feat(media): record what depends on an asset, starting with avatars by mostafasadeghidev · Pull Request #505 · CoreBunch/Instatic

mostafasadeghidev · 2026-09-05T19:44:26Z

media_usage_refs has existed since the media schema landed and nothing has ever written to it. So the library cannot tell a decorative upload from an asset the product depends on — and one case of that loses data quietly.

How it goes wrong

A profile picture is stored as an ordinary media_assets row. Nothing marks it: no role column, no filter hiding it, nothing in the grid to distinguish it from any other image.

So tidying the library sweeps it into the trash. Purging hard-deletes the row. users.avatar_media_id goes to NULL through its on delete set null foreign key. The profile falls back to a Gravatar identicon and nothing anywhere says why.

On the install where this was found it had happened three times before anyone connected the two — each time read as "the avatar disappears after an update".

What this adds

setMediaUsageRef points a (kind, id) pair at an asset, deleting the previous row first so a reference moves rather than accumulating. Four avatar changes leave one row, not four — otherwise the fifth deletion would warn about pictures replaced months ago and the warning becomes noise. Clearing an avatar clears the reference: the asset deliberately stays in the library, but nothing depends on it any more.

listMediaUsageRefs answers for a whole selection in one query, since the question is always asked about a selection, and resolves a label the operator can act on — "Ada Lovelace", not "u1".

POST /media/usage exposes it. A POST because a hundred ids is the wrong shape for a query string.

buildUsageWarning is the sentence a confirmation shows. Kept pure and separately tested because the rules are judgement, not mechanics:

Separate. "1 of 11 is still in use" lets the operator see the other ten are safe. A blanket warning is one people learn to click past.
Name it. "profile picture — Ada Lovelace", not "has a reference".
Do not block. Deleting an in-use asset is legitimate — replacing an avatar begins exactly that way. The confirmation informs; the operator decides.

Migration 032 backfills a reference for every avatar already set. Without it the feature is silent on exactly the installs it was built for: an existing avatar carries no reference, so the first confirmation that warns before a permanent delete would say nothing about it, and the operator would have to re-upload the same picture to be told it matters. Idempotent by construction — not exists on the same key setMediaUsageRef writes, which is also what makes a backfilled row indistinguishable from an app-written one, so a later avatar change moves it instead of leaving the old picture warning forever.

It takes 032, between two ids other open PRs claim: 031 (#495, 031_installed_plugins_source) and 033 (#335). Site branches took 027–030 since this was opened. Ids are only ever sorted, so the gap costs nothing, and whichever of the two lands first neither has to be renumbered. This one could move safely anyway — it inserts only where not exists, so an installation that recorded it under another number runs it again and adds nothing. An ALTER like #335's cannot.

Scope

ref_kind namespaces the source, so favicons, page nodes and CMS cells can register later without touching consumers. This PR registers avatars, reads them back, and builds the copy. The confirmation that renders it is a separate PR, so this one is reviewable as the data layer it is.

bun test src/__tests__/server/mediaUsageRefs.test.ts  11 pass
bun test src/__tests__/media/usageWarning.test.ts      8 pass
tsc -b, eslint                                         clean

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

`media_usage_refs` has existed since the media schema landed and nothing has ever written to it. So the library cannot tell a decorative upload from an asset the product depends on, and one case of that loses data quietly. A profile picture is stored as an ordinary `media_assets` row. Nothing marks it: no `role` column, no filter hiding it, nothing in the grid to distinguish it from any other image. Tidying the library sweeps it into the trash, purging hard-deletes the row, and `users.avatar_media_id` goes to NULL through its `on delete set null` foreign key. The profile falls back to a Gravatar identicon and nothing anywhere says why. On one install it happened three times before anyone connected the two. This wires the table that was already designed for it. `setMediaUsageRef` points a `(kind, id)` pair at an asset, deleting the previous row first so a reference MOVES rather than accumulating — four avatar changes leave one row, not four, or the fifth deletion would warn about pictures replaced months ago and the warning becomes noise. Clearing an avatar clears the reference, because the asset deliberately stays in the library but nothing depends on it any more. `listMediaUsageRefs` answers for a whole selection in one query, since the question is always asked about a selection, and resolves a label an operator can act on — "Ada Lovelace", not "u1". `POST /media/usage` exposes it: a POST because a hundred ids is the wrong shape for a query string. `ref_kind` namespaces the source, so favicons, page nodes and CMS cells can register without touching consumers. This change only registers avatars and only reads them back; the confirmation copy that consumes it is separate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…s in use `buildUsageWarning` turns the reference rows into the sentence a destructive confirmation puts above its buttons, and `useMediaWorkspace.lookupUsage` fetches them. Kept as a pure function with its own tests because the rules are judgement, not mechanics, and each one came from imagining the actual moment: eleven files selected, one of them a profile picture. SEPARATE. "1 of 11 is still in use" lets the operator see the other ten are safe. A blanket "some of these are in use" is the kind of warning people learn to click past, because it never says which. NAME IT. "profile picture — Ada Lovelace", not "has a reference". They have to recognise what they are about to lose. DO NOT BLOCK. Deleting an in-use asset is a legitimate thing to want — replacing an avatar begins exactly that way. The confirmation informs; the operator still decides. Past three named items it summarises, or the dialog becomes a wall of text nobody reads. An asset two things depend on counts once, because one file is what disappears. And the lookup never throws: it decorates a confirmation that must still appear if the request fails, so a network blip degrades to the plain warning rather than blocking the delete. The confirmation itself lives in a separate PR — this is the data and the copy it will render. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…s about it Wires the dormant `media_usage_refs` table so the library can tell a decorative upload from an asset the product depends on. Avatars were ordinary library rows with no marker — purging one hard-deleted it and `users.avatar_media_id` went quietly to NULL through its foreign key. Fork stack: PR CoreBunch#505.

…at had no gate The fork gate stopped at CoreBunch#359. Everything merged onto the stack since — CoreBunch#497 through CoreBunch#501, and now CoreBunch#505 — was carried with nothing to catch it being dropped by a merge resolution, which is the exact failure the gate exists for. Pinning them turned one up immediately: CoreBunch#498's guard around `removePluginVersionAssets(…, fromVersion)` is gone, because CoreBunch#359 removed that call outright — an upgrade now leaves the old version's assets on disk so published pages keep resolving. What survives of CoreBunch#498 is the rollback guard, so that is what the row pins. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…t one Registering a usage reference on upload leaves every existing install in the one state the feature was built for and silent about it: an avatar set before this code shipped has no reference, so the first confirmation that warns before a permanent delete would say nothing about it. The operator would have to re-upload the same picture to be told it matters. The backfill inserts a `user.avatar` reference for every user who has one. Idempotent by construction — `not exists` on the same key `setMediaUsageRef` writes, which is also what makes the backfilled row indistinguishable from an app-written one, so a later avatar change MOVES it instead of leaving the old picture warning forever. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Site branches took 027–029 and the ISO timestamp rewrite took 030, so the avatar backfill moves from 028 to 032. It skips 031, which CoreBunch#335 now claims. Renumbering this one is safe in a way renumbering an ALTER is not: the backfill inserts only where `not exists`, so an installation that recorded it under 028 runs it again under 032 and inserts nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ide its new tone Brings in CoreBunch#505's renumbered backfill (032) and upstream main with it. `ConfirmDeleteContext` was the one conflict: site branches added a `tone` to the confirm request so a merge can ask without looking destructive, and this branch added `details` so a purge can say what is still in use. They are independent props, so the provider passes both. Site branches also made every draft read branch-scoped. This commit only supplies `MAIN_SCOPE` where the signatures now demand one — reading the other branches is a behaviour change, and it gets its own commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CoreBunch#498 landing Twenty upstream commits, including two of this stack's own PRs (CoreBunch#359, CoreBunch#498) merged exactly as submitted. Resolved hunk by hunk, and each file checked against the resolution its PR branch reached independently: - content.ts, import.ts — every handler gains `MAIN_SCOPE`; every `@own-created` access check stays on the resolved table. Identical to CoreBunch#335's branch. - ConfirmDeleteContext — upstream's `tone` beside this stack's `details`. Identical to CoreBunch#507's branch. - publishSite.ts — only an import collided; the file now matches upstream byte for byte, as it should once CoreBunch#359 has landed. Migrations are the one place the stack deliberately differs from the PRs. `025_data_tables_created_by_plugin` keeps its id: two installations recorded it, and the ALTER cannot run twice. Its comment now says what to do when CoreBunch#335 lands as `031_…`. The avatar backfill takes CoreBunch#505's `032` — safe to renumber because it inserts only where `not exists`. `contentUsage.ts` gets `MAIN_SCOPE` to type-check; reading every branch arrives with CoreBunch#507's merge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… 032 renumber The migration files already match CoreBunch#505's (the stack took 032 in the upstream merge), so this brings only the test's id. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CoreBunch#495 claims `031_installed_plugins_source` and CoreBunch#505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

The note still said CoreBunch#335 claims 031. It now claims 033, because CoreBunch#495 took 031 — the backfill stays at 032 between them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

… and 033 (CoreBunch#335) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com>

…ows it CoreBunch#335 merged with its ALTER as `031_data_tables_created_by_plugin`, so the two entries met at the end of both migration files. Both are kept, in id order: 031 then this PR's `032_backfill_avatar_usage_refs`. The note on 032 drops the ids that no longer apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Both PR branches merged upstream main and so carry `031_data_tables_ created_by_plugin` beside their `032` backfill. Taking them as-is would have brought 031 back onto this branch WITHOUT a conflict, re-running an ALTER both installations recorded as 025. Both migration files stay as the stack had them; the fork gate's duplicate-column check passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(import): map unsupported anchor targets to _self or _blank The anchor import rules copied target="" (and _top or a named frame) straight into the node. None of those values is in AnchorTargetSchema, so the publisher's fallback replaced the whole link with module defaults and the page shipped "Click here" pointing at "#". The schema now lives in @core/htmlAttributes with a normalizeAnchorTarget() helper the importer uses for both anchor rules: empty and _top import as _self, a named target as _blank, keywords match case-insensitively, and href and text are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed only when a second page existed, so a user who edited and published Home still saw "Not started" next to a Pages widget reporting 1 published. A one-page site could never complete the step at all. The step is now "Edit the Home page". It reads In progress from first boot and completes once the dashboard pages stats report at least one published page, which is the moment the site is actually on the frontend. The rules move into a pure deriveOnboardingFacts so they are unit-tested without the network; the hook feeds it the same pages stats endpoint the Pages widget already uses. Closes #223 * fix(data): author reassignment rides the row-access boundary (#625) PATCH /data/rows/:id/author read the target row with a bare getDataRow instead of loadRowForAccess, so a persona holding content.edit.any but not data.system.tables.read could read the full contents of any system-table row (unpublished pages and posts, author identity) and re-author it, while GET on the same row correctly answered 404. The handler now resolves the row through the same table-family plus ownership check every other row write uses. * fix(ai): read tools and the MCP relay decide row access with the HTTP rules (#626) * fix(ai): read tools and the MCP relay decide row access with the HTTP rules The content read tools (content_get_document, content_list_documents, content_search_documents) called the row repositories directly, so a caller holding ai.chat plus content.edit.own could read every other user's drafts and any system-table row through the tool surface, while GET /data/rows/:id for the same caller answered 404. The MCP relay carried its own copy of the ownership rule and skipped the table-family boundary altogether. One module now owns the decision. server/auth/dataAccess.ts holds the table-family and ownership predicates plus resolveRowAccess and rowVisibilityFor; the HTTP handlers, the read tools, and the MCP relay all call it with the identity behind the request. An architecture gate fails any direct row read under server/ai that bypasses it, because this class was fixed on the HTTP side once (GHSA-x69h) and came back through the next reader. * fix(data): drop the row read import the shared access helper made unused * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header (#627) * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header Without PUBLIC_ORIGIN the MCP OAuth issuer fell back to the inbound Host header, so an unauthenticated client could make the 401 challenge, both .well-known discovery documents, and the resource comparisons echo an attacker-controlled origin (GHSA-hgjv-q732-4phj). The issuer now comes only from the configured public origin; without one, loopback requests use their own origin so local development keeps working, and every other request has no issuer: discovery and the token endpoint answer 503, the 401 challenge drops resource_metadata, and OAuth grants are not looked up while personal access tokens keep working. The server warns at boot when no public origin is configured. * test(mcp): assert discovery origins by parsed origin, not string prefix * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: MelmacAlpha <github@201620.de> Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> Co-authored-by: Mostafa Sadeghi <205455727+mostafasadeghidev@users.noreply.github.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> Co-authored-by: Rick Caves <spcxai2025@gmail.com> Co-authored-by: David Babinec <49069339+DavidBabinec@users.noreply.github.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: Norbert Gocht <ngocht@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com>

…ition (#573) * fix(site-import): keep a repeated class rule at its later cascade position A stylesheet that styled the same bare class twice had its second rule merged into the first, so the merged rule sat before any rule written between the two occurrences and lost cascade ties it wins in a browser. Each occurrence is now its own rule at its own source position. Both stay class-kind through parsing so cross-sheet conflict detection still sees the file's full definition; the registry demotes repeats at commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed only when a second page existed, so a user who edited and published Home still saw "Not started" next to a Pages widget reporting 1 published. A one-page site could never complete the step at all. The step is now "Edit the Home page". It reads In progress from first boot and completes once the dashboard pages stats report at least one published page, which is the moment the site is actually on the frontend. The rules move into a pure deriveOnboardingFacts so they are unit-tested without the network; the hook feeds it the same pages stats endpoint the Pages widget already uses. Closes #223 * fix(data): author reassignment rides the row-access boundary (#625) PATCH /data/rows/:id/author read the target row with a bare getDataRow instead of loadRowForAccess, so a persona holding content.edit.any but not data.system.tables.read could read the full contents of any system-table row (unpublished pages and posts, author identity) and re-author it, while GET on the same row correctly answered 404. The handler now resolves the row through the same table-family plus ownership check every other row write uses. * fix(ai): read tools and the MCP relay decide row access with the HTTP rules (#626) * fix(ai): read tools and the MCP relay decide row access with the HTTP rules The content read tools (content_get_document, content_list_documents, content_search_documents) called the row repositories directly, so a caller holding ai.chat plus content.edit.own could read every other user's drafts and any system-table row through the tool surface, while GET /data/rows/:id for the same caller answered 404. The MCP relay carried its own copy of the ownership rule and skipped the table-family boundary altogether. One module now owns the decision. server/auth/dataAccess.ts holds the table-family and ownership predicates plus resolveRowAccess and rowVisibilityFor; the HTTP handlers, the read tools, and the MCP relay all call it with the identity behind the request. An architecture gate fails any direct row read under server/ai that bypasses it, because this class was fixed on the HTTP side once (GHSA-x69h) and came back through the next reader. * fix(data): drop the row read import the shared access helper made unused * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header (#627) * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header Without PUBLIC_ORIGIN the MCP OAuth issuer fell back to the inbound Host header, so an unauthenticated client could make the 401 challenge, both .well-known discovery documents, and the resource comparisons echo an attacker-controlled origin (GHSA-hgjv-q732-4phj). The issuer now comes only from the configured public origin; without one, loopback requests use their own origin so local development keeps working, and every other request has no issuer: discovery and the token endpoint answer 503, the 401 challenge drops resource_metadata, and OAuth grants are not looked up while personal access tokens keep working. The server warns at boot when no public origin is configured. * test(mcp): assert discovery origins by parsed origin, not string prefix * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(import): preserve repeats after empty conditional class rules --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: MelmacAlpha <github@201620.de> Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> Co-authored-by: Mostafa Sadeghi <205455727+mostafasadeghidev@users.noreply.github.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> Co-authored-by: Rick Caves <spcxai2025@gmail.com> Co-authored-by: David Babinec <49069339+DavidBabinec@users.noreply.github.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: Norbert Gocht <ngocht@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com>

…ks (#560) * fix(import): close each style block's open @media before joining blocks A browser parses each <style> element as its own stylesheet, so an unclosed @media or rule at the end of one block ends at that block. The importer joins a page's blocks into one source, so one missing `}` pulled every later block into the media query. Close each block's open braces, comment, or string before joining. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed only when a second page existed, so a user who edited and published Home still saw "Not started" next to a Pages widget reporting 1 published. A one-page site could never complete the step at all. The step is now "Edit the Home page". It reads In progress from first boot and completes once the dashboard pages stats report at least one published page, which is the moment the site is actually on the frontend. The rules move into a pure deriveOnboardingFacts so they are unit-tested without the network; the hook feeds it the same pages stats endpoint the Pages widget already uses. Closes #223 * fix(data): author reassignment rides the row-access boundary (#625) PATCH /data/rows/:id/author read the target row with a bare getDataRow instead of loadRowForAccess, so a persona holding content.edit.any but not data.system.tables.read could read the full contents of any system-table row (unpublished pages and posts, author identity) and re-author it, while GET on the same row correctly answered 404. The handler now resolves the row through the same table-family plus ownership check every other row write uses. * fix(ai): read tools and the MCP relay decide row access with the HTTP rules (#626) * fix(ai): read tools and the MCP relay decide row access with the HTTP rules The content read tools (content_get_document, content_list_documents, content_search_documents) called the row repositories directly, so a caller holding ai.chat plus content.edit.own could read every other user's drafts and any system-table row through the tool surface, while GET /data/rows/:id for the same caller answered 404. The MCP relay carried its own copy of the ownership rule and skipped the table-family boundary altogether. One module now owns the decision. server/auth/dataAccess.ts holds the table-family and ownership predicates plus resolveRowAccess and rowVisibilityFor; the HTTP handlers, the read tools, and the MCP relay all call it with the identity behind the request. An architecture gate fails any direct row read under server/ai that bypasses it, because this class was fixed on the HTTP side once (GHSA-x69h) and came back through the next reader. * fix(data): drop the row read import the shared access helper made unused * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header (#627) * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header Without PUBLIC_ORIGIN the MCP OAuth issuer fell back to the inbound Host header, so an unauthenticated client could make the 401 challenge, both .well-known discovery documents, and the resource comparisons echo an attacker-controlled origin (GHSA-hgjv-q732-4phj). The issuer now comes only from the configured public origin; without one, loopback requests use their own origin so local development keeps working, and every other request has no issuer: discovery and the token endpoint answer 503, the 401 challenge drops resource_metadata, and OAuth grants are not looked up while personal access tokens keep working. The server warns at boot when no public origin is configured. * test(mcp): assert discovery origins by parsed origin, not string prefix * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(import): close CSS strings after a trailing escape --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: MelmacAlpha <github@201620.de> Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> Co-authored-by: Mostafa Sadeghi <205455727+mostafasadeghidev@users.noreply.github.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> Co-authored-by: Rick Caves <spcxai2025@gmail.com> Co-authored-by: David Babinec <49069339+DavidBabinec@users.noreply.github.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: Norbert Gocht <ngocht@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com>

… non-secure origins (#576) * fix(agent): hash code assets without Web Crypto so AI tools work over non-secure origins The runtime code-asset tools hashed content with `crypto.subtle.digest`, which is only defined in a secure context (HTTPS or localhost). When the CMS is reached over a LAN/Tailscale IP on plain http:// — a non-secure context — `crypto.subtle` is undefined, so the first code-asset tool call threw "crypto.subtle is undefined" and the agent hung. Add a dependency-free `sha256Hex` (src/core/utils/sha256.ts) that produces the identical 64-char digest in any context, and use it for the read→patch optimistic-concurrency fingerprint. The hash is a self-consistent, client-only fingerprint — never cryptographic-security-bearing — so a pure-JS SHA-256 is a drop-in. New test verifies it byte-for-byte against native WebCrypto across UTF-8 and all padding boundaries. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> (cherry picked from commit 78dbb7a63251bca132bb5ed58f0b15e179817acf) * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed only when a second page existed, so a user who edited and published Home still saw "Not started" next to a Pages widget reporting 1 published. A one-page site could never complete the step at all. The step is now "Edit the Home page". It reads In progress from first boot and completes once the dashboard pages stats report at least one published page, which is the moment the site is actually on the frontend. The rules move into a pure deriveOnboardingFacts so they are unit-tested without the network; the hook feeds it the same pages stats endpoint the Pages widget already uses. Closes #223 * fix(data): author reassignment rides the row-access boundary (#625) PATCH /data/rows/:id/author read the target row with a bare getDataRow instead of loadRowForAccess, so a persona holding content.edit.any but not data.system.tables.read could read the full contents of any system-table row (unpublished pages and posts, author identity) and re-author it, while GET on the same row correctly answered 404. The handler now resolves the row through the same table-family plus ownership check every other row write uses. * fix(ai): read tools and the MCP relay decide row access with the HTTP rules (#626) * fix(ai): read tools and the MCP relay decide row access with the HTTP rules The content read tools (content_get_document, content_list_documents, content_search_documents) called the row repositories directly, so a caller holding ai.chat plus content.edit.own could read every other user's drafts and any system-table row through the tool surface, while GET /data/rows/:id for the same caller answered 404. The MCP relay carried its own copy of the ownership rule and skipped the table-family boundary altogether. One module now owns the decision. server/auth/dataAccess.ts holds the table-family and ownership predicates plus resolveRowAccess and rowVisibilityFor; the HTTP handlers, the read tools, and the MCP relay all call it with the identity behind the request. An architecture gate fails any direct row read under server/ai that bypasses it, because this class was fixed on the HTTP side once (GHSA-x69h) and came back through the next reader. * fix(data): drop the row read import the shared access helper made unused * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header (#627) * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header Without PUBLIC_ORIGIN the MCP OAuth issuer fell back to the inbound Host header, so an unauthenticated client could make the 401 challenge, both .well-known discovery documents, and the resource comparisons echo an attacker-controlled origin (GHSA-hgjv-q732-4phj). The issuer now comes only from the configured public origin; without one, loopback requests use their own origin so local development keeps working, and every other request has no issuer: discovery and the token endpoint answer 503, the 401 challenge drops resource_metadata, and OAuth grants are not looked up while personal access tokens keep working. The server warns at boot when no public origin is configured. * test(mcp): assert discovery origins by parsed origin, not string prefix * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @Keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: MelmacAlpha <github@201620.de> Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> Co-authored-by: Mostafa Sadeghi <205455727+mostafasadeghidev@users.noreply.github.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> Co-authored-by: Rick Caves <spcxai2025@gmail.com> Co-authored-by: David Babinec <49069339+DavidBabinec@users.noreply.github.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: Norbert Gocht <ngocht@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com>

* fix(import): keep the content a compound submit button wraps base.submit was a leaf whose only content was the label string, with a 'Submit' fallback for buttons with no text. Submit buttons that carry an icon instead of text (an inline svg, an icon-font <i>, an <img>) lost the icon on import and published as the literal word "Submit". base.submit now accepts children and renders them when it has any, falling back to the label when it has none (the base.link contract, shared between the publisher render and the canvas via forms/content.ts). The importer recurses into submit buttons with element children instead of flattening them to a label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed only when a second page existed, so a user who edited and published Home still saw "Not started" next to a Pages widget reporting 1 published. A one-page site could never complete the step at all. The step is now "Edit the Home page". It reads In progress from first boot and completes once the dashboard pages stats report at least one published page, which is the moment the site is actually on the frontend. The rules move into a pure deriveOnboardingFacts so they are unit-tested without the network; the hook feeds it the same pages stats endpoint the Pages widget already uses. Closes #223 * fix(data): author reassignment rides the row-access boundary (#625) PATCH /data/rows/:id/author read the target row with a bare getDataRow instead of loadRowForAccess, so a persona holding content.edit.any but not data.system.tables.read could read the full contents of any system-table row (unpublished pages and posts, author identity) and re-author it, while GET on the same row correctly answered 404. The handler now resolves the row through the same table-family plus ownership check every other row write uses. * fix(ai): read tools and the MCP relay decide row access with the HTTP rules (#626) * fix(ai): read tools and the MCP relay decide row access with the HTTP rules The content read tools (content_get_document, content_list_documents, content_search_documents) called the row repositories directly, so a caller holding ai.chat plus content.edit.own could read every other user's drafts and any system-table row through the tool surface, while GET /data/rows/:id for the same caller answered 404. The MCP relay carried its own copy of the ownership rule and skipped the table-family boundary altogether. One module now owns the decision. server/auth/dataAccess.ts holds the table-family and ownership predicates plus resolveRowAccess and rowVisibilityFor; the HTTP handlers, the read tools, and the MCP relay all call it with the identity behind the request. An architecture gate fails any direct row read under server/ai that bypasses it, because this class was fixed on the HTTP side once (GHSA-x69h) and came back through the next reader. * fix(data): drop the row read import the shared access helper made unused * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header (#627) * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header Without PUBLIC_ORIGIN the MCP OAuth issuer fell back to the inbound Host header, so an unauthenticated client could make the 401 challenge, both .well-known discovery documents, and the resource comparisons echo an attacker-controlled origin (GHSA-hgjv-q732-4phj). The issuer now comes only from the configured public origin; without one, loopback requests use their own origin so local development keeps working, and every other request has no issuer: discovery and the token endpoint answer 503, the 401 challenge drops resource_metadata, and OAuth grants are not looked up while personal access tokens keep working. The server warns at boot when no public origin is configured. * test(mcp): assert discovery origins by parsed origin, not string prefix * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(site-import): upload and rewrite imported video sources and posters (#661) * fix(site-import): upload and re-point imported video sources The HTML importer stores a <video>/<source> URL in base.video's `videoUrl` prop, but the site-import asset pipeline only normalised and rewrote `src`, `href` and `srcset`. Imported videos kept their relative path and the file was never uploaded. Add `videoUrl` to the URL-bearing props and make assetPlan.ts the single owner of that list so applyAssetRewrites can no longer drift from it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(import): retain and rewrite native video posters * docs(import): group video mapping separately from anchor rules --------- Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: Norbert Gocht <ngocht@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(import): map unsupported anchor targets to _self or _blank (#575) * fix(import): map unsupported anchor targets to _self or _blank The anchor import rules copied target="" (and _top or a named frame) straight into the node. None of those values is in AnchorTargetSchema, so the publisher's fallback replaced the whole link with module defaults and the page shipped "Click here" pointing at "#". The schema now lives in @core/htmlAttributes with a normalizeAnchorTarget() helper the importer uses for both anchor rules: empty and _top import as _self, a named target as _blank, keywords match case-insensitively, and href and text are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed …

* fix(collab): publish presence for users without a display name "Your name" is optional at setup and in the profile, but the editor only published presence when the user had a display name, and the relay derived the session identity from the raw display name. A user without one published no presence at all: peers saw no cursor or selection ring, and the "someone else is editing" guards never fired for them. userDisplayLabel (src/core/users/displayName.ts) returns the trimmed display name, else the email address. The relay's session identity and the editor's published presence both use it, so they keep matching the anti-spoofing check; collaborators now see the email of a user without a display name. The account menu, profile tab, activity widget, users table, audit labels and UserAvatar use the same helper, replacing displayUserName and the inline fallbacks. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(site-import): upload and rewrite imported video sources and posters (#661) * fix(site-import): upload and re-point imported video sources The HTML importer stores a <video>/<source> URL in base.video's `videoUrl` prop, but the site-import asset pipeline only normalised and rewrote `src`, `href` and `srcset`. Imported videos kept their relative path and the file was never uploaded. Add `videoUrl` to the URL-bearing props and make assetPlan.ts the single owner of that list so applyAssetRewrites can no longer drift from it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(import): retain and rewrite native video posters * docs(import): group video mapping separately from anchor rules --------- Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: Norbert Gocht <ngocht@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(import): map unsupported anchor targets to _self or _blank (#575) * fix(import): map unsupported anchor targets to _self or _blank The anchor import rules copied target="" (and _top or a named frame) straight into the node. None of those values is in AnchorTargetSchema, so the publisher's fallback replaced the whole link with module defaults and the page shipped "Click here" pointing at "#". The schema now lives in @core/htmlAttributes with a normalizeAnchorTarget() helper the importer uses for both anchor rules: empty and _top import as _self, a named target as _blank, keywords match case-insensitively, and href and text are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed only when a second page existed, so a user who edited and published Home still saw "Not started" next to a Pages widget reporting 1 published. A one-page site could never complete the step at all. The step is now "Edit the Home page". It reads In progress from first boot and completes once the dashboard pages stats report at least one published page, which is the moment the site is actually on the frontend. The rules move into a pure deriveOnboardingFacts so they are unit-tested without the network; the hook feeds it the same pages stats endpoint the Pages widget already uses. Closes #223 * fix(data): author reassignment rides the row-access boundary (#625) PATCH /data/rows/:id/author read the target row with a bare getDataRow instead of loadRowForAccess, so a persona holding content.edit.any but not data.system.tables.read could read the full contents of any system-table row (unpublished pages and posts, author identity) and re-author it, while GET on the same row correctly answered 404. The handler now resolves the row through the same table-family plus ownership check every other row write uses. * fix(ai): read tools and the MCP relay decide row access with the HTTP rules (#626) * fix(ai): read tools and the MCP relay decide row access with the HTTP rules The content read tools (content_get_document, content_list_documents, content_search_documents) called the row repositories directly, so a caller holding ai.chat plus content.edit.own could read every other user's drafts and any system-table row through the tool surface, while GET /data/rows/:id for the same caller answered 404. The MCP relay carried its own copy of the ownership rule and skipped the table-family boundary altogether. One module now owns the decision. server/auth/dataAccess.ts holds the table-family and ownership predicates plus resolveRowAccess and rowVisibilityFor; the HTTP handlers, the read tools, and the MCP relay all call it with the identity behind the request. An architecture gate fails any direct row read under server/ai that bypasses it, because this class was fixed on the HTTP side once (GHSA-x69h) and came back through the next reader. * fix(data): drop the row read import the shared access helper made unused * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header (#627) * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header Without PUBLIC_ORIGIN the MCP OAuth issuer fell back to the inbound Host header, so an unauthenticated client could make the 401 challenge, both .well-known discovery documents, and the resource comparisons echo an attacker-controlled origin (GHSA-hgjv-q732-4phj). The issuer now comes only from the configured public origin; without one, loopback requests use their own origin so local development keeps working, and every other request has no issuer: discovery and the token endpoint answer 503, the 401 challenge drops resource_metadata, and OAuth grants are not looked up while personal access tokens keep working. The server warns at boot when no public origin is configured. * test(mcp): assert discovery origins by parsed origin, not string prefix * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (…

* fix(media): let the upload queue window stay closed mid-upload The close button worked, then an effect undid it. The effect depended on both `uploadQueue.active` and the window's open state, so closing the window re-ran it, `active && !open` was true, and it opened again on the next commit. While a transfer was in flight the window could not be shut. The open state moves into `useUploadQueueWindow(active)`, which opens the window on the transition into an active upload — detected during render against the last `active` it saw — and on nothing else. Closing hides the transfer; it doesn't cancel it. The next upload opens the window again, and a finished transfer still leaves it open until dismissed. Doing it in render rather than an effect also drops the set-state-in-effect disable and the one-commit open lag. The test drives the real hook through what a user does — upload starts, close, progress re-renders — and fails against the old effect. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(site-import): upload and rewrite imported video sources and posters (#661) * fix(site-import): upload and re-point imported video sources The HTML importer stores a <video>/<source> URL in base.video's `videoUrl` prop, but the site-import asset pipeline only normalised and rewrote `src`, `href` and `srcset`. Imported videos kept their relative path and the file was never uploaded. Add `videoUrl` to the URL-bearing props and make assetPlan.ts the single owner of that list so applyAssetRewrites can no longer drift from it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): answer conditional requests for static files and uploads with 304 (#653) * fix(server): answer conditional requests for static files and uploads with 304 serveStaticFile sent `Cache-Control: no-cache` for /uploads and the admin shell files but no ETag or Last-Modified, so the browser had nothing to revalidate with and re-downloaded every file in full. The editor preview iframe reloads every image and font on each rebuild: about 117 requests and 3.7 MB per preview load on one production site. Responses now carry a weak ETag (size + mtime) and Last-Modified, and If-None-Match / If-Modified-Since get a bodiless 304 (If-None-Match wins, per RFC 9110). A media replace that keeps the path changes the mtime, so the validator changes with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call's 90s timeout started at push time, so calls queued behind slow ones (render snapshots, a background tab) timed out before the editor reached them. The 120s idle lease was only re-armed by pushes, so a batch whose serial execution outlasted it closed the stream mid-batch: the in-flight call was rejected ("closed with 1 pending tool result(s)") and the editor's late result POST got a 404. - createBridge gains an opt-in `serial` option: the next request is emitted only after the previous one settles, and its timeout starts on emit. Queued calls still reject on abort/destroy without being emitted. The chat bridge is unchanged. - The editor bridge uses serial delivery, and its idle lease re-arms instead of closing while any call is pending. Each pending call is bounded by the per-call timeout, so an orphaned stream still drains and closes. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(collab): preserve initial sync delivery under backpressure (#590) * fix(collab): preserve initial sync delivery under backpressure * fix(collab): packetize large stored document delivery * fix(server): preserve upload MIME when revalidating cached files --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: rodrigoc-neu-Lab <rodrigo.c@neuwrk.com> Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(preview): rebuild runtime previews after the draft settles, keep the last build meanwhile (#646) Each runtime preview build POSTs the whole site document and the server re-validates it, re-bundles the page scripts and renders the page. The Preview overlay and the Site Explorer hover card rebuilt on every `site` change, so typing or a collaborator's edits aborted the in-flight build and started another — production logs show bursts of 8 cancelled requests within two seconds — and the preview blanked to "Building…" each time. - useRuntimePreviewDocument builds from the draft only once it has stayed unchanged for 400ms (PREVIEW_SITE_SETTLE_MS). - While a newer build runs, `html` keeps the previous build for the same page and context; both callers show the loading state only when there is nothing to show yet. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): read :not() and :is() correctly when tree-shaking class rules (#572) The shaker read every registry class in a selector as a requirement, including classes inside :not() and each alternative of :is()/:where(). A negated class is the opposite of a requirement and :is() alternatives are each sufficient, so rules like `.nav > li > a:not(.cart-button)` were dropped whenever no node carried the negated class. selectorPartCanMatch now splits a part into the text whose classes are all required and the alternation groups where one alternative is enough; :has() and :nth-child(n of ...) stay required. For selectors the shared lexer reads correctly, drops are a subset of before. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep style and class injection out of data-style and data-class (#561) The root-tag lookups used /\bstyle="/ and /\bclass="/, and \b matches after the hyphen in data-style and data-class. Node styles or classes were merged into the data attribute and the real attribute was never emitted. Both regexes now require whitespace before the attribute name, and the replacements use a function so $ sequences in values stay inert. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): repair invalid props one by one instead of resetting the node (#574) When Value.Parse rejected a node's props, validateNodeProps replaced every declared prop with the module default, so a link with one unsupported target published as "Click here" pointing at "#" while its href and text sat valid in the store. The catch branch now parses each declared prop on its own and falls back to the default only for the props that still fail. Fast path, successful slow path, optional props and injected keys are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(import): retain and rewrite native video posters * docs(import): group video mapping separately from anchor rules --------- Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Diogenes Pelisson <diogenes.pelisson@gmail.com> Co-authored-by: kenny-ish <114967656+kenny-ish@users.noreply.github.com> Co-authored-by: Norbert Gocht <ngocht@users.noreply.github.com> Co-authored-by: Emmanuel Ruiz <emmanuel.ruiz@arthrex.com> Co-authored-by: Emmanuel Ruiz <ehnruiz@gmail.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Marco D'Antonio <m.dantonio@netsons.com> Co-authored-by: tommy230 <tommy@godigitalalchemy.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(import): map unsupported anchor targets to _self or _blank (#575) * fix(import): map unsupported anchor targets to _self or _blank The anchor import rules copied target="" (and _top or a named frame) straight into the node. None of those values is in AnchorTargetSchema, so the publisher's fallback replaced the whole link with module defaults and the page shipped "Click here" pointing at "#". The schema now lives in @core/htmlAttributes with a normalizeAnchorTarget() helper the importer uses for both anchor rules: empty and _top import as _self, a named target as _blank, keywords match case-insensitively, and href and text are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(editor): apply classes to all selected elements (#511) Assisted-by: OpenAI Codex Co-authored-by: MelmacAlpha <260151560+MelmacAlpha@users.noreply.github.com> * fix(settings): make the Esc keycap close the modal it advertises (#499) * fix(settings): make the Esc keycap close the modal it advertises The footer reads `[Esc] close`, and the keycap looks like a button because every `Kbd` depresses on `:active`. Clicking it played that press animation and did nothing; the pointer over the word "close" turned into a text caret and a click just selected the text. An operator reasonably concluded the modal could not be dismissed with the mouse. It could — the backdrop has always closed it, and Escape works — but a control that animates under the cursor and then ignores the click is worse than no control, because it answers the question wrongly. So the hint becomes the button it already looked like. `Kbd` itself is untouched: six other surfaces render it as a genuine keyboard hint where the press styling is right, and only this one sits next to the word "close". The file header claimed there was no dedicated close button. There is one now, so it says so. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(settings): let the Button primitive own the Esc keycap's alignment and width --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * feat(plugins): @own-created contentAccess marker for plugin-created tables (#335) * feat(plugins): @own-created contentAccess marker for plugin-created tables Plugins could create tables via cms.content.tables.create but never read or write their entries: the static contentAccess[] allowlist matches by exact slug, and a runtime-chosen slug cannot be pre-declared. This made importer/migration plugins impossible on the sanctioned surface. - Migration 025 (both dialects, additive): data_tables.created_by_plugin_id, stamped by the create handler with the host-authenticated worker identity. - New @own-created contentAccess marker (OWN_CREATED_TABLES_MARKER): covers every table the declaring plugin created, resolved against the stored creator (never by slug), with the entry's declared modes; entries combine as a union. Marker modes go through the same install-time modes<->permission coherence check as slug entries. - assertContentTableAccess now takes the resolved DataTable (handlers resolve-then-assert; tree callbacks already had the table). tables.list / search filter through the same matcher, so own-created tables appear. - tables.create slug constrained to kebab-case, reserving the @ namespace; bundle export/import preserves createdByPluginId. - Docs, capability descriptions, SDK comments updated; stale "consent screen renders contentAccess verbatim" claim corrected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(branches): a fork keeps which plugin created a table Forking a branch copies `data_tables` with an explicit column list, and `created_by_plugin_id` was not in it. The branch's copy of a plugin-created table came out with no creator — so the `@own-created` contentAccess marker no longer matched it, and the table stopped belonging to the plugin that made it. Nothing reported it; the column was simply null on the copy. It is ownership, not content, so it does not belong in the merge diff — it belongs in the copy, beside `created_by_user_id`, which was already there. The test fails without the change (`Received: null`) and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): move the migration to 033 — 031 and 032 are claimed #495 claims `031_installed_plugins_source` and #505 claims `032`, so this ALTER moves to `033` before either lands. The runner keys on the full id, so two `031_…` entries would both run — but a shared number still makes whoever merges second renumber, and an ALTER can only be renumbered while no installation has applied it. That is true today, so it moves now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore(db): number the created_by_plugin_id migration 031, next after 030 on main --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(site-import): resolve cache-busted asset URLs (#539) * fix(site-import): resolve cache-busted asset URLs A query string or fragment was never stripped before looking a path up in the FileMap, so `assets/site.css?v=8f3a1c` resolved to a key that cannot exist. The reference was reported as `missing-stylesheet` / `missing-script` while the file sat in the archive, and every style rule, colour token and font in that sheet was silently dropped from the import. Static site generators commonly emit a content hash on stylesheet, script and media URLs, so this affects a whole class of input. Measured on one real 6-page export: 401 style rules and 18 colour tokens imported, against 659 and 26 for the byte-identical site without the queries — a 39% and 31% loss, reported only as warnings a user can click past. The handling was inconsistent rather than absent, which is why it survived: `linkRewrite` stripped the query itself before calling `resolveHref`, so internal page links resolved correctly while stylesheets did not, and `assetPlan` stripped one for MIME sniffing but not for resolution. Fixed at both resolution primitives: - `resolveHref` (stylesheets, scripts, CSS @import, and page links via linkRewrite) - `resolveRelativePath` (CSS url(), node src/href/srcset) and removed the now-redundant strip in `linkRewrite`. Its fragment split stays — the fragment is re-attached to the page ref and is not addressing. This cannot affect the rewrite step. Node props are replaced by the resolved FileMap key and `rewriteProps` keys on that key, while CSS passes the original `rawUrl` to `replaceRawUrlInValue` as a separate argument, so stripping changes only which entry is found. Tests: a unit group on `resolveHref` covering query, fragment, both, and empty-after-strip, plus an assertion that a query does not change traversal handling; and an end-to-end group over `buildImportPlan` asserting that a cache-busted site produces a plan identical to the same site without queries. The end-to-end shape matters here — the unit returned a plausible-looking key and every consumer dutifully failed to find it, so the defect was only ever visible downstream. Verified the new tests fail without the source change (11 failures) and pass with it. bun run build, bun test (7067), bun run lint all pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(site-import): drop the dead query strip in fontFormatForPath resolveRelativePath now strips the query before the FileMap lookup, so the only input this helper receives can no longer carry one. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: DavidBabinec <hello@davidbabinec.com> * fix(dashboard): onboarding step 03 follows the Home page being published (#624) Setup seeds one empty, unpublished Home page. The checklist step for it was "Create your first page", completed only when a second page existed, so a user who edited and published Home still saw "Not started" next to a Pages widget reporting 1 published. A one-page site could never complete the step at all. The step is now "Edit the Home page". It reads In progress from first boot and completes once the dashboard pages stats report at least one published page, which is the moment the site is actually on the frontend. The rules move into a pure deriveOnboardingFacts so they are unit-tested without the network; the hook feeds it the same pages stats endpoint the Pages widget already uses. Closes #223 * fix(data): author reassignment rides the row-access boundary (#625) PATCH /data/rows/:id/author read the target row with a bare getDataRow instead of loadRowForAccess, so a persona holding content.edit.any but not data.system.tables.read could read the full contents of any system-table row (unpublished pages and posts, author identity) and re-author it, while GET on the same row correctly answered 404. The handler now resolves the row through the same table-family plus ownership check every other row write uses. * fix(ai): read tools and the MCP relay decide row access with the HTTP rules (#626) * fix(ai): read tools and the MCP relay decide row access with the HTTP rules The content read tools (content_get_document, content_list_documents, content_search_documents) called the row repositories directly, so a caller holding ai.chat plus content.edit.own could read every other user's drafts and any system-table row through the tool surface, while GET /data/rows/:id for the same caller answered 404. The MCP relay carried its own copy of the ownership rule and skipped the table-family boundary altogether. One module now owns the decision. server/auth/dataAccess.ts holds the table-family and ownership predicates plus resolveRowAccess and rowVisibilityFor; the HTTP handlers, the read tools, and the MCP relay all call it with the identity behind the request. An architecture gate fails any direct row read under server/ai that bypasses it, because this class was fixed on the HTTP side once (GHSA-x69h) and came back through the next reader. * fix(data): drop the row read import the shared access helper made unused * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header (#627) * fix(mcp): derive OAuth discovery from the configured public origin, never the Host header Without PUBLIC_ORIGIN the MCP OAuth issuer fell back to the inbound Host header, so an unauthenticated client could make the 401 challenge, both .well-known discovery documents, and the resource comparisons echo an attacker-controlled origin (GHSA-hgjv-q732-4phj). The issuer now comes only from the configured public origin; without one, loopback requests use their own origin so local development keeps working, and every other request has no issuer: discovery and the token endpoint answer 503, the 401 challenge drops resource_metadata, and OAuth grants are not looked up while personal access tokens keep working. The server warns at boot when no public origin is configured. * test(mcp): assert discovery origins by parsed origin, not string prefix * chore(release): prepare 0.0.21 (#628) * fix(framework): set the root font size the rem scale assumes (#636) The framework converts every type and spacing token to rem against rootFontSize (10 in the Core preset), but nothing set html font-size, so at the 16px browser default every token rendered 1.6x larger than the scale says. A new emitRootFontSize preference makes the framework emit html { font-size: 62.5% } (rootFontSize / 16 as a percentage) in both the published framework.css and the canvas iframes. The Core preset turns it on for new frameworks; existing sites have no stored value, which means off, so they keep rendering exactly as before. Site settings > Publishing gets a toggle to opt in. * fix(framework): make theme-inverted sections take the alt colors (#635) The color theme scopes hung the default branch off :root.theme-default, a class nothing ever put on <html>, so theme-inverted and theme-always-alt never matched on published pages or in the canvas. The default branch now keys on :root:not(.theme-alt), which matches every page as rendered today and keeps a runtime toggle to the one theme-alt class. * feat(fonts): seed heading, body and mono font role tokens on new sites (#638) * feat(fonts): seed heading, body and mono font role tokens on new sites New sites had no font tokens and the codebase disagreed on names (docs said font-primary, the AI prompt said font-heading), so content made for one site did not resolve in another. Every brand-new site now starts with fallback-only font-heading, font-body and font-mono tokens, the Core preset adds any a site lacks without touching existing ones, and docs, schema comments and the AI prompt use the role names. Existing sites are not migrated. * fix(site-import): fill an untouched font role token instead of renaming Seeding font-heading, font-body and font-mono on new sites made an imported static site that defines one of those variables collide with the seed and get renamed to font-body-2, leaving the role token on the system stack. A role token that is still exactly as seeded is a placeholder, so the conflict now defaults to overwrite; a role token the user edited keeps the rename default. * docs(fonts): describe role tokens in terms of shared content The rationale now names imported pages, copied sections and AI output as the content the role variables serve. * test(framework): read the framework from the preset result in root font size tests applyFrameworkPreset now returns { framework, fonts }, so the root font size tests read .framework; one of them passed only because it read an absent property. * fix(import): replace import removes the previous site media (#637) A replace import wiped rows, folders and redirects but kept the old media_assets rows, so a second site shipping a file at the same storage path (two sites that embed the same font file) failed on media_assets.public_path after the data had already committed. Replace now deletes the library inside the import transaction and removes the bytes after commit, before the bundle's media is written. It only does so when the import carries media and the shell on main with no other branch, and it spares avatars and plugin-managed media, since those survive a replace. The archive endpoint now shares the JSON endpoint's apply path instead of a synthetic request, and the custom-table delete binds its boolean so replace runs on Postgres. * fix(editor): stop canvas chrome tokens shadowing site custom properties (#639) The editor-chrome stylesheet in the canvas iframe is unlayered and copied admin tokens such as --radius and --text onto :root under their own names. Unlayered beats the site's @layer user-authored, so a site defining those properties rendered with editor values in the canvas and its own values when published. Every forwarded token now lives under --chrome-*, derived from the var(--chrome-*) references in the chrome rules. * fix(ai): serialize ai_messages content before insert on Postgres (#592) On Postgres `ai_messages.content_json` is `text`, and Bun SQL binds a plain array to a text parameter via String(), storing '[object Object]'. Replaying that history yields empty user content and provider calls fail (Anthropic: 400 "user messages must have non-empty content"). JSON.stringify the content at the insert. SQLite passes strings through unchanged, and reads on both dialects JSON.parse `_json` strings, so behavior there is identical. Kept narrow on purpose: stringifying every object param in the PG adapter would turn values bound to jsonb columns into JSON string scalars and break jsonField() queries. Fixes #593. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(forms): accept the option value a form control submits for select fields (#667) A CMS-native form whose target table has a select or multiSelect field could never be submitted. The base.option nodes the setup block inserts from the table carry option.value (the slug authors edit in the Data tab), but validateCoercedValue only accepted option.id, the generated nanoid authors never see. Every choice came back as invalid_option. Resolve the submitted string by option id or value while coercing the field and store the option id, which is the documented cell shape for these fields. The id-only checks in validateCoercedValue are removed since coercion now guarantees a known id. Fixes #629 * fix(publish): prune stored runtime assets of superseded page versions (#647) Every full publish stores each page's bundled runtime files in published_runtime_assets under a fresh version path, and nothing ever deleted them. On a busy production site the table reached 206k rows / 1.5 GB (696 MB written in one day), bloating the database and its backups for bytes that are only a fallback behind the disk-baked copies. persistSitePublish now deletes, per page, the stored assets of every version other than the one being activated and the one it supersedes. Nothing re-activates an old version, and keeping the previous one covers visitors still holding its HTML — the same window the disk's two-slot swap covers. Version rows are untouched. The first publish after upgrading drops the backlog for the published pages. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): resolve custom media fields on entry routes (#662) On a post-type entry route, `{currentEntry.<field>}` for a custom media field rendered the raw media id, while the same binding inside a data.rows loop rendered the /uploads/ path: the entry frame spread raw cells and only resolved the built-in featuredMedia. publishedDataRowToEntryItem now resolves the row's media cells with the same helpers the loop source uses, and every entry-stack caller (public entry route, branch preview, draft preview) goes through it. Co-authored-by: RC <rodrigoc-neu-Lab@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(publisher): keep custom properties with underscores or a leading --_ (#617) The property-name gate rejected any custom property containing `_` or starting with `--_`, so the importer and the publisher dropped them and every var() on them resolved to nothing. Custom properties are now checked against the spec's identifier rule; standard property names keep the stricter pattern and the denylist still applies. Custom property names also pass through toKebab unchanged, so `--brandColor` is no longer emitted as `--brand-color`. Fixes #616 * fix(siteImport): rewrite var() references to the slug a colour token is emitted under (#618) Site Import turned root colour custom properties into framework tokens, which the framework emits under the normalised slug (`--brand---neutral--700` -> `--brand-neutral-700`), but left the imported `var()` references on the authored name, so they no longer resolved. The slug is now settled at plan time by `normalizeImportedColorTokens`, and every changed name is rewritten in the imported style rules and node inline styles before conflict detection, so the conflict step and the commit see the emitted name. Two names that normalise to the same slug both survive with a numeric suffix instead of one being dropped at commit. Token renames (normalisation and conflict renames) now also rename declarations of the variable in other rules, their priorities, and raw @keyframes CSS, so a `.dark { --bg: ... }` override follows its token. Conflict rename targets skip the import's other token names and any custom property the imported CSS declares, and a colour custom rename is normalised like the slug it becomes. The rename helpers move from conflicts.ts into siteImport/varRefs.ts, which keeps conflicts.ts under the 700-line module budget. Fixes #615 * fix(siteImport): rewrite var() references to the variable a font token is emitted under (#620) Site Import normalised a root `--font-*` variable at extraction (`--font-Heading` -> `font-heading`), and the store emits that form, but the imported `var(--font-Heading)` references kept the authored name and no longer resolved. Two authored names that normalise alike were deduped into one token, losing a font. Extraction now keeps the authored variable, and `normalizeImportedTokens` (new `siteImport/tokenNames.ts`) settles the emitted name of every imported colour and font token at plan time, in one pass against one set of claimed names, since both kinds share one CSS namespace. The `authored -> emitted` renames go through the existing var() and declaration rewrite, before conflict detection. `normalizeImportedColorTokens` is replaced by `normalizeImportedTokens`. Fixes #619 * fix(publisher): keep safe images in published entry bodies (#664) * fix(publisher): keep safe images in published entry bodies Fixes #595 * fix(publisher): route content render paths through the image profile --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * fix(loops): sort numeric row cells by value (#601) * fix(publisher): emit one merged rel on links and buttons instead of two (#570) base.link and base.button emitted the author's rel from the htmlAttributes bag and their own security rel as two separate attributes. Browsers keep the first, so a nofollow new-tab link published without noopener noreferrer, and the canvas showed a different rel than the page. The HTML importer also dropped every source rel on anchors as if the module regenerated it. The two anchor modules now merge the authored tokens with the security rel through one shared helper on both render paths, and the importer keeps rel. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix(mcp): deliver editor-bridge tool calls serially and hold the lease while calls are pending (#644) The editor runs relayed MCP tools strictly one at a time, but the server pushed a whole batch at once. Every call…

mostafasadeghidev and others added 2 commits September 5, 2026 21:37

mostafasadeghidev mentioned this pull request Sep 6, 2026

feat(media): warn before permanently deleting a file the site still uses #507

Open

docs(db): say which ids sit either side of the backfill

0a9b8fd

The note still said CoreBunch#335 claims 031. It now claims 033, because CoreBunch#495 took 031 — the backfill stays at 032 between them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mostafasadeghidev added a commit to mostafasadeghidev/Instatic that referenced this pull request Sep 16, 2026

merge: CoreBunch#505 — the backfill's id note names 031 (CoreBunch#495)…

58774ba

… and 033 (CoreBunch#335) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mostafasadeghidev mentioned this pull request Sep 16, 2026

feat(plugins): @own-created contentAccess marker for plugin-created tables #335

Merged

mostafasadeghidev added a commit to mostafasadeghidev/Instatic that referenced this pull request Sep 16, 2026

merge: CoreBunch#505 — the backfill's id note names 031 (CoreBunch#495)…

c50a210

… and 033 (CoreBunch#335) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mostafasadeghidev added a commit to mostafasadeghidev/Instatic that referenced this pull request Oct 16, 2026

merge: CoreBunch#505 — upstream main, with CoreBunch#335 landed as 031

ae1b7b6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Navigation Menu

Repository navigation

feat(media): record what depends on an asset, starting with avatars - #505

feat(media): record what depends on an asset, starting with avatars#505
mostafasadeghidev wants to merge 6 commits into
CoreBunch:mainfrom
mostafasadeghidev:feat/media-usage-refs

mostafasadeghidev commented Sep 5, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

mostafasadeghidev commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How it goes wrong

What this adds

Scope

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mostafasadeghidev commented Sep 5, 2026 •

edited

Loading