emdash 0.28.1 → 0.30.0

package/dist/astro/routes/api/mcp.mjs

@@ -1,14 +1,15 @@
-import "../../../base64-CmWvODNW.mjs";
-import "../../../types-CuW0zWDA.mjs";
-import { t as apiError } from "../../../error-CkAseSqZ.mjs";
-import { Dn as contentBylineInputSchema, Tn as bylineUpdateBody, un as contentSeoInput, yn as bylineCreateBody } from "../../../redirects-DXEXBAII.mjs";
-import "../../../byline-fields-2Lp5Hbgf.mjs";
-import "../../../status-CqJQX1QN.mjs";
+import "../../../base64-B-PsqheR.mjs";
+import "../../../types-D1iJ3DpO.mjs";
+import { t as apiError } from "../../../error-CEGF6UZb.mjs";
+import { t as CONTENT_TYPE_RE } from "../../../media-kIV1IxFf.mjs";
+import { Zt as contentSeoInput, fn as bylineUpdateBody, mn as contentBylineInputSchema, on as bylineCreateBody } from "../../../redirects-BBq3n2Rj.mjs";
+import "../../../relations-5_avdrN_.mjs";
+import "../../../status-COfycGIU.mjs";
 import "../../../api/schemas/index.mjs";
-import { i as hasScope } from "../../../api-tokens-DsvvCtdh.mjs";
-import { n as convertDataForWrite, t as convertDataForRead } from "../../../portable-text-cCa0cGV6.mjs";
+import { i as hasScope$1 } from "../../../api-tokens-Cvmixds7.mjs";
+import { n as convertDataForWrite, t as convertDataForRead } from "../../../portable-text-sDj92Kxv.mjs";
 import { z } from "zod";
-import { Role, canActOnOwn, hasPermission } from "@emdash-cms/auth";
+import { Permissions, Role, canActOnOwn, hasPermission } from "@emdash-cms/auth";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -35,6 +36,21 @@ const settingsSeoSchema = z.object({
 	googleVerification: z.string().max(100).optional().describe("Google Search Console verification token"),
 	bingVerification: z.string().max(100).optional().describe("Bing Webmaster Tools verification token")
 });
+const mediaUsageRepairToolSchema = z.object({
+	scope: z.enum(["collection", "all"]).describe("Repair one collection or all collections"),
+	collection: z.string().min(1).max(63).regex(COLLECTION_SLUG_PATTERN, "Invalid collection slug").optional().describe("Collection slug; required only when scope is collection")
+}).strict().superRefine((input, ctx) => {
+	if (input.scope === "collection" && input.collection === void 0) ctx.addIssue({
+		code: "custom",
+		path: ["collection"],
+		message: "Collection is required when scope is collection"
+	});
+	if (input.scope === "all" && input.collection !== void 0) ctx.addIssue({
+		code: "custom",
+		path: ["collection"],
+		message: "Collection must be omitted when scope is all"
+	});
+});
 /**
 * Return a successful tool response with the data as pretty-printed JSON.
 */
@@ -157,7 +173,7 @@ function getEmDash(extra) {
 }
 async function getCollectionFields(ec, collection) {
 	try {
-		const { SchemaRegistry } = await import("../../../schema-CX9cfNkZ.mjs").then((n) => n.t);
+		const { SchemaRegistry } = await import("../../../schema-BXxlHeAf.mjs").then((n) => n.t);
 		const col = await new SchemaRegistry(ec.db).getCollectionWithFields(collection);
 		return col ? col.fields : null;
 	} catch {
@@ -186,7 +202,7 @@ async function applyReadMarkdown(ec, collection, items) {
 	for (const item of items) if (item.data && typeof item.data === "object") item.data = convertDataForRead(item.data, fields, false);
 }
 async function invalidateBylines() {
-	const { invalidateBylineCache } = await import("../../../bylines-CAZxGSrm.mjs").then((n) => n.t);
+	const { invalidateBylineCache } = await import("../../../bylines-czseViYo.mjs").then((n) => n.t);
 	invalidateBylineCache();
 }
 /**
@@ -198,7 +214,7 @@ async function invalidateBylines() {
 */
 function requireScope(extra, scope) {
 	const payload = getExtra(extra);
-	if (payload.tokenScopes && !hasScope(payload.tokenScopes, scope)) throw new EmDashAuthError(`Insufficient scope: requires ${scope}`, "INSUFFICIENT_SCOPE");
+	if (payload.tokenScopes && !hasScope$1(payload.tokenScopes, scope)) throw new EmDashAuthError(`Insufficient scope: requires ${scope}`, "INSUFFICIENT_SCOPE");
 }
 /**
 * Defense-in-depth: enforce a minimum RBAC role on the current request.
@@ -265,7 +281,7 @@ function extractContentId(data) {
 	const item = obj.item && typeof obj.item === "object" ? obj.item : obj;
 	return typeof item?.id === "string" ? item.id : void 0;
 }
-function createMcpServer() {
+function createMcpServer(pluginTools = [], request) {
 	const server = new McpServer({
 		name: "emdash",
 		version: "0.1.0"
@@ -281,6 +297,40 @@ function createMcpServer() {
 		};
 		return originalRegisterTool(name, config, wrapped);
 	});
+	for (const tool of pluginTools) {
+		if (!(tool.permission in Permissions)) continue;
+		server.registerTool(`${tool.pluginId}__${tool.name}`, {
+			description: tool.description,
+			inputSchema: tool.inputSchema,
+			outputSchema: tool.outputSchema,
+			annotations: { destructiveHint: tool.destructive }
+		}, async (input, extra) => {
+			const payload = getExtra(extra);
+			const requiredScope = `mcp:tools:${tool.pluginId}`;
+			if (payload.tokenScopes && !hasScope$1(payload.tokenScopes, requiredScope)) {
+				if (request) await payload.emdash.handlePluginMcpDenied(tool.pluginId, tool.name, tool.route, payload.userId, request, `Missing scope: ${requiredScope}`);
+				throw new EmDashAuthError(`Insufficient scope: requires ${requiredScope}`, "INSUFFICIENT_SCOPE");
+			}
+			if (!hasPermission({ role: payload.userRole }, tool.permission)) {
+				if (request) await payload.emdash.handlePluginMcpDenied(tool.pluginId, tool.name, tool.route, payload.userId, request, `Missing permission: ${tool.permission}`);
+				throw new EmDashAuthError(`Insufficient permission: requires ${tool.permission}`, "INSUFFICIENT_PERMISSIONS");
+			}
+			if (!request) return respondError("INTERNAL_ERROR", "Missing MCP request context");
+			const result = await payload.emdash.handlePluginMcpTool(tool.pluginId, tool.name, tool.route, input, payload.userId, request);
+			if (!result.success) return unwrap(result);
+			if (tool.outputSchema) {
+				if (!result.data || typeof result.data !== "object" || Array.isArray(result.data)) return respondError("INVALID_PLUGIN_OUTPUT", "Plugin tool output must be an object when outputSchema is declared");
+				return {
+					content: [{
+						type: "text",
+						text: JSON.stringify(result.data, null, 2)
+					}],
+					structuredContent: result.data
+				};
+			}
+			return respondData(result.data);
+		});
+	}
 	server.registerTool("content_list", {
 		title: "List Content",
 		description: "List content items in a collection with optional filtering and pagination. Returns items sorted by the specified field. Use the nextCursor value from the response to fetch the next page. Status can be 'draft', 'published', or 'scheduled'. If no status is given, all non-trashed items are returned.",
@@ -355,7 +405,8 @@ function createMcpServer() {
 			status: z.enum(["draft", "published"]).optional().describe("Initial status (default 'draft'). Requires publish permission."),
 			locale: z.string().optional().describe("Locale for this content (e.g. 'fr'). Defaults to default locale."),
 			translationOf: z.string().optional().describe("ID of the content item this is a translation of. Links items in the same translation group."),
-			bylines: z.array(contentBylineInputSchema).optional().describe("Bylines to credit. Each entry references an existing byline by id (see byline_list / byline_create) with an optional roleLabel. The first entry becomes the primary byline.")
+			bylines: z.array(contentBylineInputSchema).optional().describe("Bylines to credit. Each entry references an existing byline by id (see byline_list / byline_create) with an optional roleLabel. The first entry becomes the primary byline."),
+			taxonomies: z.record(z.string(), z.array(z.string())).optional().describe("Taxonomy term assignments as { taxonomyName: [termSlug, ...] }. Term slugs are resolved in the entry's locale. Call taxonomy_list to see available taxonomies and taxonomy_list_terms to look up slugs. Missing keys leave that taxonomy unchanged.")
 		}),
 		annotations: { destructiveHint: false }
 	}, async (args, extra) => {
@@ -379,7 +430,8 @@ function createMcpServer() {
 				authorId: userId,
 				locale: args.locale,
 				translationOf: args.translationOf,
-				bylines: args.bylines
+				bylines: args.bylines,
+				taxonomies: args.taxonomies
 			});
 			if (!result.success) return unwrap(result);
 			const itemId = extractContentId(result.data);
@@ -392,7 +444,8 @@ function createMcpServer() {
 			authorId: userId,
 			locale: args.locale,
 			translationOf: args.translationOf,
-			bylines: args.bylines
+			bylines: args.bylines,
+			taxonomies: args.taxonomies
 		}));
 	});
 	server.registerTool("content_update", {
@@ -407,6 +460,7 @@ function createMcpServer() {
 			status: z.enum(["draft", "published"]).optional().describe("New status. Setting to 'published' requires publish permission. Setting to 'draft' unpublishes the item and also requires publish permission."),
 			seo: contentSeoInput.optional().describe("Per-content SEO metadata. Only valid for collections with SEO enabled (see schema_get_collection.hasSeo). Fields not included are left unchanged; pass null to clear."),
 			bylines: z.array(contentBylineInputSchema).optional().describe("Replace the byline list for this item. The first entry becomes the primary byline. Pass an empty array to clear all bylines."),
+			taxonomies: z.record(z.string(), z.array(z.string())).optional().describe("Replace taxonomy term assignments as { taxonomyName: [termSlug, ...] }. Term slugs are resolved in the entry's locale. Only named taxonomies are touched; other taxonomies are left unchanged. Pass an empty array to clear a taxonomy."),
 			publishedAt: z.iso.datetime({
 				offset: true,
 				message: "must be an ISO 8601 datetime"
@@ -431,7 +485,7 @@ function createMcpServer() {
 		const resolvedId = extractContentId(existing.data) ?? args.id;
 		if (args.status === "published") {
 			requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
-			if (args.data || args.slug || args.seo !== void 0 || args.bylines !== void 0 || args.publishedAt !== void 0) {
+			if (args.data || args.slug || args.seo !== void 0 || args.bylines !== void 0 || args.taxonomies !== void 0 || args.publishedAt !== void 0) {
 				const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
 					data,
 					slug: args.slug,
@@ -439,6 +493,7 @@ function createMcpServer() {
 					locale: args.locale,
 					seo: args.seo,
 					bylines: args.bylines,
+					taxonomies: args.taxonomies,
 					publishedAt: args.publishedAt,
 					_rev: args._rev
 				});
@@ -448,7 +503,7 @@ function createMcpServer() {
 		}
 		if (args.status === "draft") {
 			requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
-			if (args.data || args.slug || args.seo !== void 0 || args.bylines !== void 0 || args.publishedAt !== void 0) {
+			if (args.data || args.slug || args.seo !== void 0 || args.bylines !== void 0 || args.taxonomies !== void 0 || args.publishedAt !== void 0) {
 				const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
 					data,
 					slug: args.slug,
@@ -456,6 +511,7 @@ function createMcpServer() {
 					locale: args.locale,
 					seo: args.seo,
 					bylines: args.bylines,
+					taxonomies: args.taxonomies,
 					publishedAt: args.publishedAt,
 					_rev: args._rev
 				});
@@ -470,6 +526,7 @@ function createMcpServer() {
 			locale: args.locale,
 			seo: args.seo,
 			bylines: args.bylines,
+			taxonomies: args.taxonomies,
 			publishedAt: args.publishedAt,
 			_rev: args._rev
 		}));
@@ -701,7 +758,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-Bm8ZgUP9.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-XEjchwzZ.mjs").then((n) => n.n);
 			return jsonResult(await new BylineRepository(ec.db).findMany({
 				search: args.search,
 				isGuest: args.isGuest,
@@ -723,7 +780,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-Bm8ZgUP9.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-XEjchwzZ.mjs").then((n) => n.n);
 			const byline = await new BylineRepository(ec.db).findById(args.id);
 			if (!byline) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 			return jsonResult(byline);
@@ -741,7 +798,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineCreate } = await import("../../../bylines-6tm9mgQb.mjs").then((n) => n.t);
+			const { handleBylineCreate } = await import("../../../bylines-BJbT4gKS.mjs").then((n) => n.t);
 			const result = await handleBylineCreate(ec.db, args);
 			if (result.success) await invalidateBylines();
 			return unwrap(result);
@@ -761,7 +818,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineUpdate } = await import("../../../bylines-6tm9mgQb.mjs").then((n) => n.t);
+			const { handleBylineUpdate } = await import("../../../bylines-BJbT4gKS.mjs").then((n) => n.t);
 			const { id, ...input } = args;
 			const result = await handleBylineUpdate(ec.db, id, input);
 			if (result.success) await invalidateBylines();
@@ -780,7 +837,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-Bm8ZgUP9.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-XEjchwzZ.mjs").then((n) => n.n);
 			if (!await new BylineRepository(ec.db).delete(args.id)) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 			await invalidateBylines();
 			return jsonResult({ deleted: args.id });
@@ -797,7 +854,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineTranslations } = await import("../../../bylines-6tm9mgQb.mjs").then((n) => n.t);
+			const { handleBylineTranslations } = await import("../../../bylines-BJbT4gKS.mjs").then((n) => n.t);
 			return unwrap(await handleBylineTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "BYLINE_TRANSLATIONS_ERROR");
@@ -813,7 +870,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-CX9cfNkZ.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BXxlHeAf.mjs").then((n) => n.t);
 			return jsonResult({ items: await new SchemaRegistry(ec.db).listCollections() });
 		} catch (error) {
 			return respondHandlerError(error, "SCHEMA_LIST_ERROR");
@@ -829,7 +886,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-CX9cfNkZ.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BXxlHeAf.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).getCollectionWithFields(args.slug);
 			if (!collection) return respondError("NOT_FOUND", `Collection '${args.slug}' not found`);
 			return jsonResult(collection);
@@ -859,7 +916,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-CX9cfNkZ.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BXxlHeAf.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).createCollection({
 				slug: args.slug,
 				label: args.label,
@@ -887,7 +944,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-CX9cfNkZ.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BXxlHeAf.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteCollection(args.slug, { force: args.force });
 			ec.invalidateUrlPatternCache();
 			return jsonResult({ deleted: args.slug });
@@ -941,7 +998,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-CX9cfNkZ.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BXxlHeAf.mjs").then((n) => n.t);
 			return jsonResult(await new SchemaRegistry(ec.db).createField(args.collection, {
 				slug: args.slug,
 				label: args.label,
@@ -971,7 +1028,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-CX9cfNkZ.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BXxlHeAf.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteField(args.collection, args.fieldSlug);
 			return jsonResult({
 				deleted: args.fieldSlug,
@@ -1000,7 +1057,7 @@ function createMcpServer() {
 	});
 	server.registerTool("media_create", {
 		title: "Register Uploaded Media",
-		description: "Register a media file that has already been uploaded to storage. The caller is responsible for placing the file at `storageKey` (typically using a signed upload URL obtained from the admin UI or a separate API). This tool persists the metadata record so the file is discoverable via media_list / media_get and can be referenced by content. For binary uploads the MCP transport is not appropriate — use the signed-upload flow instead.",
+		description: "Register a media file that has already been uploaded to storage. The caller is responsible for placing the file at `storageKey` (typically using a signed upload URL obtained from the admin UI or a separate API). This tool persists the metadata record so the file is discoverable via media_list / media_get and can be referenced by content. To upload the file itself, use media_upload (base64 data or a public URL) instead.",
 		inputSchema: z.object({
 			filename: z.string().describe("Original filename (e.g. 'logo.png')"),
 			mimeType: z.string().describe("MIME type (e.g. 'image/png')"),
@@ -1029,6 +1086,37 @@ function createMcpServer() {
 			authorId: userId
 		}));
 	});
+	server.registerTool("media_upload", {
+		title: "Upload Media",
+		description: "Upload a media file from base64-encoded data or an external URL and register it in the media library. Returns the media item with id, storageKey, and url — ready to reference from content fields (e.g. featured_image) via content_create / content_update. Uploads are deduplicated by content hash: re-uploading identical bytes returns the existing item with deduplicated: true. URL fetches must resolve to a public http(s) host (SSRF-guarded). Subject to the global upload MIME allowlist and the configured maximum upload size.",
+		inputSchema: z.object({
+			filename: z.string().min(1).describe("Filename including extension (e.g. 'cover.png')"),
+			base64: z.string().optional().describe("Base64-encoded file contents. Provide exactly one of base64 / url."),
+			url: z.string().url().optional().describe("Public http(s) URL to fetch the file from. Provide exactly one of base64 / url."),
+			contentType: z.string().regex(CONTENT_TYPE_RE, "Invalid content type").optional().describe("MIME type (e.g. 'image/png'). Required with base64; with url it defaults to the response's Content-Type header."),
+			alt: z.string().optional().describe("Alt text for accessibility")
+		}),
+		annotations: { destructiveHint: false }
+	}, async (args, extra) => {
+		requireScope(extra, "media:write");
+		requireRole(extra, Role.CONTRIBUTOR);
+		const { emdash, userId } = getExtra(extra);
+		if (!emdash.storage) return respondError("NO_STORAGE", "Storage not configured");
+		try {
+			const { handleMediaUpload } = await import("../../../media-upload-D2wk3EIt.mjs");
+			return unwrap(await handleMediaUpload(emdash.db, emdash.storage, {
+				filename: args.filename,
+				base64: args.base64,
+				url: args.url,
+				contentType: args.contentType,
+				alt: args.alt,
+				authorId: userId,
+				maxUploadSize: emdash.config.maxUploadSize
+			}));
+		} catch (error) {
+			return respondHandlerError(error, "UPLOAD_ERROR");
+		}
+	});
 	server.registerTool("media_get", {
 		title: "Get Media Item",
 		description: "Get details of a single media file by its ID. Returns metadata including filename, MIME type, size, dimensions, alt text, and URL.",
@@ -1078,6 +1166,29 @@ function createMcpServer() {
 		requireOwnership(extra, typeof media?.authorId === "string" ? media.authorId : "", "media:delete_own", "media:delete_any");
 		return unwrap(await ec.handleMediaDelete(args.id));
 	});
+	server.registerTool("media_usage_repair", {
+		title: "Repair Media Usage Index",
+		description: "Repair content media usage indexes for one collection or every collection. Returns complete, partial, failed, or stale status; inspect the structured result.",
+		inputSchema: mediaUsageRepairToolSchema
+	}, async (args, extra) => {
+		requireScope(extra, "admin");
+		requireRole(extra, Role.ADMIN);
+		const ec = getEmDash(extra);
+		let input;
+		if (args.scope === "collection") {
+			if (args.collection === void 0) return respondError("VALIDATION_ERROR", "Collection is required when scope is collection");
+			input = {
+				scope: "collection",
+				collection: args.collection
+			};
+		} else input = { scope: "all" };
+		try {
+			const { handleMediaUsageRepair } = await import("../../../media-usage-CljdO1mc.mjs").then((n) => n.i);
+			return unwrap(await handleMediaUsageRepair(ec.db, input));
+		} catch (error) {
+			return respondHandlerError(error, "MEDIA_USAGE_REPAIR_ERROR");
+		}
+	});
 	server.registerTool("search", {
 		title: "Search Content",
 		description: "Full-text search across content collections. Searches indexed fields for matching content. Collections must have 'search' in their supports list and fields must be marked as searchable. Returns collection, item ID, title, excerpt, and relevance score.",
@@ -1085,18 +1196,20 @@ function createMcpServer() {
 			query: z.string().describe("Search query text"),
 			collections: z.array(z.string()).optional().describe("Limit search to specific collection slugs (all if omitted)"),
 			locale: z.string().optional().describe("Filter results by locale (omit to search all locales)"),
-			limit: z.number().int().min(1).max(50).optional().describe("Max results (default 20)")
+			limit: z.number().int().min(1).max(50).optional().describe("Max results (default 20)"),
+			cursor: z.string().min(1).max(2048).optional().describe("Pagination cursor from a previous response")
 		}),
 		annotations: { readOnlyHint: true }
 	}, async (args, extra) => {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { searchWithDb } = await import("../../../search-DZN2HZ-V.mjs").then((n) => n.t);
+			const { searchWithDb } = await import("../../../search-Bff-7jFt.mjs").then((n) => n.t);
 			return jsonResult(await searchWithDb(ec.db, args.query, {
 				collections: args.collections,
 				locale: args.locale,
-				limit: args.limit
+				limit: args.limit,
+				cursor: args.cursor
 			}));
 		} catch (error) {
 			return respondHandlerError(error, "SEARCH_ERROR");
@@ -1111,7 +1224,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-Bs13SN-F.mjs").then((n) => n.l);
+			const { handleTaxonomyList } = await import("../../../taxonomies-Ce49uIzY.mjs").then((n) => n.l);
 			return unwrap(await handleTaxonomyList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "TAXONOMY_LIST_ERROR");
@@ -1131,12 +1244,12 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-Bs13SN-F.mjs").then((n) => n.l);
+			const { handleTaxonomyList } = await import("../../../taxonomies-Ce49uIzY.mjs").then((n) => n.l);
 			const listResult = await handleTaxonomyList(ec.db, { locale: args.locale });
 			if (!listResult.success) return unwrap(listResult);
 			if (!listResult.data.taxonomies.find((t) => t.name === args.taxonomy)) return respondError("NOT_FOUND", `Taxonomy '${args.taxonomy}' not found`);
-			const { TaxonomyRepository } = await import("../../../taxonomy-BxGxZZdu.mjs").then((n) => n.n);
-			const { decodeCursor, encodeCursor, InvalidCursorError } = await import("../../../types-CuW0zWDA.mjs").then((n) => n.o);
+			const { TaxonomyRepository } = await import("../../../taxonomy-DfVooU4W.mjs").then((n) => n.n);
+			const { decodeCursor, encodeCursor, InvalidCursorError } = await import("../../../types-D1iJ3DpO.mjs").then((n) => n.o);
 			const repo = new TaxonomyRepository(ec.db);
 			const limit = Math.min(args.limit ?? 50, 100);
 			const terms = await repo.findByName(args.taxonomy, { locale: args.locale });
@@ -1190,7 +1303,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermCreate } = await import("../../../taxonomies-Bs13SN-F.mjs").then((n) => n.l);
+			const { handleTermCreate } = await import("../../../taxonomies-Ce49uIzY.mjs").then((n) => n.l);
 			return unwrap(await handleTermCreate(ec.db, args.taxonomy, {
 				slug: args.slug,
 				label: args.label,
@@ -1219,7 +1332,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermUpdate } = await import("../../../taxonomies-Bs13SN-F.mjs").then((n) => n.l);
+			const { handleTermUpdate } = await import("../../../taxonomies-Ce49uIzY.mjs").then((n) => n.l);
 			return unwrap(await handleTermUpdate(ec.db, args.taxonomy, args.termSlug, {
 				slug: args.slug,
 				label: args.label,
@@ -1243,7 +1356,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermDelete } = await import("../../../taxonomies-Bs13SN-F.mjs").then((n) => n.l);
+			const { handleTermDelete } = await import("../../../taxonomies-Ce49uIzY.mjs").then((n) => n.l);
 			return unwrap(await handleTermDelete(ec.db, args.taxonomy, args.termSlug));
 		} catch (error) {
 			return respondHandlerError(error, "TAXONOMY_TERM_DELETE_ERROR");
@@ -1258,7 +1371,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermTranslations } = await import("../../../taxonomies-Bs13SN-F.mjs").then((n) => n.l);
+			const { handleTermTranslations } = await import("../../../taxonomies-Ce49uIzY.mjs").then((n) => n.l);
 			return unwrap(await handleTermTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "TERM_TRANSLATIONS_ERROR");
@@ -1273,7 +1386,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuList } = await import("../../../menus-Cfivc2Ad.mjs").then((n) => n.d);
+			const { handleMenuList } = await import("../../../menus-CZyG6rvx.mjs").then((n) => n.d);
 			return unwrap(await handleMenuList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_LIST_ERROR");
@@ -1291,7 +1404,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuGet } = await import("../../../menus-Cfivc2Ad.mjs").then((n) => n.d);
+			const { handleMenuGet } = await import("../../../menus-CZyG6rvx.mjs").then((n) => n.d);
 			return unwrap(await handleMenuGet(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_GET_ERROR");
@@ -1306,7 +1419,7 @@ function createMcpServer() {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuTranslations } = await import("../../../menus-Cfivc2Ad.mjs").then((n) => n.d);
+			const { handleMenuTranslations } = await import("../../../menus-CZyG6rvx.mjs").then((n) => n.d);
 			return unwrap(await handleMenuTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_TRANSLATIONS_ERROR");
@@ -1326,7 +1439,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuCreate } = await import("../../../menus-Cfivc2Ad.mjs").then((n) => n.d);
+			const { handleMenuCreate } = await import("../../../menus-CZyG6rvx.mjs").then((n) => n.d);
 			return unwrap(await handleMenuCreate(ec.db, {
 				name: args.name,
 				label: args.label,
@@ -1350,7 +1463,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuUpdate } = await import("../../../menus-Cfivc2Ad.mjs").then((n) => n.d);
+			const { handleMenuUpdate } = await import("../../../menus-CZyG6rvx.mjs").then((n) => n.d);
 			return unwrap(await handleMenuUpdate(ec.db, args.name, {
 				label: args.label,
 				locale: args.locale
@@ -1372,7 +1485,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuDelete } = await import("../../../menus-Cfivc2Ad.mjs").then((n) => n.d);
+			const { handleMenuDelete } = await import("../../../menus-CZyG6rvx.mjs").then((n) => n.d);
 			return unwrap(await handleMenuDelete(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_DELETE_ERROR");
@@ -1407,7 +1520,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuSetItems } = await import("../../../menus-Cfivc2Ad.mjs").then((n) => n.d);
+			const { handleMenuSetItems } = await import("../../../menus-CZyG6rvx.mjs").then((n) => n.d);
 			return unwrap(await handleMenuSetItems(ec.db, args.name, args.items, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_SET_ITEMS_ERROR");
@@ -1454,7 +1567,7 @@ function createMcpServer() {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleSettingsGet } = await import("../../../settings-rZyHEcNT.mjs").then((n) => n.r);
+			const { handleSettingsGet } = await import("../../../settings-C4s8hFQm.mjs").then((n) => n.r);
 			return unwrap(await handleSettingsGet(ec.db, ec.storage));
 		} catch (error) {
 			return respondHandlerError(error, "SETTINGS_READ_ERROR");
@@ -1480,7 +1593,7 @@ function createMcpServer() {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { handleSettingsUpdate } = await import("../../../settings-rZyHEcNT.mjs").then((n) => n.r);
+			const { handleSettingsUpdate } = await import("../../../settings-C4s8hFQm.mjs").then((n) => n.r);
 			return unwrap(await handleSettingsUpdate(ec.db, ec.storage, args));
 		} catch (error) {
 			return respondHandlerError(error, "SETTINGS_UPDATE_ERROR");
@@ -1508,7 +1621,7 @@ const POST = async ({ request, locals }) => {
 	const { emdash, user } = locals;
 	if (!emdash) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
-	const server = createMcpServer();
+	const server = createMcpServer(await emdash.getEnabledPluginMcpTools(), request);
 	try {
 		const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
 		await server.connect(transport);