emdash 0.32.0 → 0.34.0

package/dist/astro/routes/api/mcp.mjs

@@ -1,13 +1,14 @@
-import "../../../base64-B-PsqheR.mjs";
-import "../../../types-XrQQ-Aex.mjs";
-import { t as apiError } from "../../../error-DmmN74gW.mjs";
-import { t as CONTENT_TYPE_RE } from "../../../media-DWIzoVFL.mjs";
-import { Qt as contentSeoInput, hn as contentBylineInputSchema, pn as bylineUpdateBody, sn as bylineCreateBody } from "../../../redirects-BOn2DIUs.mjs";
-import "../../../relations-C4duJnwI.mjs";
-import "../../../status-COfycGIU.mjs";
+import "../../../config-C3EBstHi.mjs";
+import { i as encodeBase64, t as decodeBase64 } from "../../../base64-CvLhUKQv.mjs";
+import { i as InvalidCursorError, o as decodeCursor } from "../../../types-CQPWhPxE.mjs";
+import { t as apiError } from "../../../error-DupyJZE2.mjs";
+import { t as CONTENT_TYPE_RE } from "../../../media-BWWWb8kg.mjs";
+import { Gt as updateFieldBody, Pt as createCollectionBody, Wt as updateCollectionBody, in as contentSeoInput, pn as bylineCreateBody, xn as contentBylineInputSchema, yn as bylineUpdateBody } from "../../../redirects-cV9g7V-0.mjs";
+import "../../../relations-BBApI4e2.mjs";
+import "../../../status-CWVYpbD8.mjs";
 import "../../../api/schemas/index.mjs";
-import { i as hasScope$1 } from "../../../api-tokens-CEsW_jCg.mjs";
-import { n as convertDataForWrite, t as convertDataForRead } from "../../../portable-text-CNahFfj6.mjs";
+import { i as hasScope$1 } from "../../../api-tokens-CyTsLszZ.mjs";
+import { n as convertDataForWrite, t as convertDataForRead } from "../../../portable-text-DhKbDAGr.mjs";
 import { z } from "zod";
 import { Permissions, Role, canActOnOwn, hasPermission } from "@emdash-cms/auth";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
@@ -17,6 +18,8 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 const COLLECTION_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
 /** http(s) scheme matcher used by `settings_update` URL validation. */
 const HTTP_SCHEME_PATTERN = /^https?:\/\//i;
+const TAXONOMY_CURSOR_VERSION = 2;
+const MAX_TAXONOMY_CURSOR_LENGTH = 2048;
 const settingsMediaReferenceSchema = z.object({
 	mediaId: z.string().describe("Media item ID (use media_create or media_list)"),
 	alt: z.string().optional().describe("Alt text for the media reference")
@@ -51,6 +54,64 @@ const mediaUsageRepairToolSchema = z.object({
 		message: "Collection must be omitted when scope is all"
 	});
 });
+const schemaUpdateCollectionToolSchema = z.object({
+	slug: z.string().min(1).max(63).regex(COLLECTION_SLUG_PATTERN, "Invalid collection slug").describe("Collection slug to update; the slug itself cannot be changed"),
+	label: updateCollectionBody.shape.label.describe("New plural display name"),
+	labelSingular: updateCollectionBody.shape.labelSingular.describe("New singular display name"),
+	description: updateCollectionBody.shape.description.describe("New collection description"),
+	icon: updateCollectionBody.shape.icon.describe("New admin UI icon name"),
+	supports: updateCollectionBody.shape.supports.describe("Complete feature list to enable; omit to preserve the current list"),
+	urlPattern: updateCollectionBody.shape.urlPattern.describe("New public URL pattern; pass null to clear it"),
+	routable: updateCollectionBody.shape.routable.describe("Whether entries require a slug before they can be published"),
+	hasSeo: updateCollectionBody.shape.hasSeo.describe("Whether the collection supports SEO metadata"),
+	commentsEnabled: updateCollectionBody.shape.commentsEnabled.describe("Whether comments are enabled for this collection"),
+	commentsModeration: updateCollectionBody.shape.commentsModeration.describe("Comment moderation policy"),
+	commentsClosedAfterDays: updateCollectionBody.shape.commentsClosedAfterDays.describe("Close comments after this many days; 0 keeps them open"),
+	commentsAutoApproveUsers: updateCollectionBody.shape.commentsAutoApproveUsers.describe("Whether comments from authenticated users are automatically approved")
+});
+const schemaUpdateFieldToolSchema = z.object({
+	collection: z.string().min(1).max(63).regex(COLLECTION_SLUG_PATTERN, "Invalid collection slug").describe("Collection slug containing the field"),
+	fieldSlug: z.string().min(1).max(63).regex(COLLECTION_SLUG_PATTERN, "Invalid field slug").describe("Field slug to update; the slug itself cannot be changed"),
+	label: updateFieldBody.shape.label.describe("New display name"),
+	type: updateFieldBody.shape.type.describe("New field type; only string, text, and slug aliases can be changed in place"),
+	required: updateFieldBody.shape.required.describe("Whether the field is required; changing this requires a manual content migration"),
+	unique: updateFieldBody.shape.unique.describe("Whether field values must be unique; changing this requires a manual content migration"),
+	defaultValue: updateFieldBody.shape.defaultValue.describe("Default value for new content"),
+	validation: updateFieldBody.shape.validation.describe("Validation constraints; pass null to clear existing constraints"),
+	widget: updateFieldBody.shape.widget.describe("Admin editor widget name"),
+	options: updateFieldBody.shape.options.describe("Widget configuration"),
+	sortOrder: updateFieldBody.shape.sortOrder.describe("Field order in the content editor"),
+	searchable: updateFieldBody.shape.searchable.describe("Whether full-text search indexes the field"),
+	translatable: updateFieldBody.shape.translatable.describe("Whether values vary by locale; changing to false requires a manual content migration"),
+	indexed: updateFieldBody.shape.indexed.describe("Create or remove a physical index for structured sorting")
+});
+function encodeTaxonomyCursor(term) {
+	const cursor = encodeBase64(JSON.stringify({
+		v: TAXONOMY_CURSOR_VERSION,
+		id: term.id
+	}));
+	if (cursor.length > MAX_TAXONOMY_CURSOR_LENGTH) throw new InvalidCursorError(cursor);
+	return cursor;
+}
+function decodeTaxonomyCursor(cursor) {
+	if (!cursor || cursor.length > MAX_TAXONOMY_CURSOR_LENGTH) throw new InvalidCursorError(cursor);
+	let parsed;
+	try {
+		parsed = JSON.parse(decodeBase64(cursor));
+	} catch {
+		throw new InvalidCursorError(cursor);
+	}
+	if (parsed === null || typeof parsed !== "object") throw new InvalidCursorError(cursor);
+	const candidate = parsed;
+	if ("v" in candidate) {
+		const { v, id } = candidate;
+		if (v !== TAXONOMY_CURSOR_VERSION || typeof id !== "string" || id.length === 0 || id.includes("\0")) throw new InvalidCursorError(cursor);
+		return { id };
+	}
+	const legacy = decodeCursor(cursor);
+	if (legacy.orderValue.includes("\0") || legacy.id.length === 0 || legacy.id.includes("\0")) throw new InvalidCursorError(cursor);
+	return { id: legacy.id };
+}
 /**
 * Return a successful tool response with the data as pretty-printed JSON.
 */
@@ -173,7 +234,7 @@ function getEmDash(extra) {
 }
 async function getCollectionFields(ec, collection) {
 	try {
-		const { SchemaRegistry } = await import("../../../schema-eqZhkR0S.mjs").then((n) => n.t);
+		const { SchemaRegistry } = await import("../../../schema-BFyTg38T.mjs").then((n) => n.t);
 		const col = await new SchemaRegistry(ec.db).getCollectionWithFields(collection);
 		return col ? col.fields : null;
 	} catch {
@@ -202,7 +263,7 @@ async function applyReadMarkdown(ec, collection, items) {
 	for (const item of items) if (item.data && typeof item.data === "object") item.data = convertDataForRead(item.data, fields, false);
 }
 async function invalidateBylines() {
-	const { invalidateBylineCache } = await import("../../../bylines-B8-WGdja.mjs").then((n) => n.t);
+	const { invalidateBylineCache } = await import("../../../bylines-BWemdX2k.mjs").then((n) => n.t);
 	invalidateBylineCache();
 }
 /**
@@ -316,7 +377,7 @@ function createMcpServer(pluginTools = [], request) {
 				throw new EmDashAuthError(`Insufficient permission: requires ${tool.permission}`, "INSUFFICIENT_PERMISSIONS");
 			}
 			if (!request) return respondError("INTERNAL_ERROR", "Missing MCP request context");
-			const result = await payload.emdash.handlePluginMcpTool(tool.pluginId, tool.name, tool.route, input, payload.userId, request);
+			const result = await payload.emdash.handlePluginMcpTool(tool.pluginId, tool.name, tool.route, input, payload.userId, request, payload.user);
 			if (!result.success) return unwrap(result);
 			if (tool.outputSchema) {
 				if (!result.data || typeof result.data !== "object" || Array.isArray(result.data)) return respondError("INVALID_PLUGIN_OUTPUT", "Plugin tool output must be an object when outputSchema is declared");
@@ -758,7 +819,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-C5TAqs8N.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-pEcoDps8.mjs").then((n) => n.n);
 			return jsonResult(await new BylineRepository(ec.db).findMany({
 				search: args.search,
 				isGuest: args.isGuest,
@@ -780,7 +841,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-C5TAqs8N.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-pEcoDps8.mjs").then((n) => n.n);
 			const byline = await new BylineRepository(ec.db).findById(args.id);
 			if (!byline) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 			return jsonResult(byline);
@@ -798,7 +859,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineCreate } = await import("../../../bylines-DGuqBLjV.mjs").then((n) => n.t);
+			const { handleBylineCreate } = await import("../../../bylines-DJfSfXCL.mjs").then((n) => n.t);
 			const result = await handleBylineCreate(ec.db, args);
 			if (result.success) await invalidateBylines();
 			return unwrap(result);
@@ -818,7 +879,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineUpdate } = await import("../../../bylines-DGuqBLjV.mjs").then((n) => n.t);
+			const { handleBylineUpdate } = await import("../../../bylines-DJfSfXCL.mjs").then((n) => n.t);
 			const { id, ...input } = args;
 			const result = await handleBylineUpdate(ec.db, id, input);
 			if (result.success) await invalidateBylines();
@@ -837,7 +898,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-C5TAqs8N.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-pEcoDps8.mjs").then((n) => n.n);
 			if (!await new BylineRepository(ec.db).delete(args.id)) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 			await invalidateBylines();
 			return jsonResult({ deleted: args.id });
@@ -854,7 +915,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineTranslations } = await import("../../../bylines-DGuqBLjV.mjs").then((n) => n.t);
+			const { handleBylineTranslations } = await import("../../../bylines-DJfSfXCL.mjs").then((n) => n.t);
 			return unwrap(await handleBylineTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "BYLINE_TRANSLATIONS_ERROR");
@@ -870,7 +931,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-eqZhkR0S.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BFyTg38T.mjs").then((n) => n.t);
 			return jsonResult({ items: await new SchemaRegistry(ec.db).listCollections() });
 		} catch (error) {
 			return respondHandlerError(error, "SCHEMA_LIST_ERROR");
@@ -886,7 +947,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-eqZhkR0S.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BFyTg38T.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).getCollectionWithFields(args.slug);
 			if (!collection) return respondError("NOT_FOUND", `Collection '${args.slug}' not found`);
 			return jsonResult(collection);
@@ -896,34 +957,30 @@ function createMcpServer(pluginTools = [], request) {
 	});
 	server.registerTool("schema_create_collection", {
 		title: "Create Collection",
-		description: "Create a new content collection (content type). This creates a database table and schema definition. The slug must be lowercase alphanumeric with underscores, starting with a letter. Supports: 'drafts' (draft/publish workflow), 'revisions' (version history), 'preview' (live preview), 'scheduling' (timed publish), 'search' (full-text indexing).",
+		description: "Create a new content collection (content type). This creates a database table and schema definition. The slug must be lowercase alphanumeric with underscores, starting with a letter. Supports: 'drafts' (draft/publish workflow), 'revisions' (version history), 'preview' (live preview), 'scheduling' (timed publish), 'search' (full-text indexing), and 'seo' (SEO metadata).",
 		inputSchema: z.object({
 			slug: z.string().regex(COLLECTION_SLUG_PATTERN).describe("Unique identifier (lowercase letters, numbers, underscores)"),
 			label: z.string().describe("Display name (plural, e.g. 'Blog Posts')"),
 			labelSingular: z.string().optional().describe("Singular display name (e.g. 'Blog Post')"),
 			description: z.string().optional().describe("Description of this collection"),
 			icon: z.string().optional().describe("Icon name for the admin UI"),
-			supports: z.array(z.enum([
-				"drafts",
-				"revisions",
-				"preview",
-				"scheduling",
-				"search"
-			])).optional().describe("Features to enable (default: ['drafts', 'revisions'])")
+			supports: createCollectionBody.shape.supports.describe("Features to enable (default: ['drafts', 'revisions'])"),
+			routable: createCollectionBody.shape.routable.describe("Require a slug before publishing (default: true)")
 		})
 	}, async (args, extra) => {
 		requireScope(extra, "schema:write");
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-eqZhkR0S.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BFyTg38T.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).createCollection({
 				slug: args.slug,
 				label: args.label,
 				labelSingular: args.labelSingular,
 				description: args.description,
 				icon: args.icon,
-				supports: args.supports
+				supports: args.supports,
+				routable: args.routable
 			});
 			ec.invalidateUrlPatternCache();
 			return jsonResult(collection);
@@ -944,7 +1001,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-eqZhkR0S.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BFyTg38T.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteCollection(args.slug, { force: args.force });
 			ec.invalidateUrlPatternCache();
 			return jsonResult({ deleted: args.slug });
@@ -952,6 +1009,25 @@ function createMcpServer(pluginTools = [], request) {
 			return respondHandlerError(error, "SCHEMA_DELETE_ERROR");
 		}
 	});
+	server.registerTool("schema_update_collection", {
+		title: "Update Collection",
+		description: "Update an existing collection without deleting its table, fields, or content. Only provided settings change; omitted settings keep their current values. The collection slug cannot be changed.",
+		inputSchema: schemaUpdateCollectionToolSchema,
+		annotations: { destructiveHint: false }
+	}, async (args, extra) => {
+		requireScope(extra, "schema:write");
+		requireRole(extra, Role.ADMIN);
+		const ec = getEmDash(extra);
+		const { slug, ...input } = args;
+		try {
+			const { handleSchemaCollectionUpdate } = await import("../../../schema-CeQSNwB3.mjs").then((n) => n.m);
+			const result = await handleSchemaCollectionUpdate(ec.db, slug, input);
+			if (result.success) ec.invalidateUrlPatternCache();
+			return unwrap(result);
+		} catch (error) {
+			return respondHandlerError(error, "SCHEMA_UPDATE_ERROR");
+		}
+	});
 	server.registerTool("schema_create_field", {
 		title: "Add Field to Collection",
 		description: "Add a new field to a collection's schema. This adds a column to the database table. Field types: string (short text), text (long text), number (decimal), integer, boolean, datetime, select (single choice), multiSelect (multiple), portableText (rich text), image, file, reference (link to another collection), json, slug (URL-safe id). For select/multiSelect, provide choices in validation.options array.",
@@ -991,6 +1067,7 @@ function createMcpServer(pluginTools = [], request) {
 				rows: z.number().optional().describe("Number of rows for textarea")
 			}).passthrough().optional().describe("Widget configuration"),
 			searchable: z.boolean().optional().describe("Include in full-text search index (default false)"),
+			indexed: z.boolean().optional().describe("Create a physical index for structured sorting"),
 			translatable: z.boolean().optional().describe("Whether this field is translatable (default true). Non-translatable fields are synced across all locales in a translation group.")
 		})
 	}, async (args, extra) => {
@@ -998,7 +1075,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-eqZhkR0S.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BFyTg38T.mjs").then((n) => n.t);
 			return jsonResult(await new SchemaRegistry(ec.db).createField(args.collection, {
 				slug: args.slug,
 				label: args.label,
@@ -1009,6 +1086,7 @@ function createMcpServer(pluginTools = [], request) {
 				validation: args.validation,
 				options: args.options,
 				searchable: args.searchable,
+				indexed: args.indexed,
 				translatable: args.translatable
 			}));
 		} catch (error) {
@@ -1028,7 +1106,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-eqZhkR0S.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-BFyTg38T.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteField(args.collection, args.fieldSlug);
 			return jsonResult({
 				deleted: args.fieldSlug,
@@ -1038,6 +1116,23 @@ function createMcpServer(pluginTools = [], request) {
 			return respondHandlerError(error, "FIELD_DELETE_ERROR");
 		}
 	});
+	server.registerTool("schema_update_field", {
+		title: "Update Field",
+		description: "Update an existing field without deleting its column or stored values. Only provided settings change; omitted settings keep their current values. Changes that require a content or column migration are rejected with migration guidance.",
+		inputSchema: schemaUpdateFieldToolSchema,
+		annotations: { destructiveHint: false }
+	}, async (args, extra) => {
+		requireScope(extra, "schema:write");
+		requireRole(extra, Role.ADMIN);
+		const ec = getEmDash(extra);
+		const { collection, fieldSlug, ...input } = args;
+		try {
+			const { handleSchemaFieldUpdate } = await import("../../../schema-CeQSNwB3.mjs").then((n) => n.m);
+			return unwrap(await handleSchemaFieldUpdate(ec.db, collection, fieldSlug, input));
+		} catch (error) {
+			return respondHandlerError(error, "SCHEMA_FIELD_UPDATE_ERROR");
+		}
+	});
 	server.registerTool("media_list", {
 		title: "List Media",
 		description: "List uploaded media files (images, documents, etc.) with optional MIME type filtering and pagination. Returns file metadata including filename, URL, dimensions, and alt text.",
@@ -1103,7 +1198,7 @@ function createMcpServer(pluginTools = [], request) {
 		const { emdash, userId } = getExtra(extra);
 		if (!emdash.storage) return respondError("NO_STORAGE", "Storage not configured");
 		try {
-			const { handleMediaUpload } = await import("../../../media-upload-Bc9Nc5Zf.mjs");
+			const { handleMediaUpload } = await import("../../../media-upload-9yas9zGH.mjs");
 			return unwrap(await handleMediaUpload(emdash.db, emdash.storage, {
 				filename: args.filename,
 				base64: args.base64,
@@ -1183,7 +1278,7 @@ function createMcpServer(pluginTools = [], request) {
 			};
 		} else input = { scope: "all" };
 		try {
-			const { handleMediaUsageRepair } = await import("../../../media-usage-DPJcNaAq.mjs").then((n) => n.i);
+			const { handleMediaUsageRepair } = await import("../../../media-usage-De3qvwjc.mjs").then((n) => n.i);
 			return unwrap(await handleMediaUsageRepair(ec.db, input));
 		} catch (error) {
 			return respondHandlerError(error, "MEDIA_USAGE_REPAIR_ERROR");
@@ -1204,7 +1299,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { searchWithDb } = await import("../../../search-CeO678cp.mjs").then((n) => n.t);
+			const { searchWithDb } = await import("../../../search-BpuPKZb0.mjs").then((n) => n.t);
 			return jsonResult(await searchWithDb(ec.db, args.query, {
 				collections: args.collections,
 				locale: args.locale,
@@ -1224,7 +1319,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-Dbdki3Un.mjs").then((n) => n.l);
+			const { handleTaxonomyList } = await import("../../../taxonomies-Dk3MAklL.mjs").then((n) => n.m);
 			return unwrap(await handleTaxonomyList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "TAXONOMY_LIST_ERROR");
@@ -1236,7 +1331,7 @@ function createMcpServer(pluginTools = [], request) {
 		inputSchema: z.object({
 			taxonomy: z.string().describe("Taxonomy name (e.g. 'categories', 'tags')"),
 			limit: z.number().int().min(1).max(100).optional().describe("Max items (default 50)"),
-			cursor: z.string().min(1).max(2048).optional().describe("Pagination cursor"),
+			cursor: z.string().min(1).max(MAX_TAXONOMY_CURSOR_LENGTH).optional().describe("Pagination cursor"),
 			locale: z.string().optional().describe("Filter by locale (omit for all)")
 		}),
 		annotations: { readOnlyHint: true }
@@ -1244,33 +1339,39 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-Dbdki3Un.mjs").then((n) => n.l);
+			const { handleTaxonomyList } = await import("../../../taxonomies-Dk3MAklL.mjs").then((n) => n.m);
 			const listResult = await handleTaxonomyList(ec.db, { locale: args.locale });
 			if (!listResult.success) return unwrap(listResult);
 			if (!listResult.data.taxonomies.find((t) => t.name === args.taxonomy)) return respondError("NOT_FOUND", `Taxonomy '${args.taxonomy}' not found`);
-			const { TaxonomyRepository } = await import("../../../taxonomy-DvwWAPvA.mjs").then((n) => n.n);
-			const { decodeCursor, encodeCursor, InvalidCursorError } = await import("../../../types-XrQQ-Aex.mjs").then((n) => n.o);
+			const { TaxonomyRepository } = await import("../../../taxonomy-CPeM8d2o.mjs").then((n) => n.n);
 			const repo = new TaxonomyRepository(ec.db);
 			const limit = Math.min(args.limit ?? 50, 100);
-			const terms = await repo.findByName(args.taxonomy, { locale: args.locale });
-			let startIdx = 0;
-			if (args.cursor) {
-				let decoded;
-				try {
-					decoded = decodeCursor(args.cursor);
-				} catch (error) {
-					if (error instanceof InvalidCursorError) return respondError("INVALID_CURSOR", error.message);
-					throw error;
-				}
-				startIdx = terms.findIndex((t) => t.label > decoded.orderValue || t.label === decoded.orderValue && t.id > decoded.id);
-				if (startIdx < 0) startIdx = terms.length;
+			let cursor;
+			if (args.cursor) try {
+				cursor = decodeTaxonomyCursor(args.cursor);
+			} catch (error) {
+				if (error instanceof InvalidCursorError) return respondError("INVALID_CURSOR", error.message);
+				throw error;
 			}
-			const page = terms.slice(startIdx, startIdx + limit);
-			const hasMore = startIdx + limit < terms.length;
-			const last = page.at(-1);
-			const nextCursor = hasMore && last ? encodeCursor(last.label, last.id) : void 0;
+			let pageCursor;
+			if (cursor) {
+				const cursorTerm = await repo.findById(cursor.id);
+				if (!cursorTerm || cursorTerm.name !== args.taxonomy || args.locale !== void 0 && cursorTerm.locale !== args.locale) return respondError("INVALID_CURSOR", "Pagination cursor no longer identifies a term");
+				pageCursor = {
+					sortOrder: cursorTerm.sortOrder,
+					label: cursorTerm.label,
+					id: cursorTerm.id
+				};
+			}
+			const page = await repo.findPageByName(args.taxonomy, {
+				locale: args.locale,
+				limit,
+				...pageCursor ? { cursor: pageCursor } : {}
+			});
+			const last = page.items.at(-1);
+			const nextCursor = page.hasMore && last ? encodeTaxonomyCursor(last) : void 0;
 			return jsonResult({
-				items: page.map((t) => ({
+				items: page.items.map((t) => ({
 					id: t.id,
 					name: t.name,
 					slug: t.slug,
@@ -1291,7 +1392,7 @@ function createMcpServer(pluginTools = [], request) {
 		description: "Create a new term in a taxonomy. For hierarchical taxonomies like categories, you can specify a parentId to create a child term. The parent must exist and belong to the same taxonomy. The parent's ancestor chain must not exceed 100 levels — attempts to attach a new term beneath a chain of 100+ existing ancestors are rejected.",
 		inputSchema: z.object({
 			taxonomy: z.string().describe("Taxonomy name (e.g. 'categories', 'tags')"),
-			slug: z.string().describe("URL-safe identifier for the term"),
+			slug: z.string().min(1).optional().describe("URL identifier for the term; omit to derive it from the label"),
 			label: z.string().describe("Display name"),
 			parentId: z.string().optional().describe("Parent term ID for hierarchical taxonomies"),
 			description: z.string().optional().describe("Description of the term"),
@@ -1303,7 +1404,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermCreate } = await import("../../../taxonomies-Dbdki3Un.mjs").then((n) => n.l);
+			const { handleTermCreate } = await import("../../../taxonomies-Dk3MAklL.mjs").then((n) => n.m);
 			return unwrap(await handleTermCreate(ec.db, args.taxonomy, {
 				slug: args.slug,
 				label: args.label,
@@ -1332,7 +1433,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermUpdate } = await import("../../../taxonomies-Dbdki3Un.mjs").then((n) => n.l);
+			const { handleTermUpdate } = await import("../../../taxonomies-Dk3MAklL.mjs").then((n) => n.m);
 			return unwrap(await handleTermUpdate(ec.db, args.taxonomy, args.termSlug, {
 				slug: args.slug,
 				label: args.label,
@@ -1356,7 +1457,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermDelete } = await import("../../../taxonomies-Dbdki3Un.mjs").then((n) => n.l);
+			const { handleTermDelete } = await import("../../../taxonomies-Dk3MAklL.mjs").then((n) => n.m);
 			return unwrap(await handleTermDelete(ec.db, args.taxonomy, args.termSlug));
 		} catch (error) {
 			return respondHandlerError(error, "TAXONOMY_TERM_DELETE_ERROR");
@@ -1371,7 +1472,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermTranslations } = await import("../../../taxonomies-Dbdki3Un.mjs").then((n) => n.l);
+			const { handleTermTranslations } = await import("../../../taxonomies-Dk3MAklL.mjs").then((n) => n.m);
 			return unwrap(await handleTermTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "TERM_TRANSLATIONS_ERROR");
@@ -1386,7 +1487,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuList } = await import("../../../menus-BxPLFfIc.mjs").then((n) => n.d);
+			const { handleMenuList } = await import("../../../menus-fxvEDYE6.mjs").then((n) => n.d);
 			return unwrap(await handleMenuList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_LIST_ERROR");
@@ -1404,7 +1505,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuGet } = await import("../../../menus-BxPLFfIc.mjs").then((n) => n.d);
+			const { handleMenuGet } = await import("../../../menus-fxvEDYE6.mjs").then((n) => n.d);
 			return unwrap(await handleMenuGet(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_GET_ERROR");
@@ -1419,7 +1520,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuTranslations } = await import("../../../menus-BxPLFfIc.mjs").then((n) => n.d);
+			const { handleMenuTranslations } = await import("../../../menus-fxvEDYE6.mjs").then((n) => n.d);
 			return unwrap(await handleMenuTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_TRANSLATIONS_ERROR");
@@ -1439,7 +1540,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuCreate } = await import("../../../menus-BxPLFfIc.mjs").then((n) => n.d);
+			const { handleMenuCreate } = await import("../../../menus-fxvEDYE6.mjs").then((n) => n.d);
 			return unwrap(await handleMenuCreate(ec.db, {
 				name: args.name,
 				label: args.label,
@@ -1463,7 +1564,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuUpdate } = await import("../../../menus-BxPLFfIc.mjs").then((n) => n.d);
+			const { handleMenuUpdate } = await import("../../../menus-fxvEDYE6.mjs").then((n) => n.d);
 			return unwrap(await handleMenuUpdate(ec.db, args.name, {
 				label: args.label,
 				locale: args.locale
@@ -1485,7 +1586,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuDelete } = await import("../../../menus-BxPLFfIc.mjs").then((n) => n.d);
+			const { handleMenuDelete } = await import("../../../menus-fxvEDYE6.mjs").then((n) => n.d);
 			return unwrap(await handleMenuDelete(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_DELETE_ERROR");
@@ -1520,7 +1621,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuSetItems } = await import("../../../menus-BxPLFfIc.mjs").then((n) => n.d);
+			const { handleMenuSetItems } = await import("../../../menus-fxvEDYE6.mjs").then((n) => n.d);
 			return unwrap(await handleMenuSetItems(ec.db, args.name, args.items, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_SET_ITEMS_ERROR");
@@ -1567,7 +1668,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleSettingsGet } = await import("../../../settings-CREKyj8I.mjs").then((n) => n.r);
+			const { handleSettingsGet } = await import("../../../settings-BE9aqn_9.mjs").then((n) => n.r);
 			return unwrap(await handleSettingsGet(ec.db, ec.storage));
 		} catch (error) {
 			return respondHandlerError(error, "SETTINGS_READ_ERROR");
@@ -1593,7 +1694,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { handleSettingsUpdate } = await import("../../../settings-CREKyj8I.mjs").then((n) => n.r);
+			const { handleSettingsUpdate } = await import("../../../settings-BE9aqn_9.mjs").then((n) => n.r);
 			return unwrap(await handleSettingsUpdate(ec.db, ec.storage, args));
 		} catch (error) {
 			return respondHandlerError(error, "SETTINGS_UPDATE_ERROR");
@@ -1631,6 +1732,7 @@ const POST = async ({ request, locals }) => {
 			scopes: [],
 			extra: {
 				emdash,
+				user,
 				userId: user.id,
 				userRole: user.role,
 				tokenScopes: locals.tokenScopes