emdash 0.15.0 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emdash",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Astro-native CMS with WordPress migration support",
   "type": "module",
   "main": "dist/index.mjs",
@@ -218,10 +218,10 @@
     "upng-js": "^2.1.0",
     "zod": "^4.4.1",
     "@atcute/client": "^4.2.1",
-    "@emdash-cms/admin": "0.15.0",
-    "@emdash-cms/auth": "0.15.0",
-    "@emdash-cms/gutenberg-to-portable-text": "0.15.0",
-    "@emdash-cms/registry-client": "0.2.0",
+    "@emdash-cms/auth": "0.16.0",
+    "@emdash-cms/admin": "0.16.0",
+    "@emdash-cms/gutenberg-to-portable-text": "0.16.0",
+    "@emdash-cms/registry-client": "0.3.0",
     "@emdash-cms/plugin-types": "0.0.1"
   },
   "optionalDependencies": {
@@ -248,14 +248,14 @@
     "@types/react": "19.2.14",
     "@types/sanitize-html": "^2.16.0",
     "@types/sax": "^1.2.7",
-    "@vitest/ui": "^4.1.5",
+    "@vitest/ui": "^4.1.7",
     "publint": "0.3.17",
     "tsdown": "0.20.3",
     "typescript": "^6.0.3",
     "vite": "^6.0.0",
     "vitest": "^4.1.5",
     "zod-openapi": "^5.4.6",
-    "@emdash-cms/blocks": "0.15.0"
+    "@emdash-cms/blocks": "0.16.0"
   },
   "repository": {
     "type": "git",

package/src/api/errors.ts

@@ -201,6 +201,7 @@ export const ErrorCode = {
 	AGGREGATOR_NOT_FOUND: "AGGREGATOR_NOT_FOUND",
 	CAPABILITY_ESCALATION: "CAPABILITY_ESCALATION",
 	ROUTE_VISIBILITY_ESCALATION: "ROUTE_VISIBILITY_ESCALATION",
+	ENV_INCOMPATIBLE: "ENV_INCOMPATIBLE",
 	INSTALL_FAILED: "INSTALL_FAILED",
 	UNINSTALL_FAILED: "UNINSTALL_FAILED",
 	SEARCH_FAILED: "SEARCH_FAILED",
@@ -414,6 +415,7 @@ export function mapErrorStatus(code: string | undefined): number {
 		case ErrorCode.ALREADY_INSTALLED:
 		case ErrorCode.ALREADY_CONFIGURED:
 		case ErrorCode.ALREADY_UP_TO_DATE:
+		case ErrorCode.ENV_INCOMPATIBLE:
 			return 409;
 
 		// 410 Gone

package/src/api/handlers/index.ts

@@ -171,6 +171,8 @@ export {
 
 // Registry handlers (experimental)
 export {
+	assertEnvCompatible,
+	assertSafeArtifactUrl,
 	handleRegistryInstall,
 	handleRegistryUninstall,
 	handleRegistryUpdate,

package/src/api/handlers/registry.ts

@@ -40,6 +40,8 @@
 
 import { ClientResponseError, ClientValidationError } from "@atcute/client";
 import type { Did } from "@atcute/lexicons";
+import { checkEnvCompatibility, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
+import type { HostEnv } from "@emdash-cms/registry-client/env";
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
@@ -520,6 +522,52 @@ async function fetchArtifact(mirrors: string[], declaredUrl: string): Promise<Ui
 	);
 }
 
+/**
+ * The shape of a single env-compatibility failure returned to the admin in
+ * the `ENV_INCOMPATIBLE` error's `details`.
+ */
+interface EnvIncompatibleError {
+	code: "ENV_INCOMPATIBLE";
+	message: string;
+	details: { requires: Record<string, string>; host: HostEnv };
+}
+
+/**
+ * Gate a release's `requires` constraints against the running host
+ * environment. `requires` is the lexicon-`unknown` value off the signed
+ * release record — never trust its shape; `checkEnvCompatibility` guards it.
+ *
+ * Returns `null` when every advertised constraint is satisfied (or there are
+ * none), or a structured `ENV_INCOMPATIBLE` error naming the unsatisfied
+ * constraints and the host versions. The error carries the guarded `requires`
+ * and `host` maps so the admin can render the same mismatch the UI gate shows.
+ */
+export function assertEnvCompatible(
+	requires: unknown,
+	hostEnv: HostEnv,
+): EnvIncompatibleError | null {
+	// A constraint the host can't evaluate (unknown or unparseable host
+	// version) downgrades the gate to a no-op for that env. Log it so a
+	// silent bypass is observable rather than invisible.
+	for (const skipped of findSkippedEnvConstraints(requires, hostEnv)) {
+		console.warn(
+			`[registry] env compatibility constraint skipped: ${skipped.key} requires ${skipped.required} but host version is ${skipped.reason}`,
+		);
+	}
+	const mismatches = checkEnvCompatibility(requires, hostEnv);
+	if (mismatches.length === 0) return null;
+	const guarded: Record<string, string> = {};
+	for (const m of mismatches) guarded[m.key] = m.required;
+	const summary = mismatches
+		.map((m) => `${m.key} requires ${m.required} but host is ${m.host}`)
+		.join("; ");
+	return {
+		code: "ENV_INCOMPATIBLE",
+		message: `This release is not compatible with the current environment: ${summary}.`,
+		details: { requires: guarded, host: hostEnv },
+	};
+}
+
 // ── Install ────────────────────────────────────────────────────────
 
 export async function handleRegistryInstall(
@@ -528,7 +576,7 @@ export async function handleRegistryInstall(
 	sandboxRunner: SandboxRunner | null,
 	registryConfigInput: RegistryConfigInput | undefined,
 	input: RegistryInstallInput,
-	opts?: { configuredPluginIds?: Set<string> },
+	opts?: { configuredPluginIds?: Set<string>; hostEnv?: HostEnv },
 ): Promise<ApiResult<RegistryInstallResult>> {
 	// Accept either the bare-string shorthand or the full
 	// `RegistryConfig` object (see `RegistryConfigInput`).
@@ -737,6 +785,17 @@ export async function handleRegistryInstall(
 			};
 		}
 
+		// Step 3b: environment compatibility. The signed release record may
+		// carry a `requires` block (`env:emdash`, `env:astro`, ...). Refuse
+		// the install if the running host doesn't satisfy a constraint, so a
+		// stale browser tab or non-UI caller can't bypass the admin's
+		// disabled Install button. `requires` is lexicon-`unknown`; the
+		// helper guards its shape.
+		if (opts?.hostEnv) {
+			const envError = assertEnvCompatible(releaseView.release?.requires, opts.hostEnv);
+			if (envError) return { success: false, error: envError };
+		}
+
 		// Step 3a: enforce the configured minimum release age. The browser
 		// applies the same check up front for UX, but the gate lives here
 		// -- a stale browser tab, a deep link, or a non-admin-UI caller
@@ -1212,6 +1271,7 @@ export async function handleRegistryUpdate(
 		version?: string;
 		confirmCapabilityChanges?: boolean;
 		confirmRouteVisibilityChanges?: boolean;
+		hostEnv?: HostEnv;
 	},
 ): Promise<ApiResult<RegistryUpdateResult>> {
 	const registryConfig = coerceRegistryConfig(registryConfigInput);
@@ -1363,6 +1423,14 @@ export async function handleRegistryUpdate(
 			};
 		}
 
+		// Environment compatibility gate. An ungated update could otherwise
+		// land a version whose `requires` the host doesn't satisfy. Same
+		// guard as install; `requires` is lexicon-`unknown`.
+		if (opts?.hostEnv) {
+			const envError = assertEnvCompatible(signedRelease.requires, opts.hostEnv);
+			if (envError) return { success: false, error: envError };
+		}
+
 		const declaredUrl = signedRelease.artifacts?.package?.url;
 		const declaredChecksum = signedRelease.artifacts?.package?.checksum;
 		if (!declaredUrl || !declaredChecksum) {

package/src/api/handlers/seo.ts

@@ -18,6 +18,17 @@ export interface SitemapContentEntry {
 	slug: string | null;
 	/** ISO date of last modification */
 	updatedAt: string;
+	/**
+	 * Locale of this row (e.g. `"en"`, `"fr"`). Always present — rows in
+	 * pre-i18n databases are backfilled to the configured `defaultLocale`.
+	 */
+	locale: string;
+	/**
+	 * `translation_group` ULID shared across all locale variants of the
+	 * same content. Used by the sitemap route to emit `hreflang`
+	 * alternates between siblings.
+	 */
+	translationGroup: string | null;
 }
 
 /** Per-collection sitemap data with entries and URL pattern */
@@ -93,8 +104,10 @@ export async function handleSitemapData(
 					slug: string | null;
 					id: string;
 					updated_at: string;
+					locale: string;
+					translation_group: string | null;
 				}>`
-					SELECT c.slug, c.id, c.updated_at
+					SELECT c.slug, c.id, c.updated_at, c.locale, c.translation_group
 					FROM ${sql.ref(tableName)} c
 					LEFT JOIN _emdash_seo s
 						ON s.collection = ${col.slug}
@@ -114,6 +127,8 @@ export async function handleSitemapData(
 						id: row.id,
 						slug: row.slug,
 						updatedAt: row.updated_at,
+						locale: row.locale,
+						translationGroup: row.translation_group,
 					});
 				}
 

package/src/api/handlers/snapshot.ts

@@ -294,7 +294,7 @@ export async function generateSnapshot(
 						await sql<Record<string, unknown>>`
 						SELECT * FROM ${sql.raw(`"${tableName}"`)}
 						WHERE deleted_at IS NULL
-						AND (status = 'published' OR (status = 'scheduled' AND scheduled_at <= datetime('now')))
+						AND (status = 'published' OR (status = 'scheduled' AND scheduled_at <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')))
 					`.execute(db)
 					).rows;
 				}

package/src/astro/integration/index.ts

@@ -10,6 +10,8 @@
  * to avoid bundling Node.js-only code into the production build.
  */
 
+import { createRequire } from "node:module";
+
 import type { AstroIntegration, AstroIntegrationLogger } from "astro";
 
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
@@ -34,6 +36,23 @@ export type {
 } from "./runtime.js";
 export { getStoredConfig } from "./runtime.js";
 
+/**
+ * Resolve the version of Astro the host project is building with, by reading
+ * `astro/package.json` from the project's own dependency tree. Surfaced to the
+ * admin and the registry install gate so a plugin's `env:astro` constraint can
+ * be evaluated against the real host version. Returns `undefined` if Astro
+ * can't be resolved (shouldn't happen in a real build, but never throw here).
+ */
+function resolveAstroVersion(): string | undefined {
+	try {
+		const require = createRequire(import.meta.url);
+		const pkg = require("astro/package.json") as { version?: unknown };
+		return typeof pkg.version === "string" ? pkg.version : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
 /** Default storage: Local filesystem in .emdash directory */
 const DEFAULT_STORAGE = local({
 	directory: "./.emdash/uploads",
@@ -204,6 +223,13 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				command,
 			}) => {
 				printBanner(logger);
+				// Capture the host's Astro version so the runtime can expose it
+				// to the admin and the registry install gate for `env:astro`
+				// constraint checks.
+				const astroVersion = resolveAstroVersion();
+				if (astroVersion !== undefined) {
+					serializableConfig.astroVersion = astroVersion;
+				}
 				// Extract i18n config from Astro config
 				// Astro locales can be strings OR { path, codes } objects — normalize to paths
 				if (astroConfig.i18n) {

package/src/astro/integration/routes.ts

@@ -382,6 +382,11 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/admin/plugins/registry/install.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/admin/plugins/registry/artifact",
+		entrypoint: resolveRoute("api/admin/plugins/registry/artifact.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/admin/plugins/[id]/update",
 		entrypoint: resolveRoute("api/admin/plugins/[id]/update.ts"),

package/src/astro/integration/runtime.ts

@@ -527,6 +527,14 @@ export interface EmDashConfig {
 		/** URL or path to a custom favicon for the admin panel. */
 		favicon?: string;
 	};
+
+	/**
+	 * Version of Astro the host project is building with. Populated by the
+	 * integration's `astro:config:setup` hook (not authored by the user) and
+	 * surfaced to the admin and the registry install gate so a plugin's
+	 * `env:astro` requirement can be evaluated against the real host version.
+	 */
+	astroVersion?: string;
 }
 
 const STORED_CONFIG_KEY = Symbol.for("emdash:stored-config");

package/src/astro/middleware.ts

@@ -51,6 +51,7 @@ import {
 	runWithContext,
 } from "../request-context.js";
 import type { EmDashConfig } from "./integration/runtime.js";
+import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
 import type { EmDashHandlers } from "./types.js";
 
 // Cached runtime instance (persists across requests within worker)
@@ -368,8 +369,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					try {
 						const runtime = await getRuntime(config, initSubTimings);
 						setupVerified = true;
+						const handlePublicPluginApiRoute = createPublicPluginApiRouteHandler(runtime);
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
 						locals.emdash = {
+							handlePublicPluginApiRoute,
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
@@ -496,6 +499,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 					// Plugin routes
 					handlePluginApiRoute: runtime.handlePluginApiRoute.bind(runtime),
+					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
 
 					// Media provider methods

package/src/astro/public-plugin-api-routes.ts

@@ -0,0 +1,41 @@
+import type { HandlerResponse } from "./types.js";
+
+export type PublicPluginApiRouteHandler = (
+	pluginId: string,
+	method: string,
+	path: string,
+	request: Request,
+) => Promise<HandlerResponse>;
+
+interface PublicPluginApiRouteRuntime {
+	getPluginRouteMeta(pluginId: string, path: string): { public: boolean } | null;
+	handlePluginApiRoute(
+		pluginId: string,
+		method: string,
+		path: string,
+		request: Request,
+	): Promise<HandlerResponse>;
+}
+
+function pluginRouteNotFound(): HandlerResponse {
+	return {
+		success: false,
+		error: {
+			code: "NOT_FOUND",
+			message: "Plugin route not found",
+		},
+	};
+}
+
+export function createPublicPluginApiRouteHandler(
+	runtime: PublicPluginApiRouteRuntime,
+): PublicPluginApiRouteHandler {
+	return async (pluginId, method, path, request) => {
+		const meta = runtime.getPluginRouteMeta(pluginId, path);
+		if (meta?.public !== true) {
+			return pluginRouteNotFound();
+		}
+
+		return runtime.handlePluginApiRoute(pluginId, method, path, request);
+	};
+}

package/src/astro/routes/api/admin/plugins/registry/[id]/update.ts

@@ -9,6 +9,7 @@
  * routes and `confirmRouteVisibilityChanges` is absent.
  */
 
+import { hostEnvFromVersions } from "@emdash-cms/registry-client/env";
 import type { APIRoute } from "astro";
 import { z } from "zod";
 
@@ -17,6 +18,8 @@ import { apiError, handleError, unwrapResult } from "#api/error.js";
 import { handleRegistryUpdate } from "#api/index.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 
+import { VERSION } from "../../../../../../../version.js";
+
 export const prerender = false;
 
 const updateBodySchema = z.object({
@@ -64,6 +67,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 				version: body.version,
 				confirmCapabilityChanges: body.confirmCapabilityChanges,
 				confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+				hostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),
 			},
 		);