feat(admin): allow trusted plugins to add content list columns

[logelog]

What does this PR do?

Adds a focused, display-only content-list column extension for trusted React plugins.

Plugins can export typed contentListColumns definitions for computed metadata such as review statuses, moderation outcomes, or publication readiness. EmDash retains ownership of the table, pagination, row actions, loading states, and empty states while passing each cell the current content item, collection, and locale.

The resolver:

• filters disabled or stale plugins
• supports collection and minimum-role visibility
• orders contributions deterministically
• validates malformed and duplicate definitions
• isolates failing predicates, headers, and cells so the content list remains usable
• omits plugin columns from Trash

Sorting, filtering, and search remain outside this display-only contract because they require server-backed contracts. Search is covered by #2191, indexed sorting by #2212, and indexed filtering by #2213.

#2194 has merged and supplies the shared content-list layout. This branch is now based on main and contains only the trusted-plugin extension commits.

Approved Discussion: #2048

Wider content-list context: #2397

Closes: N/A

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs; a workflow extracts catalogs on merge to main.
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: Trusted native-plugin slots for content-list columns and editor sidebar panels #2048

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: Claude Opus 5, GPT-5.6

Screenshots / test output

Local validation after rebasing:

• focused admin browser tests: 2 files, 63 tests passed
• admin production build
• core and admin typechecks
• full type-aware lint
• full repository format check
• git diff --check

No screenshot is included because the extension renders only when a trusted plugin contributes a column.

[changeset-bot]

🦋 Changeset detected

Latest commit: 5760ef3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 17 packages

Name	Type
@emdash-cms/admin	Minor
emdash	Minor
@emdash-cms/cloudflare	Minor
@emdash-cms/sandbox-workerd	Patch
@emdash-cms/plugin-mcp-smoke	Major
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/auth	Minor
@emdash-cms/blocks	Minor
@emdash-cms/gutenberg-to-portable-text	Minor
@emdash-cms/x402	Minor
create-emdash	Minor
@emdash-cms/auth-atproto	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Scope check

This PR changes 586 lines across 10 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@2195

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@2195

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@2195

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@2195

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@2195

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@2195

emdash

npm i https://pkg.pr.new/emdash@2195

create-emdash

npm i https://pkg.pr.new/create-emdash@2195

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@2195

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@2195

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@2195

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@2195

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@2195

@emdash-cms/registry-verification

npm i https://pkg.pr.new/@emdash-cms/registry-verification@2195

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@2195

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@2195

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@2195

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@2195

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@2195

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@2195

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@2195

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@2195

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@2195

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@2195

commit: 5760ef3

[emdashbot]

This is a focused, well-scoped addition to the trusted-plugin admin surface. It solves the right problem (display-only content-list columns contributed by trusted React plugins) in the right way: EmDash keeps ownership of the table while plugins provide header/cell components；filtering, sorting, and search are deliberately left out because they need server-backed semantics. The change follows the same trusted-plugin model already used for pages, widgets, and field widgets, and it is backed by an approved Discussion (#2048).

I checked the new resolver, the boundary component, the ContentList integration, the router wiring, the test coverage, and the changeset. The logic is sound: disabled/stale plugins are omitted, role and collection filters work, malformed/duplicate definitions are isolated, and error boundaries keep a broken column from crashing the list. No logic bugs, security issues, regressions, or logged-out query-count impacts were found.

There are three AGENTS.md import-extension violations on changed/new lines: two new internal imports omit the required .js extension. Fixing those is the only blocker.

[emdashbot]

[needs fixing] Internal ESM imports must use a .js extension per AGENTS.md. This new file imports from ./api without it.

Suggested change

	import type { AdminManifest, ContentItem } from "./api";
	import type { AdminManifest, ContentItem } from "./api.js";

[emdashbot]

[needs fixing] This changed import from ../lib/api is missing the required .js extension for internal ESM imports.

Suggested change

	} from "../lib/api";
	} from "../lib/api.js";

[emdashbot]

[needs fixing] The new re-export from ./lib/content-list-columns is an internal ESM import and needs the .js extension.

Suggested change

	} from "./lib/content-list-columns";
	} from "./lib/content-list-columns.js";

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat(admin): allow trusted plugins to add editor panels #2187 (4 shared files)
• feat(admin): show configured fields in content lists #2194 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.

[emdashbot]

Re-review of the trusted-plugin content-list column extension. The approach is sound: EmDash keeps full ownership of the table, pagination, row actions, loading/empty states, and sort/filter contracts while letting trusted React plugins and collection-configured scalar fields contribute display-only columns. This fits EmDash’s existing manifest-driven plugin architecture without leaking host responsibilities to plugins.

The only prior finding—the extensionless barrel-file export in packages/admin/src/components/index.ts—is now fixed (./ContentList.js).

I re-read the full diff end-to-end:

• ContentList correctly integrates collection-configured columns between title/status and plugin-contributed columns between date/actions, updates colSpan everywhere, and leaves sort/filter/search untouched.
• resolveContentListColumns deterministically orders contributions, filters disabled/stale plugins and unauthorized roles, validates malformed definitions, deduplicates per-plugin IDs, and isolates throwing collection predicates.
• ContentListColumnBoundary contains header and cell render failures so one broken plugin cannot unmount the list, and it only renders in the active-content table (not Trash).
• User-facing strings are Lingui-wrapped; alignment uses RTL-safe logical Tailwind (text-start/text-end).
• Core manifest build, schema registry persistence, migrations, seed/validate/export, and API schemas all correctly cap list columns at four, restrict them to supported field types, and preserve them round-trip.
• New tests cover configured and plugin columns, formatting, colSpan alignment, error isolation, Trash omission, and the resolver’s filtering/ordering/validation behavior.

I found no logic bugs, security issues, locale-filter misses, broken API-envelope contracts, AGENTS.md convention violations, or logged-out query-count regressions on this pass.

One non-code item remains: per the PR description, the linked Discussion is still awaiting maintainer approval; that is a governance gate outside the code review itself. LGTM.

[ascorbic]

@logelog If you resolve the conflicts we can get this in

[logelog]

@logelog If you resolve the conflicts we can get this in

Thanks a lot! I’ve rebased the branch onto the current main and resolved the conflicts. All checks are green now.

[ascorbic]

Plugin column labels must remain localizable, and the public cell contract must document batching to prevent per-row requests.

[ascorbic]

This renders the plugin label directly, so an Arabic admin still gets an English column name (and the same untranslated accessible name), even when the plugin catalog contains a translation. Resolve the label through the active Lingui instance, as plugin page labels are, and use that value for the aria label and both fallbacks.

[ascorbic]

The cell contract needs the batching constraint from the approved design. A cell that fetches metadata by item id will mount once per row and turn a 20-row page into 20 requests. Document and demonstrate one shared query key or batched request keyed by visibleItems.