[danielmlr]

Design proposal

Proposal: proposals/plugin-unpublish.md

This plan adds an emdash-plugin unpublish command, so a plugin author can take a package out of the registry without deleting records by hand. The command deletes the package profile from the publisher's repository, and the aggregator already hides the package and all of its releases when that happens. Release records stay, so a version number can't be reused and a re-publish needs a new version. Sites that installed the plugin keep their copy.

Only @emdash-cms/plugin-cli changes. The aggregator, lexicons and registry client stay as they are, so this is a feature plan. Versions published before an unpublish stay hidden after a re-publish until an operator backfill brings them back. Changing that would touch the aggregator, so it stays out of this plan.

Proposal type

• Feature plan
• RFC
• Amendment, supersession, or withdrawal

Related work

Discussion: none. @ascorbic asked for this command in #plugin-development on Discord: https://discord.com/channels/1489993220984279303/1489999833954521128/1560991228508774492. Removing an installed plugin from a site with a CLI is a separate idea, #3999.

Readiness

• The proposal identifies its author and, for an RFC, its champion and Maintainer sponsor
• The proposal describes observable behavior, compatibility, failure handling, and verification in proportion to its risk
• Conflicting accepted or pending proposals are reconciled in this pull request (none found)
• This pull request contains no implementation code
• The proposal status is accepted (check only when ready to merge)

AI assistance

• This proposal used AI assistance — model/tool: Claude Opus 5.5 (Claude Code)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9ba037c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://daniel-design-plugin-unpublish.try.emdashcms.com, https://daniel-design-plugin-unpublish-emdash-playground.emdash-cms.workers.dev (commit 9ba037c)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://56334711.try.emdashcms.com, https://56334711-emdash-playground.emdash-cms.workers.dev	9ba037c	2026-10-18T22:40:55.522Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://9b56f690.try.emdashcms.com, https://9b56f690-emdash-playground.emdash-cms.workers.dev	7fa4269	2026-10-17T18:58:08.525Z	Visit the dashboard ↗

[ascorbic]

I was skeptical about just removing the profile, but reading this convinced me. I think this is the right design.

[danielmlr]

@ascorbic I've marked the plan as accepted.
I settled the open question like this: if a plugin is published again after an unpublish, its older versions stay hidden until an operator backfill brings them back, so the aggregator stays unchanged.
One small addition since your comment: when a package had delegated release settings, the hint after unpublishing now names --provenance optional as well as required, because profile setup defaults to required.
Could you approve the PR? Then the implementation can go up right after.