --- a/packages/plugin-cli/package.json +++ b/packages/plugin-cli/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/plugin-cli", - "version": "0.9.0", + "version": "0.10.0", "description": "CLI for authoring, building, and publishing EmDash plugins. Covers init / build / dev / bundle / publish plus registry search and identity. Atproto OAuth, FAIR-shaped records, sandboxed-plugin-only.", "type": "module", "main": "dist/api.mjs", diff --git a/packages/plugin-types/CHANGELOG.md b/packages/plugin-types/CHANGELOG.md index b8281069bf..acbd88fabf 100644 --- a/packages/plugin-types/CHANGELOG.md +++ b/packages/plugin-types/CHANGELOG.md @@ -1,5 +1,11 @@ # @emdash-cms/plugin-types +## 0.3.1 + +### Patch Changes + +- [#2864](https://github.com/emdash-cms/emdash/pull/2864) [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636) Thanks [@camc314](https://github.com/camc314)! - Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules. + ## 0.3.0 ### Minor Changes diff --git a/packages/plugin-types/package.json b/packages/plugin-types/package.json index 4790a563fd..1de4c214ed 100644 --- a/packages/plugin-types/package.json +++ b/packages/plugin-types/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/plugin-types", - "version": "0.3.0", + "version": "0.3.1", "description": "Shared TypeScript types for the EmDash plugin manifest contract: capability vocabulary, manifest shape, hook/route entry types. Consumed by core (manifest reader at install/runtime) and plugin-cli (manifest writer at bundle/publish time).", "type": "module", "main": "dist/index.js", diff --git a/packages/plugins/audit-log/CHANGELOG.md b/packages/plugins/audit-log/CHANGELOG.md index 1e59c4b490..aef5e6afdd 100644 --- a/packages/plugins/audit-log/CHANGELOG.md +++ b/packages/plugins/audit-log/CHANGELOG.md @@ -1,5 +1,13 @@ # @emdash-cms/plugin-audit-log +## 0.2.1 + +### Patch Changes + +- [#2897](https://github.com/emdash-cms/emdash/pull/2897) [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes the audit log never recording media uploads or the previous state of updated content. The plugin declared only `content:read`, so EmDash skipped its `content:beforeSave` and `media:afterUpload` hooks and logged `[hooks] Plugin "audit-log" declares content:beforeSave hook without content:write capability — skipping` on every boot. + + The manifest now also declares `content:write` and `media:read`. EmDash requires `content:write` from any plugin that registers a `content:beforeSave` hook, because such a hook can rewrite the draft; the audit log returns the draft unchanged and only reads the stored item to record a before/after diff. Sites that installed the plugin from the marketplace are asked to approve the new capabilities when they update it. Recording the previous state of an update also needs an EmDash release that includes the item ID in the `content:beforeSave` event; on earlier EmDash releases the update entry is recorded without the previous state. + ## 0.2.0 ### Minor Changes diff --git a/packages/plugins/audit-log/package.json b/packages/plugins/audit-log/package.json index b2443b2d5f..cedce921fd 100644 --- a/packages/plugins/audit-log/package.json +++ b/packages/plugins/audit-log/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/plugin-audit-log", - "version": "0.2.0", + "version": "0.2.1", "description": "Audit logging plugin for EmDash CMS - tracks content changes", "type": "module", "main": "dist/index.mjs", diff --git a/packages/plugins/embeds/CHANGELOG.md b/packages/plugins/embeds/CHANGELOG.md index 2a84e70fca..c6f459fa02 100644 --- a/packages/plugins/embeds/CHANGELOG.md +++ b/packages/plugins/embeds/CHANGELOG.md @@ -1,5 +1,14 @@ # @emdash-cms/plugin-embeds +## 0.1.45 + +### Patch Changes + +- [#2864](https://github.com/emdash-cms/emdash/pull/2864) [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636) Thanks [@camc314](https://github.com/camc314)! - Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules. + +- Updated dependencies []: + - @emdash-cms/blocks@0.37.0 + ## 0.1.44 ### Patch Changes diff --git a/packages/plugins/embeds/package.json b/packages/plugins/embeds/package.json index d6d464c3f6..51cf55a53e 100644 --- a/packages/plugins/embeds/package.json +++ b/packages/plugins/embeds/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/plugin-embeds", - "version": "0.1.44", + "version": "0.1.45", "description": "Embed blocks for EmDash CMS - YouTube, Vimeo, Twitter, Bluesky, Mastodon, and more", "type": "module", "main": "src/index.ts", diff --git a/packages/plugins/forms/CHANGELOG.md b/packages/plugins/forms/CHANGELOG.md index f1f105d8b8..7f48e2ee2c 100644 --- a/packages/plugins/forms/CHANGELOG.md +++ b/packages/plugins/forms/CHANGELOG.md @@ -1,5 +1,11 @@ # @emdash-cms/plugin-forms +## 0.2.6 + +### Patch Changes + +- [#2864](https://github.com/emdash-cms/emdash/pull/2864) [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636) Thanks [@camc314](https://github.com/camc314)! - Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules. + ## 0.2.5 ### Patch Changes diff --git a/packages/plugins/forms/package.json b/packages/plugins/forms/package.json index c9506f9a71..6409b20b3b 100644 --- a/packages/plugins/forms/package.json +++ b/packages/plugins/forms/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/plugin-forms", - "version": "0.2.5", + "version": "0.2.6", "description": "Forms plugin for EmDash CMS - build forms, collect submissions, send notifications", "type": "module", "main": "src/index.ts", diff --git a/packages/registry-client/CHANGELOG.md b/packages/registry-client/CHANGELOG.md index 81ffb9ee3e..79e260156a 100644 --- a/packages/registry-client/CHANGELOG.md +++ b/packages/registry-client/CHANGELOG.md @@ -1,5 +1,68 @@ # @emdash-cms/registry-client +## 0.5.0 + +### Minor Changes + +- [#2892](https://github.com/emdash-cms/emdash/pull/2892) [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds interactive package-profile setup for delegated plugin releases. `emdash-plugin release setup` now creates a missing profile or adds delegated-release settings to an existing valid profile before writing the GitHub Actions workflow. Run `emdash-plugin profile setup` to prepare only the profile. + + Interactive setup asks for the GitHub repository when it is absent from `emdash-plugin.jsonc`, lets you choose when releases require approval, and confirms the profile write. Non-interactive callers must pass `--yes` when a profile change is required. + + The release service returns `PACKAGE_PROFILE_REQUIRED` before accepting artifact uploads when the signed profile is missing, lacks delegated-release settings, or names a different GitHub repository. Existing release intents also terminate with an actionable reason if their authoritative profile becomes invalid. + +- [#2849](https://github.com/emdash-cms/emdash/pull/2849) [`52fffdc`](https://github.com/emdash-cms/emdash/commit/52fffdc3556396f48a5320a0213da1a03337f642) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `DirectPdsClient.getPackageRepository()` for reading a package profile and every package release from one proof-verified AT Protocol repository export. + + Use the method when authorization or version selection requires a complete signed package snapshot: + + ```ts + const { profile, releases } = + await directPdsClient.getPackageRepository("gallery"); + ``` + + The client verifies the repository commit signature, record blocks, and complete Merkle search tree before returning records. Unsigned `repo.getRecord` and `repo.listRecords` envelopes cannot substitute or omit package data. Repository exports use the client's `maxResponseBytes` limit, which defaults to 5 MiB, and a missing export reports `REPOSITORY_NOT_FOUND`. + +- [#2747](https://github.com/emdash-cms/emdash/pull/2747) [`3b124f2`](https://github.com/emdash-cms/emdash/commit/3b124f23126fead8884884b9f3d53e3be5d41bd3) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds typed clients for the experimental delegated release service. `ReleaseServiceClient` submits, polls, and cancels GitHub OpenID Connect release intents; manages publisher workload policies and retained delegation; and lets publishers check whether profile-listed approvers have an active passkey and inspect publisher-scoped audit events through a publisher session. `ReleaseServiceOperatorClient` exposes the Cloudflare Access status and sanitized audit, sharded publisher and approver inventory, pause, suspension, revocation, cancellation, reconciliation, resumable encryption-key rotation, Workflow-backed fleet verification, audited key retirement, encrypted R2 archive, and fail-safe publisher restore and abort operations. + + `ReleaseServiceClient` can request, poll, list, and confirm GitHub workflow connections. The first permanent release run records GitHub's signed repository, workflow, ref, and environment as a pending request and returns a browser approval URL. The publisher must confirm those details before the service creates a workload policy. Tag-based connections can cover the current tag or all version tags while keeping the repository and workflow path exact. + + Both clients validate response envelopes and return stable `ReleaseServiceError` codes with retry metadata. Mutation helpers require idempotency keys, and workload polling requests a fresh token from the configured provider for each call. + + The plugin CLI adds `emdash-plugin release dry-run`, `release submit`, `release status`, and `release cancel` for GitHub Actions jobs. The first `release submit` requests browser approval for the permanent workflow and waits for confirmation before creating an intent. Dry-run verifies existing workload admission without creating a connection request, intent, consuming rate budget, or reserving a version. The commands request audience-bound OIDC tokens from the runner, support JSON output, and use the GitHub run identity as the default idempotency key where a mutation occurs. + + Delegated submissions use a URL-source release record: each package or listing-image artifact supplies a checksum-bound HTTPS URL and no blob. The service stages and uploads those bytes through the publisher's delegation, then creates a blob-only release record. Submit and dry-run reject mixed or blob-backed source inputs before requesting GitHub OIDC. + + Interactive `release delegate`, `revoke`, `workload`, `enrol`, `approve`, and `reject` commands print validated browser handoffs. Publisher application sessions, OAuth credentials, and passkey assertions remain at the release-service origin instead of entering the terminal process. + +- [#2749](https://github.com/emdash-cms/emdash/pull/2749) [`920e1f3`](https://github.com/emdash-cms/emdash/commit/920e1f3fe6a7c7bf725c85e26f81e588e1201243) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `emdash-plugin release setup` to create the permanent GitHub Actions workflow for delegated plugin releases. The generated workflow builds and attests the plugin, waits for first-run browser authorization, and uploads its exact bundle and provenance through GitHub OIDC before publishing. + + `ReleaseServiceClient.uploadReleaseArtifact()` supports custom workflows that need to stage checksum-bound bundle, image, or provenance bytes. Existing URL-source `release submit` workflows remain supported. + +- [#2848](https://github.com/emdash-cms/emdash/pull/2848) [`e0e60ba`](https://github.com/emdash-cms/emdash/commit/e0e60ba17b93d2022411afb8a3187c08e5142c18) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds publisher-created workflow connection invitations to delegated releases. First-time or unmatched GitHub workflows must use a package-bound, single-use invitation before they can request publisher approval; connected workflows continue without one. + + Create the invitation in the publisher dashboard or with `createWorkflowConnectionInvitation()`, then save its value as the repository's `EMDASH_CONNECTION_INVITATION` GitHub Actions secret. The generated release workflow passes this secret to the release Action automatically. Custom workflows can pass `invitationToken` to `requestWorkflowConnection()`, and publishers can reject pending requests with `rejectWorkflowConnection()`. + +- [#2746](https://github.com/emdash-cms/emdash/pull/2746) [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `DirectPdsClient` for reading package profiles and releases with AT Protocol repository proofs, and updates experimental decentralized registry installs and updates to verify current signed records directly from the publisher's PDS. + + #### Aggregator record integrity + + Install and update reject aggregator-supplied profile or release metadata whose URI or CID does not match the publisher's signed records. The server returns `AGGREGATOR_RECORD_MISMATCH` before fetching the artifact or requesting consent. + + #### Publisher identity display + + The admin treats handle resolution as an advisory identity signal. It keeps the install button disabled while attempting to resolve the package DID back to a handle, then blocks installation when `resolveDidToHandle()` conclusively returns `"invalid"`. An indeterminate result caused by a network failure, unsupported DID method, or missing handle displays the publisher DID and does not block installation. + + Install and update trust the publisher DID and the signed repository proofs for the profile and release records. A handle is display metadata and is not an authorization or record-integrity input. + + #### Provenance and release policy + + The installer applies the signed profile's release policy, independently fetches and verifies supplied Sigstore/SLSA provenance, and binds moderation labels to the exact profile or release CID. Missing required provenance and any supplied provenance that is unavailable, malformed, mismatched, or unsupported block installation and updates. Artifact checksums, archive paths, bundle limits, manifest identity, and version use the same verification rules as the registry release tooling. + + The verification package also exports `inspectPackageReleaseRecords` for validating signed records and policy before artifact and provenance evidence is available. + + Registry install and update consent now show the exact verified profile and release CIDs, signed publisher policy, and provenance status. Install consent uses permissions and MCP tools read from the verified bundle rather than the aggregator's record copy. + + Install, update, and delegated-release verification require lowercase base32 multibase `sha2-256` multihashes for package artifacts and provenance documents. The plugin CLI already produces this format. The authenticated image-artifact proxy still accepts legacy bare hexadecimal SHA-256 checksums for display-only images. + ## 0.4.0 ### Minor Changes diff --git a/packages/registry-client/package.json b/packages/registry-client/package.json index 5314e66e54..c88feea76f 100644 --- a/packages/registry-client/package.json +++ b/packages/registry-client/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/registry-client", - "version": "0.4.0", + "version": "0.5.0", "description": "Atproto-aware client for the EmDash plugin registry: credential storage, publisher repo operations, and discovery against an aggregator.", "type": "module", "main": "dist/index.js", diff --git a/packages/registry-verification/CHANGELOG.md b/packages/registry-verification/CHANGELOG.md index 14b79867d2..5baceb232e 100644 --- a/packages/registry-verification/CHANGELOG.md +++ b/packages/registry-verification/CHANGELOG.md @@ -1,5 +1,54 @@ # @emdash-cms/registry-verification +## 0.3.0 + +### Minor Changes + +- [#2892](https://github.com/emdash-cms/emdash/pull/2892) [`66aeecd`](https://github.com/emdash-cms/emdash/commit/66aeecd1feded23c2ee607b799500c390a04eb92) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds interactive package-profile setup for delegated plugin releases. `emdash-plugin release setup` now creates a missing profile or adds delegated-release settings to an existing valid profile before writing the GitHub Actions workflow. Run `emdash-plugin profile setup` to prepare only the profile. + + Interactive setup asks for the GitHub repository when it is absent from `emdash-plugin.jsonc`, lets you choose when releases require approval, and confirms the profile write. Non-interactive callers must pass `--yes` when a profile change is required. + + The release service returns `PACKAGE_PROFILE_REQUIRED` before accepting artifact uploads when the signed profile is missing, lacks delegated-release settings, or names a different GitHub repository. Existing release intents also terminate with an actionable reason if their authoritative profile becomes invalid. + +- [#2746](https://github.com/emdash-cms/emdash/pull/2746) [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds optional artifact digest candidates to `GitHubProvenanceVerifier`, allowing callers that compute several supported digest algorithms in one isolated artifact fetch to verify the digest selected by a signed SLSA provenance subject. + + Existing callers can continue passing only `artifactDigest`. Successful results return the candidate that matched the signed subject. + + Fixes `@emdash-cms/registry-verification` when it is rebundled into an Astro Cloudflare application, preventing requests from failing during Worker startup. + + Adds `@emdash-cms/registry-verification/records` for Worker callers that supply an explicit `ProvenanceVerifier`. The runtime-neutral entry does not load the Node-oriented default Sigstore verifier, while the package root keeps the existing default-verifier behavior. + + Fixes `@emdash-cms/registry-verification` when it is rebundled into an Astro Cloudflare application, preventing requests from failing during Worker startup. + +- [#2746](https://github.com/emdash-cms/emdash/pull/2746) [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds `DirectPdsClient` for reading package profiles and releases with AT Protocol repository proofs, and updates experimental decentralized registry installs and updates to verify current signed records directly from the publisher's PDS. + + #### Aggregator record integrity + + Install and update reject aggregator-supplied profile or release metadata whose URI or CID does not match the publisher's signed records. The server returns `AGGREGATOR_RECORD_MISMATCH` before fetching the artifact or requesting consent. + + #### Publisher identity display + + The admin treats handle resolution as an advisory identity signal. It keeps the install button disabled while attempting to resolve the package DID back to a handle, then blocks installation when `resolveDidToHandle()` conclusively returns `"invalid"`. An indeterminate result caused by a network failure, unsupported DID method, or missing handle displays the publisher DID and does not block installation. + + Install and update trust the publisher DID and the signed repository proofs for the profile and release records. A handle is display metadata and is not an authorization or record-integrity input. + + #### Provenance and release policy + + The installer applies the signed profile's release policy, independently fetches and verifies supplied Sigstore/SLSA provenance, and binds moderation labels to the exact profile or release CID. Missing required provenance and any supplied provenance that is unavailable, malformed, mismatched, or unsupported block installation and updates. Artifact checksums, archive paths, bundle limits, manifest identity, and version use the same verification rules as the registry release tooling. + + The verification package also exports `inspectPackageReleaseRecords` for validating signed records and policy before artifact and provenance evidence is available. + + Registry install and update consent now show the exact verified profile and release CIDs, signed publisher policy, and provenance status. Install consent uses permissions and MCP tools read from the verified bundle rather than the aggregator's record copy. + + Install, update, and delegated-release verification require lowercase base32 multibase `sha2-256` multihashes for package artifacts and provenance documents. The plugin CLI already produces this format. The authenticated image-artifact proxy still accepts legacy bare hexadecimal SHA-256 checksums for display-only images. + +### Patch Changes + +- [#2847](https://github.com/emdash-cms/emdash/pull/2847) [`529b28b`](https://github.com/emdash-cms/emdash/commit/529b28bd1c0e4257eaa4436721b110beb09d5ba3) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes delegated-release provenance verification so verified GitHub attestations include the repository, workflow, commit, and run identity needed to enforce an exact authorized workload. + +- Updated dependencies [[`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636)]: + - @emdash-cms/plugin-types@0.3.1 + ## 0.2.0 ### Minor Changes diff --git a/packages/registry-verification/package.json b/packages/registry-verification/package.json index 7eca41ee95..276c71d350 100644 --- a/packages/registry-verification/package.json +++ b/packages/registry-verification/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/registry-verification", - "version": "0.2.0", + "version": "0.3.0", "description": "Runtime-neutral verification primitives for the EmDash plugin registry.", "type": "module", "main": "dist/index.js", diff --git a/packages/workerd/CHANGELOG.md b/packages/workerd/CHANGELOG.md index c07ee64383..8350594f3b 100644 --- a/packages/workerd/CHANGELOG.md +++ b/packages/workerd/CHANGELOG.md @@ -1,5 +1,12 @@ # @emdash-cms/sandbox-workerd +## 0.5.3 + +### Patch Changes + +- Updated dependencies [[`76946e4`](https://github.com/emdash-cms/emdash/commit/76946e491c0ceb0317ebe1a1454d9786fc145bff), [`ad19827`](https://github.com/emdash-cms/emdash/commit/ad1982707e0e51bb16fd53f9328a09cb54bb2922), [`cd294dc`](https://github.com/emdash-cms/emdash/commit/cd294dc4fcbafa6fe6a33692d11b9f9abf1cc45c), [`f622a17`](https://github.com/emdash-cms/emdash/commit/f622a1752b0e7e82a33181af2481f57a52ac9b50), [`b06fc63`](https://github.com/emdash-cms/emdash/commit/b06fc6361a88378a697f8d93f7b7718739dc0ed5), [`595a6b1`](https://github.com/emdash-cms/emdash/commit/595a6b12a11e67b89684bc5f5c14fbb6f0fc5e7f), [`ecdba4d`](https://github.com/emdash-cms/emdash/commit/ecdba4d1338447e1a267a3498764f9a1de2a0636), [`7a5d9c1`](https://github.com/emdash-cms/emdash/commit/7a5d9c1838f6afc5649b7bc0940eacf920b40dab), [`de122b4`](https://github.com/emdash-cms/emdash/commit/de122b4e4b65843312bd393d09601e694ef1dee0), [`6676283`](https://github.com/emdash-cms/emdash/commit/6676283a20babf847c5dcc6692296b606d6b6d55), [`05d5596`](https://github.com/emdash-cms/emdash/commit/05d559625224fbfd23fc08608c44a46ef3735c3e), [`d418b64`](https://github.com/emdash-cms/emdash/commit/d418b64ce8cd88a0b67cd089767ed928820f5dc7), [`60691df`](https://github.com/emdash-cms/emdash/commit/60691dfb7c24e362dcd564897bce352268dab658), [`062e8be`](https://github.com/emdash-cms/emdash/commit/062e8be39847581570f579578c3afd584703b22e), [`b44bc2c`](https://github.com/emdash-cms/emdash/commit/b44bc2cc178d204d75d2b4a19c2b28e13ce240f9), [`9def325`](https://github.com/emdash-cms/emdash/commit/9def3252a991f4b750c2d63effd6a474857cd338), [`67f676d`](https://github.com/emdash-cms/emdash/commit/67f676d1e8209d8885532f0f6114bc3686167d34), [`ebd13f8`](https://github.com/emdash-cms/emdash/commit/ebd13f80d7e125f76f4460d851ef83b383ef28d0), [`8a06cd6`](https://github.com/emdash-cms/emdash/commit/8a06cd66b81d153fcc50c4e261364fc5a6b59118), [`6da29d3`](https://github.com/emdash-cms/emdash/commit/6da29d3e3c2d37e83e5bc92c6958fc652f4a9c42), [`4cc3817`](https://github.com/emdash-cms/emdash/commit/4cc3817526733049ee2d2bb198e8c74c94228162), [`d8910d7`](https://github.com/emdash-cms/emdash/commit/d8910d71a775b1b83a45d410171a179c2962fb74), [`b8873c7`](https://github.com/emdash-cms/emdash/commit/b8873c7bd1b1755010bcb46e4511eebccba2b48a), [`01855cb`](https://github.com/emdash-cms/emdash/commit/01855cb9cb8fd748170e462e391925533b226fcd), [`c81e5e7`](https://github.com/emdash-cms/emdash/commit/c81e5e770e070697b4e06b9994d9ea9e8e1fb5f8), [`965bf33`](https://github.com/emdash-cms/emdash/commit/965bf3303bb71a2444c414585e29960606ae0cbb), [`06499ad`](https://github.com/emdash-cms/emdash/commit/06499ad538adcea6f4a580e0c56235851fd239cf), [`bb8b087`](https://github.com/emdash-cms/emdash/commit/bb8b087c9a79c07336d2cdcadc6cec92428a2b4a), [`980538d`](https://github.com/emdash-cms/emdash/commit/980538d22cc73cd2c45263e10234fbaf66067513), [`30d4076`](https://github.com/emdash-cms/emdash/commit/30d40760ee09faec1c77254d76d021f457e507b8), [`9ccc2e7`](https://github.com/emdash-cms/emdash/commit/9ccc2e7277267032459bd9c1fa39d79d645e7ded), [`98ef920`](https://github.com/emdash-cms/emdash/commit/98ef92055bc7d6e1af644bc62ae207651eda3af0), [`556c9fe`](https://github.com/emdash-cms/emdash/commit/556c9fe0eb9c5ea08cb809e0093b007729e1a8e7), [`2970377`](https://github.com/emdash-cms/emdash/commit/29703779c2476bc8f68c317f54b59b4a0744bfe0), [`37e08b0`](https://github.com/emdash-cms/emdash/commit/37e08b013cbd87fe57963a10c31b64091862f975), [`013156d`](https://github.com/emdash-cms/emdash/commit/013156db5bf7e2ce9ba2734eebf85bd2e72c2c36), [`c7b6fdf`](https://github.com/emdash-cms/emdash/commit/c7b6fdfd1f5dd9a168f5d0f6bfa9b7b9ff343145)]: + - emdash@0.37.0 + ## 0.5.2 ### Patch Changes diff --git a/packages/workerd/package.json b/packages/workerd/package.json index 61dc2b94bd..ac6063bcaa 100644 --- a/packages/workerd/package.json +++ b/packages/workerd/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/sandbox-workerd", - "version": "0.5.2", + "version": "0.5.3", "description": "workerd-based plugin sandbox for EmDash on Node.js", "type": "module", "main": "dist/index.mjs", diff --git a/packages/x402/CHANGELOG.md b/packages/x402/CHANGELOG.md index 990cce2321..9b4029144f 100644 --- a/packages/x402/CHANGELOG.md +++ b/packages/x402/CHANGELOG.md @@ -1,5 +1,7 @@ # @emdash-cms/x402 +## 0.37.0 + ## 0.36.0 ## 0.35.0 diff --git a/packages/x402/package.json b/packages/x402/package.json index ca053626b6..4e2007c16f 100644 --- a/packages/x402/package.json +++ b/packages/x402/package.json @@ -1,6 +1,6 @@ { "name": "@emdash-cms/x402", - "version": "0.36.0", + "version": "0.37.0", "description": "x402 payment protocol integration for Astro sites", "license": "MIT", "repository": {