ci: release

[emdashbot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@emdash-cms/admin@0.11.0

Minor Changes

• #942 7c536e5 Thanks @MA2153! - Adds per-field allowed MIME types for file and image fields. Field-level allowedTypes is now honored end-to-end: it filters the media picker, widens upload acceptance for that field (so e.g. a zip-only field can accept zip uploads even though the global allowlist excludes them), and validates referenced media against the destination field on content save. The schema editor in admin gains an "Allowed types" control with curated presets and freeform entry.

  Behavior change: the image builder's allowedTypes option was previously accepted but read by nothing. It is now load-bearing — a code-first schema that already passed allowedTypes (e.g. ["image/png"]) will now actually narrow the picker and gate uploads. Most users will see no change; if you set this option intending the old (silent) behavior, drop it.

  Behavior change: updating a field via the admin schema editor now explicitly clears its validation when the form contains no validation settings, instead of leaving an existing validation value intact. This only affects fields with pre-existing validation that is not expressible in the editor UI.

• #921 530b013 Thanks @jcheese1! - Adds table support to the PortableText editor. Users can now insert and edit tables via the slash command menu (/table) or toolbar button. Tables support header rows, column/row insertion and deletion, and include a bubble menu for quick editing.

Patch Changes

• #958 7f6b6ea Thanks @ascorbic! - Fixes admin lists, tables and info cards rendering as transparent against the page background. Card containers in the content list, content type list, content type editor, media library, comments, users and device authorization views now have an explicit bg-kumo-base surface so they're visually distinct from the body.

  Also fixes column header labels in content list tables ("Title", "Status", etc.) rendering pale because of an undefined Tailwind class (text-kumo-fg) -- they now use the default text color and rely on the sort indicator icon to signal active state.

• #952 131bea6 Thanks @ascorbic! - Replaces 20 raw <input type="checkbox"> elements across the admin UI with Kumo's Switch and Checkbox components. Single-boolean toggles (SEO, Enable comments, Required, etc.) become Switch; multi-select / list-context checkboxes (collection multi-select, term tree nodes) become Checkbox. Drops manual styling and label markup that duplicated what the Kumo components provide built-in.

• #956 54b5aa1 Thanks @CacheMeOwside! - Fixes broken checkboxes on the comments moderation page (/_emdash/admin/comments). Selecting a comment threw a JavaScript error and did not select the row.

• #934 c630e31 Thanks @ascorbic! - Fixes button and link inconsistencies across the admin UI. Standardises on Kumo's Button icon prop and LinkButton (with external for new-tab links) instead of manual icon spacing and raw anchor styling, removes a <Link><Button> invalid HTML nesting in the plugin manager, and translates two stray English strings in the user list empty state.

• #949 7aa1897 Thanks @ascorbic! - Fixes invalid <a><button> HTML produced by <Link><Button>...</Button></Link> patterns across the admin UI. Introduces a RouterLinkButton component that wraps TanStack Router's <Link> with Kumo button styling (variant, size, shape, icon props), and migrates all existing <Link className={buttonVariants(...)}> usages to use it. Extracts the duplicated "Back to settings" header link into a shared BackToSettingsLink component.

• #940 0b8a319 Thanks @ascorbic! - Fixes the long tail of untranslated English strings in the admin UI: settings panels, marketplace, sandboxed-plugin host, auth flows, taxonomy/menu management, and lib/api fallback messages. After this PR, EmDash admin UI is fully localizable across all known surfaces.

• #957 13ff061 Thanks @ascorbic! - Fixes the OG image picker in the content editor only appearing for collections with a field literally named featured_image. The OG image control now lives in the SEO sidebar panel alongside the other SEO fields, so any collection with seo enabled can set a social preview image regardless of whether it has a featured image field.

• #955 49b66d9 Thanks @ascorbic! - Removes the sticky editor header from content / content-type / section / settings pages. The sticky implementation had transparency artifacts (backdrop-blur over varied content), layout fragility (negative margins canceling parent padding), z-index conflicts with the app bar, and ~85px of permanent vertical chrome. Each editor now renders a Save button at the bottom of the form so users can save without scrolling back to the top header. The distraction-free hover-overlay header in the content editor is preserved.

• #966 1b2fa77 Thanks @ahliweb! - i18n(id): complete Indonesian translation (320 strings)

• #937 af15975 Thanks @ascorbic! - Fixes ~250 untranslated English strings in the admin UI's most-used screens (router toasts, content type editor, widgets, byline and user routes, invite-accept flow, portable text editor toolbar, image and embed editor nodes, user list). All title=, aria-label=, placeholder=, and toast messages in these areas now flow through Lingui.

• #950 a4968c1 Thanks @ascorbic! - Replaces raw <select> and <input type="search"> elements across the admin UI with Kumo's Select and Input components. This gives consistent styling, proper focus rings, accessibility (label association via the Field wrapper), and dark-mode handling for free instead of relying on hand-rolled Tailwind classes that bypassed the design system.

• #973 f80fb58 Thanks @ahliweb! - Translates the remaining untranslated string in the Indonesian locale, bringing it to 100% coverage.

• Updated dependencies []:

  • @emdash-cms/blocks@0.11.0

emdash@0.11.0

Minor Changes

• #978 27e6d58 Thanks @ascorbic! - Enforces the sandboxed plugin bundle size caps from RFC 0001 §"Bundle size limits" in both the bundle and publish CLI flows: total decompressed ≤ 256 KB, per-file decompressed ≤ 128 KB, and at most 20 files per bundle. The previous bundle command capped only the total at 5 MB; the publish command now also re-validates the decompressed tarball before signing the release record so a publisher hits the same cap locally that aggregators enforce at ingest. Bundles between 256 KB and the old 5 MB ceiling will now be rejected — usually a sign the plugin is bundling host-provided dependencies or assets that belong in a CDN rather than the plugin payload.

• #942 7c536e5 Thanks @MA2153! - Adds per-field allowed MIME types for file and image fields. Field-level allowedTypes is now honored end-to-end: it filters the media picker, widens upload acceptance for that field (so e.g. a zip-only field can accept zip uploads even though the global allowlist excludes them), and validates referenced media against the destination field on content save. The schema editor in admin gains an "Allowed types" control with curated presets and freeform entry.

  Behavior change: the image builder's allowedTypes option was previously accepted but read by nothing. It is now load-bearing — a code-first schema that already passed allowedTypes (e.g. ["image/png"]) will now actually narrow the picker and gate uploads. Most users will see no change; if you set this option intending the old (silent) behavior, drop it.

  Behavior change: updating a field via the admin schema editor now explicitly clears its validation when the form contains no validation settings, instead of leaving an existing validation value intact. This only affects fields with pre-existing validation that is not expressible in the editor UI.

Patch Changes

• #893 f8ee1ed Thanks @j-liszt! - Enhances Passkey authentication with polymorphic algorithm support. Adds support for RS256 (RSA) alongside the existing ES256 (ECDSA) implementation, ensuring full compatibility with Windows Hello, hardware security keys, and FIDO2 standards. Includes a database migration to track and persist credential algorithms for future-proof authentication.

  Note for standalone @emdash-cms/auth consumers: If your credentials table already exists, you must manually run ALTER TABLE credentials ADD COLUMN algorithm INTEGER NOT NULL DEFAULT -7 to support this update. The DEFAULT -7 value ensures that existing rows (which are all ES256) continue to work seamlessly without requiring any data backfill.

• #976 4c11017 Thanks @ask-bonk! - Fixes migration 016_api_tokens failing with table "_emdash_api_tokens" already exists after a partially-applied previous attempt. If up() crashed mid-way (D1 subrequest limit, isolate cancellation, transient connection error), the migration record never got recorded and Kysely re-ran the migration from the top on the next request, blocking every subsequent boot. up() now uses IF NOT EXISTS on every CREATE so a retry skips already-applied steps and finishes the remainder. Resolves the "table already exists" error reported on fresh Cloudflare Workers + D1 deploys.

• #939 f1d4c0b Thanks @schiste! - Make the MCP menu write tools locale-aware by exposing locale on menu_create,
  menu_update, menu_delete, and menu_set_items, exposing translationOf on
  menu_create, and teaching handleMenuSetItems() to target the requested locale
  and tag inserted menu items with that menu's locale.

  All seven menu-name lookups (handleMenuUpdate, handleMenuDelete,
  handleMenuSetItems, handleMenuItemCreate, handleMenuItemUpdate,
  handleMenuItemDelete, handleMenuItemReorder) now fail loud with the new
  AMBIGUOUS_LOCALE error code (HTTP 400) when called with a name that exists
  in multiple locales and no locale is provided. Previously the lookup silently
  picked an arbitrary translation, which could rewrite or delete the wrong
  locale's menu on multi-locale installs. The error message lists the available
  locales so callers can recover. Single-locale installs and callers that already
  pass locale are unaffected.

  The translationOf → locale requirement is now enforced inside
  handleMenuCreate (returns VALIDATION_ERROR), so REST/SDK callers get the
  same guard the MCP boundary already provided.

• d273e9a Thanks @ascorbic! - Refactors the plugin manifest types to re-export from @emdash-cms/plugin-types. The capability vocabulary (PluginCapability, CAPABILITY_RENAMES, normalizeCapability, isDeprecatedCapability) and manifest shape (ManifestHookEntry, ManifestRouteEntry, PluginStorageConfig, StorageCollectionConfig) now live in the shared package so the registry CLI can write the same types core reads. Existing imports from emdash's plugin types module continue to work unchanged.

• #943 514d32d Thanks @Rimander! - Fixes seed menu items losing their translation_group across export/apply by adding optional id, locale, and translationOf fields to SeedMenuItem. The export emits stable seed IDs and translationOf references; the apply resolves them to the anchor's translation_group, matching the existing pattern for content entries, taxonomies, and terms.

• #948 8116949 Thanks @ascorbic! - Adds always-on db.* and cache.* Server-Timing fields so render-phase performance is diagnosable in production. Each request now emits db.total (cumulative DB ms), db.count (query count), db.first / db.last (first/last query offset from request start), and cache.hit / cache.miss (request-scoped cache stats). The Kysely log hook is now always installed so counters work without setting EMDASH_QUERY_LOG.

• #946 c4ee7ad Thanks @LeanderG! - Fixes Postgres rate-limit queries by quoting the reserved window column name.

• Updated dependencies [7f6b6ea, 131bea6, f8ee1ed, 54b5aa1, c630e31, 7c536e5, 7aa1897, 943df46, 0b8a319, 13ff061, 49b66d9, 1b2fa77, 530b013, af15975, a4968c1, f80fb58]:

  • @emdash-cms/admin@0.11.0
  • @emdash-cms/auth@0.11.0
  • @emdash-cms/plugin-types@0.0.1
  • @emdash-cms/auth-atproto@0.2.3
  • @emdash-cms/gutenberg-to-portable-text@0.11.0

@emdash-cms/registry-cli@0.1.0

Minor Changes

• #978 27e6d58 Thanks @ascorbic! - Enforces the sandboxed plugin bundle size caps from RFC 0001 §"Bundle size limits" in both the bundle and publish CLI flows: total decompressed ≤ 256 KB, per-file decompressed ≤ 128 KB, and at most 20 files per bundle. The previous bundle command capped only the total at 5 MB; the publish command now also re-validates the decompressed tarball before signing the release record so a publisher hits the same cap locally that aggregators enforce at ingest. Bundles between 256 KB and the old 5 MB ceiling will now be rejected — usually a sign the plugin is bundling host-provided dependencies or assets that belong in a CDN rather than the plugin payload.

Patch Changes

• #929 5464b55 Thanks @ascorbic! - Fixes the CLI hanging indefinitely after a successful login or logout. run() was returning correctly, but something in the OAuth path left a ref'd handle alive that prevented Node's event loop from draining. Workaround: force-exit at the top level once runMain resolves. The underlying handle leak is unidentified.

• #929 5464b55 Thanks @ascorbic! - Switches the login flow to request granular OAuth scopes derived from the @emdash-cms/registry-lexicons lexicon set instead of the broad transition:generic: repo: for every record-shaped lexicon (package profile, package release, publisher profile, publisher verification) and rpc:<nsid>?aud=* for every aggregator query (getLatestRelease, getPackage, listReleases, resolvePackage, searchPackages). Display name resolution no longer goes through com.atproto.server.getSession; the handle is read from the DID document via LocalActorResolver so the CLI doesn't need an rpc:com.atproto.* scope and isn't affected by PDS-side DPoP/Bearer compatibility quirks. If the PDS rejects the granular scopes with invalid_scope, login automatically retries once with transition:generic and prints a notice. Existing sessions continue working with their original scope until they're revoked or re-issued.

• #929 5464b55 Thanks @ascorbic! - Improves login error reporting for OAuth response failures. Previously, transient PDS errors surfaced as a bare unknown_error with a stack trace; the CLI now prints the HTTP status, endpoint, OAuth error code/description, a body snippet when the response wasn't OAuth-shaped JSON, and a hint to retry on 5xx responses.

• #923 943df46 Thanks @ascorbic! - Adds @emdash-cms/registry-cli: standalone CLI for the experimental plugin registry. Subcommands for login, logout, whoami, switch, search, info, bundle, and publish. Atproto OAuth via loopback callback server. The publish flow fetches the tarball from the URL, verifies a sha256 multihash, extracts and validates manifest.json, locally validates each lexicon record, and atomically writes profile + release records (with the EmDash declaredAccess trust extension) via a single atproto applyWrites. Distributes via npx @emdash-cms/registry-cli to keep atproto deps out of the core CMS install.

• Updated dependencies [943df46, 943df46, 5464b55, 943df46]:

  • @emdash-cms/plugin-types@0.0.1
  • @emdash-cms/registry-client@0.0.1
  • @emdash-cms/registry-lexicons@0.1.0

@emdash-cms/registry-lexicons@0.1.0

Minor Changes

• #929 5464b55 Thanks @ascorbic! - Adds RECORD_NSIDS and QUERY_NSIDS const arrays alongside the existing NSID map. They enumerate the record-shaped and query-shaped lexicons in this package so consumers (e.g. tooling that builds OAuth repo: / rpc: scopes) can derive their list from the lexicon set instead of hand-rolling one that drifts.

Patch Changes

• #923 943df46 Thanks @ascorbic! - Adds @emdash-cms/registry-lexicons: generated TypeScript types and runtime validation schemas for the EmDash plugin registry lexicons (com.emdashcms.experimental.*). EXPERIMENTAL — NSIDs and shapes will change while RFC 0001 is in flight; pin to an exact version.

@emdash-cms/auth@0.11.0

Patch Changes

• #893 f8ee1ed Thanks @j-liszt! - Enhances Passkey authentication with polymorphic algorithm support. Adds support for RS256 (RSA) alongside the existing ES256 (ECDSA) implementation, ensuring full compatibility with Windows Hello, hardware security keys, and FIDO2 standards. Includes a database migration to track and persist credential algorithms for future-proof authentication.

  Note for standalone @emdash-cms/auth consumers: If your credentials table already exists, you must manually run ALTER TABLE credentials ADD COLUMN algorithm INTEGER NOT NULL DEFAULT -7 to support this update. The DEFAULT -7 value ensures that existing rows (which are all ES256) continue to work seamlessly without requiring any data backfill.

@emdash-cms/auth-atproto@0.2.3

Patch Changes

• Updated dependencies [f8ee1ed, 27e6d58, 4c11017, f1d4c0b, 7c536e5, d273e9a, 514d32d, 8116949, c4ee7ad]:
  • @emdash-cms/auth@0.11.0
  • emdash@0.11.0

@emdash-cms/cloudflare@0.11.0

Patch Changes

• Updated dependencies [f8ee1ed, 27e6d58, 4c11017, f1d4c0b, 7c536e5, d273e9a, 514d32d, 8116949, c4ee7ad]:
  • emdash@0.11.0

@emdash-cms/plugin-types@0.0.1

Patch Changes

• #923 943df46 Thanks @ascorbic! - Adds @emdash-cms/plugin-types: shared TypeScript types for the EmDash plugin manifest contract — capability vocabulary (PluginCapability, CAPABILITY_RENAMES, isDeprecatedCapability, normalizeCapability), manifest shape (PluginManifest, ManifestHookEntry, ManifestRouteEntry, PluginAdminConfig, PluginStorageConfig). Consumed by both emdash (manifest reader at install/runtime) and @emdash-cms/registry-cli (manifest writer at bundle/publish time). After the registry phase 1 cutover removes the legacy bundling code from core, both sides will continue depending on this single source of truth.

@emdash-cms/plugin-embeds@0.1.11

Patch Changes

• Updated dependencies [f8ee1ed, 27e6d58, 4c11017, f1d4c0b, 7c536e5, d273e9a, 514d32d, 8116949, c4ee7ad]:
  • emdash@0.11.0
  • @emdash-cms/blocks@0.11.0

@emdash-cms/plugin-forms@0.2.2

Patch Changes

• #983 06d5f3f Thanks @ppppangu! - Fix embedded forms so public rendering accepts the API response envelope returned by the form definition route.

• Updated dependencies [f8ee1ed, 27e6d58, 4c11017, f1d4c0b, 7c536e5, d273e9a, 514d32d, 8116949, c4ee7ad]:

  • emdash@0.11.0

@emdash-cms/registry-client@0.0.1

Patch Changes

• #923 943df46 Thanks @ascorbic! - Adds @emdash-cms/registry-client: atproto-aware client for the EmDash plugin registry. Three independent layers — credential storage (filesystem / env-vars / in-memory), publisher repo operations, and discovery against an aggregator. EXPERIMENTAL — pin to an exact version while RFC 0001 is in flight.

• Updated dependencies [5464b55, 943df46]:

  • @emdash-cms/registry-lexicons@0.1.0

@emdash-cms/blocks@0.11.0

create-emdash@0.11.0

@emdash-cms/gutenberg-to-portable-text@0.11.0

@emdash-cms/x402@0.11.0

@emdash-cms/fixture-perf-site@0.0.6

Patch Changes

• Updated dependencies [f8ee1ed, 27e6d58, 4c11017, f1d4c0b, 7c536e5, d273e9a, 514d32d, 8116949, c4ee7ad]:
  • emdash@0.11.0
  • @emdash-cms/cloudflare@0.11.0

@emdash-cms/perf-demo-site@0.0.6

Patch Changes

• Updated dependencies [f8ee1ed, 27e6d58, 06d5f3f, 4c11017, f1d4c0b, 7c536e5, d273e9a, 514d32d, 8116949, c4ee7ad]:
  • emdash@0.11.0
  • @emdash-cms/plugin-forms@0.2.2
  • @emdash-cms/cloudflare@0.11.0

@emdash-cms/cache-demo-site@0.0.6

Patch Changes

• Updated dependencies [f8ee1ed, 27e6d58, 06d5f3f, 4c11017, f1d4c0b, 7c536e5, d273e9a, 514d32d, 8116949, c4ee7ad]:
  • emdash@0.11.0
  • @emdash-cms/plugin-forms@0.2.2
  • @emdash-cms/cloudflare@0.11.0

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-i18n	838c091	May 11 2026, 06:19 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	docs	838c091	May 11 2026, 06:19 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-perf-coordinator	838c091	May 11 2026, 06:19 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	838c091	May 11 2026, 06:21 AM

[github-actions]

Scope check

This PR touches 29 files. PRs with a broad scope are harder to review. Please confirm the scope hasn't drifted beyond the intended change.
This PR spans 5 different areas (area/core, area/admin, area/plugins, area/auth, area/cloudflare). Consider breaking it into smaller, focused PRs.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	838c091	May 11 2026, 06:21 AM

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@925

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@925

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@925

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@925

emdash

npm i https://pkg.pr.new/emdash@925

create-emdash

npm i https://pkg.pr.new/create-emdash@925

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@925

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@925

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@925

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@925

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@925

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@925

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@925

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@925

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@925

commit: 838c091

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat(aggregator): scaffold plugin-registry aggregator #971 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.