ci: release

[emdashbot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@emdash-cms/admin@0.20.0

Minor Changes

• #1427 acfeb89 Thanks @swissky! - Media details show the file URL with a Copy URL action

  The media library previously exposed no way to obtain a file's URL — the
  detail panel now shows the absolute file URL (relative local-storage paths
  are resolved against the current origin) with a one-click copy button, so
  editors can paste media URLs wherever a URL field is needed.

• #1425 3e344af Thanks @swissky! - Repeater fields support image sub-fields with the media picker (#1424)

  Repeater rows previously rendered every non-scalar sub-field as a plain text
  input, so galleries had to be built from hand-pasted URLs. Image sub-fields
  now render the same media-picker UI as top-level image fields (select,
  preview, change, remove) and store the same MediaValue shape — legacy string
  URLs keep working.

  Includes: image in the schema-builder sub-field type select, the shared
  ImageFieldRenderer extracted out of ContentEditor for reuse, and the
  sub-field type whitelists in core (REPEATER_SUB_FIELD_TYPES + the API Zod
  enum) extended — the Zod enum also gains the previously missing url entry
  that the builder already offered.

Patch Changes

• #1447 141aa11 Thanks @ascorbic! - Fixes @atcute peer dependency warnings on install (#1435)

  Installing EmDash pulled in mismatched @atcute package versions, so pnpm install / npm install reported unmet peer warnings for @atcute/identity and @atcute/lexicons. The bundled @atcute dependencies are now aligned on v2 and installs are clean. If your project also depends on @atcute packages directly, note they have moved to v2 (@atcute/client 5, @atcute/lexicons 2, @atcute/atproto 4, @atcute/oauth-node-client 2).

• #1478 ddf8f0d Thanks @pitscher! - Fixes localization for sections API fallback error messages in the admin UI

• #1473 68840a9 Thanks @pitscher! - Fixes localization for the dashboard API fallback error message in the admin UI

• #1468 eaedec0 Thanks @pitscher! - Fixes localization for the generic dialog error fallback in the admin UI

• #1465 8bb20c4 Thanks @pitscher! - Fixes untranslated MediaPickerModal references for the library

• #1486 fb31240 Thanks @ascorbic! - Adds an avatar image picker to the byline editor. The avatarMediaId field was already part of the byline model and API but had no admin control, so byline avatars could only be set programmatically, and editing a byline through the UI cleared any avatar that had been set. You can now choose, change, and remove a byline's avatar from the editor.

• #1476 022fd66 Thanks @pitscher! - Fixes localization for search API fallback error messages in the admin UI

• #1454 5d8358b Thanks @pitscher! - Fixes untranslated ContentTypeEditor form text to let it be translatable

• #1499 ce96271 Thanks @swissky! - Capitalize German status labels (published, scheduled, archived, pending) in the admin UI. As standalone badge labels these are nouns and should follow German capitalization (e.g. "publiziert" → "Publiziert"), matching the already-capitalized "Entwurf".

• #1470 b2e65ac Thanks @pitscher! - Fixes localization for media API fallback error messages in the admin UI

• #1475 589d07f Thanks @pitscher! - Fixes localization for the current-user API fallback error message in the admin UI

• #1411 d6269e7 Thanks @memdigital! - Adds an en-GB (British English) locale to the admin UI. British spelling and morphology only - terminology is unchanged. en-GB browsers are auto-selected via the existing Accept-Language resolution.

• #1477 325c673 Thanks @pitscher! - Fixes localization for shared API fallback messages in the admin UI

• #1496 af4af50 Thanks @ahliweb! - Fixes the remaining untranslated Indonesian admin strings.

• #1472 c48604b Thanks @pitscher! - Fixes localization for settings API fallback error messages in the admin UI

• #1455 52ea731 Thanks @pitscher! - Fixes untranslated PluginFieldErrorBoundary strings

• #1507 6c1fe5c Thanks @ascorbic! - Speeds up browsing and searching large media libraries. The media library and the media picker now load small resized thumbnails through Astro's image endpoint instead of fetching every grid item's full-size original, so opening the library and searching for older items no longer waits on full-resolution downloads (#1488). Where no runtime image service is available the original is served as before, so nothing renders worse than it did.

• #1500 6246774 Thanks @swissky! - Fix unreadable "Published" status badge in dark mode. The content editor rendered the published badge as <Badge variant="primary" className="text-white">, which produces white text on a light inverted background in dark mode. Use the semantic variant="success" (green) instead, which is dark-mode aware and matches the green "published" badge used on the content overview list.

• #1461 b01aa9b Thanks @ascorbic! - Fixes registry installs failing with "Plugin manifest has changed since you consented" for plugins that declare hook-registration capabilities (email transport, email events, page fragments) or read user records. Plugin bundles now declare their access as a structured declaredAccess contract that the registry record, the install-consent dialog, and the sandbox all read consistently, so every capability a plugin declares is shown for consent and enforced — no capability is silently dropped. Re-publish affected plugins to adopt the new bundle format; existing installs are unaffected.

• #1471 5f7cd11 Thanks @pitscher! - Fixes localization for email settings API fallback error messages in the admin UI

• #1469 263392f Thanks @pitscher! - Fixes localization for plugin API fallback error messages in the admin UI

• #1466 eddadf8 Thanks @pitscher! - Fixes localization for code block language labels in the admin editor

• Updated dependencies [141aa11, b01aa9b]:

  • @emdash-cms/registry-client@0.3.2
  • @emdash-cms/registry-lexicons@0.1.1
  • @emdash-cms/plugin-types@0.1.0
  • @emdash-cms/blocks@0.20.0

@emdash-cms/cloudflare@0.20.0

Minor Changes

• #1492 7688f0b Thanks @ascorbic! - Adds a durableObjects() database adapter that stores the whole CMS in a single Durable Object's SQLite. With session: "auto" (plus the experimental and replica_routing compatibility flags) reads route to the nearest read replica and writes proxy to the primary, cutting read latency for globally distributed traffic. Register the exported EmDashDB class in your worker and add a new_sqlite_classes migration.

Patch Changes

• Updated dependencies [141aa11, 7688f0b, c7166b0, 9c994ad, eddaf91, afc3a0f, 3d423a7, b01aa9b, 3e344af, 7688f0b, 8807701]:
  • emdash@0.20.0

emdash@0.20.0

Minor Changes

• #1461 b01aa9b Thanks @ascorbic! - Fixes registry installs failing with "Plugin manifest has changed since you consented" for plugins that declare hook-registration capabilities (email transport, email events, page fragments) or read user records. Plugin bundles now declare their access as a structured declaredAccess contract that the registry record, the install-consent dialog, and the sandbox all read consistently, so every capability a plugin declares is shown for consent and enforced — no capability is silently dropped. Re-publish affected plugins to adopt the new bundle format; existing installs are unaffected.

• #1425 3e344af Thanks @swissky! - Repeater fields support image sub-fields with the media picker (#1424)

  Repeater rows previously rendered every non-scalar sub-field as a plain text
  input, so galleries had to be built from hand-pasted URLs. Image sub-fields
  now render the same media-picker UI as top-level image fields (select,
  preview, change, remove) and store the same MediaValue shape — legacy string
  URLs keep working.

  Includes: image in the schema-builder sub-field type select, the shared
  ImageFieldRenderer extracted out of ContentEditor for reuse, and the
  sub-field type whitelists in core (REPEATER_SUB_FIELD_TYPES + the API Zod
  enum) extended — the Zod enum also gains the previously missing url entry
  that the builder already offered.

Patch Changes

• #1447 141aa11 Thanks @ascorbic! - Fixes @atcute peer dependency warnings on install (#1435)

  Installing EmDash pulled in mismatched @atcute package versions, so pnpm install / npm install reported unmet peer warnings for @atcute/identity and @atcute/lexicons. The bundled @atcute dependencies are now aligned on v2 and installs are clean. If your project also depends on @atcute packages directly, note they have moved to v2 (@atcute/client 5, @atcute/lexicons 2, @atcute/atproto 4, @atcute/oauth-node-client 2).

• #1492 7688f0b Thanks @ascorbic! - Fixes a read-your-writes gap with database read replication: the session bookmark cookie is now persisted even when page rendering throws after a successful write, so an immediately-following request can't read pre-write state from a lagging replica.

• #1459 c7166b0 Thanks @mvanhorn! - Fix scheduled entries staying hidden after their scheduled time (#1402)

  isVisible() read scheduledAt via dataStr, which returned an empty string for the Date the loader produced, so entries whose scheduled time had passed never became visible. The visibility check now reads the scheduled time correctly.

• #1458 9c994ad Thanks @mvanhorn! - Fix npx emdash types crash caused by the schema endpoint envelope (#1188)

  The /schema route returned an enveloped JSON body while client.request() already unwraps the .data field, so emdash types received undefined and crashed. The route now returns the un-enveloped shape the client expects.

• #1489 eddaf91 Thanks @ascorbic! - Fixes admin pages hanging indefinitely (and eventually returning 524 timeouts) on Cloudflare Workers. The worker-lifetime caches for site settings and search-index health could be left holding a request that never completed (for example when a visitor's request was cancelled mid-load), which then stalled every later request served by that worker until it was recycled. These caches now keep resolved values rather than in-flight requests, so a cancelled or interrupted request can no longer wedge the rest.

• #1481 afc3a0f Thanks @MA2153! - Fixes collection where filters to apply every taxonomy key instead of silently dropping all but the first. Filtering by two or more taxonomies (e.g. { category: ["news"], region: ["emea"] }) now returns the intersection — entries tagged in each taxonomy — matching how field and byline filters already compose.

• #1498 3d423a7 Thanks @ascorbic! - Reduces redundant database queries when rendering content pages: widget areas are now request-cached, taxonomy term usage-counts are fetched once per request instead of once per taxonomy widget, and getTermsForEntries reuses already-hydrated terms instead of re-querying. Fewer round trips per page on every backend.

• #1492 7688f0b Thanks @ascorbic! - Adds an rpc.count Server-Timing metric reporting physical database round trips, distinct from db.count (logical queries). Backends that batch (the new Durable Objects SQL driver coalesces same-turn reads into one round trip) can now surface how many round trips a request actually made.

• #1504 8807701 Thanks @swissky! - Adds image entries to per-collection sitemaps. When a content entry has an SEO image, the sitemap now emits it as a Google <image:image> entry, helping Google discover and index page images for Google Images.

• Updated dependencies [141aa11, ddf8f0d, 68840a9, eaedec0, 8bb20c4, fb31240, 022fd66, 5d8358b, ce96271, b2e65ac, 589d07f, d6269e7, 325c673, af4af50, c48604b, 52ea731, acfeb89, 6c1fe5c, 6246774, b01aa9b, 3e344af, 5f7cd11, 263392f, eddadf8]:

  • @emdash-cms/admin@0.20.0
  • @emdash-cms/registry-client@0.3.2
  • @emdash-cms/plugin-types@0.1.0
  • @emdash-cms/auth@0.20.0
  • @emdash-cms/gutenberg-to-portable-text@0.20.0

@emdash-cms/plugin-cli@0.6.0

Minor Changes

• #1461 b01aa9b Thanks @ascorbic! - Fixes registry installs failing with "Plugin manifest has changed since you consented" for plugins that declare hook-registration capabilities (email transport, email events, page fragments) or read user records. Plugin bundles now declare their access as a structured declaredAccess contract that the registry record, the install-consent dialog, and the sandbox all read consistently, so every capability a plugin declares is shown for consent and enforced — no capability is silently dropped. Re-publish affected plugins to adopt the new bundle format; existing installs are unaffected.

Patch Changes

• #1447 141aa11 Thanks @ascorbic! - Fixes @atcute peer dependency warnings on install (#1435)

  Installing EmDash pulled in mismatched @atcute package versions, so pnpm install / npm install reported unmet peer warnings for @atcute/identity and @atcute/lexicons. The bundled @atcute dependencies are now aligned on v2 and installs are clean. If your project also depends on @atcute packages directly, note they have moved to v2 (@atcute/client 5, @atcute/lexicons 2, @atcute/atproto 4, @atcute/oauth-node-client 2).

• Updated dependencies [141aa11, b01aa9b]:

  • @emdash-cms/registry-client@0.3.2
  • @emdash-cms/registry-lexicons@0.1.1
  • @emdash-cms/plugin-types@0.1.0

@emdash-cms/plugin-types@0.1.0

Minor Changes

• #1461 b01aa9b Thanks @ascorbic! - Fixes registry installs failing with "Plugin manifest has changed since you consented" for plugins that declare hook-registration capabilities (email transport, email events, page fragments) or read user records. Plugin bundles now declare their access as a structured declaredAccess contract that the registry record, the install-consent dialog, and the sandbox all read consistently, so every capability a plugin declares is shown for consent and enforced — no capability is silently dropped. Re-publish affected plugins to adopt the new bundle format; existing installs are unaffected.

@emdash-cms/auth-atproto@0.2.16

Patch Changes

• #1447 141aa11 Thanks @ascorbic! - Fixes @atcute peer dependency warnings on install (#1435)

  Installing EmDash pulled in mismatched @atcute package versions, so pnpm install / npm install reported unmet peer warnings for @atcute/identity and @atcute/lexicons. The bundled @atcute dependencies are now aligned on v2 and installs are clean. If your project also depends on @atcute packages directly, note they have moved to v2 (@atcute/client 5, @atcute/lexicons 2, @atcute/atproto 4, @atcute/oauth-node-client 2).

• Updated dependencies []:

  • @emdash-cms/auth@0.20.0

create-emdash@0.20.0

Patch Changes

• #1403 34dd430 Thanks @scottbuscemi! - Scaffold local secrets into .env for every platform, including Cloudflare — previously Cloudflare projects got .dev.vars.

  Since August 2025, Wrangler and the Cloudflare Vite plugin read .env files in local development, so there's no longer a reason to split Node (.env) and Workers (.dev.vars). New projects now write EMDASH_ENCRYPTION_KEY to a single .env file regardless of platform, matching the dotenv convention most developers already expect.

  This is a deliberate, pre-1.0 hard switch away from .dev.vars. It's called out as a minor bump rather than a patch because the scaffolded file changes name and the surrounding docs/guidance change with it.

  Backwards compatibility / upgrade notes:

  • Existing projects are unaffected — a .dev.vars you already have keeps working; Wrangler still reads it.
  • Wrangler loads either .dev.vars or .env, never both: if a .dev.vars file is present its values win and .env is ignored entirely. If you migrate an existing project to .env, move your secrets across and delete .dev.vars, otherwise the new .env is silently shadowed.
  • When scaffolding into a directory that still contains a .dev.vars, create-emdash now prints a warning explaining the shadowing rule so the encryption key actually loads.

  emdash secrets generate --write already accepted any path and is unchanged; only the documented/suggested target moves to .env.

@emdash-cms/plugin-embeds@0.1.24

Patch Changes

• Updated dependencies []:
  • @emdash-cms/blocks@0.20.0

@emdash-cms/registry-client@0.3.2

Patch Changes

• #1447 141aa11 Thanks @ascorbic! - Fixes @atcute peer dependency warnings on install (#1435)

  Installing EmDash pulled in mismatched @atcute package versions, so pnpm install / npm install reported unmet peer warnings for @atcute/identity and @atcute/lexicons. The bundled @atcute dependencies are now aligned on v2 and installs are clean. If your project also depends on @atcute packages directly, note they have moved to v2 (@atcute/client 5, @atcute/lexicons 2, @atcute/atproto 4, @atcute/oauth-node-client 2).

• Updated dependencies [141aa11, b01aa9b]:

  • @emdash-cms/registry-lexicons@0.1.1

@emdash-cms/registry-lexicons@0.1.1

Patch Changes

• #1447 141aa11 Thanks @ascorbic! - Fixes @atcute peer dependency warnings on install (#1435)

  Installing EmDash pulled in mismatched @atcute package versions, so pnpm install / npm install reported unmet peer warnings for @atcute/identity and @atcute/lexicons. The bundled @atcute dependencies are now aligned on v2 and installs are clean. If your project also depends on @atcute packages directly, note they have moved to v2 (@atcute/client 5, @atcute/lexicons 2, @atcute/atproto 4, @atcute/oauth-node-client 2).

• #1461 b01aa9b Thanks @ascorbic! - Fixes registry installs failing with "Plugin manifest has changed since you consented" for plugins that declare hook-registration capabilities (email transport, email events, page fragments) or read user records. Plugin bundles now declare their access as a structured declaredAccess contract that the registry record, the install-consent dialog, and the sandbox all read consistently, so every capability a plugin declares is shown for consent and enforced — no capability is silently dropped. Re-publish affected plugins to adopt the new bundle format; existing installs are unaffected.

@emdash-cms/sandbox-workerd@0.1.8

Patch Changes

• Updated dependencies [141aa11, 7688f0b, c7166b0, 9c994ad, eddaf91, afc3a0f, 3d423a7, b01aa9b, 3e344af, 7688f0b, 8807701]:
  • emdash@0.20.0

@emdash-cms/auth@0.20.0

@emdash-cms/blocks@0.20.0

@emdash-cms/gutenberg-to-portable-text@0.20.0

@emdash-cms/x402@0.20.0

@emdash-cms/fixture-perf-site@0.0.19

Patch Changes

• Updated dependencies [141aa11, 7688f0b, 7688f0b, c7166b0, 9c994ad, eddaf91, afc3a0f, 3d423a7, b01aa9b, 3e344af, 7688f0b, 8807701]:
  • emdash@0.20.0
  • @emdash-cms/cloudflare@0.20.0

@emdash-cms/perf-demo-site@0.0.19

Patch Changes

• Updated dependencies [141aa11, 7688f0b, 7688f0b, c7166b0, 9c994ad, eddaf91, afc3a0f, 3d423a7, b01aa9b, 3e344af, 7688f0b, 8807701]:
  • emdash@0.20.0
  • @emdash-cms/plugin-cli@0.6.0
  • @emdash-cms/cloudflare@0.20.0
  • @emdash-cms/plugin-webhook-notifier@0.2.0

@emdash-cms/cache-demo-site@0.0.19

Patch Changes

• Updated dependencies [141aa11, 7688f0b, 7688f0b, c7166b0, 9c994ad, eddaf91, afc3a0f, 3d423a7, b01aa9b, 3e344af, 7688f0b, 8807701]:
  • emdash@0.20.0
  • @emdash-cms/plugin-cli@0.6.0
  • @emdash-cms/cloudflare@0.20.0
  • @emdash-cms/plugin-webhook-notifier@0.2.0

@emdash-cms/do-demo-site@0.0.19

Patch Changes

• Updated dependencies [141aa11, 7688f0b, 7688f0b, c7166b0, 9c994ad, eddaf91, afc3a0f, 3d423a7, b01aa9b, 3e344af, 7688f0b, 8807701]:
  • emdash@0.20.0
  • @emdash-cms/plugin-cli@0.6.0
  • @emdash-cms/cloudflare@0.20.0
  • @emdash-cms/plugin-webhook-notifier@0.2.0

@emdash-cms/do-solo-demo-site@0.0.19

Patch Changes

• Updated dependencies [141aa11, 7688f0b, 7688f0b, c7166b0, 9c994ad, eddaf91, afc3a0f, 3d423a7, b01aa9b, 3e344af, 7688f0b, 8807701]:
  • emdash@0.20.0
  • @emdash-cms/plugin-cli@0.6.0
  • @emdash-cms/cloudflare@0.20.0
  • @emdash-cms/plugin-webhook-notifier@0.2.0

---

Try this PR

Open a fresh playground →

A full working EmDash site, deployed from this branch. Each visit gets its own session-scoped sandbox: no login needed and no shared state. Try the admin, edit content, hit the public site.

_{Tracks changeset-release/main. Updated automatically when the playground redeploys.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	5686c3c	Jun 16 2026, 04:24 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	docs	5686c3c	Jun 16 2026, 04:25 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	5686c3c	Jun 16 2026, 04:27 PM

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@1449

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@1449

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@1449

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@1449

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@1449

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@1449

emdash

npm i https://pkg.pr.new/emdash@1449

create-emdash

npm i https://pkg.pr.new/create-emdash@1449

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@1449

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@1449

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@1449

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@1449

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@1449

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@1449

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@1449

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@1449

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@1449

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@1449

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@1449

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@1449

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@1449

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@1449

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@1449

commit: 5686c3c

[github-actions]

Scope check

This PR touches 29 files. PRs with a broad scope are harder to review. Please confirm the scope hasn't drifted beyond the intended change.
This PR spans 5 different areas (area/core, area/admin, area/plugins, area/auth, area/cloudflare). Consider breaking it into smaller, focused PRs.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.