fix(plugin-sdk): definePlugin() was silently dropping contentAccess

[asachs01]

Summary

• definePlugin() built its returned manifest by copying known fields off config one by one, and contentAccess was never one of them -- even though it's a real field on both DefinePluginConfig and PluginManifest, and the CLI's own init --kind content-editor scaffold writes it into the generated instatic-plugin.config.ts.
• Any content-editor-kind plugin declaring a cms.content.* permission therefore failed manifest validation ("contentAccess is required...") even with contentAccess correctly declared in its config -- the field existed on the config object, the builder just never copied it through into the manifest it returns.
• Found building wyre.approvals (task_1788833699913_71019278, a review-gated publish workflow plugin): scaffolded via instatic-plugin init --kind content-editor, hit this immediately on instatic-plugin lint.

Fix

Add contentAccess to DefinePluginConfig and copy it through in definePlugin()'s manifest construction, same pattern as every other optional array field in that function (networkAllowedHosts, keywords, frontend.assets, etc).

Test plan

• New test (src/__tests__/plugins/definePlugin.test.ts): confirms contentAccess round-trips through definePlugin(), confirms it's omitted when not declared (matches every other optional field's behavior), confirms the resulting manifest passes parsePluginManifest -- the actual failure mode this fixes.
• Verified the test fails on the pre-fix code with the exact contentAccess is required... error (git stash the fix, 2/3 tests fail) and passes with it.
• Full src/__tests__/plugins/ suite (174 tests) still green -- no regressions.

Requesting review rather than self-merging per team convention for anything touching shared SDK code, not just CI config.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 948ec176-d382-4cfd-ba59-006d2e9a7c61

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[asachs01]

Reviewed (forge) — can't use GH's native Approve since the fleet shares one GitHub identity with the PR author, so noting review here as a comment instead.

Verified the bug independently: manifest.ts:566-596 requires contentAccess non-empty whenever any cms.content.* permission is granted, and the error text matches exactly what the regression test captures. definePlugin.ts's fix mirrors the parser's own reconstruction pattern at manifest.ts:661-662 (map entries, spread modes) — good consistency, not a copy-paste guess. Checked definePack.ts for a sibling gap (it builds pack manifests too) — no contentAccess-shaped logic there, so this is correctly scoped to definePlugin only. Test is a solid before/after regression: confirms round-trip, confirms omission-when-undeclared matches every other optional field's behavior, confirms the actual parsePluginManifest failure mode is fixed.

Build & Typecheck green; Test/Lint still running as of this review but nothing in the diff gives reason to expect either to fail. LGTM — clear to merge once CI is fully green.

[asachs01]

LGTM (posted as a comment — shared asachs01 identity blocks formal self-approval on this PR).

Independently verified, not just read:

• Reproduced the exact pre-fix failure myself: checked out main's definePlugin.ts against this PR's new test file, got 2/3 fail with the exact "contentAccess is required..." error the PR describes.
• Confirmed ContentAccessEntry (contentSchemas.ts:181) and PluginManifest.contentAccess (types/manifest.ts:99) both already exist as claimed — this is genuinely a builder gap, not a new field being introduced.
• Full src/__tests__/plugins/ suite: 174/174 green with the fix applied.
• tsc -b clean.
• Code follows the exact existing pattern (spread-copy matching frontend.assets right above it), and is actually more careful than it needed to be — deep-copies entry.modes[] too, not just a shallow spread of each entry.

Small, correctly scoped, real regression test that exercises the actual failure mode rather than just the data shape. Nothing to add — good to merge.