Skip to content

Commit 11da4f3

Browse files
skiski
committed
Merge upstream emdash main (290 commits)
Catches deployment/suhail-ski up with emdash-cms/emdash main. Conflict in pnpm-lock.yaml resolved by taking upstream's lock and re-running pnpm install to pick up the @suhailski/57th-parallel template deps. Notable upstream changes folded in: - Plugin authoring CLI + manifest format (emdash-cms#1057, emdash-cms#1059) - Registry packages — lexicons, client, CLI (emdash-cms#923) - Migration 036 taxonomy preservation (emdash-cms#1086) - WXR import w/ WPML/Polylang translations (emdash-cms#1087) - TypeScript 6 upgrade, tsgo beta (emdash-cms#1074) - FTS5 corruption fix on publish (emdash-cms#768) - Plugin bundle size caps (emdash-cms#978) - And ~280 smaller fixes / chores CLI rebuilt against the new core. Verified by listing posts on suhail.ski — both tutorial posts come back as expected. 57th-parallel template untouched by upstream. Our 5 local commits preserved across the merge. Used --config.manage-package-manager-versions=false to bypass pnpm's self-switch to 11.1.3, which packages weirdly on Windows. The current shell's pnpm 10.12.4 worked fine against the merged manifests.
2 parents 0763f7e + 792f73c commit 11da4f3

1,351 files changed

Lines changed: 222605 additions & 33941 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.changeset/config.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"updateInternalDependencies": "minor",
2929
"bumpVersionsWithWorkspaceProtocolOnly": true,
3030
"ignore": [
31+
"@emdash-cms/aggregator",
3132
"@emdash-cms/blocks-playground",
3233
"@emdash-cms/demo-cloudflare",
3334
"@emdash-cms/demo-postgres",

‎.changeset/fifty-numbers-matter.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
"create-emdash": patch
3+
---
4+
5+
Pins `packageManager` for pnpm-scaffolded sites so a recent enough pnpm is used (settings-only `pnpm-workspace.yaml` requires pnpm 10.5+). For npm, yarn, or bun selections the field is stripped so corepack doesn't force pnpm on a non-pnpm user.

‎.changeset/fix-local-media-id-normalization.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
"emdash": patch
3+
---
4+
5+
pr: 1100
6+
commit: f753dba340dca791d4cf34a78c29ed6a0d552cd4
7+
author: jcheese1
8+
9+
Resolve bare local media IDs in media fields before falling back to external URLs.

‎.changeset/ready-worlds-rush.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
"@emdash-cms/admin": patch
3+
"emdash": patch
4+
---
5+
6+
pr: 1101
7+
commit: e539731451994206bf60824a31815a8a925c7252
8+
author: ascorbic
9+
10+
Fixes experimental registry navigation and allows the configured registry aggregator through the admin CSP.

‎.changeset/registry-boundary-validation.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
"@emdash-cms/registry-client": minor
3+
"emdash": patch
4+
---
5+
6+
Validates aggregator responses at the read-side trust boundary in `DiscoveryClient`. Two layers run:
7+
8+
- **Response envelope** (`uri`, `cid`, `did`, `slug`, `version`, …): `DiscoveryClient` now routes every call through `@atcute/client`'s schema-validating `.call()` against the aggregator method's output lexicon. Request params are validated too. A non-conforming envelope throws `ClientValidationError`.
9+
- **Embedded signed `profile` / `release` records** (typed `unknown` by the aggregator lexicon because they are relayed verbatim from publisher repos under a different lexicon namespace): now `safeParse`'d against `com.emdashcms.experimental.package.profile` / `release`. A conforming record is returned as the typed lexicon shape; a non-conforming one is surfaced as `null` so one bad record doesn't fail an entire search page.
10+
11+
Refines the return types from `unknown` to `PackageProfile.Main | null` / `PackageRelease.Main | null` (new exported `ValidatedPackageView` / `ValidatedReleaseView` / `ValidatedSearchPackages` / `ValidatedListReleases` types). Callers must null-check. The registry install handler now fails closed when the aggregator returns a release record that does not conform to its lexicon.
12+
13+
Validation is structural only — the lexicon's `uri` format permits non-HTTP schemes, so UI rendering these URLs still applies its own scheme allow-list.

‎.changeset/registry-profile-fields-admin.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
"@emdash-cms/admin": minor
3+
---
4+
5+
Renders the full registry package profile in the admin. The plugin detail page now shows the license (linked to spdx.org for single SPDX identifiers), keywords, all authors, all security contacts, and a link to the source repository. The browse cards show the license alongside the description.

‎.changeset/registry-profile-fields-cli.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
"@emdash-cms/plugin-cli": minor
3+
---
4+
5+
Publishes the full profile block from `emdash-plugin.jsonc`. First publish now writes `name`, `description`, `keywords`, multiple authors, and multiple security contacts to the package profile record, plus the source `repo` URL to the release record — previously only `license` and a single author/security contact were sent.
6+
7+
Deprecates the `--license`, `--author-*`, and `--security-*` flags in favour of declaring these in `emdash-plugin.jsonc`. The flags still work and override the manifest when both are present; a deprecation warning is printed when they are used.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@ Closes #
2525
- [ ] `pnpm test` passes (or targeted tests for my change)
2626
- [ ] `pnpm format` has been run
2727
- [ ] I have added/updated tests for my changes (if applicable)
28-
- [ ] User-visible strings in the admin UI are [wrapped for translation](https://github.com/emdash-cms/emdash/blob/main/CONTRIBUTING.md#internationalization-i18n) and `pnpm locale:extract` has been run (if applicable)
28+
- [ ] User-visible strings in the admin UI are [wrapped for translation](https://github.com/emdash-cms/emdash/blob/main/CONTRIBUTING.md#internationalization-i18n) (if applicable). Do not include `messages.po` changes except in translation PRs — a workflow extracts catalogs on merge to `main`.
2929
- [ ] I have added a [changeset](https://github.com/emdash-cms/emdash/blob/main/CONTRIBUTING.md#changesets) (if this PR changes a published package)
3030
- [ ] New features link to an approved Discussion: https://github.com/emdash-cms/emdash/discussions/...
3131

3232
## AI-generated code disclosure
3333

34-
<!-- If any part of this PR was generated by AI tools (Copilot, Claude, GPT, Cursor, etc.), check the box. This is fine — we just need to know so reviewers can pay extra attention to edge cases. -->
34+
<!-- If any part of this PR was generated by AI tools (Copilot, Claude, GPT, Cursor, etc.), check the box and name the model(s)/tool(s) you used. Naming the model lets reviewers run the review pass with a different model family to catch family-specific blind spots. -->
3535

36-
- [ ] This PR includes AI-generated code
36+
- [ ] This PR includes AI-generated code — model/tool: <!-- e.g. Claude Opus 4.7, GPT-5.5, Cursor + Sonnet 4.6, Copilot -->
3737

3838
## Screenshots / test output
3939

‎.github/bonk-models.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"$comment": "Model registry for /bonk and /review keyword routing. The first word after /bonk, /review, or @ask-bonk in a comment selects the alias; an unknown or absent word falls back to `default`. Each registration is the opencode model definition that gets injected into OPENCODE_CONFIG_CONTENT so the opencode version pinned in the workflows can resolve models released after its bundled models.dev snapshot. The `options` field passes through to AI SDK providerOptions and carries per-call reasoning controls -- shape is provider-specific: Anthropic uses `effort` + `thinking.type`, OpenAI uses `reasoningEffort`, Google uses `thinkingConfig.thinkingLevel` (Gemini 3+) or `thinkingConfig.thinkingBudget` (Gemini 2.5).",
3+
"default": "opus",
4+
"models": {
5+
"opus": {
6+
"id": "anthropic/claude-opus-4-7",
7+
"registration": {
8+
"id": "anthropic/claude-opus-4-7",
9+
"options": {
10+
"effort": "xhigh",
11+
"thinking": {
12+
"type": "adaptive"
13+
}
14+
}
15+
}
16+
},
17+
"kimi": {
18+
"id": "workers-ai/@cf/moonshotai/kimi-k2.6",
19+
"registration": {
20+
"id": "workers-ai/@cf/moonshotai/kimi-k2.6"
21+
}
22+
}
23+
}
24+
}

‎.github/scripts/check-no-major.mjs‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/usr/bin/env node
2+
import { readFileSync } from "node:fs";
3+
import { glob } from "node:fs/promises";
4+
5+
const offenders = [];
6+
const seen = [];
7+
8+
for await (const file of glob("**/package.json", {
9+
exclude: (path) =>
10+
path.includes("node_modules") || path.includes("/dist/") || path.includes("/.git/"),
11+
})) {
12+
let pkg;
13+
try {
14+
pkg = JSON.parse(readFileSync(file, "utf8"));
15+
} catch {
16+
continue;
17+
}
18+
if (pkg.private || !pkg.name || !pkg.version) continue;
19+
seen.push(`${pkg.name}@${pkg.version}`);
20+
const major = Number.parseInt(pkg.version.split(".")[0], 10);
21+
if (Number.isFinite(major) && major >= 1) {
22+
offenders.push(`${pkg.name}@${pkg.version} (${file})`);
23+
}
24+
}
25+
26+
if (offenders.length > 0) {
27+
console.error("::error::Non-0.x versions detected. Releases must stay in 0.x while in pre-1.0:");
28+
for (const o of offenders) console.error(` ${o}`);
29+
process.exit(1);
30+
}
31+
32+
console.log(`Checked ${seen.length} non-private packages, all are 0.x.`);

0 commit comments

Comments
 (0)