v0.0.3 — Extensible content workflows and accessible administration

NafCMS 0.0.3 extends host and plugin workflows and improves accessible administration.

Added

• Content events and CmsEvent constants for page, article, form, media and navigation writes, including persisted form submissions and a listener example.

• Conventional block views through ProvidesBlockViewInterface, with explicit mapping precedence, missing-view warnings and registry removal methods.

• Skip-to-content links in admin, authentication and public layouts, with focusable main-content targets in all shipped page templates.

• Host-aware integrity:check with view resolution, slot agreement, content-anchor and block-view checks; orphan checks remain package-only.

• make:block, make:template and make:plugin commands with explicit registration instructions and protection against existing targets.

• @api annotations and documentation for the stable extension surface.

• Keyboard slot movement and polite add/remove/reorder announcements in the page builder.

• Automated WCAG A/AA checks using axe-core, shared builder DOM fixtures and layout accessibility regression tests.

• F9 switches the admin and login screens between dark and light. The choice is stored as before and follows into other open tabs; the toggle button names the shortcut. The handler cancels F9, so Edge's Immersive Reader and Firefox's Reader View do not open on these screens.

• cms()->pageTemplates() registry for page-builder templates. Plugins can add, replace, or remove templates; the host's src/Resources/pages/page_templates.php is read last and wins by id. Layout::fromDefinition() rebuilds a layout from a definition array.

Fixed

• cms.page.published, cms.navigation.published and cms.article.published now fire on the usual publishing paths as well: saving a page or navigation with status published, and approving an article review with direct publication. Before, only the rarely used explicit publish actions reported a publication.

• A page block whose declared view file is missing renders the placeholder and logs one warning instead of failing the whole page. BlockViewRegistry::declaredView() returns the declared view without the file check.

• Content events are dispatched with event()->isolated()->dispatch(), so one failing listener is logged and no longer stops the others.

• Example templates provide their own published host CSS instead of relying on utilities outside the package Tailwind source scan.

• Toasts use a persistent polite live region and no dialog roles on individual messages.

• Modal notifyJs dialogs trap Tab focus, focus the alert confirmation button and restore the opening element after dismissal.

• Admin and authentication boot scripts respect the system color scheme; later system changes apply while no preference is saved.

• Admin controls that removed their outlines now expose a visible keyboard-focus ring.

• Builder and remaining selected view strings, accessible labels and notifications use translated English keys; remove the unused role prompt.

• The page builder now offers the host's and plugins' templates. It previously read only the package's template file, while saving and rendering already included the host file, so host templates rendered but could not be selected.

Changed

• Audit entries and content events for a change are written by one internal helper from the same snapshots.
• Require Framework 0.2.13 for event()->isolated()->dispatch().
• Host service overrides and block registrations belong in the host's bootstrap.php before app()->run(), like in every NAF application; the separate src/services.php convention is gone from the docs, example 06 and make:block.
• Require naf/form 0.2.4, which validates CSRF tokens for every method except GET, HEAD and OPTIONS and no longer exempts Bearer requests, and naf/mcp 0.2.6, which exempts its own RPC route from that check.
• PageTemplateCatalog is deprecated in favour of cms()->pageTemplates().

Upgrade from the host root, then run vendor/bin/naf nafcms:assets:publish, vendor/bin/naf nafcms:assets:check and vendor/bin/naf db:migrate up. Custom UserPrivilegePolicyInterface adapters must implement assertProfileChange().

Validation: 555 tests / 2,716 assertions, PHPStan, strict Composer validation, style, documentation/integrity checks, 35 builder tests, asset tests and build passed locally. Release-commit CI covers supported PHP 8.3/8.4, PHP 8.3 minimum dependencies, PHP 8.5 compatibility, MariaDB migrations, audits, assets and a fresh-host package smoke test.

v0.0.2 — Include template utilities in distributed CSS

CMS templates now contribute their Tailwind utilities to the distributed stylesheet. In v0.0.1 the explicit source path pointed at the nonexistent src/views directory, so utilities used only by templates could be missing even though rebuilding the stylesheet produced a reproducible result.

The source now points at the package's actual top-level views directory, and the shipped CSS has been regenerated. A CLI build regression verifies that a template-only utility is emitted and unrelated local HTML is excluded. It fails against the old path and passes with this correction; CI runs it alongside the 25 existing builder tests.

For an existing installation, update the CMS package, then run vendor/bin/naf nafcms:assets:publish and vendor/bin/naf nafcms:assets:check from the host root. Review any host-modified asset collision reported by the publisher. No database migration is added by this patch.

Validation at the exact release commit includes 493 PHP tests / 2455 assertions, PHP 8.3 minimum NAF dependencies and PHP 8.3/8.4/8.5 compatibility, PHPStan, style, Composer/npm audits, MariaDB migrations, package/archive checks and the real fresh-host smoke. Exact merge CI.

This patch completes the first CMS preview publication. The preview compatibility limits described in v0.0.1 still apply.

v0.0.1 — First CMS preview for NAF

Use v0.0.2 or newer. That patch corrects template discovery in the Tailwind build and ships the complete regenerated stylesheet. Existing v0.0.1 installations should update and republish/check CMS assets.

NafCMS v0.0.1 is the first CMS preview for an ordinary NAF application. It provides localized articles and publishing workflows, pages, forms, media, navigation, themes, users and permissions, audit history, and explicit page/API/content/block extension registries. Composer installs it as naf/cms; the host owns configuration, storage and its public webroot.

The preview includes scoped MCP tools and an optional browser-local Ollama assistant. Package defaults remain read-only, while installation-specific runtime files and published assets belong to the host. Authentication, CSRF, permissions and token scopes remain enforced by the existing NAF/CMS integrations.

This release also corrects the standalone chart translation fallback, declares PDO in the CMS, requires Framework 0.2.9 and CLI 0.2.2, and uses published dependency commits. Static analysis avoids application boot, Tailwind builds use explicit package sources, and installation checks preserve the starter's project guide. Obsolete Auth development-repository instructions are replaced with the published Composer setup.

Sitebuilder payloads, extension APIs and storage shapes may change before v0.1. Local AI is Ollama-only, custom theme JavaScript is disabled, and PHP 8.5 remains a compatibility target. Back up the database and host runtime/media/theme files before upgrades; publish/check assets and apply migrations after updating.

Validation at the release commit: 493 tests / 2455 assertions; PHP 8.3 and 8.4 plus PHP 8.5 compatibility; PHP 8.3 minimum NAF dependencies; PHPStan and formatting; Composer/npm audits; 25 builder tests and reproducible assets; MariaDB migrations; archive inspection and a fresh SQLite host covering CLI, scoped MCP, authentication boundaries and vendor immutability. Exact merge CI.

Install with composer require naf/cms in a NAF host. Follow the CMS documentation for plugin order, database configuration, asset publication and first administrator creation.