emdash 0.28.1 → 0.30.0

package/dist/{api-DxFSorgk.mjs → api-b8WIiGU4.mjs}

@@ -1,27 +1,34 @@
 import { r as validatePluginIdentifier, t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
+import { s as isSqlite } from "./dialect-helpers-HxEQGl_1.mjs";
 import { n as getI18nConfig, r as isI18nEnabled } from "./config-CVssduLe.mjs";
 import { o as invalidateCollectionCache } from "./object-cache-Bok5j2ae.mjs";
-import { r as RevisionRepository, t as ContentRepository } from "./content-DhgEth4k.mjs";
-import { r as encodeBase64, t as decodeBase64 } from "./base64-CmWvODNW.mjs";
-import { n as InvalidCursorError, r as ScheduledNotDueError, t as EmDashValidationError } from "./types-CuW0zWDA.mjs";
-import { t as MediaRepository } from "./media-BrXIaMFN.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-B2isWQhr.mjs";
-import { t as UserRepository } from "./user-BjAOvU3Z.mjs";
-import { t as CommentRepository } from "./comment-CzeatwBV.mjs";
-import { t as withTransaction } from "./transaction-qfqpPVpu.mjs";
-import { t as RedirectRepository } from "./redirect-IyfNirgS.mjs";
-import { r as requestCached } from "./request-cache-KCNHp_RJ.mjs";
-import { t as BylineRepository } from "./byline-Bm8ZgUP9.mjs";
-import { r as parseAllowedMimeTypes, t as matchesMimeAllowlist } from "./mime-CCEzze7W.mjs";
-import { t as SeoRepository } from "./seo-DXu2UQnC.mjs";
-import { r as invalidateRedirectCache } from "./cache-CEBAZjir.mjs";
-import { n as isMissingTableError } from "./db-errors-CK46D-ly.mjs";
-import { n as hashString } from "./hash-DrvzIXcz.mjs";
-import { n as SchemaRegistry, t as SchemaError } from "./registry-B57vp_X9.mjs";
-import { a as reconcileManifestAccess, i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-BHlgZM1W.mjs";
-import { a as normalizeCapabilities, r as declaredAccessToCapabilities } from "./types-DROWRxYV.mjs";
-import { t as EmDashStorageError } from "./types-Jo3UYd6b.mjs";
-import { n as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-1g7usGBg.mjs";
+import { r as RevisionRepository, t as ContentRepository } from "./content-Ci04z2z-.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-BxXyunY-.mjs";
+import { n as isMissingTableError, t as isMissingColumnError } from "./db-errors-CcWLaRiR.mjs";
+import { i as encodeBase64, t as decodeBase64 } from "./base64-B-PsqheR.mjs";
+import { n as InvalidCursorError, r as ScheduledNotDueError, t as EmDashValidationError } from "./types-D1iJ3DpO.mjs";
+import { t as MediaRepository } from "./media-BjhhENaJ.mjs";
+import { t as UserRepository } from "./user-Bh-L1qo6.mjs";
+import { t as TaxonomyRepository } from "./taxonomy-DfVooU4W.mjs";
+import { t as CommentRepository } from "./comment-DPT0WKyd.mjs";
+import { t as OptionsRepository } from "./options-BlmBHTvX.mjs";
+import { t as withTransaction } from "./transaction-D0FOsb3X.mjs";
+import { t as RedirectRepository } from "./redirect-CgLPYflR.mjs";
+import { r as requestCached } from "./request-cache-BSUptuJR.mjs";
+import { t as BylineRepository } from "./byline-XEjchwzZ.mjs";
+import { r as parseAllowedMimeTypes, t as matchesMimeAllowlist } from "./mime-DfIVjNkr.mjs";
+import { t as SeoRepository } from "./seo-2cmFHZns.mjs";
+import { r as invalidateRedirectCache } from "./cache-CGCd6AVM.mjs";
+import { t as FTSManager } from "./fts-manager-DzqIBrrW.mjs";
+import { u as invalidateTermCache } from "./taxonomies-DjSKBZpq.mjs";
+import { n as hashString } from "./hash-DFFrkivP.mjs";
+import { t as ErrorCode } from "./errors-DtEXIQQV.mjs";
+import { n as SchemaRegistry, t as SchemaError } from "./registry-FV15nLge.mjs";
+import { t as PluginStateRepository } from "./state-xxv6ZTMv.mjs";
+import { a as reconcileManifestAccess, i as pluginManifestSchema, r as normalizeManifestRoute } from "./manifest-schema-bCq54i7F.mjs";
+import { a as normalizeCapabilities, r as declaredAccessToCapabilities } from "./types-CK0LxPUQ.mjs";
+import { t as EmDashStorageError } from "./types-BD40g7zz.mjs";
+import { n as resolveAndValidateExternalUrl, t as SsrfError } from "./ssrf-CviKqWmq.mjs";
 import { sql } from "kysely";
 import { createGzipDecoder, unpackTar } from "modern-tar";
 import { ClientResponseError, ClientValidationError } from "@atcute/client";
@@ -340,6 +347,23 @@ async function resolveSearchColumns(db, collection) {
 	return columns;
 }
 /**
+* Decide whether the content-list `q` filter can be served from the
+* collection's FTS5 index instead of a full-scan substring LIKE (#1517).
+*
+* Requires SQLite (FTS5 is SQLite-only), search enabled on the collection,
+* every non-slug display column present in the searchable-field set (or the
+* index would miss matches the LIKE finds), and the index table actually
+* existing.
+*/
+async function canUseFtsForListFilter(db, collection, searchColumns) {
+	if (!isSqlite(db)) return false;
+	const ftsManager = new FTSManager(db);
+	if (!(await ftsManager.getSearchConfig(collection))?.enabled) return false;
+	const searchable = new Set(await ftsManager.getSearchableFields(collection));
+	if (!searchColumns.every((col) => col === "slug" || searchable.has(col))) return false;
+	return ftsManager.ftsTableExists(collection);
+}
+/**
 * Create a 301 auto-redirect from an entry's old URL to its new one after a
 * slug change, using the collection's URL pattern. Shared by
 * handleContentUpdate (direct slug edits) and handleContentPublish (slug edits
@@ -385,6 +409,7 @@ async function handleContentList(db, collection, params) {
 		if (q) {
 			where.q = q;
 			where.searchColumns = await resolveSearchColumns(db, collection);
+			where.useFts = await canUseFtsForListFilter(db, collection, where.searchColumns);
 		}
 		const result = await repo.findMany(collection, {
 			cursor: params.cursor,
@@ -421,6 +446,13 @@ async function handleContentList(db, collection, params) {
 				message: `Collection '${collection}' not found`
 			}
 		};
+		if (isMissingColumnError(error, "deleted_at")) return {
+			success: false,
+			error: {
+				code: "COLLECTION_SCHEMA_MISMATCH",
+				message: `Collection '${collection}' backing table is missing the 'deleted_at' column`
+			}
+		};
 		if (error instanceof EmDashValidationError) return {
 			success: false,
 			error: {
@@ -588,7 +620,6 @@ async function handleContentCreate(db, collection, body) {
 			});
 			if (body.bylines !== void 0) created.primaryBylineId = (await bylineRepo.setContentBylines(collection, created.id, body.bylines))[0]?.byline.translationGroup ?? null;
 			if (body.translationOf) {
-				const { TaxonomyRepository } = await import("./taxonomy-BxGxZZdu.mjs").then((n) => n.n);
 				await new TaxonomyRepository(trx).copyEntryTerms(collection, body.translationOf, created.id);
 				if (body.bylines === void 0) {
 					await bylineRepo.copyContentBylines(collection, body.translationOf, created.id);
@@ -599,6 +630,7 @@ async function handleContentCreate(db, collection, body) {
 			await hydrateBylines(trx, collection, created);
 			if (body.seo && hasSeo) created.seo = await new SeoRepository(trx).upsert(collection, created.id, body.seo);
 			else if (hasSeo) created.seo = { ...SEO_DEFAULTS };
+			if (body.taxonomies) await assignTaxonomies(trx, collection, created.id, effectiveLocale, body.taxonomies);
 			return created;
 		});
 		return {
@@ -696,6 +728,7 @@ async function handleContentUpdate(db, collection, id, body) {
 			if (body.seo && hasSeo) updated.seo = await new SeoRepository(trx).upsert(collection, resolvedId, body.seo);
 			else if (hasSeo) updated.seo = await new SeoRepository(trx).get(collection, resolvedId);
 			await hydrateBylines(trx, collection, updated);
+			if (body.taxonomies) await assignTaxonomies(trx, collection, resolvedId, updated.locale ?? body.locale, body.taxonomies);
 			return updated;
 		});
 		return {
@@ -1076,11 +1109,22 @@ async function handleContentPublish(db, collection, id, options = {}) {
 				message: error.message
 			}
 		};
-		if (error instanceof EmDashValidationError) return {
+		if (error instanceof EmDashValidationError) {
+			const details = error.details;
+			return {
+				success: false,
+				error: {
+					code: typeof details === "object" && details !== null && "code" in details && details.code === "SLUG_CONFLICT" ? "SLUG_CONFLICT" : "VALIDATION_ERROR",
+					message: error.message
+				}
+			};
+		}
+		const message = error instanceof Error ? error.message.toLowerCase() : "";
+		if ((message.includes("unique constraint failed") || message.includes("duplicate key")) && message.includes("slug")) return {
 			success: false,
 			error: {
-				code: "VALIDATION_ERROR",
-				message: error.message
+				code: "SLUG_CONFLICT",
+				message: `The staged slug is already used by another entry in collection '${collection}'`
 			}
 		};
 		console.error("Content publish error:", error);
@@ -1302,6 +1346,35 @@ async function syncNonTranslatableFields(trx, collectionSlug, updatedItemId, tra
 		AND id != ${updatedItemId}
 	`.execute(trx);
 }
+/**
+* Resolve a `{ taxonomyName: [slug, ...] }` map to term IDs and replace the
+* entry's assignments for each named taxonomy.
+*
+* Shared by handleContentCreate and handleContentUpdate so both MCP entry
+* points behave identically. Slug resolution is scoped to `locale`; passing
+* `undefined` lets `findBySlug` fall back to its default (lowest locale code)
+* so callers on single-locale sites don't need to know the site's default.
+*
+* Throws EmDashValidationError on unknown slug or wrong shape; the calling
+* handler translates that into a VALIDATION_ERROR response.
+*/
+async function assignTaxonomies(trx, collection, entryId, locale, taxonomies) {
+	const taxRepo = new TaxonomyRepository(trx);
+	let anyChange = false;
+	for (const [taxonomyName, slugs] of Object.entries(taxonomies)) {
+		if (!Array.isArray(slugs)) throw new EmDashValidationError(`taxonomies.${taxonomyName} must be an array of term slugs`);
+		const termIds = [];
+		for (const slug of slugs) {
+			if (typeof slug !== "string" || slug.length === 0) throw new EmDashValidationError(`taxonomies.${taxonomyName} contains a non-string or empty slug`);
+			const term = await taxRepo.findBySlug(taxonomyName, slug, locale);
+			if (!term) throw new EmDashValidationError(`Unknown taxonomy term: ${taxonomyName}='${slug}'${locale ? ` (locale '${locale}')` : ""}`);
+			termIds.push(term.id);
+		}
+		await taxRepo.setTermsForEntry(collection, entryId, taxonomyName, termIds);
+		anyChange = true;
+	}
+	if (anyChange) invalidateTermCache();
+}
 
 //#endregion
 //#region src/api/handlers/manifest.ts
@@ -2022,126 +2095,6 @@ async function handleOrphanedTableRegister(db, slug, options) {
 	}
 }
 
-//#endregion
-//#region src/plugins/state.ts
-function toPluginStatus(value) {
-	if (value === "active") return "active";
-	return "inactive";
-}
-function toPluginSource(value) {
-	if (value === "marketplace") return "marketplace";
-	if (value === "registry") return "registry";
-	return "config";
-}
-/**
-* Repository for plugin state in the database
-*/
-var PluginStateRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Get state for a specific plugin
-	*/
-	async get(pluginId) {
-		const row = await this.db.selectFrom("_plugin_state").selectAll().where("plugin_id", "=", pluginId).executeTakeFirst();
-		if (!row) return null;
-		return rowToPluginState(row);
-	}
-	/**
-	* Get all plugin states
-	*/
-	async getAll() {
-		return (await this.db.selectFrom("_plugin_state").selectAll().execute()).map(rowToPluginState);
-	}
-	/**
-	* Get all marketplace-installed plugin states
-	*/
-	async getMarketplacePlugins() {
-		return (await this.db.selectFrom("_plugin_state").selectAll().where("source", "=", "marketplace").execute()).map(rowToPluginState);
-	}
-	/**
-	* Get all registry-installed plugin states.
-	*
-	* The runtime's registry sync path uses this to discover which
-	* registry plugins should be loaded into the sandbox on this worker.
-	*/
-	async getRegistryPlugins() {
-		return (await this.db.selectFrom("_plugin_state").selectAll().where("source", "=", "registry").execute()).map(rowToPluginState);
-	}
-	/**
-	* Create or update plugin state
-	*/
-	async upsert(pluginId, version, status, opts) {
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const existing = await this.get(pluginId);
-		if (existing) {
-			const updates = {
-				status,
-				version
-			};
-			if (status === "active" && existing.status !== "active") updates.activated_at = now;
-			else if (status === "inactive" && existing.status !== "inactive") updates.deactivated_at = now;
-			if (opts?.source) updates.source = opts.source;
-			if (opts?.marketplaceVersion !== void 0) updates.marketplace_version = opts.marketplaceVersion;
-			if (opts?.displayName !== void 0) updates.display_name = opts.displayName;
-			if (opts?.description !== void 0) updates.description = opts.description;
-			if (opts?.registryPublisherDid !== void 0) updates.registry_publisher_did = opts.registryPublisherDid;
-			if (opts?.registrySlug !== void 0) updates.registry_slug = opts.registrySlug;
-			await this.db.updateTable("_plugin_state").set(updates).where("plugin_id", "=", pluginId).execute();
-		} else await this.db.insertInto("_plugin_state").values({
-			plugin_id: pluginId,
-			status,
-			version,
-			installed_at: now,
-			activated_at: status === "active" ? now : null,
-			deactivated_at: null,
-			data: null,
-			source: opts?.source ?? "config",
-			marketplace_version: opts?.marketplaceVersion ?? null,
-			display_name: opts?.displayName ?? null,
-			description: opts?.description ?? null,
-			registry_publisher_did: opts?.registryPublisherDid ?? null,
-			registry_slug: opts?.registrySlug ?? null
-		}).execute();
-		return await this.get(pluginId);
-	}
-	/**
-	* Enable a plugin
-	*/
-	async enable(pluginId, version) {
-		return this.upsert(pluginId, version, "active");
-	}
-	/**
-	* Disable a plugin
-	*/
-	async disable(pluginId, version) {
-		return this.upsert(pluginId, version, "inactive");
-	}
-	/**
-	* Delete plugin state
-	*/
-	async delete(pluginId) {
-		return ((await this.db.deleteFrom("_plugin_state").where("plugin_id", "=", pluginId).executeTakeFirst()).numDeletedRows ?? 0) > 0;
-	}
-};
-function rowToPluginState(row) {
-	return {
-		pluginId: row.plugin_id,
-		status: toPluginStatus(row.status),
-		version: row.version,
-		installedAt: new Date(row.installed_at),
-		activatedAt: row.activated_at ? new Date(row.activated_at) : null,
-		deactivatedAt: row.deactivated_at ? new Date(row.deactivated_at) : null,
-		source: toPluginSource(row.source),
-		marketplaceVersion: row.marketplace_version ?? null,
-		displayName: row.display_name ?? null,
-		description: row.description ?? null,
-		registryPublisherDid: row.registry_publisher_did ?? null,
-		registrySlug: row.registry_slug ?? null
-	};
-}
-
 //#endregion
 //#region src/api/handlers/plugins.ts
 function marketplaceIconUrl(marketplaceUrl, pluginId) {
@@ -2169,11 +2122,23 @@ function buildPluginInfo(plugin, state, marketplaceUrl) {
 		hasAdminPages: (plugin.admin.pages?.length ?? 0) > 0,
 		hasDashboardWidgets: (plugin.admin.widgets?.length ?? 0) > 0,
 		hasHooks: Object.keys(plugin.hooks ?? {}).length > 0,
+		hasSettings: Object.keys(plugin.admin.settingsSchema ?? {}).length > 0,
 		installedAt: state?.installedAt?.toISOString(),
 		activatedAt: state?.activatedAt?.toISOString() ?? void 0,
 		deactivatedAt: state?.deactivatedAt?.toISOString() ?? void 0,
 		description: state?.description ?? void 0,
-		iconUrl: isMarketplace && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, plugin.id) : void 0
+		iconUrl: isMarketplace && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, plugin.id) : void 0,
+		mcpToolsEnabled: state?.mcpToolsEnabled ?? false,
+		mcpTools: Object.entries(plugin.mcp?.tools ?? {}).flatMap(([name, tool]) => {
+			const permission = plugin.routes[tool.route]?.permission;
+			return permission ? [{
+				name,
+				description: tool.description,
+				route: tool.route,
+				permission,
+				destructive: tool.destructive ?? false
+			}] : [];
+		})
 	};
 }
 /**
@@ -2195,16 +2160,19 @@ function buildSandboxedPluginInfo(entry, state) {
 		hasAdminPages: (entry.adminPages?.length ?? 0) > 0,
 		hasDashboardWidgets: (entry.adminWidgets?.length ?? 0) > 0,
 		hasHooks: false,
+		hasSettings: Object.keys(entry.settingsSchema ?? {}).length > 0,
 		installedAt: state?.installedAt?.toISOString(),
 		activatedAt: state?.activatedAt?.toISOString() ?? void 0,
 		deactivatedAt: state?.deactivatedAt?.toISOString() ?? void 0,
-		description: state?.description ?? void 0
+		description: state?.description ?? void 0,
+		mcpToolsEnabled: state?.mcpToolsEnabled ?? false,
+		mcpTools: entry.mcp?.tools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool) ?? []
 	};
 }
 /**
 * List all configured plugins with their state
 */
-async function handlePluginList(db, configuredPlugins, sandboxedPluginEntries, marketplaceUrl) {
+async function handlePluginList(db, configuredPlugins, sandboxedPluginEntries, marketplaceUrl, runtimeSettingsSchemaLookup) {
 	try {
 		const allStates = await new PluginStateRepository(db).getAll();
 		const stateMap = new Map(allStates.map((s) => [s.pluginId, s]));
@@ -2234,11 +2202,14 @@ async function handlePluginList(db, configuredPlugins, sandboxedPluginEntries, m
 				hasAdminPages: false,
 				hasDashboardWidgets: false,
 				hasHooks: false,
+				hasSettings: Object.keys(runtimeSettingsSchemaLookup?.(state.pluginId) ?? {}).length > 0,
 				installedAt: state.installedAt?.toISOString(),
 				activatedAt: state.activatedAt?.toISOString() ?? void 0,
 				deactivatedAt: state.deactivatedAt?.toISOString() ?? void 0,
 				description: state.description ?? void 0,
-				iconUrl: state.source === "marketplace" && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, state.pluginId) : void 0
+				iconUrl: state.source === "marketplace" && marketplaceUrl ? marketplaceIconUrl(marketplaceUrl, state.pluginId) : void 0,
+				mcpToolsEnabled: state.mcpToolsEnabled,
+				mcpTools: []
 			});
 		}
 		return {
@@ -2311,10 +2282,13 @@ function buildStateOnlyPluginInfo(state) {
 		hasAdminPages: false,
 		hasDashboardWidgets: false,
 		hasHooks: false,
+		hasSettings: false,
 		installedAt: state.installedAt?.toISOString(),
 		activatedAt: state.activatedAt?.toISOString() ?? void 0,
 		deactivatedAt: state.deactivatedAt?.toISOString() ?? void 0,
-		description: state.description ?? void 0
+		description: state.description ?? void 0,
+		mcpToolsEnabled: state.mcpToolsEnabled,
+		mcpTools: []
 	};
 }
 /**
@@ -2394,6 +2368,141 @@ async function handlePluginDisable(db, configuredPlugins, sandboxedPluginEntries
 	}
 }
 
+//#endregion
+//#region src/api/handlers/plugin-settings.ts
+function settingsKey(pluginId, key) {
+	return `plugin:${pluginId}:settings:${key}`;
+}
+/**
+* Resolve a plugin's settings schema from either the configured
+* (in-process) plugin list or the statically-sandboxed entries.
+* Returns null when the plugin doesn't exist, undefined-equivalent
+* empty object when it declares no schema.
+*/
+function getPluginSettingsSchema(configuredPlugins, sandboxedPluginEntries, pluginId) {
+	const plugin = configuredPlugins.find((p) => p.id === pluginId);
+	if (plugin) return plugin.admin.settingsSchema ?? {};
+	const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+	if (sandboxed) return sandboxed.settingsSchema ?? {};
+	return null;
+}
+/**
+* Validate a single value against its schema field.
+* Returns an error message, or null when valid.
+*/
+function validateValue(key, field, value) {
+	switch (field.type) {
+		case "string":
+		case "secret":
+		case "url":
+		case "email":
+			if (typeof value !== "string") return `Setting "${key}" must be a string`;
+			if (field.type === "url" && value !== "" && !URL.canParse(value)) return `Setting "${key}" must be a valid URL`;
+			if (field.type === "email" && value !== "" && !value.includes("@")) return `Setting "${key}" must be a valid email address`;
+			return null;
+		case "number":
+			if (typeof value !== "number" || Number.isNaN(value)) return `Setting "${key}" must be a number`;
+			if (field.min !== void 0 && value < field.min) return `Setting "${key}" must be at least ${field.min}`;
+			if (field.max !== void 0 && value > field.max) return `Setting "${key}" must be at most ${field.max}`;
+			return null;
+		case "boolean": return typeof value === "boolean" ? null : `Setting "${key}" must be a boolean`;
+		case "select":
+			if (typeof value !== "string" || !field.options.some((o) => o.value === value)) return `Setting "${key}" must be one of the defined options`;
+			return null;
+		default: return `Setting "${key}" has an unknown field type`;
+	}
+}
+async function buildSettingsResponse(optionsRepo, pluginId, schema) {
+	const keys = Object.keys(schema);
+	const stored = await optionsRepo.getMany(keys.map((key) => settingsKey(pluginId, key)));
+	const values = {};
+	const secretsSet = {};
+	for (const key of keys) {
+		const field = schema[key];
+		if (!field) continue;
+		const storedValue = stored.get(settingsKey(pluginId, key));
+		if (field.type === "secret") {
+			secretsSet[key] = typeof storedValue === "string" && storedValue.length > 0;
+			continue;
+		}
+		if (storedValue !== void 0 && storedValue !== null) values[key] = storedValue;
+		else if ("default" in field && field.default !== void 0) values[key] = field.default;
+		else values[key] = null;
+	}
+	return {
+		schema,
+		values,
+		secretsSet
+	};
+}
+/**
+* Get a plugin's settings (schema + current values, secrets masked)
+*/
+async function handlePluginSettingsGet(db, pluginId, schema) {
+	try {
+		return {
+			success: true,
+			data: await buildSettingsResponse(new OptionsRepository(db), pluginId, schema)
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.PLUGIN_SETTINGS_READ_ERROR,
+				message: "Failed to read plugin settings"
+			}
+		};
+	}
+}
+/**
+* Update a plugin's settings.
+*
+* Only keys present in `updates` are written. A `null` value deletes the
+* stored value (reverting to the schema default). Secret fields are
+* write-only: they accept a new string value or `null` to clear, and the
+* response never echoes them back.
+*/
+async function handlePluginSettingsUpdate(db, pluginId, schema, updates) {
+	try {
+		for (const [key, value] of Object.entries(updates)) {
+			const field = schema[key];
+			if (!field) return {
+				success: false,
+				error: {
+					code: ErrorCode.VALIDATION_ERROR,
+					message: `Unknown setting "${key}" for plugin "${pluginId}"`
+				}
+			};
+			if (value === null) continue;
+			const error = validateValue(key, field, value);
+			if (error) return {
+				success: false,
+				error: {
+					code: ErrorCode.VALIDATION_ERROR,
+					message: error
+				}
+			};
+		}
+		return {
+			success: true,
+			data: await withTransaction(db, async (trx) => {
+				const txRepo = new OptionsRepository(trx);
+				for (const [key, value] of Object.entries(updates)) if (value === null) await txRepo.delete(settingsKey(pluginId, key));
+				else await txRepo.set(settingsKey(pluginId, key), value);
+				return buildSettingsResponse(txRepo, pluginId, schema);
+			})
+		};
+	} catch {
+		return {
+			success: false,
+			error: {
+				code: ErrorCode.PLUGIN_SETTINGS_UPDATE_ERROR,
+				message: "Failed to update plugin settings"
+			}
+		};
+	}
+}
+
 //#endregion
 //#region src/plugins/marketplace.ts
 /**
@@ -2856,6 +2965,14 @@ async function handleMarketplaceInstall(db, storage, sandboxRunner, marketplaceU
 		};
 		const bundleIdentityError = validateBundleIdentity(bundle, pluginId, version);
 		if (bundleIdentityError) return bundleIdentityError;
+		if ((bundle.manifest.mcp?.tools.length ?? 0) > 0 && !opts?.confirmMcpTools) return {
+			success: false,
+			error: {
+				code: "MCP_TOOL_CONSENT_REQUIRED",
+				message: "Plugin MCP tools require explicit consent",
+				details: { mcpTools: bundle.manifest.mcp?.tools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool) }
+			}
+		};
 		await storeBundleInR2(storage, pluginId, version, bundle);
 		await stateRepo.upsert(pluginId, version, "active", {
 			source: "marketplace",
@@ -3005,12 +3122,24 @@ async function handleMarketplaceUpdate(db, storage, sandboxRunner, marketplaceUr
 				}
 			}
 		};
+		const oldMcpTools = [...oldBundle?.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		const newMcpTools = [...bundle.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		if (JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools) && !opts?.confirmMcpTools) return {
+			success: false,
+			error: {
+				code: "MCP_TOOL_CONSENT_REQUIRED",
+				message: "Plugin update changes its MCP tools",
+				details: { mcpTools: newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool) }
+			}
+		};
 		await storeBundleInR2(storage, pluginId, newVersion, bundle);
 		await stateRepo.upsert(pluginId, newVersion, "active", {
 			source: "marketplace",
 			marketplaceVersion: newVersion,
 			displayName: pluginDetail.name,
-			description: pluginDetail.description ?? void 0
+			description: pluginDetail.description ?? void 0,
+			mcpToolsEnabled: false,
+			mcpToolsConsent: null
 		});
 		deleteBundleFromR2(storage, pluginId, oldVersion).catch(() => {});
 		return {
@@ -4191,6 +4320,17 @@ async function handleRegistryInstall(db, storage, sandboxRunner, registryConfigI
 				}
 			};
 		}
+		const actualMcpTools = (bundle.manifest.mcp?.tools ?? []).map(({ inputSchema: _, outputSchema: __, ...tool }) => tool);
+		if (actualMcpTools.length > 0) {
+			if (JSON.stringify(input.acknowledgedMcpTools) !== JSON.stringify(actualMcpTools)) return {
+				success: false,
+				error: {
+					code: "MCP_TOOL_CONSENT_REQUIRED",
+					message: "Plugin MCP tools require explicit consent",
+					details: { mcpTools: actualMcpTools }
+				}
+			};
+		}
 		await storeBundleInR2(storage, pluginId, version, bundle, "registry");
 		const profile = packageView.profile;
 		try {
@@ -4509,13 +4649,25 @@ async function handleRegistryUpdate(db, storage, sandboxRunner, registryConfigIn
 				}
 			}
 		};
+		const oldMcpTools = [...oldBundle?.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		const newMcpTools = [...bundle.manifest.mcp?.tools ?? []].toSorted((a, b) => a.name.localeCompare(b.name));
+		if (JSON.stringify(oldMcpTools) !== JSON.stringify(newMcpTools) && !opts?.confirmMcpTools) return {
+			success: false,
+			error: {
+				code: "MCP_TOOL_CONSENT_REQUIRED",
+				message: "Plugin update changes its MCP tools",
+				details: { mcpTools: newMcpTools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool) }
+			}
+		};
 		await storeBundleInR2(storage, pluginId, newVersion, bundle, "registry");
 		await stateRepo.upsert(pluginId, newVersion, "active", {
 			source: "registry",
 			registryPublisherDid: publisherDid,
 			registrySlug: slug,
 			displayName: existing.displayName ?? slug,
-			description: existing.description ?? void 0
+			description: existing.description ?? void 0,
+			mcpToolsEnabled: false,
+			mcpToolsConsent: null
 		});
 		deleteBundleFromR2(storage, pluginId, oldVersion, "registry").catch(() => {});
 		return {
@@ -4642,5 +4794,5 @@ async function handleRegistryUpdateCheck(db, registryConfigInput) {
 }
 
 //#endregion
-export { handleContentGet as $, handleSchemaFieldCreate as A, handleMediaUpdate as B, handleOrphanedTableList as C, handleSchemaCollectionGet as D, handleSchemaCollectionDelete as E, handleSchemaFieldUpdate as F, handleContentAuthors as G, handleRevisionList as H, handleMediaCreate as I, handleContentCountTrashed as J, handleContentCompare as K, handleMediaDelete as L, handleSchemaFieldGet as M, handleSchemaFieldList as N, handleSchemaCollectionList as O, handleSchemaFieldReorder as P, handleContentDuplicate as Q, handleMediaGet as R, PluginStateRepository as S, handleSchemaCollectionCreate as T, handleRevisionRestore as U, handleRevisionGet as V, generateManifest as W, handleContentDelete as X, handleContentCreate as Y, handleContentDiscardDraft as Z, loadBundleFromR2 as _, handleRegistryUpdateCheck as a, handleContentRestore as at, handlePluginGet as b, validateAggregatorUrl as c, handleContentUnpublish as ct, handleMarketplaceSearch as d, validateRev as dt, handleContentGetIncludingTrashed as et, handleMarketplaceUninstall as f, handleThemeSearch as g, handleThemeGetDetail as h, handleRegistryUpdate as i, handleContentPublish as it, handleSchemaFieldDelete as j, handleSchemaCollectionUpdate as k, handleMarketplaceGetPlugin as l, handleContentUnschedule as lt, handleMarketplaceUpdateCheck as m, handleRegistryInstall as n, handleContentListTrashed as nt, coerceRegistryConfig as o, handleContentSchedule as ot, handleMarketplaceUpdate as p, handleContentCountScheduled as q, handleRegistryUninstall as r, handleContentPermanentDelete as rt, normalizeRegistryConfig as s, handleContentTranslations as st, assertSafeArtifactUrl as t, handleContentList as tt, handleMarketplaceInstall as u, handleContentUpdate as ut, handlePluginDisable as v, handleOrphanedTableRegister as w, handlePluginList as x, handlePluginEnable as y, handleMediaList as z };
-//# sourceMappingURL=api-DxFSorgk.mjs.map
+export { handleContentDiscardDraft as $, handleSchemaCollectionList as A, handleMediaGet as B, handlePluginGet as C, handleSchemaCollectionCreate as D, handleOrphanedTableRegister as E, handleSchemaFieldList as F, handleRevisionRestore as G, handleMediaUpdate as H, handleSchemaFieldReorder as I, handleContentCompare as J, generateManifest as K, handleSchemaFieldUpdate as L, handleSchemaFieldCreate as M, handleSchemaFieldDelete as N, handleSchemaCollectionDelete as O, handleSchemaFieldGet as P, handleContentDelete as Q, handleMediaCreate as R, handlePluginEnable as S, handleOrphanedTableList as T, handleRevisionGet as U, handleMediaList as V, handleRevisionList as W, handleContentCountTrashed as X, handleContentCountScheduled as Y, handleContentCreate as Z, loadBundleFromR2 as _, handleRegistryUpdateCheck as a, handleContentPermanentDelete as at, handlePluginSettingsUpdate as b, validateAggregatorUrl as c, handleContentSchedule as ct, handleMarketplaceSearch as d, handleContentUnschedule as dt, handleContentDuplicate as et, handleMarketplaceUninstall as f, handleContentUpdate as ft, handleThemeSearch as g, handleThemeGetDetail as h, handleRegistryUpdate as i, handleContentListTrashed as it, handleSchemaCollectionUpdate as j, handleSchemaCollectionGet as k, handleMarketplaceGetPlugin as l, handleContentTranslations as lt, handleMarketplaceUpdateCheck as m, handleRegistryInstall as n, handleContentGetIncludingTrashed as nt, coerceRegistryConfig as o, handleContentPublish as ot, handleMarketplaceUpdate as p, validateRev as pt, handleContentAuthors as q, handleRegistryUninstall as r, handleContentList as rt, normalizeRegistryConfig as s, handleContentRestore as st, assertSafeArtifactUrl as t, handleContentGet as tt, handleMarketplaceInstall as u, handleContentUnpublish as ut, getPluginSettingsSchema as v, handlePluginList as w, handlePluginDisable as x, handlePluginSettingsGet as y, handleMediaDelete as z };
+//# sourceMappingURL=api-b8WIiGU4.mjs.map