feat(plugins): predicate-guarded atomic updateIf for plugin storage (no-oversell)

.changeset/README.md

@@ -1,8 +1,115 @@
-# Changesets
+# Writing and reviewing changesets
 
-Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
-with multi-package repos, or single-package repos to help you version and publish your code. You can
-find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+A changeset determines the version bump for a published package, and its description becomes public documentation in the package CHANGELOG. Readers commonly encounter it while deciding whether and how to upgrade. Write and review it for someone who runs the package, not someone who has read the pull request or diff.
 
-We have a quick list of common questions to get you started engaging with this project in
-[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)
+## When to add a changeset
+
+Add a changeset for any change to a published package's behavior or API, including bug fixes, features, and behavior-changing refactors. Without one, the change will not trigger a release.
+
+- Multi-package changes need one changeset listing all affected packages.
+- A pull request with several distinct changes can include one changeset per change; each becomes a separate CHANGELOG entry.
+- Several pull requests that build one feature for the same release, such as a stack of dependent pull requests, need one changeset describing the complete user-facing capability. Put it in one pull request in the stack rather than documenting the implementation sequence. Use one changeset only when release coordination guarantees that every pull request will ship together; otherwise, each independently releasable pull request needs its own changeset.
+- Docs-only, test-only, CI/tooling, demo, and template changes do not need a changeset. [`config.json`](config.json) lists packages that are excluded from releases.
+
+Create a changeset with the following command, then edit the generated Markdown file:
+
+```bash
+pnpm changeset
+```
+
+The pull request author selects the affected packages and bump type in the changeset frontmatter. Use `patch` for bug fixes and small improvements, and `minor` for new backwards-compatible features. EmDash does not currently accept `major` bumps while it is pre-1.0. A breaking change or significant default change requires prior maintainer approval; use the package and bump strategy agreed with the maintainers.
+
+## Lead with the released behavior
+
+Lead with a present-tense verb such as **Fixes**, **Adds**, **Updates**, **Removes**, or **Deprecates**. In the opening sentence:
+
+- Name the user-facing API, option, command, component, or behavior when readers will recognize it.
+- Identify who is affected and what they can now do, or state the observable problem that is fixed.
+- Describe the released behavior, not file names, private functions, refactors, queries, or implementation choices.
+
+Give detail in proportion to the impact. One specific sentence is often enough for a patch. A significant minor feature usually needs the capability, basic usage, defaults and compatibility, affected environments, and any action readers must take. Put the most important capability first; do not bury it under incidental fixes or implementation details.
+
+Breaking changes and default changes must be unmistakable. State who is affected, the previous and current behavior, the action required to migrate, and how to restore the previous behavior when that is possible. Prefer a minimal configuration or before-and-after example over a general warning.
+
+Longer entries can use Markdown headings, but start at h4 (`####`). Changesets are embedded below headings in generated CHANGELOG files, so h2 or h3 headings break the document hierarchy.
+
+Do not keep useful explanations or examples only in a changeset or PR description. Add them to the canonical feature or upgrade documentation too; the CHANGELOG is usually read once, while the docs remain the reference.
+
+## Examples
+
+The following patch entry names the affected command and the problem a script author observes:
+
+```md
+---
+"emdash": patch
+---
+
+Fixes `emdash migrate --json` so progress messages go to stderr, allowing scripts to parse stdout as JSON.
+```
+
+The following minor-feature entry explains the capability, basic usage, and exit-code contract:
+
+````md
+---
+"emdash": minor
+---
+
+Adds `--check` to `emdash migrate` so deployment pipelines can detect pending or unknown migration records without changing the database.
+
+Run the check after deploying the application artifact that produced the migration manifest:
+
+```sh
+pnpm exec emdash migrate --check
+```
+
+The command exits with `0` when the database matches the build, `2` when known migrations are pending, and `3` when the database contains migration records unknown to the build. It works with every database adapter supported by the migration manifest.
+````
+
+The following approved default-change entry records its `minor` bump and makes the impact and reversion path explicit:
+
+````md
+---
+"emdash": minor
+---
+
+Updates `memoryCache()` to use a five-minute default TTL instead of one hour, so sites using the in-memory object cache refresh cached pages more frequently after an upgrade.
+
+Sites that depend on the previous one-hour lifetime can keep it explicitly:
+
+```ts
+objectCache: memoryCache({ defaultTtl: 3600 });
+```
+
+#### What should I do?
+
+Set `defaultTtl: 3600` before upgrading if the shorter cache lifetime would add unacceptable load to your site.
+````
+
+Use the same level of detail for a breaking change: name the removed or changed surface in the first sentence, then provide the smallest working migration. Do not submit a breaking change until maintainers have approved its package and release strategy.
+
+## Bad and good descriptions
+
+These comparisons show the difference between technically related prose and useful release documentation:
+
+```diff
+- Fixes a bug in media handling.
++ Fixes R2 media uploads larger than 10 MB failing before the upload begins.
+```
+
+```diff
+- Refactors `hydrateEntryBylines` to chunk SQL IN clauses.
++ Fixes D1 errors when loading an entry with more bylines than the database bind-parameter limit.
+```
+
+```diff
+- Updates migration status handling and exit codes.
++ Adds `emdash migrate --check` so deployment pipelines can detect pending or unknown migrations without changing the database.
+```
+
+## Review changesets as documentation
+
+Request a rewrite when an entry is vague, describes internal mechanics, reads like a commit message, buries a significant capability under incidental details, or does not help readers decide whether the release matters to them. Frontmatter validity and technical accuracy are necessary but not sufficient.
+
+Review the description as documentation alongside the bump type and package list.
+
+For Changesets CLI and configuration behavior, see the [Changesets documentation](https://github.com/changesets/changesets/tree/main/docs).

.changeset/attribution-2881.md

@@ -0,0 +1,10 @@
+---
+"emdash": patch
+"@emdash-cms/plugin-audit-log": patch
+---
+
+Fixes content attribution for authenticated REST, visual editing, and MCP saves.
+
+- Revisions record the acting user without changing the entry owner. MCP updates preserve the existing owner, and actorless internal writes leave revision attribution unset instead of inferring it from ownership.
+- `content:beforeSave` and `content:afterSave` receive an actor snapshot with the authenticated user's `id` and `role`. The snapshot is isolated between hooks so one plugin cannot change the attribution seen by another.
+- The audit-log plugin stores the actor ID as `userId` on content create and update entries.

.changeset/bright-plugins-name.md

@@ -0,0 +1,7 @@
+---
+"@emdash-cms/admin": minor
+---
+
+Adds public names for registry plugins in the `@publisher.example/plugin-slug` format. Registry results and installed-plugin cards display the verified public name and link to a handle-based detail URL, while exact public-name searches open the matching package.
+
+When a publisher handle conclusively fails identity verification, the admin displays **INVALID HANDLE** and prevents installation. Temporary lookup failures fall back to the stable publisher identifier without marking the handle invalid.

.changeset/bright-snapshots-travel.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Fixes snapshot exports and content backups on PostgreSQL so preview snapshots, manual backups, and scheduled backups include the same content and portable schema metadata as SQLite.

.changeset/calm-bindings-report.md

@@ -0,0 +1,6 @@
+---
+"emdash": patch
+"@emdash-cms/cloudflare": patch
+---
+
+Fixes Cloudflare binding failures during runtime startup returning `NOT_CONFIGURED` from EmDash API routes. Missing D1, R2, KV, Durable Object, and Hyperdrive bindings now return `BINDING_NOT_FOUND` with the binding-specific setup message. Invalid KV and Hyperdrive binding configuration returns `CONFIGURATION_ERROR`.

.changeset/calm-bundles-stay.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Fixes overlapping marketplace or registry plugin updates and downgrades deleting the active plugin bundle. Updates retain previous version bundles so delayed work cannot remove a version that becomes active again.

.changeset/calm-keys-guide.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/admin": patch
+---
+
+Improves passkey account creation with device-aware guidance before the browser prompt. EmDash explains what a passkey is and where it is saved, detects when a built-in authenticator is unavailable, and guides users through Windows Hello, another device, or a security key. Compatible browsers receive a preference for the selected path, while the browser continues to control the secure passkey prompt.

.changeset/calm-registry-first-releases.md

@@ -0,0 +1,10 @@
+---
+"@emdash-cms/registry-lexicons": minor
+"@emdash-cms/registry-client": minor
+"@emdash-cms/admin": patch
+"emdash": patch
+---
+
+Adds a fail-closed first-release exemption to the plugin registry's optional minimum release age policy. A package's first release can install immediately only when the aggregator reports exactly one retained release and confirms that it continuously observed the package's release history.
+
+Existing packages, backfilled packages, and packages with missing or incomplete history remain subject to the configured holdback. Deleted releases still count, and explicit publisher or package exemptions continue to work.

.changeset/calm-themes-follow.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/admin": patch
+---
+
+Fixes the admin appearance toggle so every click changes the visible color scheme. The admin follows the system preference whenever the selected appearance matches it.

.changeset/collection-sidebar-groups.md

@@ -0,0 +1,6 @@
+---
+"emdash": minor
+"@emdash-cms/admin": minor
+---
+
+Adds a `group` setting to collections. Collections that share a group render as one collapsible folder in the admin sidebar, positioned where the first of them appears; a taxonomy joins the folder when every collection it is assigned to is shown in that folder. A folder you have not touched opens while one of its members is active; once you open or close it yourself, the sidebar remembers that choice in the browser. Set the group in the content type editor under Navigation, in seed files, or through the schema API and the MCP collection tools; leaving it empty keeps today's flat list.

.changeset/complete-pt-br-admin-translation.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/admin": patch
+---
+
+Completes the Brazilian Portuguese (`pt-BR`) admin translation. Brazilian Portuguese admins now see localized text throughout the admin instead of falling back to English for 1,170 of 2,292 strings.

.changeset/config.json

@@ -37,6 +37,7 @@
 		"@emdash-cms/playground",
 		"@emdash-cms/plugin-api-test",
 		"@emdash-cms/plugin-marketplace-test",
+		"@emdash-cms/plugin-mcp-smoke",
 		"@emdash-cms/plugin-sandboxed-test",
 		"@emdash-cms/template-blank",
 		"@emdash-cms/template-blog",

.changeset/emdashhead-seo-panel.md

@@ -0,0 +1,29 @@
+---
+"emdash": minor
+---
+
+`<EmDashHead>` now applies the entry's SEO panel values (title, description, image, canonical, noindex) automatically on server-rendered content pages. Previously the panel was silently ignored unless the page wired `getSeoMeta()` by hand.
+
+#### Affected pages
+
+Pages that include `<EmDashHead>` and fetch their entry through `getEmDashEntry()` receive the overlay. This includes warm object-cache hits, because `getEmDashEntry()` primes the same request-scoped cache from the cached snapshot when the loader never runs. Multi-entry collection results (e.g. `getEmDashCollection()`) are not currently covered.
+
+#### What editors can override
+
+Editor-set panel values replace the template-provided base fields for `description`, `og:title`, `og:description`, `og:image`, the canonical URL, and robots. They also feed the JSON-LD structured data, so head tags and structured data stay in sync.
+
+#### What plugins see
+
+Plugin `page:metadata` and `page:fragments` hooks — in the head and in the body components — receive the overlaid page context, but plugin contributions still win via first-wins dedup.
+
+#### What does not change
+
+- The `<title>` element remains the template's responsibility.
+- Prerendered pages and pages that bypass `<EmDashHead>` keep using `getSeoMeta()`.
+- No additional database query is made; the panel data rides along on the entry query the page already runs.
+
+#### Canonical and image URL resolution
+
+`getSeoMeta()` now resolves an explicit SEO panel canonical through the same resolver as `<EmDashHead>`: root-relative values (`/custom-path`) are absolutized against the site URL when one is configured (previously they were returned unchanged), and protocol-relative values (`//host/path`) pass through untouched. The same panel value now produces the same canonical URL on both paths.
+
+Protocol-relative SEO image references (`//cdn.example.com/x.png`) are no longer prefixed with the site URL, which previously produced a broken doubled-path URL. This corrects `og:image` output everywhere the panel image is resolved: the `<EmDashHead>` overlay, `getSeoMeta()`, and image URLs in the sitemap.

.changeset/entry-edit-lock.md

@@ -0,0 +1,30 @@
+---
+"emdash": minor
+"@emdash-cms/admin": minor
+---
+
+Adds an edit lock per content entry, so two people no longer discover a collision only after both have done the work.
+
+Opening an entry in the admin takes a lock on it. A second editor is told who has it and chooses between opening the entry read-only, where nothing they type can be lost to a refused save, and taking it over. After a take-over, the previous holder is told within two minutes that the entry moved on, their next save is refused, and a banner names who holds it now.
+
+The lock lasts seven minutes. The admin renews it every two minutes while the entry is open, so a pause in typing does not lose it, and every save on the entry extends it too. Leaving the editor or closing the tab releases it, as does moving the entry to the trash; a tab that loses power or network lets it lapse.
+
+#### Who is newly refused
+
+Scripts, API tokens and the CLI that update, delete, publish, unpublish, schedule or discard an entry while an editor has it open in the admin now receive `409 ENTRY_LOCKED` where the write used to succeed. This applies to every collection once the migration has run. The response's `error.message` names the holder and `error.details` carries their `userId`, `userName`, `acquiredAt` and `expiresAt`. Pass `"overrideLock": true` in the request body to write anyway, or `?overrideLock=true` on `DELETE`, which has no body. The CLI takes `--override-lock` on `content update`, `content delete`, `content publish`, `content unpublish` and `content schedule`. The MCP content tools do not honour the lock yet.
+
+Locks are per entry and per locale, so two translations of the same entry can be edited at once.
+
+Take or read a lock directly through `GET`, `POST` and `DELETE` on `/_emdash/api/content/{collection}/{id}/lock`.
+
+#### Turning it off
+
+Locking is on for every collection. Switch it off under **Content Types** → your collection → **Edit locking**, with `editLocking: false` in a seed file, or through `schema_update_collection`:
+
+```json
+{ "slug": "posts", "editLocking": false }
+```
+
+#### Upgrading
+
+Includes database migration `075_entry_edit_locks`. Projects on the default `auto` runtime migration mode need no action. Projects that migrate as a deployment step: run `emdash migrate` before deploying this version.

.changeset/hidden-collections-dashboard-quick-action.md

@@ -0,0 +1,5 @@
+---
+"@emdash-cms/admin": patch
+---
+
+Fixes the dashboard showing a "+ New …" quick action for collections marked `hidden`, matching the sidebar link the flag already removes.

.changeset/moderation-manipulation-findings.md

@@ -0,0 +1,6 @@
+---
+"@emdash-cms/registry-moderation": minor
+"@emdash-cms/registry-lexicons": minor
+---
+
+Adds `moderation-manipulation` findings so labelers can distinguish direct attempts to bypass automated moderation from quoted or descriptive discussion of prompt injection.

.changeset/olive-crabs-repeat.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Fixes visual editing on list pages. Entries from `getEmDashCollection` now carry a working `edit` proxy in edit mode, so spreading `{...entry.edit.title}` renders the annotation and the toolbar makes the element editable. Previously every collection entry received a no-op proxy in every mode, so only pages built from `getEmDashEntry` were click-to-edit — fields shown exclusively in a list, and collections with no detail page, could not be edited on the page at all.

.changeset/permalink-date-tokens.md

@@ -0,0 +1,6 @@
+---
+"emdash": minor
+"@emdash-cms/admin": minor
+---
+
+Adds WordPress-style date tokens to collection URL patterns. `url_pattern` now supports `{year}`, `{month}`, `{day}`, `{hour}`, `{minute}`, `{second}` (resolved from the entry's publish date, zero-padded) alongside `{slug}` and `{id}` — so you can reproduce permalinks like `/{year}/{month}/{day}/{slug}.html`. The tokens resolve everywhere the pattern is used: sitemap canonical URLs, hreflang alternates, navigation menu links, slug-change auto-redirects, and the admin's preview and "View published" links. Tokens stay literal when an entry has no publish date, so canonical URLs remain stable across edits.

.changeset/plugin-http-external-targets.md

@@ -0,0 +1,10 @@
+---
+"emdash": patch
+"@emdash-cms/sandbox-workerd": patch
+---
+
+Fixes plugin HTTP requests with `allowedHosts` so initial URLs and redirects also pass SSRF validation. Requests are rejected when URL or DNS validation identifies an unsupported scheme or a non-public address.
+
+Existing callers of the shared outbound URL validator also reject these non-public ranges.
+
+The default validator resolves public hostnames through `cloudflare-dns.com` before dispatch. Self-hosted deployments must permit access to that endpoint when using the default resolver.