@sonicjs-cms/core 3.0.0-beta.23 → 3.0.0-beta.24

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createAuth } from './chunk-SOZUG52O.js';
-import { getEmailService, hasEmailService, setEmailService, reconcileMenuFromPlugins, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default } from './chunk-SK5CHFJP.js';
-export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-SK5CHFJP.js';
+import { getEmailService, hasEmailService, setEmailService, reconcileMenuFromPlugins, invalidateVariablesCache, resolveVariablesInObject, resolveDocScope, denyIfNotAllowed, DocumentRepository, dispatchHookEvent, getCustomData, createDocumentSchema, renderTable, getVariablesCached, setVariablesCache, TenantService, isValidMemberRole, renderConfirmationDialog, getConfirmationDialogScript, VALID_MEMBER_ROLES, userProfilesPlugin, lexicalEditorPlugin, api_media_default, api_system_default, apiDocumentsRoutes, api_default, adminDocumentsRoutes, admin_api_default, adminCollectionsRoutes, adminSettingsRoutes, router2, admin_content_default, adminMediaRoutes, router, adminPluginRoutes, adminLogsRoutes, userRoutes, auth_default, test_cleanup_default, getDocumentRequestContext, updateDocumentSchema, effectiveTenantForType } from './chunk-VC5XVPLM.js';
+export { DocumentRepository, ROUTES_INFO, admin_api_default as adminApiRoutes, adminCheckboxRoutes, adminCollectionsRoutes, admin_content_default as adminContentRoutes, router as adminDashboardRoutes, adminLogsRoutes, adminMediaRoutes, adminPluginRoutes, adminSettingsRoutes, userRoutes as adminUsersRoutes, api_content_crud_default as apiContentCrudRoutes, api_media_default as apiMediaRoutes, api_default as apiRoutes, api_system_default as apiSystemRoutes, auth_default as authRoutes, createUserProfilesPlugin, defineUserProfile, getUserProfileConfig, userProfilesPlugin } from './chunk-VC5XVPLM.js';
 import './chunk-VVYVFCML.js';
 import './chunk-BHND5PEV.js';
 import { SettingsService, setAppInstance } from './chunk-2XAQTPAE.js';
@@ -8,30 +8,30 @@ export { Logger, getLogger, initLogger } from './chunk-2XAQTPAE.js';
 import { getAllCacheStats, CACHE_CONFIGS, getCacheService, clearAllCaches, parseCacheKey } from './chunk-K25XHMM3.js';
 import { schema_exports } from './chunk-AI663NBO.js';
 export { apiTokens, content, contentVersions, insertContentSchema, insertLogConfigSchema, insertMediaSchema, insertPluginActivityLogSchema, insertPluginAssetSchema, insertPluginHookSchema, insertPluginRouteSchema, insertPluginSchema, insertSystemLogSchema, insertUserSchema, insertWorkflowHistorySchema, logConfig, media, pluginActivityLog, pluginAssets, pluginHooks, pluginRoutes, plugins, selectContentSchema, selectLogConfigSchema, selectMediaSchema, selectPluginActivityLogSchema, selectPluginAssetSchema, selectPluginHookSchema, selectPluginRouteSchema, selectPluginSchema, selectSystemLogSchema, selectUserSchema, selectWorkflowHistorySchema, systemLogs, users, workflowHistory } from './chunk-AI663NBO.js';
-import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-DIBCKCUE.js';
-export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-DIBCKCUE.js';
+import { requireAuth, DocumentTypeRegistry, requireRbac, requireRole, getJwtExpirySecondsFromDb, AuthManager, metricsMiddleware, bootstrapMiddleware, securityHeadersMiddleware, csrfProtection } from './chunk-FHPEM77Y.js';
+export { AuthManager, PermissionManager, bootstrapDocumentTypes, bootstrapMiddleware, cacheHeaders, compressionMiddleware, detailedLoggingMiddleware, getActivePlugins, isPluginActive, logActivity, loggingMiddleware, optionalAuth, performanceLoggingMiddleware, requireActivePlugin, requireActivePlugins, requireAnyPermission, requireAuth, requirePermission, requireRole, securityHeadersMiddleware as securityHeaders, securityLoggingMiddleware } from './chunk-FHPEM77Y.js';
 import { RbacService, DocumentsService } from './chunk-3TMTYJAJ.js';
 export { DocumentsService, RbacService } from './chunk-3TMTYJAJ.js';
 import { nanoid } from './chunk-UWUP2VMT.js';
-import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-KS24NPPL.js';
-export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-KS24NPPL.js';
-export { MigrationService } from './chunk-A46IRC5A.js';
+import { PluginService, PLUGIN_REGISTRY, invalidateTenantCache, getCollectionRegistry, TENANT_COOKIE, MULTI_TENANT_PLUGIN_ID, collectionRecordToRow, tenantMiddleware } from './chunk-RJ2O5IIE.js';
+export { PluginBootstrapService, PluginService as PluginServiceClass, getAvailableCollectionNames, loadCollectionConfig, loadCollectionConfigs, registerCollections, validateCollectionConfig } from './chunk-RJ2O5IIE.js';
+export { MigrationService } from './chunk-UIHIXTIS.js';
 export { renderFilterBar } from './chunk-URIBTX27.js';
 import { renderAdminLayout } from './chunk-BJROXF4N.js';
 export { getConfirmationDialogScript, renderAlert, renderConfirmationDialog, renderForm, renderFormField, renderPagination, renderTable } from './chunk-BJROXF4N.js';
 import { init_admin_layout_catalyst_template, renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
 export { renderAdminLayoutCatalyst } from './chunk-THFZSDIU.js';
-import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes } from './chunk-XXRR54AB.js';
-export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, registerPlugins, topoSort } from './chunk-XXRR54AB.js';
-import { definePlugin, setPluginMenu, setPluginDefinitions, resolvePluginMenuItems } from './chunk-2MIYYAO4.js';
-export { applySchemaDefaults, definePlugin, getPluginMenu, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields, resetPluginMenu, resolvePluginMenuItems, setPluginMenu } from './chunk-2MIYYAO4.js';
+import { TurnstileService, HookSystemImpl, createPluginWirer, registerPluginRoutes } from './chunk-VYQVDL2M.js';
+export { HookSystemImpl, HookUtils, PluginDependencyCycleError, PluginManager as PluginManagerClass, PluginRegistryImpl, PluginValidator as PluginValidatorClass, RegisterPluginsError, ScopedHookSystem as ScopedHookSystemClass, collectCronSchedules, collectCrons, createScheduledHandler, dispatchCronTick, registerPlugins, topoSort } from './chunk-VYQVDL2M.js';
+import { definePlugin, setPluginMenu, setPluginDefinitions, resolvePluginMenuItems } from './chunk-VGEZNFWH.js';
+export { applySchemaDefaults, definePlugin, getPluginMenu, isDefinedPlugin, parseConfigSchema, parseFormDataToSettings, renderSchemaFields, resetPluginMenu, resolvePluginMenuItems, setPluginMenu } from './chunk-VGEZNFWH.js';
 import { setHookSystem } from './chunk-RNZFGN4R.js';
 export { getHookSystem, getTypedHooks, hasHookSystem, resetHookSystem, setHookSystem } from './chunk-RNZFGN4R.js';
 export { QueryFilterBuilder, TemplateRenderer, buildQuery, renderTemplate, templateRenderer } from './chunk-QZGABF2M.js';
 export { metricsTracker } from './chunk-FICTAGD4.js';
 import './chunk-X7ZAEI5S.js';
-import { getCoreVersion, package_default } from './chunk-DPLJYTHE.js';
-export { SONICJS_VERSION, getCoreVersion } from './chunk-DPLJYTHE.js';
+import { getCoreVersion, package_default } from './chunk-LNI3FYSI.js';
+export { SONICJS_VERSION, getCoreVersion } from './chunk-LNI3FYSI.js';
 import { escapeHtml, sanitizeInput } from './chunk-TQABQWOP.js';
 export { escapeHtml, sanitizeInput, sanitizeObject } from './chunk-TQABQWOP.js';
 export { HOOKS } from './chunk-QXOZI5Q2.js';
@@ -22051,10 +22051,837 @@ var site_settings_collection_default = {
 function createDb(d1) {
   return drizzle(d1, { schema: schema_exports });
 }
+var mcpTypeConfigSchema = z.object({
+  read: z.boolean().default(true),
+  write: z.boolean().default(true)
+});
+var mcpConfigSchema = z.object({
+  /** Collections exposed over MCP. Omitted → every active collection. */
+  expose: z.array(z.string()).optional(),
+  /** Per-collection read/write overrides, keyed by collection name. */
+  types: z.record(z.string(), mcpTypeConfigSchema).default({}),
+  /** Field names stripped from every tool response + write schema. */
+  redactFields: z.array(z.string()).default([]),
+  /** Max documents returned by list_* tools and document resources. */
+  listLimit: z.number().int().positive().max(200).default(50)
+});
+function resolveMcpConfig(raw, collections) {
+  const cfg = mcpConfigSchema.parse(raw ?? {});
+  const exposeSet = cfg.expose ? new Set(cfg.expose) : null;
+  const types = collections.filter((c) => exposeSet ? exposeSet.has(c.name) : true).map((c) => {
+    const override = cfg.types[c.name];
+    return {
+      typeId: c.name,
+      displayName: c.displayName ?? c.name,
+      read: override?.read ?? true,
+      write: override?.write ?? true
+    };
+  });
+  return { types, redactFields: cfg.redactFields, listLimit: cfg.listLimit };
+}
+
+// src/plugins/core-plugins/mcp-plugin/schema/field-to-jsonschema.ts
+var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
+  "id",
+  "root_id",
+  "rootId",
+  "created_at",
+  "createdAt",
+  "updated_at",
+  "updatedAt",
+  "version_number",
+  "versionNumber"
+]);
+function fieldToJsonSchema(field) {
+  const base = {};
+  if (field.title) base.title = field.title;
+  if (field.description) base.description = field.description;
+  switch (field.type) {
+    case "number":
+      return {
+        ...base,
+        type: "number",
+        ...field.min != null ? { minimum: field.min } : {},
+        ...field.max != null ? { maximum: field.max } : {}
+      };
+    case "boolean":
+    case "checkbox":
+      return { ...base, type: "boolean" };
+    case "date":
+    case "datetime":
+      return { ...base, type: "string", format: "date-time" };
+    case "select":
+    case "radio":
+      return { ...base, type: "string", ...field.enum ? { enum: field.enum } : {} };
+    case "multiselect":
+      return {
+        ...base,
+        type: "array",
+        items: { type: "string", ...field.enum ? { enum: field.enum } : {} }
+      };
+    case "array":
+      return {
+        ...base,
+        type: "array",
+        items: field.items ? fieldToJsonSchema(field.items) : {}
+      };
+    case "object":
+      return {
+        ...base,
+        type: "object",
+        ...field.properties ? { properties: mapProperties(field.properties) } : {}
+      };
+    case "json":
+      return { ...base };
+    // string-like: string, slug, email, url, richtext, markdown, textarea, editors,
+    // reference, media, color, file, user
+    default: {
+      const node = { ...base, type: "string" };
+      if (field.minLength != null) node.minLength = field.minLength;
+      if (field.maxLength != null) node.maxLength = field.maxLength;
+      if (field.pattern) node.pattern = field.pattern;
+      if (field.format) node.format = field.format;
+      return node;
+    }
+  }
+}
+function mapProperties(props) {
+  const out = {};
+  for (const [name, field] of Object.entries(props)) {
+    out[name] = fieldToJsonSchema(field);
+  }
+  return out;
+}
+function collectionToJsonSchema(schema, opts = {}) {
+  const properties = {};
+  const required = [];
+  const redact2 = new Set(opts.redactFields ?? []);
+  const schemaRequired = new Set(schema.required ?? []);
+  for (const [name, field] of Object.entries(schema.properties ?? {})) {
+    if (redact2.has(name)) continue;
+    if (opts.forWrite && SYSTEM_FIELDS.has(name)) continue;
+    properties[name] = fieldToJsonSchema(field);
+    if (field.required || schemaRequired.has(name)) required.push(name);
+  }
+  return { type: "object", properties, ...required.length ? { required } : {} };
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/registry.ts
+var PHASE_FLAGS = { includeWrite: true, includeSearch: false };
+var EMPTY_OBJECT_SCHEMA = { type: "object", properties: {} };
+function buildToolRegistry(cfg, collections, opts = {}) {
+  const tools = [];
+  tools.push({
+    name: "list_collections",
+    description: "List every content collection exposed over MCP, with its read/write access.",
+    inputSchema: EMPTY_OBJECT_SCHEMA,
+    op: "list_collections"
+  });
+  if (opts.includeSearch) {
+    tools.push({
+      name: "search_content",
+      description: "Search content across exposed collections by title or slug.",
+      inputSchema: {
+        type: "object",
+        properties: { query: { type: "string", description: "Text matched against document title and slug." } },
+        required: ["query"]
+      },
+      op: "search_content"
+    });
+  }
+  for (const t of cfg.types) {
+    const col = collections.get(t.typeId);
+    const writeSchema = col ? collectionToJsonSchema(col.schema, { forWrite: true, redactFields: cfg.redactFields }) : EMPTY_OBJECT_SCHEMA;
+    if (t.read) {
+      tools.push({
+        name: `list_${t.typeId}`,
+        description: `List ${t.displayName} documents.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            status: {
+              type: "string",
+              enum: ["published", "draft"],
+              description: "Lifecycle to list. Defaults to published."
+            },
+            limit: { type: "number", description: `Max documents to return (capped at ${cfg.listLimit}).` }
+          }
+        },
+        op: "list",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `get_${t.typeId}`,
+        description: `Get one ${t.displayName} document by id or slug.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: { type: "string", description: "Document id or root id." },
+            slug: { type: "string", description: "Document slug (alternative to id)." }
+          }
+        },
+        op: "get",
+        typeId: t.typeId
+      });
+    }
+    if (opts.includeWrite && t.write) {
+      tools.push({
+        name: `create_${t.typeId}`,
+        description: `Create a ${t.displayName} document.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            title: { type: "string" },
+            slug: { type: "string" },
+            data: writeSchema,
+            publish: { type: "boolean", description: "Publish immediately. Defaults to false (draft)." }
+          }
+        },
+        op: "create",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `update_${t.typeId}`,
+        description: `Update a ${t.displayName} document (saves a new draft).`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            id: { type: "string", description: "Root id of the document to update." },
+            title: { type: "string" },
+            slug: { type: "string" },
+            data: writeSchema
+          },
+          required: ["id"]
+        },
+        op: "update",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `publish_${t.typeId}`,
+        description: `Publish a ${t.displayName} document.`,
+        inputSchema: {
+          type: "object",
+          properties: { id: { type: "string", description: "Root id of the document to publish." } },
+          required: ["id"]
+        },
+        op: "publish",
+        typeId: t.typeId
+      });
+      tools.push({
+        name: `delete_${t.typeId}`,
+        description: `Delete a ${t.displayName} document.`,
+        inputSchema: {
+          type: "object",
+          properties: { id: { type: "string", description: "Root id of the document to delete." } },
+          required: ["id"]
+        },
+        op: "delete",
+        typeId: t.typeId
+      });
+    }
+  }
+  return tools;
+}
+
+// src/plugins/core-plugins/mcp-plugin/jsonrpc.ts
+var JSON_RPC = {
+  PARSE_ERROR: -32700,
+  INVALID_REQUEST: -32600,
+  METHOD_NOT_FOUND: -32601,
+  INVALID_PARAMS: -32602,
+  INTERNAL_ERROR: -32603,
+  /** Custom: no valid API key on the request. */
+  UNAUTHORIZED: -32001
+};
+var McpToolError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpToolError";
+  }
+};
+function rpcResult(id, result) {
+  return { jsonrpc: "2.0", id: id ?? null, result };
+}
+function rpcError(id, code, message, data) {
+  return { jsonrpc: "2.0", id: id ?? null, error: { code, message, ...{} } };
+}
+function parseJsonRpc(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return { error: { code: JSON_RPC.INVALID_REQUEST, message: "Request must be a JSON object" } };
+  }
+  const b = body;
+  if (b.jsonrpc !== "2.0") {
+    return { error: { code: JSON_RPC.INVALID_REQUEST, message: 'jsonrpc must be "2.0"' } };
+  }
+  if (typeof b.method !== "string" || b.method.length === 0) {
+    return { error: { code: JSON_RPC.INVALID_REQUEST, message: "method must be a non-empty string" } };
+  }
+  const id = b.id === void 0 ? null : b.id;
+  const params = b.params && typeof b.params === "object" && !Array.isArray(b.params) ? b.params : {};
+  return { jsonrpc: "2.0", id, method: b.method, params };
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/documents.ts
+function redact(data, fields) {
+  if (!fields.length) return data;
+  const out = { ...data };
+  for (const f of fields) delete out[f];
+  return out;
+}
+function shapeDocument(doc, redactFields) {
+  return {
+    id: doc.id,
+    rootId: doc.rootId,
+    typeId: doc.typeId,
+    title: doc.title,
+    slug: doc.slug,
+    status: doc.status,
+    isPublished: doc.isPublished,
+    publishedAt: doc.publishedAt,
+    updatedAt: doc.updatedAt,
+    data: redact(doc.data, redactFields)
+  };
+}
+async function resolveType(ctx, typeId) {
+  const docType = await new DocumentTypeRegistry(ctx.db).findById(typeId);
+  if (!docType || !docType.isActive) throw new McpToolError(`Unknown document type: ${typeId}`);
+  const effTenant = effectiveTenantForType(ctx.tenantId, docType.settings);
+  const repo = new DocumentRepository(ctx.db, effTenant);
+  return { docType, repo };
+}
+async function execList(ctx, typeId, args) {
+  const { docType, repo } = await resolveType(ctx, typeId);
+  const status = args.status === "draft" ? "draft" : "published";
+  const limit = Math.min(Math.max(1, args.limit ?? ctx.listLimit), ctx.listLimit);
+  const now = Math.floor(Date.now() / 1e3);
+  const docs = await repo.list({
+    typeId,
+    status,
+    timeWindow: status === "published",
+    now,
+    limit
+  });
+  const allowed = await Promise.all(
+    docs.map((d) => repo.isAllowed(ctx.principalSet, d.rootId, "read", docType.settings))
+  );
+  return docs.filter((_, i) => allowed[i]).map((d) => shapeDocument(d, ctx.redactFields));
+}
+async function execGet(ctx, typeId, args) {
+  const { docType, repo } = await resolveType(ctx, typeId);
+  let doc = null;
+  if (args.id) {
+    doc = await repo.getById(args.id) ?? await repo.getPublished(args.id) ?? await repo.getCurrentDraft(args.id);
+  } else if (args.slug) {
+    doc = await repo.getBySlug(typeId, args.slug);
+  } else {
+    throw new McpToolError('get requires an "id" or "slug" argument');
+  }
+  if (!doc || doc.typeId !== typeId) throw new McpToolError("Document not found");
+  const ok = await repo.isAllowed(ctx.principalSet, doc.rootId, "read", docType.settings);
+  if (!ok) throw new McpToolError("Document not found");
+  return shapeDocument(doc, ctx.redactFields);
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/mutations.ts
+async function resolveWriteScope(ctx, typeId) {
+  const docType = await new DocumentTypeRegistry(ctx.db).findById(typeId);
+  if (!docType || !docType.isActive) throw new McpToolError(`Unknown document type: ${typeId}`);
+  const effTenant = effectiveTenantForType(ctx.tenantId, docType.settings);
+  const repo = new DocumentRepository(ctx.db, effTenant);
+  const svc = new DocumentsService(ctx.db, {
+    queryableFields: docType.queryableFields ?? [],
+    typeSchemaVersion: docType.schemaVersion,
+    maxVersionsPerRoot: docType.settings?.maxVersionsPerRoot,
+    tenantId: effTenant,
+    versioning: docType.settings?.versioning ?? false
+  });
+  return { docType, effTenant, repo, svc };
+}
+async function assertAllowed(scope, ctx, rootId, permission) {
+  const ok = await scope.repo.isAllowed(ctx.principalSet, rootId, permission, scope.docType.settings ?? {});
+  if (!ok) throw new McpToolError(`Permission denied: cannot ${permission} ${scope.docType.id}`);
+}
+function applyUserFieldDefaults(data, typeId, userId) {
+  const col = getCollectionRegistry().getByName(typeId);
+  if (!col?.schema?.properties) return data;
+  const props = col.schema.properties;
+  const patched = { ...data };
+  for (const [name, field] of Object.entries(props)) {
+    if (field.type === "user" && !patched[name]) patched[name] = userId;
+  }
+  return patched;
+}
+async function execCreate(ctx, typeId, args) {
+  const scope = await resolveWriteScope(ctx, typeId);
+  await assertAllowed(scope, ctx, "", "create");
+  const data = redact(applyUserFieldDefaults(args.data ?? {}, typeId, ctx.userId), ctx.redactFields);
+  const input = createDocumentSchema.parse({
+    typeId,
+    tenantId: scope.effTenant,
+    title: args.title ?? null,
+    slug: args.slug ?? null,
+    data,
+    ownerId: ctx.userId,
+    publishOnCreate: Boolean(args.publish)
+  });
+  const doc = await scope.svc.create(input, ctx.userId);
+  return shapeDocument(doc, ctx.redactFields);
+}
+async function execUpdate(ctx, typeId, args) {
+  if (!args.id) throw new McpToolError('update requires an "id" (root id)');
+  const scope = await resolveWriteScope(ctx, typeId);
+  const current = await scope.repo.getCurrentDraft(args.id);
+  if (!current || current.typeId !== typeId) throw new McpToolError("Document not found");
+  await assertAllowed(scope, ctx, args.id, "update");
+  const patch = updateDocumentSchema.parse({
+    ...args.title !== void 0 ? { title: args.title } : {},
+    ...args.slug !== void 0 ? { slug: args.slug } : {},
+    ...args.data !== void 0 ? { data: redact(args.data, ctx.redactFields) } : {}
+  });
+  const doc = await scope.svc.saveDraft(args.id, patch, ctx.userId);
+  return shapeDocument(doc, ctx.redactFields);
+}
+async function execPublish(ctx, typeId, args) {
+  if (!args.id) throw new McpToolError('publish requires an "id" (root id)');
+  const scope = await resolveWriteScope(ctx, typeId);
+  const current = await scope.repo.getCurrentDraft(args.id);
+  if (!current || current.typeId !== typeId) throw new McpToolError("Document not found");
+  await assertAllowed(scope, ctx, args.id, "publish");
+  const doc = await scope.svc.publish(current.id, ctx.userId);
+  return shapeDocument(doc, ctx.redactFields);
+}
+async function execDelete(ctx, typeId, args) {
+  if (!args.id) throw new McpToolError('delete requires an "id" (root id)');
+  const scope = await resolveWriteScope(ctx, typeId);
+  const current = await scope.repo.getCurrentDraft(args.id) ?? await scope.repo.getPublished(args.id);
+  if (!current || current.typeId !== typeId) throw new McpToolError("Document not found");
+  await assertAllowed(scope, ctx, args.id, "delete");
+  if (scope.docType.settings?.pii) {
+    await scope.svc.erase(args.id, scope.effTenant);
+    return { rootId: args.id, deleted: true, erased: true };
+  }
+  const ids = /* @__PURE__ */ new Set();
+  ids.add(current.id);
+  if (current.isCurrentDraft) {
+    const published = await scope.repo.getPublished(args.id);
+    if (published) ids.add(published.id);
+  } else {
+    const draft = await scope.repo.getCurrentDraft(args.id);
+    if (draft) ids.add(draft.id);
+  }
+  for (const id of ids) await scope.svc.softDelete(id);
+  return { rootId: args.id, deleted: true, erased: false };
+}
+
+// src/plugins/core-plugins/mcp-plugin/tools/static.ts
+function execListCollections(types) {
+  return types.map((t) => ({ typeId: t.typeId, displayName: t.displayName, read: t.read, write: t.write }));
+}
+
+// src/plugins/core-plugins/mcp-plugin/resources/schemas.ts
+function buildResourceList(cfg) {
+  const out = [
+    { uri: "sonicjs://collections", name: "All collections", mimeType: "application/json" }
+  ];
+  for (const t of cfg.types) {
+    out.push({
+      uri: `sonicjs://collections/${t.typeId}/schema`,
+      name: `${t.displayName} schema`,
+      mimeType: "application/json"
+    });
+  }
+  return out;
+}
+var SCHEMA_URI = /^sonicjs:\/\/collections\/([^/]+)\/schema$/;
+function readResource(uri, cfg, collections) {
+  if (uri === "sonicjs://collections") {
+    const list = cfg.types.map((t) => ({
+      typeId: t.typeId,
+      displayName: t.displayName,
+      read: t.read,
+      write: t.write
+    }));
+    return { uri, mimeType: "application/json", text: JSON.stringify(list, null, 2) };
+  }
+  const m = uri.match(SCHEMA_URI);
+  if (m) {
+    const typeId = m[1];
+    const exposed = cfg.types.find((t) => t.typeId === typeId);
+    const col = collections.get(typeId);
+    if (!exposed || !col) throw new McpToolError(`Unknown collection: ${typeId}`);
+    const schema = collectionToJsonSchema(col.schema, { redactFields: cfg.redactFields });
+    return { uri, mimeType: "application/json", text: JSON.stringify(schema, null, 2) };
+  }
+  throw new McpToolError(`Unknown resource URI: ${uri}`);
+}
+
+// src/plugins/core-plugins/mcp-plugin/routes/mcp.ts
+var SERVER_INFO = { name: "sonicjs-mcp", version: "1.0.0" };
+var PROTOCOL_VERSION = "2024-11-05";
+function createMcpRoutes(options = {}) {
+  const app2 = new Hono();
+  app2.post("/", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json(rpcError(null, JSON_RPC.PARSE_ERROR, "Invalid JSON"));
+    }
+    const parsed = parseJsonRpc(body);
+    if ("error" in parsed) {
+      const id2 = body && typeof body === "object" ? body.id ?? null : null;
+      return c.json(rpcError(id2, parsed.error.code, parsed.error.message));
+    }
+    const { id, method, params } = parsed;
+    const user = c.get("user");
+    if (!user) {
+      return c.json(
+        rpcError(id, JSON_RPC.UNAUTHORIZED, "Unauthorized: provide a valid API key via Authorization: Bearer sk_...")
+      );
+    }
+    const { tenantId, principalSet, userId } = getDocumentRequestContext(c);
+    const registry = getCollectionRegistry();
+    const active = registry.listActive();
+    const collections = new Map(active.map((col) => [col.name, col]));
+    const cfg = resolveMcpConfig(options, active);
+    const tools = buildToolRegistry(cfg, collections, PHASE_FLAGS);
+    try {
+      switch (method) {
+        case "initialize":
+          return c.json(
+            rpcResult(id, {
+              protocolVersion: PROTOCOL_VERSION,
+              serverInfo: SERVER_INFO,
+              capabilities: { tools: {}, resources: {} }
+            })
+          );
+        case "tools/list":
+          return c.json(
+            rpcResult(id, {
+              tools: tools.map((t) => ({ name: t.name, description: t.description, inputSchema: t.inputSchema }))
+            })
+          );
+        case "tools/call": {
+          const name = typeof params.name === "string" ? params.name : "";
+          const args = params.arguments && typeof params.arguments === "object" ? params.arguments : {};
+          const tool = tools.find((t) => t.name === name);
+          if (!tool) return c.json(rpcError(id, JSON_RPC.METHOD_NOT_FOUND, `Unknown tool: ${name}`));
+          const readCtx = {
+            db: c.env.DB,
+            tenantId,
+            principalSet,
+            listLimit: cfg.listLimit,
+            redactFields: cfg.redactFields
+          };
+          const writeCtx = {
+            db: c.env.DB,
+            tenantId,
+            principalSet,
+            userId: userId ?? "",
+            redactFields: cfg.redactFields
+          };
+          try {
+            let result;
+            switch (tool.op) {
+              case "list_collections":
+                result = execListCollections(cfg.types);
+                break;
+              case "list":
+                result = await execList(readCtx, tool.typeId, args);
+                break;
+              case "get":
+                result = await execGet(readCtx, tool.typeId, args);
+                break;
+              case "create":
+                result = await execCreate(writeCtx, tool.typeId, args);
+                break;
+              case "update":
+                result = await execUpdate(writeCtx, tool.typeId, args);
+                break;
+              case "publish":
+                result = await execPublish(writeCtx, tool.typeId, args);
+                break;
+              case "delete":
+                result = await execDelete(writeCtx, tool.typeId, args);
+                break;
+              default:
+                return c.json(rpcError(id, JSON_RPC.METHOD_NOT_FOUND, `Tool not available: ${name}`));
+            }
+            return c.json(rpcResult(id, { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] }));
+          } catch (e) {
+            if (e instanceof McpToolError) {
+              return c.json(rpcResult(id, { content: [{ type: "text", text: e.message }], isError: true }));
+            }
+            throw e;
+          }
+        }
+        case "resources/list":
+          return c.json(rpcResult(id, { resources: buildResourceList(cfg) }));
+        case "resources/read": {
+          const uri = typeof params.uri === "string" ? params.uri : "";
+          if (!uri) return c.json(rpcError(id, JSON_RPC.INVALID_PARAMS, 'resources/read requires a "uri" param'));
+          try {
+            const contents = readResource(uri, cfg, collections);
+            return c.json(rpcResult(id, { contents: [contents] }));
+          } catch (e) {
+            if (e instanceof McpToolError) return c.json(rpcError(id, JSON_RPC.INVALID_PARAMS, e.message));
+            throw e;
+          }
+        }
+        default:
+          return c.json(rpcError(id, JSON_RPC.METHOD_NOT_FOUND, `Method not found: ${method}`));
+      }
+    } catch (e) {
+      console.error("[mcp] handler error:", e);
+      return c.json(rpcError(id, JSON_RPC.INTERNAL_ERROR, "Internal error"));
+    }
+  });
+  return app2;
+}
+
+// src/plugins/core-plugins/mcp-plugin/admin/templates.ts
+init_admin_layout_catalyst_template();
+function accessBadge(ok) {
+  return ok ? `<span class="inline-flex items-center rounded-full bg-emerald-50 dark:bg-emerald-900/20 px-2 py-0.5 text-xs font-medium text-emerald-700 dark:text-emerald-400 ring-1 ring-emerald-600/20 dark:ring-emerald-400/20">Yes</span>` : `<span class="inline-flex items-center rounded-full bg-zinc-100 dark:bg-zinc-800 px-2 py-0.5 text-xs font-medium text-zinc-500 dark:text-zinc-400 ring-1 ring-zinc-200 dark:ring-zinc-700">No</span>`;
+}
+function toolNamesForType(typeId, tools) {
+  const names = tools.filter((t) => t.typeId === typeId).map((t) => `<code class="text-xs font-mono text-zinc-500 dark:text-zinc-400">${escapeHtml(t.name)}</code>`);
+  return names.length ? names.join('<span class="text-zinc-300 dark:text-zinc-600 mx-1">,</span>') : "\u2014";
+}
+function buildClaudeJson(endpointUrl) {
+  return JSON.stringify(
+    {
+      mcpServers: {
+        sonicjs: {
+          type: "http",
+          url: endpointUrl,
+          headers: { Authorization: "Bearer sk_YOUR_API_KEY" }
+        }
+      }
+    },
+    null,
+    2
+  );
+}
+function buildCursorJson(endpointUrl) {
+  return JSON.stringify(
+    {
+      mcpServers: {
+        sonicjs: {
+          url: endpointUrl,
+          headers: { Authorization: "Bearer sk_YOUR_API_KEY" }
+        }
+      }
+    },
+    null,
+    2
+  );
+}
+function renderMcpDashboardPage(data) {
+  const { endpointUrl, types, tools, user, version, dynamicMenuItems } = data;
+  const safeEndpoint = escapeHtml(endpointUrl);
+  const typeCount = types.length;
+  const toolCount = tools.length;
+  const typeRows = types.length ? types.map(
+    (t) => `
+      <tr class="border-t border-zinc-950/5 dark:border-white/10">
+        <td class="py-3 pr-4 text-sm font-mono text-zinc-950 dark:text-white">${escapeHtml(t.typeId)}</td>
+        <td class="py-3 pr-4 text-sm text-zinc-500 dark:text-zinc-400">${escapeHtml(t.displayName)}</td>
+        <td class="py-3 pr-4">${accessBadge(t.read)}</td>
+        <td class="py-3 pr-4">${accessBadge(t.write)}</td>
+        <td class="py-3 text-sm">${toolNamesForType(t.typeId, tools)}</td>
+      </tr>`
+  ).join("") : `<tr><td colspan="5" class="py-8 text-center text-sm text-zinc-500 dark:text-zinc-400">No collections exposed. Register collections via <code class="font-mono">registerCollections()</code> in your app entry point.</td></tr>`;
+  const claudeJson = escapeHtml(buildClaudeJson(endpointUrl));
+  const cursorJson = escapeHtml(buildCursorJson(endpointUrl));
+  const content2 = `
+    <div class="space-y-8">
+
+      <!-- Header -->
+      <div class="sm:flex sm:items-center sm:justify-between">
+        <div class="sm:flex-auto">
+          <h1 class="text-2xl/8 font-semibold text-zinc-950 dark:text-white sm:text-xl/8">MCP Server</h1>
+          <p class="mt-2 text-sm/6 text-zinc-500 dark:text-zinc-400">
+            Model Context Protocol endpoint for AI agents (Claude Code, Cursor, VS Code). Requests are authenticated with API keys.
+          </p>
+        </div>
+        <div class="mt-4 sm:mt-0 sm:ml-16">
+          <a href="/admin/plugins/api-keys"
+            class="inline-flex items-center justify-center rounded-lg bg-cyan-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-cyan-500 transition-colors shadow-sm">
+            Mint API Key
+          </a>
+        </div>
+      </div>
+
+      <!-- Status -->
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm">
+        <h2 class="text-sm font-semibold text-zinc-950 dark:text-white mb-4">Endpoint</h2>
+        <div class="flex items-center gap-3">
+          <code id="endpoint-url" class="flex-1 rounded-lg bg-zinc-50 dark:bg-zinc-800 px-3 py-2 text-sm font-mono text-zinc-950 dark:text-white ring-1 ring-zinc-950/5 dark:ring-white/5 break-all">${safeEndpoint}</code>
+          <button type="button" onclick="copyEndpoint()"
+            class="shrink-0 rounded-lg bg-zinc-100 dark:bg-zinc-800 px-3 py-2 text-sm font-medium text-zinc-700 dark:text-zinc-300 hover:bg-zinc-200 dark:hover:bg-zinc-700 ring-1 ring-zinc-950/5 dark:ring-white/10 transition-colors">
+            Copy
+          </button>
+        </div>
+        <div class="mt-4 flex flex-wrap gap-4 text-sm text-zinc-500 dark:text-zinc-400">
+          <span>
+            <span class="font-semibold text-zinc-950 dark:text-white">${typeCount}</span>
+            collection${typeCount === 1 ? "" : "s"} exposed
+          </span>
+          <span class="text-zinc-300 dark:text-zinc-600">&middot;</span>
+          <span>
+            <span class="font-semibold text-zinc-950 dark:text-white">${toolCount}</span>
+            tool${toolCount === 1 ? "" : "s"} available
+          </span>
+          <span class="text-zinc-300 dark:text-zinc-600">&middot;</span>
+          <span>Auth via <a href="/admin/plugins/api-keys" class="text-cyan-600 dark:text-cyan-400 hover:underline">API Keys</a></span>
+        </div>
+      </div>
+
+      <!-- Exposed collections table -->
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm overflow-x-auto">
+        <h2 class="text-sm font-semibold text-zinc-950 dark:text-white mb-4">Exposed collections</h2>
+        <table class="w-full text-left">
+          <thead>
+            <tr class="text-xs font-semibold uppercase tracking-wide text-zinc-500 dark:text-zinc-400">
+              <th class="pb-2 pr-4">ID</th>
+              <th class="pb-2 pr-4">Display name</th>
+              <th class="pb-2 pr-4">Read</th>
+              <th class="pb-2 pr-4">Write</th>
+              <th class="pb-2">Tools</th>
+            </tr>
+          </thead>
+          <tbody>${typeRows}</tbody>
+        </table>
+      </div>
+
+      <!-- Integration guide -->
+      <div class="rounded-xl bg-white/80 dark:bg-zinc-900/80 backdrop-blur-xl p-6 ring-1 ring-zinc-950/5 dark:ring-white/10 shadow-sm space-y-6">
+        <div>
+          <h2 class="text-sm font-semibold text-zinc-950 dark:text-white mb-1">Integration guide</h2>
+          <p class="text-sm text-zinc-500 dark:text-zinc-400">
+            <a href="/admin/plugins/api-keys" class="text-cyan-600 dark:text-cyan-400 hover:underline">Mint an API key</a>,
+            then paste one of the configs below into your MCP client.
+            Replace <code class="font-mono text-xs">sk_YOUR_API_KEY</code> with the key.
+          </p>
+        </div>
+
+        <!-- Claude Code -->
+        <div>
+          <div class="flex items-center justify-between mb-2">
+            <h3 class="text-sm font-medium text-zinc-700 dark:text-zinc-300">
+              Claude Code &mdash; <code class="font-mono text-xs">~/.claude/mcp.json</code>
+            </h3>
+            <button type="button" onclick="copyConfig('claude-config')"
+              class="text-xs text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors">
+              Copy
+            </button>
+          </div>
+          <pre id="claude-config" class="rounded-lg bg-zinc-950 dark:bg-zinc-800 px-4 py-3 text-sm font-mono text-zinc-100 overflow-x-auto ring-1 ring-zinc-700 dark:ring-zinc-600 whitespace-pre">${claudeJson}</pre>
+        </div>
+
+        <!-- Cursor -->
+        <div>
+          <div class="flex items-center justify-between mb-2">
+            <h3 class="text-sm font-medium text-zinc-700 dark:text-zinc-300">
+              Cursor &mdash; <code class="font-mono text-xs">~/.cursor/mcp.json</code>
+            </h3>
+            <button type="button" onclick="copyConfig('cursor-config')"
+              class="text-xs text-zinc-500 dark:text-zinc-400 hover:text-zinc-700 dark:hover:text-zinc-200 transition-colors">
+              Copy
+            </button>
+          </div>
+          <pre id="cursor-config" class="rounded-lg bg-zinc-950 dark:bg-zinc-800 px-4 py-3 text-sm font-mono text-zinc-100 overflow-x-auto ring-1 ring-zinc-700 dark:ring-zinc-600 whitespace-pre">${cursorJson}</pre>
+        </div>
+
+        <p class="text-xs text-zinc-400 dark:text-zinc-500">
+          MCP v1 = HTTP POST only (no SSE stream). Clients that require stdio transport can use
+          <code class="font-mono">npx mcp-remote ${safeEndpoint}</code> as a local bridge.
+        </p>
+      </div>
+
+    </div>
+
+    <script>
+      function copyEndpoint() {
+        navigator.clipboard.writeText(document.getElementById('endpoint-url').textContent.trim()).then(() => {
+          window.showNotification && window.showNotification('Endpoint URL copied', 'success')
+        })
+      }
+      function copyConfig(id) {
+        navigator.clipboard.writeText(document.getElementById(id).textContent).then(() => {
+          window.showNotification && window.showNotification('Config copied', 'success')
+        })
+      }
+    </script>`;
+  const layoutData = {
+    title: "MCP Server",
+    pageTitle: "MCP Server",
+    currentPath: "/admin/mcp",
+    user,
+    content: content2,
+    version,
+    dynamicMenuItems
+  };
+  return renderAdminLayoutCatalyst(layoutData);
+}
+
+// src/plugins/core-plugins/mcp-plugin/admin/routes.ts
+function createMcpAdminRoutes(options = {}) {
+  const routes2 = new Hono();
+  routes2.use("*", requireAuth());
+  routes2.use("*", async (c, next) => {
+    const user = c.get("user");
+    if (user?.role !== "admin") return c.json({ error: "Access denied" }, 403);
+    return next();
+  });
+  routes2.get("/", async (c) => {
+    const url = new URL(c.req.url);
+    const endpointUrl = `${url.protocol}//${url.host}/mcp`;
+    const registry = getCollectionRegistry();
+    const active = registry.listActive();
+    const collections = new Map(active.map((col) => [col.name, col]));
+    const cfg = resolveMcpConfig(options, active);
+    const tools = buildToolRegistry(cfg, collections, PHASE_FLAGS);
+    const user = c.get("user");
+    return c.html(
+      renderMcpDashboardPage({
+        endpointUrl,
+        types: cfg.types,
+        tools,
+        user: { name: user.email, email: user.email, role: user.role },
+        version: c.get("appVersion"),
+        dynamicMenuItems: c.get("pluginMenuItems")
+      })
+    );
+  });
+  return routes2;
+}
+
+// src/plugins/core-plugins/mcp-plugin/index.ts
+var MCP_ICON = `<svg class="h-5 w-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 9l3 3-3 3m5 0h3M5 20h14a2 2 0 002-2V6a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z"/></svg>`;
+function mcpPlugin(options = {}) {
+  return definePlugin({
+    id: "mcp",
+    version: "1.0.0",
+    name: "MCP Server",
+    description: "Exposes SonicJS content as Model Context Protocol tools for AI agents (Claude Code, Cursor, \u2026).",
+    sonicjsVersionRange: "^3.0.0",
+    author: { name: "SonicJS Team" },
+    register(app2) {
+      app2.route("/mcp", createMcpRoutes(options));
+      app2.route("/admin/mcp", createMcpAdminRoutes(options));
+    },
+    menu: [{ label: "MCP Server", path: "/admin/mcp", icon: MCP_ICON, order: 87 }]
+  });
+}
+function createMcpPlugin(options) {
+  return mcpPlugin(options);
+}
 
 // src/index.ts
 var VERSION = package_default.version;
 
-export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
+export { BUILT_IN_PROVIDERS, CloudflareEmailProvider2 as CloudflareEmailProvider, OAuthService, VERSION, createDb, createHelloWorldPlugin, createMcpPlugin, createOAuthProvidersPlugin, createRedirectPlugin, createSonicJSApp, emailReconciliationPlugin, generateTriggersComment, helloWorldPlugin, mcpPlugin, oauthProvidersPlugin, parseCronTriggers, redirectPlugin, setupCoreMiddleware, setupCoreRoutes, site_settings_collection_default as siteSettingsCollection, updateWranglerTriggers };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map