EmDash 1.0 Roadmap

[khoinguyenpham04]

This is the public tracker for the EmDash 1.0 milestone.

1.0 is the first stable release. The milestone remains the source of truth for implementation status; this issue is the checklist view so GitHub can track linked issue progress.

Originally discussed in #1730.

Current Status

• Milestone: 1.0
• Progress: tracked by the checklist below
• Due date: not set

Data Safety, Schema, And Localization Correctness

• Improve deployed schema evolution workflow for Cloudflare D1 sites #442
• content_taxonomies links content and terms with inconsistent locale semantics (term side locale-agnostic, entry side per-locale → tag drift across translations) #1348
• localeCode schema lowercases the ?locale= filter, returning zero rows for locales with uppercase subtags #1551
• Migration: canonicalize pre-existing lowercase locale rows after #1551 #1599
• Unpublished Posts are included in Category counts #581
• Admin UI silently buckets published content into Trash when ec_{collection} table schema lacks EmDash's expected columns #709
• Runtime Postgres migrations can stampede when a pending migration fails on Cloudflare Workers #1744
• i18n: InviteAcceptPage and buildInviteEmail() bypass the locale system (still English when site locale is non-English) #915
• Render hreflang alternates in page head for translated content #1690
• Collection where taxonomy filter joins on t.id (term id) instead of translation_group, so it only matches default-locale term slugs #1480
• Sitemaps omit hreflang self/x-default alternates for untranslated entries on i18n sites #1522

Editorial Safety And Publishing Workflow

• Revisions show incorrect date #919
• Lose edit state when going back #1582
• Add publishing audit and provenance for humans, API clients, and agents #1682
• Define editorial safety acceptance criteria for publishing workflows #1683

API, MCP, And Agent Workflows

• search() ignores the cursor option and never returns nextCursor — pagination is impossible #1463
• Bug: search MCP tool returns D1_ERROR: no such column: c.title when collections argument is omitted #1178
• MCP: content_create/content_update ignores taxonomies field (categories/tags not assigned) #953
• Add MCP tools for safe schema updates #1681

Plugin Platform And Registry

• Plugin settingsSchema does not auto-generate admin settings UI #341
• Expose authenticated user to plugin route handlers via RouteContext #812
• Admin CSP img-src doesn't extend from plugin allowedHosts (blocks Unsplash thumbnails in Featured Image Studio) #415
• Document and harden plugin sandbox operations for Cloudflare and Node #1680
• Implement registry labeller and wire labels into install flows #1684
• Make registry the single visible plugin distribution path #1685
• Implement attested CI publishing for registry plugins #1687

Cloudflare Production Readiness

• Feature request: built-in SMTP email transport in core #1541
• Worker exceeded resource limits #475
• Dev startup triggers heavy internal typegen + SSR dep optimizer race on Cloudflare, causing chunk errors. #484
• Improve diagnostics for missing bindings and sandbox requirements #1686
• No production email provider on Cloudflare Workers — magic link, invites and notifications fail with "Email is not configured" #1431

Security And Governance

• Responsible Disclosure #993
• EmDash Image emits inline style attributes that violate strict CSP #1602
• CSP connect-src blocks S3 signed uploads from admin UI #205
• Comments: Turnstile widget is rendered but its token is never verified server-side #1589
• Review secret management and rotation for stable release #1688
• EmDashHead JSON-LD scripts are injected via HTML string and are not CSP-hashed #1601

Performance And Release Confidence

• perf(core): reduce public render query count for menu resolution and page metadata paths #1189
• Admin content-list search filter does an unindexable full-table scan #1517
• Add real-D1 coverage for core migrations and queries #1689

Editor, Admin, Media, And Site Experience

• Feature request: native repeater/array field type (e.g. "gallery" of media) #1369
• feat(admin): editable gallery Portable Text block (no TipTap editor node — import/render-only) #1436
• Feature: Collection sort order in admin sidebar #474
• feat(admin): sidebar menu tree with collection grouping, plugin subgroups, and public menu sync #1023
• feat(admin): allow hiding user-defined collections from admin sidebar #1131
• feat(admin): configurable display field and date field for collection list view #1133
• SEO panel fields silently ignored unless the page wires getSeoMeta (footgun for content editors) #1518
• Add provider-aware media usage index foundation #1669

Migration And Onboarding

• DX: "add emdash to existing Astro project" path has 3 unstated requirements that produce silent failures #962
• WordPress import crashes with 'module is not defined' — sax CJS incompatible with workerd" #573
• Add realistic WordPress migration acceptance test #1691

Feedback We Are Looking For

• Which 1.0 items are blocking you from using EmDash in production?
• Which issues have the clearest reproduction steps or acceptance criteria?
• Which items would you be interested in helping implement, test, or document?
• Are any milestone items unclear enough that they should be split or rewritten?

Thanks for helping shape the path to EmDash 1.0.

[Vallhalen]

Feedback from a production user running EmDash on Cloudflare Workers Paid + D1, with an agent-driven publishing workflow (Claude via MCP). Very glad this roadmap is public and scoped.

What's blocking us in production

• Improve deployed schema evolution workflow for Cloudflare D1 sites #442 (D1 schema evolution). This bit us hard bumping 0.27 → 0.28.1: our home page collection had ~81 flat fields, the loader added ~3 folded JSON columns on top, and we crossed D1's ~100 columns-per-result-set limit. Site died until we migrated the home to Portable Text blocks. Repro is trivial: any collection over ~90 flat fields on 0.28+. Would love this to have a firm 1.0 target because "just don't have that many fields" is not a real answer for real editorial schemas.
• MCP: content_create/content_update ignores taxonomies field (categories/tags not assigned) #953 (MCP taxonomies ignored). feat(mcp): support taxonomies field on content_create/content_update (#953) #1874 is open with tests + changeset. The main open call is slugs vs IDs on the payload shape, would appreciate a maintainer read on that. This one shipping unblocks single-round-trip agent publishing, which today needs N follow-up REST calls per taxonomy.
• SEO panel fields silently ignored unless the page wires getSeoMeta (footgun for content editors) #1518 (SEO panel fields silently ignored unless getSeoMeta is wired). We hit this too. Silent drops are the worst class of bug for agent workflows because the agent has no signal to retry.

Cleanest repros / acceptance criteria on the list

• Bug: search MCP tool returns D1_ERROR: no such column: c.title when collections argument is omitted #1178 (Search MCP D1_ERROR when collections omitted), MCP: content_create/content_update ignores taxonomies field (categories/tags not assigned) #953, content_taxonomies links content and terms with inconsistent locale semantics (term side locale-agnostic, entry side per-locale → tag drift across translations) #1348 (content_taxonomies locale semantics), localeCode schema lowercases the ?locale= filter, returning zero rows for locales with uppercase subtags #1551 (locale lowercasing) all have very concrete failure modes. Easy to write a golden test against each.

Where I can help

• MCP parity items (MCP: content_create/content_update ignores taxonomies field (categories/tags not assigned) #953, Bug: search MCP tool returns D1_ERROR: no such column: c.title when collections argument is omitted #1178, Add MCP tools for safe schema updates #1681). After feat(mcp): support taxonomies field on content_create/content_update (#953) #1874 I know that surface reasonably well; happy to take one more.
• Cloudflare / D1 edge cases (Improve deployed schema evolution workflow for Cloudflare D1 sites #442, Dev startup triggers heavy internal typegen + SSR dep optimizer race on Cloudflare, causing chunk errors. #484, Improve diagnostics for missing bindings and sandbox requirements #1686). Running on production CF daily, willing to write reproductions and test PRs against a real D1 binding.
• Docs for agent workflows. After building tooling around content_create / content_update / media, I have a good sense of what confuses an LLM the first time it hits these tools. Happy to contribute an "authoring content via MCP" guide once the taxonomies + search items land.

Items that feel underspecified

• Add publishing audit and provenance for humans, API clients, and agents #1682 ("publishing audit and provenance for humans, API clients, and agents") reads like three separate acceptance criteria stapled together. Might be worth splitting by consumer.
• Define editorial safety acceptance criteria for publishing workflows #1683 ("editorial safety acceptance criteria") is meta, and it's not obvious when it's "done" versus when child issues close it out.

Thanks for the transparency here, this is the first 1.0 milestone I've seen from a CMS project that's actually scoped to correctness rather than feature count.

[ascorbic]

Thanks @Vallhalen, that's super useful