dineway 0.1.49 → 0.2.0

package/dist/astro/routes/api/mcp.mjs

@@ -1,37 +1,43 @@
 import "../../../dialect-helpers-fk43GbDb.mjs";
 import "../../../base64-F8-DUraK.mjs";
-import "../../../types-CSgR9nQB.mjs";
-import "../../../loader--GOYux8M.mjs";
-import "../../../content-CBxYGWfL.mjs";
-import "../../../media-CbKyYukG.mjs";
-import "../../../options-LsPjZlqD.mjs";
-import "../../../site-activity-DONFrMBJ.mjs";
-import { t as ReviewRequestRepository } from "../../../review-requests-BW2NxY-l.mjs";
-import "../../../entity-aliases-4y93Yjuc.mjs";
-import "../../../request-cache-ho99schz.mjs";
-import { a as ContextRepository, i as parseSiteBriefingScope, r as formatSiteBriefingText, t as SiteBriefingAssembler } from "../../../briefing-CkTee1ex.mjs";
-import { t as SITE_CONTEXT_TYPES } from "../../../context-types-r8oFvyOq.mjs";
-import "../../../fts-manager-B5l_qwrA.mjs";
-import "../../../registry-D7HACema.mjs";
-import "../../../settings-CUXOxzsT.mjs";
-import { n as VERSION } from "../../../version-C4gfn0PJ.mjs";
-import "../../../query-CZ3TH_Uu.mjs";
-import "../../../zod-generator-K91-g665.mjs";
-import "../../../schema-Bsi-VpYv.mjs";
-import { t as apiError } from "../../../error-DCSuUAZW.mjs";
-import { P as settingsUpdateBody, Sn as contentBylineInputSchema, sn as contentSeoInput } from "../../../redirects-ocRJmQHP.mjs";
-import "../../../byline-fields-cNrLJVRs.mjs";
+import "../../../types-Dq1qT19x.mjs";
+import "../../../loader-CjWqjweO.mjs";
+import "../../../object-cache-D51qOseS.mjs";
+import "../../../content-Bh4BDjv8.mjs";
+import "../../../media-DMj0grzC.mjs";
+import "../../../options-DQPTH5n0.mjs";
+import "../../../site-activity-Dy3FROs0.mjs";
+import { t as ReviewRequestRepository } from "../../../review-requests-DUyEmtmG.mjs";
+import { a as ASSIGNMENT_STATUSES, i as ASSIGNMENT_PRIORITIES, l as HITL_REQUEST_PRIORITIES, r as ASSIGNMENT_ACTOR_TYPES, t as HitlRequestService, u as HITL_REQUEST_STATUSES } from "../../../hitl-Hw1RmWOq.mjs";
+import "../../../request-cache-D9GQBxMP.mjs";
+import { a as ContextRepository, i as parseSiteBriefingScope, r as formatSiteBriefingText, t as SiteBriefingAssembler } from "../../../briefing-CawZ59CY.mjs";
+import { t as SITE_CONTEXT_TYPES } from "../../../context-types-DqTo6C79.mjs";
+import "../../../content-refresh-CgutSUfO.mjs";
+import "../../../fts-manager-Crzypjqu.mjs";
+import "../../../registry-CtyVedcN.mjs";
+import "../../../settings-BbqgHWpU.mjs";
+import { n as VERSION } from "../../../version-BTvfRGc6.mjs";
+import "../../../query-jaAmw8E1.mjs";
+import "../../../zod-generator-B7TMjyFJ.mjs";
+import "../../../schema-DXdYj4R3.mjs";
+import { t as apiError } from "../../../error-CytFlgcd.mjs";
+import { Cn as contentBylineInputSchema, P as settingsUpdateBody, _n as bylineCreateBody, cn as contentSeoInput, xn as bylineUpdateBody } from "../../../redirects-CA-xylPG.mjs";
+import "../../../byline-fields-DOJO16Gm.mjs";
+import "../../../status-DANd8ERo.mjs";
 import "../../../api/schemas/index.mjs";
-import "../../../utils-B8hBJ9Oz.mjs";
-import "../../../search-Gdrqj582.mjs";
-import { i as hasScope } from "../../../api-tokens-CYUoFGo7.mjs";
-import { C as HITL_REQUEST_STATUSES, E as ASSIGNMENT_STATUSES, S as HITL_REQUEST_PRIORITIES, T as ASSIGNMENT_PRIORITIES, _ as RiskPolicyEvaluator, a as ActorExpertiseService, b as toPublicContextEntry, f as SettingsHitlPayloadBuilder, g as SchemaHitlPayloadBuilder, i as HandoffSnapshotStore, n as HitlRequestService, o as EntityResolver, r as AssignmentService, t as WorkflowHitlCoordinator, v as ReviewPayloadBuilder, w as ASSIGNMENT_ACTOR_TYPES, x as toPublicContextEntryPage, y as toPublicContextDiff } from "../../../site-context-C8Az_P_I.mjs";
-import { T as resolveActorIdentity, b as schemaMcpToolSource, d as logSchemaActivity, o as logContentActivity, p as logSiteActivitySafely, r as contentMcpToolSource, t as activityChangedKeys } from "../../../activity-events-CwM7yxPW.mjs";
+import { i as hasScope } from "../../../api-tokens-2r7OWi_I.mjs";
+import { r as registerPluginMcpRegistry, t as createReviewedPluginMcpCommandExecutor } from "../../../mcp-reviewed-executor-TwVbMzG6.mjs";
+import { t as resolveActorIdentity } from "../../../actor-CrObAPV0.mjs";
+import { d as logSchemaActivity, o as logContentActivity, p as logSiteActivitySafely, r as contentMcpToolSource, t as activityChangedKeys, x as schemaMcpToolSource } from "../../../activity-events-y6eT8UW6.mjs";
+import "../../../utils-CMDhr5Xd.mjs";
+import "../../../search-DSaLgEFI.mjs";
+import { n as convertDataForWrite, t as convertDataForRead } from "../../../portable-text-dA_UlJwW.mjs";
+import { _ as ReviewPayloadBuilder, a as EntityResolver, b as toPublicContextEntryPage, d as SettingsHitlPayloadBuilder, g as RiskPolicyEvaluator, h as SchemaHitlPayloadBuilder, i as ActorExpertiseService, n as AssignmentService, r as HandoffSnapshotStore, t as WorkflowHitlCoordinator, v as toPublicContextDiff, y as toPublicContextEntry } from "../../../site-context-DQiL8Fl5.mjs";
 import { z } from "zod";
 import { Role, canActOnOwn, hasPermission } from "@dineway-ai/auth";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
 //#region src/mcp/server.ts
 const COLLECTION_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
@@ -101,6 +107,28 @@ function getExtra(extra) {
 function getDineway(extra) {
 	return getExtra(extra).dineway;
 }
+async function getCollectionFields(dineway, collection) {
+	try {
+		const { SchemaRegistry } = await import("../../../schema-DXdYj4R3.mjs").then((n) => n.t);
+		return (await new SchemaRegistry(dineway.db).getCollectionWithFields(collection))?.fields ?? null;
+	} catch {
+		return null;
+	}
+}
+async function convertWriteData(dineway, collection, data) {
+	const fields = await getCollectionFields(dineway, collection);
+	if (!fields) return data;
+	return convertDataForWrite(data, fields);
+}
+async function applyReadMarkdown(dineway, collection, items) {
+	const fields = await getCollectionFields(dineway, collection);
+	if (!fields) return;
+	for (const item of items) if (item.data && typeof item.data === "object") item.data = convertDataForRead(item.data, fields, false);
+}
+async function invalidateBylines() {
+	const { invalidateBylineCache } = await import("../../../bylines-y4LO-dTj.mjs").then((n) => n.t);
+	invalidateBylineCache();
+}
 function canReadDrafts(extra) {
 	return hasPermission({ role: getExtra(extra).userRole }, "content:read_drafts");
 }
@@ -240,7 +268,8 @@ function scopeReadableForExpertise(payload, scope) {
 			case "menu": return contentDiffReadableForHandoff(payload);
 			case "collection":
 			case "site": return contentDiffReadableForHandoff(payload) || schemaReadableForHandoff(payload) || pluginsReadableForHandoff(payload);
-			case "plugin": return pluginsReadableForHandoff(payload);
+			case "plugin":
+			case "plugin_extension": return pluginsReadableForHandoff(payload);
 		}
 	} catch {
 		return false;
@@ -426,7 +455,7 @@ async function logMcpContentActivity(dineway, locals, collection, entryId, actio
 function experimentalWorkflowDescription(description) {
 	return "Experimental: this deferred Site Context workflow surface exists on the current branch but is not part of the approved baseline contract. " + description;
 }
-function createMcpServer() {
+function createMcpServer(options = {}) {
 	const server = new McpServer({
 		name: "dineway",
 		version: VERSION
@@ -457,6 +486,7 @@ function createMcpServer() {
 				db: ec.db,
 				storage: ec.storage,
 				configuredPlugins: ec.configuredPlugins,
+				sandboxedPluginEntries: ec.sandboxedPluginEntries,
 				marketplaceUrl: ec.config.marketplace,
 				permissions: briefingPermissions(payload)
 			}).assemble({
@@ -1536,21 +1566,30 @@ function createMcpServer() {
 			cursor: z.string().optional().describe("Pagination cursor from a previous response"),
 			orderBy: z.string().optional().describe("Field to sort by (e.g. 'created_at', 'updated_at')"),
 			order: z.enum(["asc", "desc"]).optional().describe("Sort direction (default 'desc')"),
-			locale: z.string().optional().describe("Filter by locale (e.g. 'en', 'fr'). Only relevant when i18n is enabled.")
+			locale: z.string().optional().describe("Filter by locale (e.g. 'en', 'fr'). Only relevant when i18n is enabled."),
+			markdown: z.boolean().optional().describe("Return rich text (portableText) fields as Markdown strings instead of Portable Text arrays (default false).")
 		}),
 		annotations: { readOnlyHint: true }
 	}, async (args, extra) => {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		const status = canReadDrafts(extra) ? args.status : "published";
-		return unwrap(await ec.handleContentList(args.collection, {
+		const result = await ec.handleContentList(args.collection, {
 			status,
 			limit: args.limit,
 			cursor: args.cursor,
 			orderBy: args.orderBy,
 			order: args.order,
 			locale: args.locale
-		}));
+		});
+		if (result.success && args.markdown) {
+			const data = result.data;
+			if (data && typeof data === "object" && "items" in data && Array.isArray(data.items)) {
+				const items = data.items.filter((item) => typeof item === "object" && item !== null);
+				await applyReadMarkdown(ec, args.collection, items);
+			}
+		}
+		return unwrap(result);
 	});
 	server.registerTool("content_get", {
 		title: "Get Content",
@@ -1558,28 +1597,32 @@ function createMcpServer() {
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug (e.g. 'posts', 'pages')"),
 			id: z.string().describe("Content item ID (ULID) or slug"),
-			locale: z.string().optional().describe("Locale to scope slug lookup (e.g. 'fr'). Only affects slug resolution; IDs are globally unique.")
+			locale: z.string().optional().describe("Locale to scope slug lookup (e.g. 'fr'). Only affects slug resolution; IDs are globally unique."),
+			markdown: z.boolean().optional().describe("Return rich text (portableText) fields as Markdown strings instead of Portable Text arrays (default false).")
 		}),
 		annotations: { readOnlyHint: true }
 	}, async (args, extra) => {
 		requireScope(extra, "content:read");
-		const result = await getDineway(extra).handleContentGet(args.collection, args.id, args.locale);
+		const ec = getDineway(extra);
+		const result = await ec.handleContentGet(args.collection, args.id, args.locale);
 		if (result.success && !canReadDrafts(extra)) {
 			const data = result.data && typeof result.data === "object" ? result.data : {};
 			if (!isPublishedRecord("item" in data ? data.item : data)) return errorResult("Content not found");
 		}
+		if (result.success && args.markdown && result.data?.item) await applyReadMarkdown(ec, args.collection, [result.data.item]);
 		return unwrap(result);
 	});
 	server.registerTool("content_create", {
 		title: "Create Content",
-		description: "Create a new content item in a collection. The 'data' object should contain field values matching the collection's schema (use schema_get_collection to check). Rich text fields accept Portable Text JSON arrays. A slug is auto-generated if not provided. Items are created as 'draft' by default — use content_publish to make them live.",
+		description: "Create a new content item in a collection. The 'data' object should contain field values matching the collection's schema (use schema_get_collection to check). For rich text (portableText) fields, pass a Markdown string — converted to Portable Text automatically; prefer this. Pass a Portable Text JSON array only for complex content Markdown can't express. A slug is auto-generated if not provided. Items are created as 'draft' by default — use content_publish to make them live.",
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug (e.g. 'posts', 'pages')"),
 			data: z.record(z.string(), z.unknown()).describe("Field values as key-value pairs matching the collection schema"),
 			slug: z.string().optional().describe("URL slug (auto-generated from title if omitted)"),
 			status: z.enum(["draft", "published"]).optional().describe("Initial status (default 'draft'). Requires publish permission."),
 			locale: z.string().optional().describe("Locale for this content (e.g. 'fr'). Defaults to default locale."),
-			translationOf: z.string().optional().describe("ID of the content item this is a translation of. Links items in the same translation group.")
+			translationOf: z.string().optional().describe("ID of the content item this is a translation of. Links items in the same translation group."),
+			bylines: z.array(contentBylineInputSchema).optional().describe("Bylines to credit. Each entry references an existing byline by id, with an optional roleLabel. The first entry becomes the primary byline.")
 		}),
 		annotations: { destructiveHint: false }
 	}, async (args, extra) => {
@@ -1593,6 +1636,7 @@ function createMcpServer() {
 			if (!source.success) return unwrap(source);
 			requireOwnership(extra, extractContentAuthorId(source.data), "content:edit_own", "content:edit_any");
 		}
+		const data = await convertWriteData(dineway, args.collection, args.data);
 		if (args.status === "published") {
 			if (!hasPermission({
 				id: userId,
@@ -1600,11 +1644,12 @@ function createMcpServer() {
 			}, "content:publish_own")) throw new McpError(ErrorCode.InvalidRequest, "Insufficient permissions: publishing requires content:publish_own");
 			if (contentPublishReviewRequired(extra)) throw new McpError(ErrorCode.InvalidRequest, "Token-authenticated content creation with immediate publish is review-gated. Create a draft first, submit review_request_submit, resolve it as approved, then call content_publish with review_request_id.");
 			const result = await dineway.handleContentCreate(args.collection, {
-				data: args.data,
+				data,
 				slug: args.slug,
 				authorId: userId,
 				locale: args.locale,
-				translationOf: args.translationOf
+				translationOf: args.translationOf,
+				bylines: args.bylines
 			});
 			if (!result.success) return unwrap(result);
 			const itemId = extractContentId(result.data);
@@ -1622,11 +1667,12 @@ function createMcpServer() {
 			return unwrap(result);
 		}
 		const result = await dineway.handleContentCreate(args.collection, {
-			data: args.data,
+			data,
 			slug: args.slug,
 			authorId: userId,
 			locale: args.locale,
-			translationOf: args.translationOf
+			translationOf: args.translationOf,
+			bylines: args.bylines
 		});
 		if (result.success) {
 			const itemId = extractContentId(result.data);
@@ -1641,7 +1687,7 @@ function createMcpServer() {
 	});
 	server.registerTool("content_update", {
 		title: "Update Content",
-		description: "Update an existing content item. Only include fields you want to change in the 'data' object — unspecified fields are left unchanged. Pass the _rev token from content_get to enable optimistic concurrency checking (the update fails if the item was modified since you read it). `seo` and `bylines` are persisted alongside field updates. `publishedAt` requires content:publish_any permission and is useful for content imports.",
+		description: "Update an existing content item. Only include fields you want to change in the 'data' object — unspecified fields are left unchanged. Rich text (portableText) fields accept a Markdown string (recommended, converted automatically); use a Portable Text JSON array only for complex content Markdown can't express. Pass the _rev token from content_get to enable optimistic concurrency checking (the update fails if the item was modified since you read it). `seo` and `bylines` are persisted alongside field updates. `publishedAt` requires content:publish_any permission and is useful for content imports.",
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug"),
 			id: z.string().describe("Content item ID or slug"),
@@ -1676,12 +1722,13 @@ function createMcpServer() {
 			}, "content:publish_any")) return errorResult("[INSUFFICIENT_PERMISSIONS] Setting publishedAt requires content:publish_any permission");
 		}
 		const hasInlineUpdates = args.data || args.slug || args.seo !== void 0 || args.bylines !== void 0 || args.publishedAt !== void 0;
+		const data = args.data ? await convertWriteData(dineway, args.collection, args.data) : args.data;
 		if (args.status === "published") {
 			requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
 			if (contentPublishReviewRequired(extra) && hasInlineUpdates) throw new McpError(ErrorCode.InvalidRequest, "Token-authenticated publish with inline content changes is review-gated. Save the draft first, submit review_request_submit, resolve it as approved, then publish with review_request_id.");
 			if (hasInlineUpdates) {
 				const updateResult = await dineway.handleContentUpdate(args.collection, resolvedId, {
-					data: args.data,
+					data,
 					slug: args.slug,
 					authorId: userId,
 					locale: args.locale,
@@ -1708,7 +1755,7 @@ function createMcpServer() {
 			requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
 			if (hasInlineUpdates) {
 				const updateResult = await dineway.handleContentUpdate(args.collection, resolvedId, {
-					data: args.data,
+					data,
 					slug: args.slug,
 					authorId: userId,
 					locale: args.locale,
@@ -1731,7 +1778,7 @@ function createMcpServer() {
 			return unwrap(unpublishResult);
 		}
 		const result = await dineway.handleContentUpdate(args.collection, resolvedId, {
-			data: args.data,
+			data,
 			slug: args.slug,
 			authorId: userId,
 			locale: args.locale,
@@ -2018,7 +2065,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-Bsi-VpYv.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-DXdYj4R3.mjs").then((n) => n.t);
 			return jsonResult({ items: await new SchemaRegistry(ec.db).listCollections() });
 		} catch (error) {
 			return errorResult(error);
@@ -2034,7 +2081,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-Bsi-VpYv.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-DXdYj4R3.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).getCollectionWithFields(args.slug);
 			if (!collection) return errorResult(`Collection '${args.slug}' not found`);
 			return jsonResult(collection);
@@ -2064,7 +2111,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getDineway(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-Bsi-VpYv.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-DXdYj4R3.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).createCollection({
 				slug: args.slug,
 				label: args.label,
@@ -2128,7 +2175,7 @@ function createMcpServer() {
 					request
 				});
 			}
-			const { SchemaRegistry } = await import("../../../schema-Bsi-VpYv.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-DXdYj4R3.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteCollection(args.slug, { force: args.force });
 			ec.invalidateManifest();
 			await logSchemaActivity(ec.db, locals, {
@@ -2192,7 +2239,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getDineway(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-Bsi-VpYv.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-DXdYj4R3.mjs").then((n) => n.t);
 			const field = await new SchemaRegistry(ec.db).createField(args.collection, {
 				slug: args.slug,
 				label: args.label,
@@ -2261,7 +2308,7 @@ function createMcpServer() {
 					request
 				});
 			}
-			const { SchemaRegistry } = await import("../../../schema-Bsi-VpYv.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-DXdYj4R3.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteField(args.collection, args.fieldSlug);
 			ec.invalidateManifest();
 			await logSchemaActivity(ec.db, locals, {
@@ -2394,7 +2441,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		try {
-			const { searchWithDb } = await import("../../../search-Gdrqj582.mjs").then((n) => n.t);
+			const { searchWithDb } = await import("../../../search-DSaLgEFI.mjs").then((n) => n.t);
 			return jsonResult(await searchWithDb(ec.db, args.query, {
 				collections: args.collections,
 				locale: args.locale,
@@ -2404,6 +2451,124 @@ function createMcpServer() {
 			return errorResult(error);
 		}
 	});
+	server.registerTool("byline_list", {
+		title: "List Bylines",
+		description: "List bylines (author/contributor credits) with optional filtering and pagination. Bylines are standalone records referenced by content items; use the returned id with content_create/content_update or byline_get. Use the nextCursor value from the response to fetch the next page.",
+		inputSchema: z.object({
+			search: z.string().optional().describe("Filter by display name or slug substring"),
+			isGuest: z.boolean().optional().describe("Filter by guest byline state"),
+			userId: z.string().optional().describe("Filter to the byline linked to a Dineway user ID"),
+			locale: z.string().optional().describe("Filter by locale (omit for all)"),
+			limit: z.number().int().min(1).max(100).optional().describe("Max items (default 50)"),
+			cursor: z.string().min(1).max(2048).optional().describe("Pagination cursor")
+		}),
+		annotations: { readOnlyHint: true }
+	}, async (args, extra) => {
+		requireScope(extra, "content:read");
+		const ec = getDineway(extra);
+		try {
+			const { BylineRepository } = await import("../../../byline-e51-fWRs.mjs").then((n) => n.n);
+			return jsonResult(await new BylineRepository(ec.db).findMany({
+				search: args.search,
+				isGuest: args.isGuest,
+				userId: args.userId,
+				locale: args.locale,
+				limit: args.limit,
+				cursor: args.cursor
+			}));
+		} catch (error) {
+			return errorResult(error);
+		}
+	});
+	server.registerTool("byline_get", {
+		title: "Get Byline",
+		description: "Get a single byline by its ID, including bio, avatar, website, linked user, and any custom fields.",
+		inputSchema: z.object({ id: z.string().describe("Byline ID") }),
+		annotations: { readOnlyHint: true }
+	}, async (args, extra) => {
+		requireScope(extra, "content:read");
+		const ec = getDineway(extra);
+		try {
+			const { BylineRepository } = await import("../../../byline-e51-fWRs.mjs").then((n) => n.n);
+			const byline = await new BylineRepository(ec.db).findById(args.id);
+			if (!byline) return errorResult(`Byline '${args.id}' not found`);
+			return jsonResult(byline);
+		} catch (error) {
+			return errorResult(error);
+		}
+	});
+	server.registerTool("byline_create", {
+		title: "Create Byline",
+		description: "Create a new byline (author/contributor credit). The slug must be unique and contain only lowercase letters, digits, and hyphens. Link the byline to a Dineway user via userId, or leave it as a standalone guest credit. The returned id can then be passed to content_create/content_update bylines.",
+		inputSchema: z.object({ ...bylineCreateBody.shape }),
+		annotations: { destructiveHint: false }
+	}, async (args, extra) => {
+		requireScope(extra, "content:write");
+		requireRole(extra, Role.EDITOR);
+		const ec = getDineway(extra);
+		try {
+			const { handleBylineCreate } = await import("../../../bylines-CMQNCNFh.mjs").then((n) => n.t);
+			const result = await handleBylineCreate(ec.db, args);
+			if (result.success) await invalidateBylines();
+			return unwrap(result);
+		} catch (error) {
+			return errorResult(error);
+		}
+	});
+	server.registerTool("byline_update", {
+		title: "Update Byline",
+		description: "Update an existing byline. Any field can be omitted to leave it unchanged. Renaming the slug must not collide with another byline.",
+		inputSchema: z.object({
+			id: z.string().describe("Byline ID to update"),
+			...bylineUpdateBody.shape
+		})
+	}, async (args, extra) => {
+		requireScope(extra, "content:write");
+		requireRole(extra, Role.EDITOR);
+		const ec = getDineway(extra);
+		try {
+			const { handleBylineUpdate } = await import("../../../bylines-CMQNCNFh.mjs").then((n) => n.t);
+			const { id, ...input } = args;
+			const result = await handleBylineUpdate(ec.db, id, input);
+			if (result.success) await invalidateBylines();
+			return unwrap(result);
+		} catch (error) {
+			return errorResult(error);
+		}
+	});
+	server.registerTool("byline_delete", {
+		title: "Delete Byline",
+		description: "Permanently delete a byline. Any content crediting this byline loses the association, and it is cleared as a primary byline where set.",
+		inputSchema: z.object({ id: z.string().describe("Byline ID to delete") }),
+		annotations: { destructiveHint: true }
+	}, async (args, extra) => {
+		requireScope(extra, "content:write");
+		requireRole(extra, Role.EDITOR);
+		const ec = getDineway(extra);
+		try {
+			const { BylineRepository } = await import("../../../byline-e51-fWRs.mjs").then((n) => n.n);
+			if (!await new BylineRepository(ec.db).delete(args.id)) return errorResult(`Byline '${args.id}' not found`);
+			await invalidateBylines();
+			return jsonResult({ deleted: args.id });
+		} catch (error) {
+			return errorResult(error);
+		}
+	});
+	server.registerTool("byline_translations", {
+		title: "List Byline Translations",
+		description: "Return every locale variant of a byline, identified via its shared translation group.",
+		inputSchema: z.object({ id: z.string().describe("Byline ID") }),
+		annotations: { readOnlyHint: true }
+	}, async (args, extra) => {
+		requireScope(extra, "content:read");
+		const ec = getDineway(extra);
+		try {
+			const { handleBylineTranslations } = await import("../../../bylines-CMQNCNFh.mjs").then((n) => n.t);
+			return unwrap(await handleBylineTranslations(ec.db, args.id));
+		} catch (error) {
+			return errorResult(error);
+		}
+	});
 	server.registerTool("taxonomy_list", {
 		title: "List Taxonomies",
 		description: "List all taxonomy definitions (e.g. categories, tags). Taxonomies are classification systems applied to content. Each has a name, label, and can be hierarchical (categories) or flat (tags). Optionally filter by locale.",
@@ -2413,7 +2578,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-D9Sw4wWM.mjs").then((n) => n.l);
+			const { handleTaxonomyList } = await import("../../../taxonomies-9s-v03H-.mjs").then((n) => n.l);
 			return unwrap(await handleTaxonomyList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return errorResult(error);
@@ -2433,12 +2598,12 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-D9Sw4wWM.mjs").then((n) => n.l);
+			const { handleTaxonomyList } = await import("../../../taxonomies-9s-v03H-.mjs").then((n) => n.l);
 			const listResult = await handleTaxonomyList(ec.db, { locale: args.locale });
 			if (!listResult.success) return unwrap(listResult);
 			if (!listResult.data.taxonomies.find((t) => t.name === args.taxonomy)) return errorResult(`Taxonomy '${args.taxonomy}' not found`);
-			const { TaxonomyRepository } = await import("../../../taxonomy-B169Nm6B.mjs").then((n) => n.n);
-			const { decodeCursor, encodeCursor } = await import("../../../types-CSgR9nQB.mjs").then((n) => n.a);
+			const { TaxonomyRepository } = await import("../../../taxonomy-Dvsw6BOs.mjs").then((n) => n.n);
+			const { decodeCursor, encodeCursor } = await import("../../../types-Dq1qT19x.mjs").then((n) => n.a);
 			const repo = new TaxonomyRepository(ec.db);
 			const limit = Math.min(args.limit ?? 50, 100);
 			const terms = await repo.findByName(args.taxonomy, { locale: args.locale });
@@ -2487,7 +2652,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { handleTermCreate } = await import("../../../taxonomies-D9Sw4wWM.mjs").then((n) => n.l);
+			const { handleTermCreate } = await import("../../../taxonomies-9s-v03H-.mjs").then((n) => n.l);
 			return unwrap(await handleTermCreate(ec.db, args.taxonomy, {
 				slug: args.slug,
 				label: args.label,
@@ -2517,7 +2682,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { handleTermUpdate } = await import("../../../taxonomies-D9Sw4wWM.mjs").then((n) => n.l);
+			const { handleTermUpdate } = await import("../../../taxonomies-9s-v03H-.mjs").then((n) => n.l);
 			return unwrap(await handleTermUpdate(ec.db, args.taxonomy, args.termSlug, {
 				slug: args.slug,
 				label: args.label,
@@ -2542,7 +2707,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { handleTermDelete } = await import("../../../taxonomies-D9Sw4wWM.mjs").then((n) => n.l);
+			const { handleTermDelete } = await import("../../../taxonomies-9s-v03H-.mjs").then((n) => n.l);
 			return unwrap(await handleTermDelete(ec.db, args.taxonomy, args.termSlug, { locale: args.locale }));
 		} catch (error) {
 			return errorResult(error);
@@ -2557,7 +2722,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		try {
-			const { handleTermTranslations } = await import("../../../taxonomies-D9Sw4wWM.mjs").then((n) => n.l);
+			const { handleTermTranslations } = await import("../../../taxonomies-9s-v03H-.mjs").then((n) => n.l);
 			return unwrap(await handleTermTranslations(ec.db, args.id));
 		} catch (error) {
 			return errorResult(error);
@@ -2572,7 +2737,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		try {
-			const { handleMenuList } = await import("../../../menus-BZbXf-ej.mjs").then((n) => n.d);
+			const { handleMenuList } = await import("../../../menus-TaW1gKnk.mjs").then((n) => n.d);
 			return unwrap(await handleMenuList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return errorResult(error);
@@ -2590,7 +2755,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		try {
-			const { handleMenuGet } = await import("../../../menus-BZbXf-ej.mjs").then((n) => n.d);
+			const { handleMenuGet } = await import("../../../menus-TaW1gKnk.mjs").then((n) => n.d);
 			return unwrap(await handleMenuGet(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return errorResult(error);
@@ -2605,7 +2770,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getDineway(extra);
 		try {
-			const { handleMenuTranslations } = await import("../../../menus-BZbXf-ej.mjs").then((n) => n.d);
+			const { handleMenuTranslations } = await import("../../../menus-TaW1gKnk.mjs").then((n) => n.d);
 			return unwrap(await handleMenuTranslations(ec.db, args.id));
 		} catch (error) {
 			return errorResult(error);
@@ -2625,7 +2790,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { handleMenuCreate } = await import("../../../menus-BZbXf-ej.mjs").then((n) => n.d);
+			const { handleMenuCreate } = await import("../../../menus-TaW1gKnk.mjs").then((n) => n.d);
 			return unwrap(await handleMenuCreate(ec.db, {
 				name: args.name,
 				label: args.label,
@@ -2649,7 +2814,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { handleMenuUpdate } = await import("../../../menus-BZbXf-ej.mjs").then((n) => n.d);
+			const { handleMenuUpdate } = await import("../../../menus-TaW1gKnk.mjs").then((n) => n.d);
 			return unwrap(await handleMenuUpdate(ec.db, args.name, {
 				label: args.label,
 				locale: args.locale
@@ -2671,7 +2836,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { handleMenuDelete } = await import("../../../menus-BZbXf-ej.mjs").then((n) => n.d);
+			const { handleMenuDelete } = await import("../../../menus-TaW1gKnk.mjs").then((n) => n.d);
 			return unwrap(await handleMenuDelete(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return errorResult(error);
@@ -2706,7 +2871,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getDineway(extra);
 		try {
-			const { handleMenuSetItems } = await import("../../../menus-BZbXf-ej.mjs").then((n) => n.d);
+			const { handleMenuSetItems } = await import("../../../menus-TaW1gKnk.mjs").then((n) => n.d);
 			return unwrap(await handleMenuSetItems(ec.db, args.name, args.items, { locale: args.locale }));
 		} catch (error) {
 			return errorResult(error);
@@ -2753,7 +2918,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getDineway(extra);
 		try {
-			const { handleSettingsGet } = await import("../../../settings-DlBsT2VS.mjs").then((n) => n.r);
+			const { handleSettingsGet } = await import("../../../settings-i4VPP8bT.mjs").then((n) => n.r);
 			return unwrap(await handleSettingsGet(ec.db, ec.storage));
 		} catch (error) {
 			return errorResult(error);
@@ -2790,7 +2955,7 @@ function createMcpServer() {
 					request
 				});
 			}
-			const { handleSettingsUpdate } = await import("../../../settings-DlBsT2VS.mjs").then((n) => n.r);
+			const { handleSettingsUpdate } = await import("../../../settings-i4VPP8bT.mjs").then((n) => n.r);
 			const result = await handleSettingsUpdate(ec.db, ec.storage, settingsInput);
 			if (!result.success) return unwrap(result);
 			await logSiteActivitySafely(ec.db, locals, {
@@ -2812,8 +2977,36 @@ function createMcpServer() {
 			return errorResult(error);
 		}
 	});
+	if (options.pluginMcpRegistry) registerPluginMcpRegistry(server, options.pluginMcpRegistry, {
+		resolveContext: resolvePluginMcpExecutionContext,
+		authorizeTarget: options.authorizePluginMcpTarget,
+		authorizeSensitiveOutput: options.authorizePluginMcpSensitiveOutput,
+		executeCommand: options.executePluginMcpCommand
+	});
 	return server;
 }
+function resolvePluginMcpExecutionContext(plugin, requestExtra) {
+	if (!isMcpRequestExtra(requestExtra)) throw new Error("Dineway MCP request context is unavailable");
+	const payload = getExtra(requestExtra);
+	const resolvedActor = resolveActorIdentity(actorLocals(payload));
+	return {
+		plugin,
+		actor: {
+			type: resolvedActor.actorType,
+			id: resolvedActor.actorId,
+			userId: payload.userId || null,
+			role: payload.userRole,
+			authMethod: payload.authToken?.type ?? "session",
+			tokenScopes: payload.tokenScopes
+		},
+		db: payload.dineway.db,
+		storage: payload.dineway.storage,
+		http: typeof payload.dineway.getPluginHttpAccess === "function" ? payload.dineway.getPluginHttpAccess(plugin.id) : void 0
+	};
+}
+function isMcpRequestExtra(value) {
+	return typeof value === "object" && value !== null;
+}
 
 //#endregion
 //#region src/astro/routes/api/mcp.ts
@@ -2834,7 +3027,10 @@ const POST = async ({ request, locals }) => {
 	const { dineway, user } = locals;
 	if (!dineway) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
 	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
-	const server = createMcpServer();
+	const server = createMcpServer({
+		pluginMcpRegistry: dineway.getPluginMcpRegistry(),
+		executePluginMcpCommand: createReviewedPluginMcpCommandExecutor()
+	});
 	try {
 		const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
 		await server.connect(transport);