@plutocms/core 0.47.1 → 0.48.0

package/CHANGELOG.md

@@ -1,6 +1,17 @@
 # Changelog
 
 
+## [0.48.0](https://github.com/plutocms/pluto/compare/v0.47.1...v0.48.0) (2026-11-02)
+
+
+### Features
+
+* a Deploy tab in Settings puts the Git CMS site on Vercel, Netlify, a Node host, Cloudflare or GitHub Pages ([#373](https://github.com/plutocms/pluto/issues/373)) ([f8a7a27](https://github.com/plutocms/pluto/commit/f8a7a276e3019f0dc5aff933cb4e703ad85c343f))
+* a draft save of the Git CMS skips the deploy, and the build status follows the last deploy ([#371](https://github.com/plutocms/pluto/issues/371)) ([800b2a5](https://github.com/plutocms/pluto/commit/800b2a557ad7b7678133a5f04fe000c86aaa9e19))
+* a read-only Users page for the Git CMS lists the people with write access to the repo ([#369](https://github.com/plutocms/pluto/issues/369)) ([0412158](https://github.com/plutocms/pluto/commit/0412158ff698074ccff505c3e0630bc4721e0cf4))
+* the admin navbar shows the backend (Git or a database), and local mode counts the commits to push ([#368](https://github.com/plutocms/pluto/issues/368)) ([b71c4b5](https://github.com/plutocms/pluto/commit/b71c4b5cbbc728ddf6214fa35cbbe8190f64e164))
+* the Git CMS builds a static site (nuxt generate, GitHub Pages) from the files of the checkout ([#372](https://github.com/plutocms/pluto/issues/372)) ([f5de17e](https://github.com/plutocms/pluto/commit/f5de17e85a5ec6e54d15eb40e8d12719caf94ee1))
+
 ## [0.47.1](https://github.com/plutocms/pluto/compare/v0.47.0...v0.47.1) (2026-11-02)
 
 

package/FEATURES.md

@@ -97,18 +97,29 @@ policies shared by every project here.
   (`excerpt` in a list, `html` for one item, through `adapter.toPublic`), and `PlutoMarkdown` (an alias of the core `PlutoHtml`, which shows the sanitized `html` of any backend). The GitHub App is created from the site (App Manifest flow): the setup routes
   under `/api/_pluto/github/setup/` (`status`, `github/start`, `github/callback`), a result page with the
   env block, a `.env` write in development, a setup check on `/admin/login`, a **GitHub** tab in Settings,
-  and a private key in PEM, `\n` or base64 form. The edit form shows the build status of the head
-  commit (check runs, commit statuses, deployments) next to Save, for GitHub storage with
+  and a private key in PEM, `\n` or base64 form. With `commit.skipDeploy` off, a draft save gets
+  `[skip ci]`, so only a change of published content deploys. The edit form shows the build status of the
+  newest commit that did not skip CI (check runs, commit statuses, deployments) next to Save, for GitHub storage with
   `commit.skipDeploy` off: the route `GET /api/_pluto/github/build-status`, a pure reducer, a polling loop,
   and an Info popover with links to the Action or the build. A content type with `liveOnSave` shows
   "Live" at once after a save and the static build as a small spinner. The file adapter has
   `readFile` (safe relative paths) and `_frontmatter` on `get`, and core has the auto-imported
-  `markPublicRead(event)` for layers. @.claude/skills/git-cms/SKILL.md
+  `markPublicRead(event)` for layers. The backend badge shows local mode or the GitHub repo. In local
+  mode it counts the commits that are not pushed and has a Push button (`/api/_pluto/github/local/status`
+  and `push`, dev local request only). A read-only **Users** page (`/admin/users`) lists the people
+  with write access to the repo (`GET /api/_pluto/github/users`), their GitHub role, what it gives in
+  Pluto, and who `ALLOWED_USERS` blocks. A static build (`nuxt generate`, or the `github_pages`
+  preset) prerenders the site from the files of the checkout with no token, adds no server route,
+  keeps the admin out, and takes a sub path from `PLUTO_BASE_URL` (`PlutoHtml` puts it before the
+  site paths of a post body). A **Deploy** tab in Settings (`/admin/settings/deploy`) puts the site
+  on a host: import links for Vercel and Netlify, a Node host guide, Cloudflare Pages build settings,
+  and GitHub Pages (in local mode it writes and commits the workflow and turns Pages on with the
+  GitHub CLI). @.claude/skills/git-cms/SKILL.md
 - Lazy admin components: core registers its field widgets and dashboard widgets with
   `defineAsyncComponent`, shows a skeleton per field, widget and settings panel while a chunk
   loads, and warns in dev about a registered component that is not async.
   @.claude/skills/extension-registry/SKILL.md
-- Admin shell: core owns the `/admin` parent route, the `/admin/login` page, the route guard, the admin banners, the navbar and the user menu. A backend layer registers an auth driver, account menu items, site info and link actions. The admin is for staff only: a signed-in user with no capability goes to `/admin/no-access`. In production, an app with no auth driver (the backend is missing or did not load) sends every admin path to `/admin/not-configured`; in dev the admin opens. The bar shows on `/admin/**` for staff, and on public pages for staff only. A route hides the bar with the page meta `plutoAdminBar: false`, and `isPlutoPreviewPath` marks the preview path. The bar height is the token `--pluto-admin-bar-height`, and `<html>` gets `data-pluto-admin-bar` while the bar shows. A hint cookie puts the bar frame in the server HTML of a public page for staff (the actions and the user menu load after the mount). Content types with `adminBar` get "New <type>" and "Edit <type>" buttons (`usePlutoEditLink`). With two or more types, one "New" menu lists them, grouped by `navGroup`. A `navGroup` also puts related types under one sidebar item (registry bucket `navGroups`, core group `pages`). @.claude/skills/admin-shell/SKILL.md
+- Admin shell: core owns the `/admin` parent route, the `/admin/login` page, the route guard, the admin banners, the navbar and the user menu. A backend layer registers an auth driver, account menu items, site info, link actions and the backend badge of the navbar ("Git · Local", "Git · GitHub", "Database · Supabase", with a popover; `usePlutoBackend`). The admin is for staff only: a signed-in user with no capability goes to `/admin/no-access`. In production, an app with no auth driver (the backend is missing or did not load) sends every admin path to `/admin/not-configured`; in dev the admin opens. The bar shows on `/admin/**` for staff, and on public pages for staff only. A route hides the bar with the page meta `plutoAdminBar: false`, and `isPlutoPreviewPath` marks the preview path. The bar height is the token `--pluto-admin-bar-height`, and `<html>` gets `data-pluto-admin-bar` while the bar shows. A hint cookie puts the bar frame in the server HTML of a public page for staff (the actions and the user menu load after the mount). Content types with `adminBar` get "New <type>" and "Edit <type>" buttons (`usePlutoEditLink`). With two or more types, one "New" menu lists them, grouped by `navGroup`. A `navGroup` also puts related types under one sidebar item (registry bucket `navGroups`, core group `pages`). @.claude/skills/admin-shell/SKILL.md
 - Local layers helper: `plutoLayer(name)` from `@plutocms/core/layers` gives a Nuxt `extends` entry.
   With `PLUTO_LOCAL_ROOT`, it uses the local checkouts of the Pluto layers. @.claude/skills/local-layers/SKILL.md
 - Pluto logo: `PlutoLogo` draws the logo inline. The wordmark takes the text color, so the logo works

package/app/components/Pluto/Admin/PlutoAdminBackendBadge.vue

@@ -0,0 +1,84 @@
+<script setup lang="ts">
+// The backend badge of the admin navbar: "Git · GitHub", "Git · Local",
+// "Database · Supabase". It tells the editor where the content goes. A click
+// opens a popover with the details of the backend (its own component). A
+// count (for example the commits that are not pushed) shows as a small pill.
+// The backend comes from the `backend` field of `definePlutoExtension`. See
+// the admin-shell skill.
+const { t } = usePlutoI18n()
+const { backend } = usePlutoBackend()
+const open = ref(false)
+
+const kindLabel = computed(() =>
+  backend.value?.kind === 'database'
+    ? t('pluto.backend.kind.database')
+    : t('pluto.backend.kind.git')
+)
+const kindIcon = computed(() =>
+  backend.value?.kind === 'database'
+    ? 'i-lucide-database'
+    : 'i-lucide-git-branch'
+)
+const buttonLabel = computed(() => {
+  const name = `${kindLabel.value} · ${backend.value?.label ?? ''}`
+  return backend.value?.countLabel
+    ? `${t('pluto.backend.open', { name })} (${backend.value.countLabel})`
+    : t('pluto.backend.open', { name })
+})
+
+watch(open, (value) => {
+  if (value) {
+    backend.value?.onOpen?.()
+  }
+})
+</script>
+
+<template>
+  <UPopover
+    v-if="backend"
+    v-model:open="open"
+    :content="{ align: 'start', sideOffset: 4 }"
+  >
+    <PlutoNavbarHit :label="buttonLabel" size="sm">
+      <span class="flex items-center gap-x-1.5">
+        <UIcon :name="kindIcon" class="size-4 shrink-0" />
+        <span class="hidden md:inline">{{ kindLabel }}</span>
+        <span class="text-muted hidden md:inline">·</span>
+        <span class="text-muted hidden max-w-32 truncate md:inline">
+          {{ backend.label }}
+        </span>
+        <span
+          v-if="backend.count"
+          :title="backend.countLabel"
+          class="bg-warning text-inverted rounded-full px-1.5 text-[0.6875rem]/4 font-semibold tabular-nums"
+        >
+          {{ backend.count }}
+        </span>
+      </span>
+    </PlutoNavbarHit>
+
+    <template #content>
+      <div class="w-80 max-w-[calc(100vw-2rem)] p-4 text-sm">
+        <div class="mb-3 flex items-center gap-x-2">
+          <UIcon
+            :name="backend.icon || kindIcon"
+            class="text-highlighted size-5 shrink-0"
+          />
+          <div class="min-w-0">
+            <p class="text-highlighted truncate font-semibold">
+              {{ backend.label }}
+            </p>
+            <p class="text-muted text-xs">
+              {{
+                backend.kind === 'database'
+                  ? t('pluto.backend.databaseMode')
+                  : t('pluto.backend.gitMode')
+              }}
+            </p>
+          </div>
+        </div>
+        <component :is="backend.details" v-if="backend.details" />
+      </div>
+    </template>
+  </UPopover>
+</template>

package/app/components/Pluto/Admin/PlutoAdminNavbar.vue

@@ -85,6 +85,13 @@ const siteDomain = computed(() => domainFromUrl(site.url.value) || host)
         -->
         <div class="-mx-1 h-full min-w-0 overflow-hidden px-1">
           <ul class="flex h-full min-w-0 items-center gap-x-1 text-sm">
+            <!-- Where the content goes: Git or a database. Admin pages only. -->
+            <ClientOnly>
+              <li v-if="isAdmin" class="h-full shrink-0">
+                <PlutoAdminBackendBadge />
+              </li>
+            </ClientOnly>
+
             <PlutoNavbarButton
               v-if="isAdmin"
               :label="t('pluto.navbar.viewSite')"

package/app/components/Pluto/Github/PlutoGithubBackendDetails.vue

@@ -0,0 +1,180 @@
+<script setup lang="ts">
+// The popover body of the backend badge (`backend.details`) for the Git CMS.
+// Local mode (`fs` store): the saves are commits in the local repo, the
+// commits that are not pushed, and a Push button. GitHub mode: the repo and
+// the branch that each save commits to, with links to GitHub.
+import { usePlutoGithubLocalGit } from '../../../../modules/pluto-github/runtime/app/composables/pluto-github-local-git'
+import { usePlutoGithubSession } from '../../../../modules/pluto-github/runtime/app/composables/pluto-github-session'
+
+const { t } = usePlutoI18n()
+const errorText = usePlutoErrorText()
+const config = useRuntimeConfig().public.plutoGithub as
+  | {
+      storage?: string
+      repo?: string
+      branch?: string
+    }
+  | undefined
+const local = config?.storage === 'fs'
+const repo = config?.repo || ''
+const branch = config?.branch || 'main'
+const session = usePlutoGithubSession()
+const git = usePlutoGithubLocalGit()
+const pushError = ref('')
+const pushed = ref(false)
+
+const repoUrl = computed(() => (repo ? `https://github.com/${repo}` : ''))
+const commitsUrl = computed(() =>
+  repo ? `https://github.com/${repo}/commits/${encodeURIComponent(branch)}` : ''
+)
+const visibility = computed(() => {
+  const value = session.repo.value?.private
+  if (value === undefined) {
+    return ''
+  }
+  return value
+    ? t('pluto.github.backend.private')
+    : t('pluto.github.backend.public')
+})
+
+// What the local repo needs, in one line. `null` while the first read runs.
+const localState = computed(() => {
+  const status = git.status.value
+  if (!status) {
+    return null
+  }
+  if (!status.repo) {
+    return status.reason === 'no-git'
+      ? t('pluto.github.local.noGit')
+      : t('pluto.github.local.notARepo')
+  }
+  if (!status.branch) {
+    return t('pluto.github.local.detached')
+  }
+  if (!status.remote) {
+    return t('pluto.github.local.noRemote')
+  }
+  return status.ahead
+    ? t('pluto.github.local.ahead', status.ahead)
+    : t('pluto.github.local.upToDate')
+})
+const canPush = computed(() => {
+  const status = git.status.value
+  return Boolean(
+    status?.repo && status.branch && status.remote && status.ahead > 0
+  )
+})
+
+async function push() {
+  pushError.value = ''
+  pushed.value = false
+  try {
+    await git.push()
+    pushed.value = true
+  } catch (error) {
+    pushError.value = errorText(error, 'pluto.github.local.errors.failed')
+  }
+}
+</script>
+
+<template>
+  <div class="space-y-3">
+    <template v-if="local">
+      <p class="text-muted">{{ t('pluto.github.local.description') }}</p>
+
+      <dl class="grid grid-cols-[auto_1fr] gap-x-3 gap-y-1">
+        <template v-if="git.status.value?.repo && git.status.value.branch">
+          <dt class="text-muted">{{ t('pluto.github.backend.branch') }}</dt>
+          <dd class="text-highlighted truncate font-mono text-xs/5">
+            {{ git.status.value.branch }}
+          </dd>
+        </template>
+        <template v-if="repo">
+          <dt class="text-muted">{{ t('pluto.github.backend.repo') }}</dt>
+          <dd class="truncate">
+            <ULink :to="repoUrl" target="_blank" class="font-mono text-xs/5">
+              {{ repo }}
+            </ULink>
+          </dd>
+        </template>
+      </dl>
+
+      <div
+        class="border-default flex items-center justify-between gap-3 rounded-md border px-3 py-2"
+      >
+        <p v-if="localState" class="text-highlighted min-w-0">
+          {{ localState }}
+        </p>
+        <USkeleton v-else class="h-4 w-32" />
+        <UButton
+          v-if="canPush"
+          :label="t('pluto.github.local.push')"
+          :loading="git.pushing.value"
+          icon="i-lucide-upload"
+          size="xs"
+          @click="push"
+        />
+      </div>
+
+      <p
+        v-if="pushed && !canPush"
+        class="text-success flex items-center gap-1.5"
+        role="status"
+      >
+        <UIcon name="i-lucide-check" class="size-4" />
+        {{ t('pluto.github.local.pushed') }}
+      </p>
+      <p v-if="pushError" class="text-error" role="alert">
+        {{ pushError }}
+      </p>
+      <p v-else-if="canPush" class="text-muted text-xs">
+        {{ t('pluto.github.local.pushHint') }}
+      </p>
+    </template>
+
+    <template v-else>
+      <p class="text-muted">
+        {{ t('pluto.github.backend.description') }}
+      </p>
+      <dl class="grid grid-cols-[auto_1fr] gap-x-3 gap-y-1">
+        <dt class="text-muted">{{ t('pluto.github.backend.repo') }}</dt>
+        <dd class="flex min-w-0 items-center gap-2">
+          <span class="text-highlighted truncate font-mono text-xs/5">
+            {{ repo }}
+          </span>
+          <UBadge
+            v-if="visibility"
+            :label="visibility"
+            color="neutral"
+            size="sm"
+            variant="subtle"
+          />
+        </dd>
+        <dt class="text-muted">{{ t('pluto.github.backend.branch') }}</dt>
+        <dd class="text-highlighted truncate font-mono text-xs/5">
+          {{ branch }}
+        </dd>
+      </dl>
+      <div v-if="repoUrl" class="flex flex-wrap gap-2">
+        <UButton
+          :label="t('pluto.github.backend.openRepo')"
+          :to="repoUrl"
+          color="neutral"
+          icon="i-pluto-github"
+          size="xs"
+          target="_blank"
+          variant="outline"
+        />
+        <UButton
+          :label="t('pluto.github.backend.commits')"
+          :to="commitsUrl"
+          color="neutral"
+          icon="i-lucide-history"
+          size="xs"
+          target="_blank"
+          variant="outline"
+        />
+      </div>
+    </template>
+  </div>
+</template>

package/app/components/Pluto/Github/PlutoGithubBuildStatus.vue

@@ -1,6 +1,8 @@
 <script setup lang="ts">
 // A toolbar item of the edit form (`contentToolbarItems`). It shows the build
-// of the head commit of the content branch: a spinner while the site builds,
+// of the newest commit of the content branch that did not skip CI (a draft
+// save skips it), so a draft that was never public in this page shows nothing:
+// a spinner while the site builds,
 // a check mark when it is live, and an error icon when the build failed. The
 // Info button opens the details, with a link to each Action or build.
 // The CMS plugin registers it only for GitHub storage with `skipDeploy` off.
@@ -12,22 +14,33 @@ import type {
   PlutoBuildState,
 } from '../../../../modules/pluto-github/runtime/shared/build-status'
 import { usePlutoGithubBuildStatus } from '../../../../modules/pluto-github/runtime/app/composables/pluto-github-build-status'
+import { isPublicItem } from '../../../../modules/pluto-github/runtime/shared/client-rules'
 import { savedAgo } from '../../../composables/internal/content-dirty'
 
 const { t, locale } = usePlutoI18n()
 const form = usePlutoContentForm()
 const { status, check, afterSave } = usePlutoGithubBuildStatus()
 
+// True when the item was public in this page: published when the page opened, or after a save.
+// A draft save skips the deploy, so a draft that was never public has no build to show.
+const everPublic = ref(
+  form ? isPublicItem(form.type.value, form.item.value) : true
+)
+
 // Read when the edit page opens, and after each save. A new item has no commit yet:
 // the form goes to the edit page after the first save, and this item mounts again there.
 onMounted(() => {
-  if (form?.editing.value) {
+  if (form?.editing.value && everPublic.value) {
     check()
   }
 })
 // True after a save in this page. With `liveOnSave` the change is live from then on.
 const savedHere = ref(false)
-form?.onSaved(() => {
+form?.onSaved((saved) => {
+  everPublic.value ||= isPublicItem(form.type.value, saved)
+  if (!everPublic.value) {
+    return
+  }
   savedHere.value = true
   afterSave()
 })
@@ -130,7 +143,7 @@ const commitTime = computed(() => ago(status.value?.committedAt))
 </script>
 
 <template>
-  <div v-if="summary" class="flex items-center gap-1">
+  <div v-if="summary && everPublic" class="flex items-center gap-1">
     <!-- A live region: a screen reader hears the change. -->
     <div
       role="status"