Wasm plugins' isolated Postgres role is deliberately denied on core
tables, which left no sanctioned path to data_tables/data_table_rows.
Adds the datatables.* capability family (get_table_by_key, get_row,
list_rows, create_row, update_row_data, find_row_by_field) following
the datasources pattern: interface package, ABI proto messages, guest
stub, CoreServices wiring, golden round-trip coverage.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Plugins declare site-root path claims (exact or prefix) and a sitemap
contribution flag in plugin.mod; the packer validates and stamps them
into PluginManifest. Validation rejects reserved prefixes (/admin,
/api/plugins, /ws), traversal, duplicates, and prefix claims that cover
a reserved prefix.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Host-mediated outbound HTTP for wasm plugins: guest http.RoundTripper
over the http.request capability; the host performs the request under
policy. New egress package defines the host-pattern grammar (exact or
multi-label wildcard, public-suffix rejected), matching, resource
bounds, and the ErrDenied sentinel (ABI_ERROR_CODE_EGRESS_DENIED).
plugin.mod gains first-class AllowedHosts + MaxResponseMB; manifest
gains allowed_hosts=34, max_response_mb=35. CoreServices.OutboundHTTP
carries the transport. Golden roundtrip + denial-mapping tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds content.published_block_configs: the host returns the stored
content JSON of every block with a given key inside currently
published page snapshots. Restores server-authoritative per-block
enforcement for sandboxed guests (calcomblock's captcha requirement
was inert under wasm — blockConfig hardcoded nil because no capability
exposed published block content). Breaking: content.Content gains a
method; the cms adapter implements it in the paired bump.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bootstrap the plugin-facing SDK module so the fleet migration (P2) becomes a
mechanical block/core/X -> block/pluginsdk/X import rewrite.
- abi/proto/v1: the single source-of-truth ABI proto tree, copied from the cms
authoring source (cms/backend/abi/proto/v1) with go_package retargeted to
git.dev.alexdunmow.com/block/pluginsdk/abi/v1;abiv1. Kills the hand-kept
cms/core proto duplication (audit gap 4).
- abi/v1: generated Go bindings (buf generate); byte-identical to core's abi/v1
save the embedded go_package path.
- plugin/ (registration + DI surface), plugin/wasmguest/** (transport shim,
caps stubs, bnwasm db driver, testdata fixtures + golden .pb), and the
guest-facing type packages: blocks (+builtin/shared/tags), templates
(+pongo/bn), auth, settings, content, gating, crypto, rbac, video, ai,
subscriptions, menus, datasources. Internal imports rewritten core ->
pluginsdk; zero block/core references remain.
- README/AGENTS(+CLAUDE symlink)/Makefile: proto is the contract, Go is one
binding; no replace directives; templates/bn is a synced copy authored in cms.
Spec: cms docs/superpowers/specs/2026-07-07-proto-first-plugin-sdk-design.md
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
