feat: support raw plugin HTTP requests and responses

[ttmx]

What does this PR do?

Adds raw request and response support to native and sandboxed plugin API routes.

Plugin authors can set body: "text" or body: "bytes" to receive the decoded request body through ctx.input. Omitting body preserves the existing JSON and query-string behavior. Route handlers can return a Web API Response to control the response body, status, and headers without the standard JSON envelope.

The route options are preserved through both plugin bundlers and manifests. The workerd sandbox transports byte inputs as base64 and reconstructs custom responses across the isolate boundary.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md

• pnpm typecheck passes

• pnpm lint passes

• pnpm test passes (or targeted tests for my change)

• pnpm format has been run

• I have added/updated tests for my changes (if applicable)

• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main. No admin UI strings changed.

• I have added and reviewed the user-facing changeset (if this PR changes a published package)

• New features link to approved Discussions:
  Proposal: first-class native plugin HTTP, asset, and CSP contracts #2337
  Plugin routes should support raw responses (custom content-type, headers) #1003
  Raw request body access for plugin routes (webhook signature verification) #2546

• I have included screenshots below if this PR changes the UI. No UI changed.

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: OpenAI Codex (GPT-5.6 Sol/Terra/Luna)

Screenshots / test output

Not applicable; this PR does not change the UI.

Verified locally:

• Core raw-route, cache, bundling, manifest, and route tests: 128 passed
• Plugin CLI bundle tests: 12 passed
• Workerd raw-route and response transport tests: 6 passed
• Core, workerd, plugin CLI, and plugin-types typechecks
• Type-aware lint, Oxfmt, Prettier, and documentation build

[changeset-bot]

🦋 Changeset detected

Latest commit: cbc22c2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 23 packages

Name	Type
emdash	Minor
@emdash-cms/plugin-types	Minor
@emdash-cms/plugin-cli	Minor
@emdash-cms/cloudflare	Minor
@emdash-cms/sandbox-workerd	Minor
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/admin	Minor
@emdash-cms/registry-verification	Patch
@emdash-cms/release-service	Patch
@emdash-cms/labeler	Patch
@emdash-cms/release-action	Patch
@emdash-cms/release-verifier	Patch
@emdash-cms/auth	Minor
@emdash-cms/blocks	Minor
create-emdash	Minor
@emdash-cms/gutenberg-to-portable-text	Minor
@emdash-cms/x402	Minor
@emdash-cms/auth-atproto	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Scope check

This PR changes 1,069 lines across 36 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@3073

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@3073

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@3073

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@3073

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@3073

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@3073

emdash

npm i https://pkg.pr.new/emdash@3073

create-emdash

npm i https://pkg.pr.new/create-emdash@3073

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@3073

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@3073

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@3073

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@3073

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@3073

@emdash-cms/registry-moderation

npm i https://pkg.pr.new/@emdash-cms/registry-moderation@3073

@emdash-cms/registry-verification

npm i https://pkg.pr.new/@emdash-cms/registry-verification@3073

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@3073

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@3073

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@3073

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@3073

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@3073

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@3073

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@3073

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@3073

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@3073

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@3073

commit: cbc22c2

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat(plugins): return a Response from a route handler to serve non-JSON content #2162 (3 shared files)
• Fix config plugin display metadata #2817 (4 shared files)
• feat(core): built-in SMTP email transport for generic SMTP credentials #2156 (4 shared files)
• feat(plugins): opt-in raw request body for native plugin routes #1983 (3 shared files)
• feat(plugins): add revision based conditional writes to storage and KV #2980 (3 shared files)
• feat: cache purge API (object cache + native Workers Caching) #2297 (5 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.