emdash 0.30.0 → 0.31.1

package/src/api/handlers/content.ts

@@ -30,7 +30,7 @@ import { UserRepository } from "../../database/repositories/user.js";
 import { withTransaction } from "../../database/transaction.js";
 import type { Database } from "../../database/types.js";
 import { validateIdentifier } from "../../database/validate.js";
-import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
+import { getI18nConfig, isI18nEnabled, resolveConfiguredLocale } from "../../i18n/config.js";
 import { invalidateRedirectCache } from "../../redirects/cache.js";
 import { FTSManager } from "../../search/fts-manager.js";
 import { invalidateTermCache } from "../../taxonomies/index.js";
@@ -269,7 +269,11 @@ async function resolveId(
 	identifier: string,
 	locale?: string,
 ): Promise<string | null> {
-	const item = await repo.findByIdOrSlug(collection, identifier, locale);
+	const item = await repo.findByIdOrSlug(
+		collection,
+		identifier,
+		locale ? resolveConfiguredLocale(locale) : undefined,
+	);
 	return item?.id ?? null;
 }
 
@@ -283,7 +287,11 @@ async function resolveIdIncludingTrashed(
 	identifier: string,
 	locale?: string,
 ): Promise<string | null> {
-	const item = await repo.findByIdOrSlugIncludingTrashed(collection, identifier, locale);
+	const item = await repo.findByIdOrSlugIncludingTrashed(
+		collection,
+		identifier,
+		locale ? resolveConfiguredLocale(locale) : undefined,
+	);
 	return item?.id ?? null;
 }
 
@@ -427,7 +435,7 @@ export async function handleContentList(
 		const repo = new ContentRepository(db);
 		const where: FindManyOptions["where"] = {};
 		if (params.status) where.status = params.status;
-		if (params.locale) where.locale = params.locale;
+		if (params.locale) where.locale = resolveConfiguredLocale(params.locale);
 		if (params.authorId) where.authorId = params.authorId;
 
 		// A date range requires a target column; ignore stray from/to without
@@ -579,7 +587,11 @@ export async function handleContentGet(
 ): Promise<ApiResult<ContentResponse>> {
 	try {
 		const repo = new ContentRepository(db);
-		const item = await repo.findByIdOrSlug(collection, id, locale);
+		const item = await repo.findByIdOrSlug(
+			collection,
+			id,
+			locale ? resolveConfiguredLocale(locale) : undefined,
+		);
 
 		if (!item) {
 			return {
@@ -624,7 +636,11 @@ export async function handleContentGetIncludingTrashed(
 ): Promise<ApiResult<ContentResponse>> {
 	try {
 		const repo = new ContentRepository(db);
-		const item = await repo.findByIdOrSlugIncludingTrashed(collection, id, locale);
+		const item = await repo.findByIdOrSlugIncludingTrashed(
+			collection,
+			id,
+			locale ? resolveConfiguredLocale(locale) : undefined,
+		);
 
 		if (!item) {
 			return {
@@ -706,7 +722,9 @@ export async function handleContentCreate(
 			// Default to the configured site locale rather than the repo's
 			// hard-coded "en" — otherwise non-English default-locale sites
 			// silently create entries in a locale the editor never chose.
-			const effectiveLocale = body.locale ?? getI18nConfig()?.defaultLocale;
+			const effectiveLocale = body.locale
+				? resolveConfiguredLocale(body.locale)
+				: getI18nConfig()?.defaultLocale;
 
 			let slug: string | null | undefined = body.slug;
 			if (!slug) {

package/src/api/handlers/menus.ts

@@ -25,7 +25,7 @@ import {
 	type UpdateMenuItemInput as UpdateMenuItemRepoInput,
 } from "../../database/repositories/menu.js";
 import type { Database } from "../../database/types.js";
-import { getI18nConfig } from "../../i18n/config.js";
+import { getI18nConfig, resolveConfiguredLocale } from "../../i18n/config.js";
 import type { ApiResult } from "../types.js";
 
 // Re-export entity types so route files and tests can import them from the
@@ -89,7 +89,8 @@ async function resolveMenu(
 	name: string,
 	options: { locale?: string },
 ): Promise<ResolveMenuResult> {
-	const matches = await repo.findByName(name, options);
+	const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
+	const matches = await repo.findByName(name, { locale });
 	if (matches.length === 0) {
 		return {
 			success: false,
@@ -124,7 +125,8 @@ export async function handleMenuList(
 ): Promise<ApiResult<MenuListItem[]>> {
 	try {
 		const repo = new MenuRepository(db);
-		const items = await repo.findMany(options);
+		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
+		const items = await repo.findMany({ locale });
 		return { success: true, data: items };
 	} catch {
 		return {
@@ -175,7 +177,9 @@ export async function handleMenuCreate(
 
 		// Duplicate guard: same (name, locale). Falls back to the configured
 		// defaultLocale to match the column DEFAULT set by migration 036.
-		const effectiveLocale = input.locale ?? getI18nConfig()?.defaultLocale ?? "en";
+		const effectiveLocale = input.locale
+			? resolveConfiguredLocale(input.locale)
+			: (getI18nConfig()?.defaultLocale ?? "en");
 		if (await repo.existsByNameAndLocale(input.name, effectiveLocale)) {
 			return {
 				success: false,
@@ -188,7 +192,7 @@ export async function handleMenuCreate(
 			};
 		}
 
-		const menu = await repo.create(input);
+		const menu = await repo.create({ ...input, locale: effectiveLocale });
 		return { success: true, data: menu };
 	} catch {
 		return {
@@ -212,7 +216,8 @@ export async function handleMenuGet(
 ): Promise<ApiResult<MenuWithItems>> {
 	try {
 		const repo = new MenuRepository(db);
-		const matches = await repo.findByName(name, options);
+		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
+		const matches = await repo.findByName(name, { locale });
 		if (matches.length === 0) {
 			return {
 				success: false,

package/src/api/handlers/relations.ts

@@ -10,6 +10,7 @@ import {
 import { InvalidCursorError } from "../../database/repositories/types.js";
 import type { ContentItem } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
+import { resolveConfiguredLocale } from "../../i18n/config.js";
 import { SchemaRegistry } from "../../schema/registry.js";
 import type { ApiResult } from "../types.js";
 
@@ -70,7 +71,10 @@ export async function handleRelationCreate(
 			}
 		}
 
-		const relation = await repo.create(input);
+		const relation = await repo.create({
+			...input,
+			locale: input.locale ? resolveConfiguredLocale(input.locale) : undefined,
+		});
 		return { success: true, data: { relation } };
 	} catch (error) {
 		// A bad `translationOf` makes the repo throw loudly rather than mint an
@@ -127,7 +131,8 @@ export async function handleRelationList(
 ): Promise<ApiResult<{ relations: Relation[] }>> {
 	try {
 		const repo = new RelationRepository(db);
-		const relations = await repo.list(opts.locale);
+		const locale = opts.locale ? resolveConfiguredLocale(opts.locale) : undefined;
+		const relations = await repo.list(locale);
 		return { success: true, data: { relations } };
 	} catch {
 		return {

package/src/api/handlers/taxonomies.ts

@@ -12,6 +12,7 @@ import { ulid } from "ulidx";
 
 import { TaxonomyRepository } from "../../database/repositories/taxonomy.js";
 import type { Database, TaxonomyDefTable } from "../../database/types.js";
+import { resolveConfiguredLocale } from "../../i18n/config.js";
 import { invalidateTaxonomyDefsCache, invalidateTermCache } from "../../taxonomies/index.js";
 import { fetchVisibleTermCounts } from "../../taxonomies/term-counts.js";
 import type { ApiResult } from "../types.js";
@@ -174,8 +175,9 @@ export async function handleTaxonomyList(
 	options: { locale?: string } = {},
 ): Promise<ApiResult<TaxonomyListResponse>> {
 	try {
+		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
 		let query = db.selectFrom("_emdash_taxonomy_defs").selectAll();
-		if (options.locale !== undefined) query = query.where("locale", "=", options.locale);
+		if (locale !== undefined) query = query.where("locale", "=", locale);
 		const [rows, collectionRows] = await Promise.all([
 			query.execute(),
 			db.selectFrom("_emdash_collections").select("slug").execute(),
@@ -216,6 +218,7 @@ export async function handleTaxonomyCreate(
 	},
 ): Promise<ApiResult<{ taxonomy: TaxonomyDef }>> {
 	try {
+		const locale = input.locale ? resolveConfiguredLocale(input.locale) : undefined;
 		if (!NAME_PATTERN.test(input.name)) {
 			return {
 				success: false,
@@ -265,19 +268,19 @@ export async function handleTaxonomyCreate(
 
 		// Duplicate guard scoped to locale (so the same name can exist in ES
 		// and EN).
-		if (input.locale !== undefined) {
+		if (locale !== undefined) {
 			const existing = await db
 				.selectFrom("_emdash_taxonomy_defs")
 				.select("id")
 				.where("name", "=", input.name)
-				.where("locale", "=", input.locale)
+				.where("locale", "=", locale)
 				.executeTakeFirst();
 			if (existing) {
 				return {
 					success: false,
 					error: {
 						code: "CONFLICT",
-						message: `Taxonomy '${input.name}' already exists in locale '${input.locale}'`,
+						message: `Taxonomy '${input.name}' already exists in locale '${locale}'`,
 					},
 				};
 			}
@@ -293,7 +296,7 @@ export async function handleTaxonomyCreate(
 				label_singular: input.labelSingular ?? null,
 				hierarchical: input.hierarchical ? 1 : 0,
 				collections: JSON.stringify(collections),
-				...(input.locale !== undefined ? { locale: input.locale } : {}),
+				...(locale !== undefined ? { locale } : {}),
 				translation_group: translationGroup ?? id,
 			})
 			.execute();
@@ -390,7 +393,8 @@ export async function handleTermList(
 		if (!lookup.success) return lookup;
 
 		const repo = new TaxonomyRepository(db);
-		const terms = await repo.findByName(taxonomyName, { locale: options.locale });
+		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
+		const terms = await repo.findByName(taxonomyName, { locale });
 
 		// Counts match what visitors see on the public site: published (or
 		// scheduled-and-due) entries that aren't soft-deleted, scoped to the
@@ -535,6 +539,7 @@ export async function handleTermCreate(
 	},
 ): Promise<ApiResult<TermResponse>> {
 	try {
+		const locale = input.locale ? resolveConfiguredLocale(input.locale) : undefined;
 		// Taxonomy definitions are per-locale, but terms can exist in any locale
 		// regardless of whether the def has been translated there. Look up the
 		// def across all locales — we only care that it *exists*.
@@ -548,14 +553,14 @@ export async function handleTermCreate(
 			input.parentId === "" || input.parentId === undefined ? undefined : input.parentId;
 
 		// Conflict check is scoped to locale (per-locale slugs are unique).
-		const existing = await repo.findBySlug(taxonomyName, input.slug, input.locale);
+		const existing = await repo.findBySlug(taxonomyName, input.slug, locale);
 		if (existing) {
 			return {
 				success: false,
 				error: {
 					code: "CONFLICT",
-					message: input.locale
-						? `Term '${input.slug}' already exists in '${taxonomyName}' (${input.locale})`
+					message: locale
+						? `Term '${input.slug}' already exists in '${taxonomyName}' (${locale})`
 						: `Term with slug '${input.slug}' already exists in taxonomy '${taxonomyName}'`,
 				},
 			};
@@ -594,7 +599,7 @@ export async function handleTermCreate(
 			label: input.label,
 			parentId: parentId ?? undefined,
 			data: input.description ? { description: input.description } : undefined,
-			locale: input.locale,
+			locale,
 			translationOf: input.translationOf,
 		});
 
@@ -635,7 +640,8 @@ export async function handleTermGet(
 ): Promise<ApiResult<TermGetResponse>> {
 	try {
 		const repo = new TaxonomyRepository(db);
-		const term = await repo.findBySlug(taxonomyName, termSlug, options.locale);
+		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
+		const term = await repo.findBySlug(taxonomyName, termSlug, locale);
 
 		if (!term) {
 			return {
@@ -743,7 +749,8 @@ export async function handleTermUpdate(
 ): Promise<ApiResult<TermResponse>> {
 	try {
 		const repo = new TaxonomyRepository(db);
-		const term = await repo.findBySlug(taxonomyName, termSlug, options.locale);
+		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
+		const term = await repo.findBySlug(taxonomyName, termSlug, locale);
 
 		if (!term) {
 			return {
@@ -763,7 +770,7 @@ export async function handleTermUpdate(
 
 		// Check if new slug conflicts (per-locale uniqueness).
 		if (newSlug !== undefined && newSlug !== termSlug) {
-			const existing = await repo.findBySlug(taxonomyName, newSlug, options.locale);
+			const existing = await repo.findBySlug(taxonomyName, newSlug, locale);
 			if (existing && existing.id !== term.id) {
 				return {
 					success: false,
@@ -832,7 +839,8 @@ export async function handleTermDelete(
 ): Promise<ApiResult<{ deleted: true }>> {
 	try {
 		const repo = new TaxonomyRepository(db);
-		const term = await repo.findBySlug(taxonomyName, termSlug, options.locale);
+		const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
+		const term = await repo.findBySlug(taxonomyName, termSlug, locale);
 
 		if (!term) {
 			return {

package/src/api/schemas/bylines.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { cursorPaginationQuery, httpUrl } from "./common.js";
+import { cursorPaginationQuery, httpUrl, localeCode } from "./common.js";
 
 /** Slug pattern: lowercase letters, digits, and hyphens; must start with a letter */
 const bylineSlugPattern = /^[a-z][a-z0-9-]*$/;
@@ -81,7 +81,7 @@ export const bylinesListQuery = cursorPaginationQuery
 		 * Rejects empty strings so the picker can't silently fetch the
 		 * unfiltered list when the admin URL has `?locale=` with no value.
 		 */
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 	})
 	.meta({ id: "BylinesListQuery" });
 
@@ -102,7 +102,7 @@ export const bylineCreateBody = z
 		 * configured `defaultLocale`) is used. Rejects empty strings — an
 		 * empty locale would create rows no resolver requests.
 		 */
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 		/**
 		 * When set, the new row joins the source byline's translation_group
 		 * rather than minting a fresh one. Requires `locale`.
@@ -126,7 +126,7 @@ export const bylineCreateBody = z
 
 export const bylineTranslationCreateBody = z
 	.object({
-		locale: z.string().min(1),
+		locale: localeCode,
 		slug: z
 			.string()
 			.min(1)

package/src/api/schemas/common.ts

@@ -53,16 +53,17 @@ export const httpUrl = z
 	.url()
 	.refine((url) => HTTP_SCHEME_RE.test(url), "URL must use http or https");
 
-/** BCP 47 locale code — language with optional script/region subtags (e.g. en, en-US, pt-BR, es-419, zh-Hant) */
-export const localeCode = z
-	.string()
-	.regex(/^[a-z]{2,3}(-[a-z0-9]{2,8})*$/i, "Invalid locale code")
-	.transform((v) => v.toLowerCase());
+/**
+ * BCP 47 locale code — language with optional script/region subtags (e.g. en, en-US, pt-BR, es-419, zh-Hant).
+ * Validation is case-insensitive, but the value is preserved verbatim because the site config, stored
+ * `locale` columns, and public query path all keep the raw BCP-47 casing.
+ */
+export const localeCode = z.string().regex(/^[a-z]{2,3}(-[a-z0-9]{2,8})*$/i, "Invalid locale code");
 
 /** Shared `?locale=xx` query shape for endpoints that filter by locale. */
 export const localeFilterQuery = z
 	.object({
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 	})
 	.meta({ id: "LocaleFilterQuery" });
 

package/src/api/schemas/menus.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { isSafeHref } from "../../utils/url.js";
+import { localeCode } from "./common.js";
 
 // ---------------------------------------------------------------------------
 // Menus: Input schemas
@@ -24,7 +25,7 @@ export const createMenuBody = z
 	.object({
 		name: z.string().min(1),
 		label: z.string().min(1),
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 		/** When set, clones the items from the source menu. The new menu joins
 		 * the source's translation_group. */
 		translationOf: z.string().min(1).optional(),

package/src/api/schemas/relations.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 
+import { localeCode } from "./common.js";
+
 const slugPattern = /^[a-z][a-z0-9_]*$/;
 const collectionSlug = z
 	.string()
@@ -18,7 +20,7 @@ export const createRelationBody = z
 		childCollection: collectionSlug.optional(),
 		parentLabel: z.string().min(1).max(200),
 		childLabel: z.string().min(1).max(200),
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 		translationOf: z.string().min(1).optional(),
 	})
 	// A translation inherits its structural fields (name, parentCollection,

package/src/api/schemas/taxonomies.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 
+import { localeCode } from "./common.js";
+
 // ---------------------------------------------------------------------------
 // Taxonomy definitions: Input schemas
 // ---------------------------------------------------------------------------
@@ -24,7 +26,7 @@ export const createTaxonomyDefBody = z
 			.max(100)
 			.optional()
 			.default([]),
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 		translationOf: z.string().min(1).optional(),
 	})
 	.meta({ id: "CreateTaxonomyDefBody" });
@@ -39,7 +41,7 @@ export const createTermBody = z
 		label: z.string().min(1),
 		parentId: z.string().nullish(),
 		description: z.string().optional(),
-		locale: z.string().min(1).optional(),
+		locale: localeCode.optional(),
 		translationOf: z.string().min(1).optional(),
 	})
 	.meta({ id: "CreateTermBody" });

package/src/astro/prefetch.ts

@@ -40,10 +40,15 @@ async function prefetchWidgetAreas(): Promise<void> {
 	}
 }
 
-/** Warm every taxonomy's term list via the real helper (primes per-name keys). */
+/**
+ * Warm every taxonomy's term list via the real helper (primes per-name keys).
+ * Counts are left out: they cost an aggregate over the whole assignment pivot
+ * per taxonomy, and only a consumer that renders one can say it's needed. A
+ * consumer that does asks for it and reuses the term list warmed here.
+ */
 async function prefetchTaxonomyTerms(): Promise<void> {
 	const defs = await getTaxonomyDefs();
-	await Promise.allSettled(defs.map((def) => getTaxonomyTerms(def.name)));
+	await Promise.allSettled(defs.map((def) => getTaxonomyTerms(def.name, { includeCounts: false })));
 }
 
 /** Warm every menu via the real helper (primes `menu:${name}:${locale}`). */

package/src/astro/routes/api/admin/bylines/index.ts

@@ -8,7 +8,7 @@ import { bylineCreateBody, bylinesListQuery } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
-import { getI18nConfig } from "../../../../../i18n/config.js";
+import { getI18nConfig, resolveConfiguredLocale } from "../../../../../i18n/config.js";
 
 export const prerender = false;
 
@@ -25,13 +25,10 @@ export const GET: APIRoute = async ({ url, locals }) => {
 	const query = parseQuery(url, bylinesListQuery);
 	if (isParseError(query)) return query;
 
+	const locale = query.locale ? resolveConfiguredLocale(query.locale) : undefined;
 	const i18n = getI18nConfig();
-	if (query.locale && i18n && !i18n.locales.includes(query.locale)) {
-		return apiError(
-			"VALIDATION_ERROR",
-			`Locale "${query.locale}" is not configured for this site`,
-			400,
-		);
+	if (locale && i18n && !i18n.locales.includes(locale)) {
+		return apiError("VALIDATION_ERROR", `Locale "${locale}" is not configured for this site`, 400);
 	}
 
 	try {
@@ -40,7 +37,7 @@ export const GET: APIRoute = async ({ url, locals }) => {
 			search: query.search,
 			isGuest: query.isGuest,
 			userId: query.userId,
-			locale: query.locale,
+			locale,
 			cursor: query.cursor,
 			limit: query.limit,
 		});

package/src/astro/routes/api/oauth/authorize.ts

@@ -69,11 +69,16 @@ function getCsrfCookie(request: Request): string | null {
 
 const SCOPE_LABELS: Record<string, string> = {
 	"content:read": "Read content (posts, pages, etc.)",
-	"content:write": "Create, edit, and delete content",
+	"content:write": "Create, edit, and delete content; manage menus and taxonomies",
 	"media:read": "View media files",
 	"media:write": "Upload and manage media files",
 	"schema:read": "View collection schemas",
 	"schema:write": "Create and modify collection schemas",
+	"taxonomies:manage": "Manage taxonomies",
+	"menus:manage": "Manage navigation menus",
+	"settings:read": "View site settings",
+	"settings:manage": "Modify site settings",
+	"mcp:tools": "Use MCP tools from all enabled plugins",
 	admin: "Full administrative access",
 };
 
@@ -141,7 +146,9 @@ export const GET: APIRoute = async ({ url, request, locals }) => {
 	}
 
 	// Parse and validate scopes
-	const requestedScopes = (scope ?? "").split(" ").filter(Boolean).filter(isValidScope);
+	const requestedScopes = [
+		...new Set((scope ?? "").split(" ").filter(Boolean).filter(isValidScope)),
+	];
 
 	if (requestedScopes.length === 0) {
 		return new Response(renderErrorPage("No valid scopes requested."), {
@@ -201,6 +208,21 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const v = formData.get(name);
 		return typeof v === "string" ? v : fallback;
 	};
+	const requestedScopes = new Set(
+		(new URL(request.url).searchParams.get("scope") ?? "")
+			.split(" ")
+			.filter(Boolean)
+			.filter(isValidScope),
+	);
+	const selectedScopes = [
+		...new Set(
+			formData
+				.getAll("scope")
+				.filter((value): value is string => typeof value === "string")
+				.filter(isValidScope)
+				.filter((scope) => requestedScopes.has(scope)),
+		),
+	];
 
 	// SEC-18: Validate CSRF token (double-submit cookie pattern).
 	// The form includes a hidden csrf_token field; the cookie has the same value.
@@ -285,7 +307,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		response_type: field("response_type", "code"),
 		client_id: field("client_id"),
 		redirect_uri: redirectUri,
-		scope: field("scope"),
+		scope: selectedScopes.join(" "),
 		state,
 		code_challenge: field("code_challenge"),
 		code_challenge_method: field("code_challenge_method", "S256"),
@@ -294,12 +316,16 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 	if (!result.success) {
 		const errMsg = result.error?.message ?? "Authorization failed";
+		const invalidScope = result.error?.code === "INVALID_SCOPE";
 		// On error, redirect back with error params — use generic description to avoid
 		// leaking internal error details to the (already-validated) redirect target
 		try {
 			const errorUrl = new URL(redirectUri);
-			errorUrl.searchParams.set("error", "server_error");
-			errorUrl.searchParams.set("error_description", "Authorization failed");
+			errorUrl.searchParams.set("error", invalidScope ? "invalid_scope" : "server_error");
+			errorUrl.searchParams.set(
+				"error_description",
+				invalidScope ? "No selected permission can be granted" : "Authorization failed",
+			);
 			if (state) errorUrl.searchParams.set("state", state);
 			return Response.redirect(errorUrl.toString(), 302);
 		} catch {
@@ -331,8 +357,8 @@ function renderConsentPage(params: {
 }): string {
 	const scopeList = params.scopes
 		.map((s) => {
-			const label = SCOPE_LABELS[s] ?? s;
-			return `<li>${escapeHtml(label)}</li>`;
+			const label = SCOPE_LABELS[s] ?? getPluginScopeLabel(s) ?? s;
+			return `<li><label><input type="checkbox" name="scope" value="${escapeHtml(s)}" checked><span>${escapeHtml(label)}</span></label></li>`;
 		})
 		.join("\n");
 
@@ -353,6 +379,8 @@ function renderConsentPage(params: {
   ul { list-style: none; margin-bottom: 1.5rem; }
   li { padding: 0.5rem 0; border-bottom: 1px solid #262626; font-size: 0.875rem; }
   li:last-child { border-bottom: none; }
+  label { display: flex; align-items: flex-start; gap: 0.625rem; cursor: pointer; }
+  input[type="checkbox"] { margin-top: 0.125rem; accent-color: #2563eb; }
   .actions { display: flex; gap: 0.75rem; }
   button { flex: 1; padding: 0.625rem 1rem; border-radius: 8px; border: none; font-size: 0.875rem; font-weight: 500; cursor: pointer; }
   .approve { background: #2563eb; color: white; }
@@ -366,14 +394,13 @@ function renderConsentPage(params: {
   <h1>Authorize Application</h1>
   <p class="client-id">${escapeHtml(params.clientId)}</p>
   <p class="user">Signed in as <strong>${escapeHtml(params.userName)}</strong></p>
-  <h2>Permissions requested</h2>
-  <ul>${scopeList}</ul>
   <form method="POST">
+    <h2>Permissions requested</h2>
+    <ul>${scopeList}</ul>
     <input type="hidden" name="csrf_token" value="${escapeHtml(params.csrfToken)}">
     <input type="hidden" name="response_type" value="${escapeHtml(params.responseType)}">
     <input type="hidden" name="client_id" value="${escapeHtml(params.clientId)}">
     <input type="hidden" name="redirect_uri" value="${escapeHtml(params.redirectUri)}">
-    <input type="hidden" name="scope" value="${escapeHtml(params.scopes.join(" "))}">
     <input type="hidden" name="state" value="${escapeHtml(params.state)}">
     <input type="hidden" name="code_challenge" value="${escapeHtml(params.codeChallenge)}">
     <input type="hidden" name="code_challenge_method" value="${escapeHtml(params.codeChallengeMethod)}">
@@ -388,6 +415,11 @@ function renderConsentPage(params: {
 </html>`;
 }
 
+function getPluginScopeLabel(scope: string): string | null {
+	const pluginId = scope.startsWith("mcp:tools:") ? scope.slice("mcp:tools:".length) : "";
+	return pluginId ? `Use MCP tools from ${pluginId}` : null;
+}
+
 function renderErrorPage(message: string): string {
 	return `<!DOCTYPE html>
 <html lang="en">