0.12.0

New features

Access control and publication safety

• Implemented user access management.
• Implemented frontend page restriction and payment-aware restricted access flow.
• Added restricted file access in admin and moved file description/transcription handling into versioned data.
• Added private file storage for access-restricted pages with related admin UI and asset handling changes.
• Added MCP protection against concurrent overwrite with latest_id checks.

Admin experience and content editing

• Added edit capabilities for page/element/file items and expanded bulk edit workflows for pages/elements/files.
• Introduced page list sorting by first/last edit and list/filter refresh improvements.
• Improved file handling in admin: image/audio/video controls, drag/drop and private/public behaviors, SVG detail handling, and related tests/fixtures.
• Added/refined many admin workflows and tests around access controls, page detail/fileretail, and list rendering.

Search, caching and performance

• Added gzipped cache storage and cache-clearing simplification.
• Enabled page cache for CDN responses with middleware updates and removed response cookie barriers for CDN cacheability.
• Added event-based observability and monitoring work that affects page/action tracking.

Theme + site experience improvements

• Added/expanded theme package content and demo seeders, including demo seeders.
• Added new bold, estate, journal, luxury, and style themes
• Added/updated list and hero/content block behavior in frontend themes.

AI/automation and tooling

• Added/expanded AI mutation/tooling validation.
• Added WebMCP integration for search/contact actions.
• Refined AI prompts and chat/tool-call behavior in admin contexts.

Breaking/compatibility-impacting changes

High impact

• File/JSON API contract change: Page.has now represents number of child pages, not prior semantics.
• MCP write contract change: latest_id is now required for MCP save operations and enforced on add/save tools. API clients must send current latest token.
• Storage behavior changes for files: file metadata handling moved to versioned model paths and new relocation/private-file flow introduced. Custom integrations that read file metadata directly should revalidate assumptions.

Medium impact

• Architecture/package boundary shifts: core/theme/admin/graphql/pulse registration and provider wiring moved; extensions that assumed previous package ownership may need updates.
• Cache behavior changes: CDN-friendly response flow now relies on stricter cache semantics (cookie removal from public pages, route/middleware changes).
• URL generation changes for redirects/links may affect integrations depending on legacy relative URL output.

Low impact / policy changes

• License header changed from LGPL to MIT.
• Some defaults, build outputs, and dependency bumps are present across admin/theme tooling and are generally internal upgrades.

What's Changed

• Bump esbuild and vite in /admin by @dependabot[bot] in #221
• Require latest_id in MCP tools to avoid overwriting concurrent changes in #222
• Notify editors about changes in the list/tree view in #223
• Enable page cache for CDNs in #224
• Added drop zone for uploading files in admin fields in #225
• Added batch edits for elements/files/pages (recursively) in #226
• Broadcast different events for each action in #227
• Changed page "has" attribute to contain the number of children in #229
• Improved bulk editing of pages/elements/files in #231
• Changed license from LGPL to MIT license in #232
• Hardened security in #233
• Fixed searching for texts in CJK and other spaceless languages in #234
• Added demo seeder command with theme-specific seeder overrides in #235
• Added WebMCP for search and contact form in #237
• Rewritten page synthesize as streaming chat in #236
• Added schema validation to refine in AI sub-package in #238
• Enable extensions to register plugins in the admin backend in #239
• Use configurable timeout for portential long running AI operations in #240
• Guard against Laravel errors returning a HTML reponse in #241
• Implemented observability by emitting events on all actions in #242
• Implemented pulse package for integration into laravel/pulse in #243
• Improved pulse package and added page request monitoring in #246
• Refactor Pulse cards in #247
• Refactor and simplify Pulse in #248
• Added "style" theme in #250
• Improved admin translations in #251
• Allow several hero images in #252
• Implemented configurable number of cards per row in #255
• Streamlined page meta/config data shape in #253
• Prevent Core depending on GraphQL package in #257
• Moved code which is admin related to the sub-package in #258
• Split rate limiter registration into each responsible sub-package in #259
• Moved theme schema registration out core package in #260
• Simplified Pulse events and implementation in #261
• Separated admin editor includes from theme in #262
• Moved theme schema registration out core package in #264
• Clearly separate search and theme package configuration in #265
• Prevent Core depending on GraphQL package in #263
• Move file description/transcription into version aux column in #268
• Bump brace-expansion from 5.0.6 to 5.0.7 in /admin by @dependabot[bot] in #269
• Bump immutable from 5.1.7 to 5.1.9 in /admin by @dependabot[bot] in #271
• Bump dompurify from 3.4.11 to 3.4.12 in /admin by @dependabot[bot] in #270
• Performance and security optimizations in #272
• Implemented frontend page restriction in #256
• Simplified clearing caches in #273
• Added edit capabilities to page/element/file items in #276
• Bump brace-expansion from 5.0.7 to 5.0.8 in /admin by @dependabot[bot] in #274
• Bump postcss from 8.5.15 to 8.5.23 in /admin by @dependabot[bot] in #275
• Implemented private file storage for access restricted pages in #277
• Implemented payment handling for restricted page access in #278
• Bump brace-expansion from 5.0.8 to 5.0.9 in /admin by @dependabot[bot] in #280

Full Changelog: 0.11.5...0.12.0