{"id":98026,"date":"2026-10-06T15:02:00","date_gmt":"2026-10-06T19:02:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=98026"},"modified":"2026-09-29T07:55:47","modified_gmt":"2026-09-29T11:55:47","slug":"emdash-hook-system-event-driven-plugins-98026","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdash-hook-system-event-driven-plugins-98026\/","title":{"rendered":"EmDash Hook System: Build Event-Driven Plugins Without Database Access"},"content":{"rendered":"

Cloudflare\u2019s EmDash CMS<\/a> launched with a promise: plugins that can\u2019t touch your database unless you explicitly allow them. The mechanism that makes this possible is the hook system, powered by dynamic workers running in V8 isolates. This isn\u2019t theoretical \u2014 every plugin you write for EmDash declares capabilities, registers hooks, and executes in a sandbox that spins up in under 5 milliseconds.<\/p>\n

Here\u2019s exactly how it works, with concrete examples you can copy.<\/p>\n

What a Hook Actually Does in EmDash<\/h2>\n

In WordPress, a hook is a PHP function call that lets plugins intercept actions like save_post<\/code>codecodecodecode or wp_login<\/code>codecodecodecode. The plugin code runs in the same process as WordPress core, with full access to $wpdb<\/code>codecodecodecode and the file system. EmDash replaces that architecture entirely.<\/p>\n

An EmDash hook is a TypeScript function that triggers when a specific event occurs \u2014 a post being published, a user logging in, a comment being approved. The plugin registers a handler using the definePlugin<\/code>codecodecodecode function from the @emdash-cms\/plugin<\/code>codecodecodecode package. When the event fires, EmDash spins up a dynamic worker, passes the event context, executes the handler, and tears down the worker. The plugin never sees your database or other plugins\u2019 data.<\/p>\n

The critical difference: capabilities are declared upfront in a manifest. A plugin that only declares read:content<\/code>codecodecodecode and email:send<\/code>codecodecodecode can literally do nothing else \u2014 no file reads, no network calls, no database writes. The runtime enforces this at the V8 isolate level using Linux namespaces and seccomp filters.<\/p>\n

Registering Your First Hook: A Concrete Example<\/h2>\n

Let\u2019s build a plugin that sends a welcome email when a new user registers. In WordPress, you\u2019d write something like add_action('user_register', 'send_welcome_email')<\/code>codecodecodecode and the plugin would have unfettered access to your users table. In EmDash, you write:<\/p>\n

“`typescript<\/p>\n

import { definePlugin } from ‘@emdash-cms\/plugin’;<\/p>\n

export default definePlugin({<\/p>\n

id: ‘welcome-email’,<\/p>\n

version: ‘1.0.0’,<\/p>\n

capabilities: [‘read:content’, ’email:send’],<\/p>\n

hooks: {<\/p>\n

‘user:created’: async (context) => {<\/p>\n

const { user, email } = context;<\/p>\n

await email.send({<\/p>\n

to: user.email,<\/p>\n

subject: ‘Welcome to our site!’,<\/p>\n

template: ‘welcome’,<\/p>\n

});<\/p>\n

},<\/p>\n

},<\/p>\n

});<\/p>\n

“`<\/p>\n

Three things happen here. First, the plugin declares capabilities<\/code>codecodecodecode \u2014 it can read content and send emails, nothing else. Second, it registers a handler for the user:created<\/code>codecodecodecode hook. Third, the handler receives a typed context object containing only the data it needs \u2014 the new user\u2019s email address, not the password hash or session tokens.<\/p>\n

If a compromised version of this plugin tried to read context.user.password_hash<\/code>codecodecodecode, the TypeScript compiler would catch it at build time. If it tried to make an outbound HTTP request, the dynamic worker\u2019s seccomp filter would block it at runtime. The plugin physically cannot escalate.<\/p>\n

Available Hooks and Their Payloads<\/h2>\n

EmDash ships with a growing set of hooks. As of version 0.1.0, these include:<\/p>\n