A full-stack TypeScript CMS built on Astro and Cloudflare. EmDash takes the ideas that made WordPress dominant -- extensibility, admin UX, a plugin ecosystem -- and rebuilds them on serverless, type-safe foundations. Plugins run in sandboxed Worker isolates, solving the fundamental security problem with WordPress's plugin architecture.
Important
EmDash depends on Dynamic Workers to run secure sandboxed plugins. Dynamic Workers are currently only available on paid accounts. Upgrade your account (starting at $5/mo) or comment out the worker_loaders block of your wrangler.jsonc configuration file to disable plugins.
npm create emdash@latestOr deploy directly to your Cloudflare account:
EmDash runs on Cloudflare (D1 + R2 + Workers) or any Node.js server with SQLite. No PHP, no separate hosting tier -- just deploy your Astro site.
Use EmDash as the CMS and Ecommerce service for an organization's Astro product. The product keeps its own frontend and calls EmDash through its HTTP API.
- Node.js 22 or newer
- An Astro 6 project
- A persistent database: SQLite for Node.js, PostgreSQL/libSQL, or Cloudflare D1
- Persistent media storage: local files for Node.js or R2/S3 for deployed environments
EMDASH_ENCRYPTION_KEYfor encrypted plugin and payment configuration
Install EmDash in the product:
pnpm add emdashGenerate the local encryption key once:
pnpm exec emdash secrets generate --write .envConfigure the integration in the product's astro.config.mjs:
import { defineConfig } from "astro/config";
import emdash, { local } from "emdash/astro";
import { sqlite } from "emdash/db";
export default defineConfig({
integrations: [
emdash({
database: sqlite({ url: "file:./data/emdash.db" }),
storage: local({
directory: "./uploads",
baseUrl: "/_emdash/api/media/file",
}),
}),
],
});Start the product locally:
pnpm devThe product can call the public content and Ecommerce endpoints from its server or browser code:
const products = await fetch("/_emdash/api/shop/products").then((response) => response.json());
const content = await fetch("/_emdash/api/content/posts").then((response) => response.json());Ecommerce uses the /_emdash/api/shop base path: products are available at GET /_emdash/api/shop/products, and orders are created with POST /_emdash/api/shop/orders. Admin shop endpoints require an authenticated user with the corresponding shop permission.
For a product in this monorepo, keep the workspace dependency and run the demo with:
pnpm --filter emdash-demo devUse the configuration reference for PostgreSQL, libSQL, D1, R2, and production migration settings.
EmDash ships with three starter templates:
|
A classic blog with sidebar widgets, search, and RSS.
|
A conversion-focused landing page with pricing and contact form.
|
A visual portfolio for showcasing creative work.
|
WordPress was built for a different era. Running WordPress today means managing PHP alongside JavaScript, layering caches to get acceptable performance, and knowing that 96% of WordPress security vulnerabilities come from plugins. EmDash is what WordPress would look like if you started from scratch with today's tools.
Sandboxed plugins. WordPress plugins have full access to the database, filesystem, and user data. A single vulnerable plugin can compromise the entire site. EmDash plugins run in isolated Worker sandboxes via Dynamic Worker Loaders, each with a declared capability manifest. A plugin that requests read:content and email:send can do exactly that and nothing else.
export default () =>
definePlugin({
id: "notify-on-publish",
capabilities: ["read:content", "email:send"],
hooks: {
"content:afterSave": async (event, ctx) => {
if (event.content.status !== "published") return;
await ctx.email.send({
to: "editors@example.com",
subject: `New post: ${event.content.title}`,
});
},
},
});Structured content, not serialized HTML. WordPress stores rich text as HTML with metadata embedded in comments -- tying your content to its DOM representation. EmDash uses Portable Text, a structured JSON format that decouples content from presentation. Your content can render as a web page, a mobile app, an email, or an API response without parsing HTML.
Built for agents. EmDash ships with agent skills for building plugins and themes, a CLI that lets agents manage content and schema programmatically, and a built-in MCP server so AI tools like Claude and ChatGPT can interact with your site directly.
Runs anywhere. EmDash uses portable abstractions at every layer -- Kysely for SQL, S3 API for storage -- that work with SQLite, D1, Turso, PostgreSQL, R2, AWS S3, or local files. It runs best on Cloudflare, but it's not locked to it.
EmDash is an Astro integration. Add it to your config and you get a complete CMS: admin panel, REST API, authentication, media library, and plugin system.
// astro.config.mjs
import emdash from "emdash/astro";
import { d1 } from "emdash/db";
export default defineConfig({
integrations: [emdash({ database: d1() })],
});Content types are defined in the database, not in code. Non-developers create and modify collections through the admin UI. Each collection gets a real SQL table with typed columns. Developers generate TypeScript types from the live schema:
npx emdash typesQuery content using Astro's Live Collections -- no rebuilds, no separate API:
---
import { getEmDashCollection } from "emdash";
const { entries: posts } = await getEmDashCollection("posts");
---
{posts.map((post) => <article>{post.data.title}</article>)}Content -- Blog posts, pages, custom content types. Rich text editing via TipTap with Portable Text storage. Revisions, drafts, scheduled publishing, full-text search (FTS5), inline visual editing.
Admin -- Full admin panel with visual schema builder, media library (drag-drop uploads via signed URLs), navigation menus, taxonomies, widgets, and a WordPress import wizard.
Ecommerce -- Product catalog, checkout orders, payment status, delivery zones, customer history, and order management from the admin panel.
Auth -- Passkey-first (WebAuthn) with OAuth and magic link fallbacks. Role-based access control: Administrator, Editor, Author, Contributor.
Plugins -- definePlugin() API with lifecycle hooks, KV storage, settings, admin pages, dashboard widgets, custom block types, and API routes. Sandboxed execution on Cloudflare via Dynamic Worker Loaders.
Agents -- Skill files for AI-assisted plugin and theme development. CLI for programmatic site management. Built-in MCP server for direct AI tool integration.
WordPress migration -- Import posts, pages, media, and taxonomies from WXR exports, the WordPress REST API, or WordPress.com. Agent skills help port plugins and themes.
| Layer | Cloudflare | Also works with |
|---|---|---|
| Database | D1 | SQLite, Turso/libSQL, PostgreSQL |
| Storage | R2 | AWS S3, any S3-compatible service, local filesystem |
| Sessions | KV | Redis, file-based |
| Plugins | Worker isolates (sandboxed) | In-process (safe mode) |
EmDash is in beta preview. We welcome contributions, feedback, plugins, themes, and ideas.
npm create emdash@latestSee the documentation for guides, API reference, and plugin development.
This is a pnpm monorepo. To contribute:
git clone https://github.com/emdash-cms/emdash.git && cd emdash
pnpm install
pnpm buildRun the demo (Node.js + SQLite, no Cloudflare account needed):
pnpm --filter emdash-demo seed
pnpm --filter emdash-demo devOpen the admin at http://localhost:4321/_emdash/admin.
pnpm test # run all tests
pnpm typecheck # type check
pnpm lint:quick # fast lint (< 1s)
pnpm format # format with oxfmtSee CONTRIBUTING.md for the full contributor guide.
packages/
core/ Astro integration, APIs, admin UI, CLI
auth/ Authentication library
blocks/ Portable Text block definitions
cloudflare/ Cloudflare adapter (D1, R2, Worker Loader)
plugins/ First-party plugins (forms, embeds, SEO, audit-log, etc.)
create-emdash/ npm create emdash scaffolding
gutenberg-to-portable-text/ WordPress block converter
templates/ Starter templates (blog, marketing, portfolio, starter, blank)
demos/ Development and example sites
docs/ Documentation site (Starlight)