emdash 0.36.0 → 0.38.0

package/dist/astro/routes/api/mcp.mjs

@@ -1,14 +1,14 @@
 import "../../../config-C3EBstHi.mjs";
 import { i as encodeBase64, t as decodeBase64 } from "../../../base64-CvLhUKQv.mjs";
 import { i as InvalidCursorError, o as decodeCursor } from "../../../types-CQPWhPxE.mjs";
-import { t as apiError } from "../../../error-D9w94fjV.mjs";
-import { t as CONTENT_TYPE_RE } from "../../../media-BjwNuLEu.mjs";
-import { Gt as updateFieldBody, Pt as createCollectionBody, Wt as updateCollectionBody, in as contentSeoInput, pn as bylineCreateBody, xn as contentBylineInputSchema, yn as bylineUpdateBody } from "../../../redirects-CRIM55KH.mjs";
-import "../../../relations-BTPM2saV.mjs";
-import "../../../status-DDu8HIQl.mjs";
+import { t as apiError } from "../../../error-BDcFyoRt.mjs";
+import { t as CONTENT_TYPE_RE } from "../../../media-C1EIZKh1.mjs";
+import { En as bylineUpdateBody, K as createTaxonomyDefBody, On as contentBylineInputSchema, Xt as updateFieldBody, Yt as updateCollectionBody, bn as bylineCreateBody, st as updateTaxonomyDefBody, un as contentSeoInput, zt as createCollectionBody } from "../../../entry-lock-DIYHAaSw.mjs";
+import "../../../relations-rOmbndUJ.mjs";
+import "../../../status-Cenfk_r5.mjs";
 import "../../../api/schemas/index.mjs";
-import { i as hasScope$1 } from "../../../api-tokens-B5NHLNUN.mjs";
-import { n as convertDataForWrite, t as convertDataForRead } from "../../../portable-text-C8Tvp4_g.mjs";
+import { i as hasScope$1 } from "../../../api-tokens-B_lfpmH3.mjs";
+import { n as convertDataForWrite, t as convertDataForRead } from "../../../portable-text-BS3d5n-0.mjs";
 import { z } from "zod";
 import { Permissions, Role, canActOnOwn, hasPermission } from "@emdash-cms/auth";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
@@ -18,8 +18,26 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 const COLLECTION_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
 /** http(s) scheme matcher used by `settings_update` URL validation. */
 const HTTP_SCHEME_PATTERN = /^https?:\/\//i;
+/**
+* Shared wording for the `_rev` parameter on write tools. Agents only see the
+* tool schema, so the retry protocol is stated here.
+*/
+const REV_PARAM_DESCRIPTION = "Revision token proving you have read the current item. Call content_get first and pass back the _rev it returns. If this call fails with CONFLICT the item changed in the meantime: call content_get again and retry with the new token.";
+/**
+* Replaces Zod's "expected string, received undefined" for a caller that never
+* read the schema, so the message says where the token comes from.
+*/
+const REV_MISSING_ERROR = "_rev is required: call content_get for this item and pass back the _rev it returns.";
 const TAXONOMY_CURSOR_VERSION = 2;
 const MAX_TAXONOMY_CURSOR_LENGTH = 2048;
+const contentDateTimeInputSchema = z.iso.datetime({
+	offset: true,
+	message: "must be an ISO 8601 datetime"
+}).or(z.iso.datetime({
+	offset: true,
+	precision: -1,
+	message: "must be an ISO 8601 datetime"
+}));
 const settingsMediaReferenceSchema = z.object({
 	mediaId: z.string().describe("Media item ID (use media_create or media_list)"),
 	alt: z.string().optional().describe("Alt text for the media reference")
@@ -64,10 +82,14 @@ const schemaUpdateCollectionToolSchema = z.object({
 	urlPattern: updateCollectionBody.shape.urlPattern.describe("New public URL pattern; pass null to clear it"),
 	routable: updateCollectionBody.shape.routable.describe("Whether entries require a slug before they can be published"),
 	hasSeo: updateCollectionBody.shape.hasSeo.describe("Whether the collection supports SEO metadata"),
+	group: updateCollectionBody.shape.group.describe("Admin sidebar folder shared with other collections of the same group; pass null to move the collection back inline"),
 	commentsEnabled: updateCollectionBody.shape.commentsEnabled.describe("Whether comments are enabled for this collection"),
 	commentsModeration: updateCollectionBody.shape.commentsModeration.describe("Comment moderation policy"),
 	commentsClosedAfterDays: updateCollectionBody.shape.commentsClosedAfterDays.describe("Close comments after this many days; 0 keeps them open"),
-	commentsAutoApproveUsers: updateCollectionBody.shape.commentsAutoApproveUsers.describe("Whether comments from authenticated users are automatically approved")
+	commentsAutoApproveUsers: updateCollectionBody.shape.commentsAutoApproveUsers.describe("Whether comments from authenticated users are automatically approved"),
+	editLocking: updateCollectionBody.shape.editLocking.describe("Whether opening an entry takes an edit lock that refuses other editors' writes"),
+	titleField: updateCollectionBody.shape.titleField.describe("Field slug to use as the Title column in admin lists; pass null to fall back to the default"),
+	dateField: updateCollectionBody.shape.dateField.describe("Datetime field slug to use as the Date column in admin lists; pass null to fall back to the default")
 });
 const schemaUpdateFieldToolSchema = z.object({
 	collection: z.string().min(1).max(63).regex(COLLECTION_SLUG_PATTERN, "Invalid collection slug").describe("Collection slug containing the field"),
@@ -234,7 +256,7 @@ function getEmDash(extra) {
 }
 async function getCollectionFields(ec, collection) {
 	try {
-		const { SchemaRegistry } = await import("../../../schema-BY-oVntF.mjs").then((n) => n.t);
+		const { SchemaRegistry } = await import("../../../schema-CRu38Pr5.mjs").then((n) => n.t);
 		const col = await new SchemaRegistry(ec.db).getCollectionWithFields(collection);
 		return col ? col.fields : null;
 	} catch {
@@ -263,7 +285,7 @@ async function applyReadMarkdown(ec, collection, items) {
 	for (const item of items) if (item.data && typeof item.data === "object") item.data = convertDataForRead(item.data, fields, false);
 }
 async function invalidateBylines() {
-	const { invalidateBylineCache } = await import("../../../bylines-BSo9B9RX.mjs").then((n) => n.t);
+	const { invalidateBylineCache } = await import("../../../bylines-BX8QhcTk.mjs").then((n) => n.t);
 	invalidateBylineCache();
 }
 /**
@@ -342,6 +364,12 @@ function extractContentId(data) {
 	const item = obj.item && typeof obj.item === "object" ? obj.item : obj;
 	return typeof item?.id === "string" ? item.id : void 0;
 }
+/** Extract the `_rev` token from a content handler response. */
+function extractContentRev(data) {
+	if (!data || typeof data !== "object") return void 0;
+	const rev = data._rev;
+	return typeof rev === "string" ? rev : void 0;
+}
 function createMcpServer(pluginTools = [], request) {
 	const server = new McpServer({
 		name: "emdash",
@@ -430,7 +458,7 @@ function createMcpServer(pluginTools = [], request) {
 	});
 	server.registerTool("content_get", {
 		title: "Get Content",
-		description: "Get a single content item by its ID or slug. Returns the full content data including all field values, metadata, and a _rev token for optimistic concurrency (pass _rev back when updating to detect conflicts).",
+		description: "Get a single content item by its ID or slug. Returns the full content data including all field values, metadata, and a _rev token. content_update, content_publish, content_unpublish and content_discard_draft require that token, so read the item here before calling them.",
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug (e.g. 'posts', 'pages')"),
 			id: z.string().describe("Content item ID (ULID) or slug"),
@@ -473,7 +501,11 @@ function createMcpServer(pluginTools = [], request) {
 	}, async (args, extra) => {
 		requireScope(extra, "content:write");
 		requireRole(extra, Role.CONTRIBUTOR);
-		const { emdash, userId } = getExtra(extra);
+		const { emdash, userId, userRole } = getExtra(extra);
+		const actor = {
+			id: userId,
+			role: userRole
+		};
 		if (args.translationOf) {
 			const source = await emdash.handleContentGet(args.collection, args.translationOf);
 			if (!source.success) return unwrap(source);
@@ -483,7 +515,7 @@ function createMcpServer(pluginTools = [], request) {
 		if (args.status === "published") {
 			if (!hasPermission({
 				id: userId,
-				role: getExtra(extra).userRole
+				role: userRole
 			}, "content:publish_own")) throw new EmDashAuthError("Insufficient permissions: publishing requires content:publish_own", "INSUFFICIENT_PERMISSIONS");
 			const result = await emdash.handleContentCreate(args.collection, {
 				data,
@@ -492,7 +524,8 @@ function createMcpServer(pluginTools = [], request) {
 				locale: args.locale,
 				translationOf: args.translationOf,
 				bylines: args.bylines,
-				taxonomies: args.taxonomies
+				taxonomies: args.taxonomies,
+				actor
 			});
 			if (!result.success) return unwrap(result);
 			const itemId = extractContentId(result.data);
@@ -506,12 +539,13 @@ function createMcpServer(pluginTools = [], request) {
 			locale: args.locale,
 			translationOf: args.translationOf,
 			bylines: args.bylines,
-			taxonomies: args.taxonomies
+			taxonomies: args.taxonomies,
+			actor
 		}));
 	});
 	server.registerTool("content_update", {
 		title: "Update Content",
-		description: "Update an existing content item. Only include fields you want to change in the 'data' object — unspecified fields are left unchanged. Rich text (portableText) fields accept a Markdown string (recommended, converted automatically); use a Portable Text JSON array only for complex content Markdown can't express (custom blocks, embeds). Pass the _rev token from content_get to enable optimistic concurrency checking (the update fails if the item was modified since you read it). `seo` and `bylines` are persisted alongside the field updates in a single transaction. `publishedAt` requires the content:publish_any permission and is useful for migrations or correcting historical dates.",
+		description: "Update an existing content item. Only include fields you want to change in the 'data' object — unspecified fields are left unchanged. Rich text (portableText) fields accept a Markdown string (recommended, converted automatically); use a Portable Text JSON array only for complex content Markdown can't express (custom blocks, embeds). Requires the _rev token from content_get, so read the item before updating it: the update fails if the item changed since that read. When status is not set, a change to a published item is staged as a draft, so the response shows the new values while the live version keeps the old ones until content_publish. `seo` and `bylines` are persisted alongside the field updates in a single transaction. `publishedAt` requires the content:publish_any permission and is useful for migrations or correcting historical dates.",
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug"),
 			id: z.string().describe("Content item ID or slug"),
@@ -522,16 +556,17 @@ function createMcpServer(pluginTools = [], request) {
 			seo: contentSeoInput.optional().describe("Per-content SEO metadata. Only valid for collections with SEO enabled (see schema_get_collection.hasSeo). Fields not included are left unchanged; pass null to clear."),
 			bylines: z.array(contentBylineInputSchema).optional().describe("Replace the byline list for this item. The first entry becomes the primary byline. Pass an empty array to clear all bylines."),
 			taxonomies: z.record(z.string(), z.array(z.string())).optional().describe("Replace taxonomy term assignments as { taxonomyName: [termSlug, ...] }. Term slugs are resolved in the entry's locale. Only named taxonomies are touched; other taxonomies are left unchanged. Pass an empty array to clear a taxonomy."),
-			publishedAt: z.iso.datetime({
-				offset: true,
-				message: "must be an ISO 8601 datetime"
-			}).nullish().describe("Override the publication timestamp (ISO 8601). Requires content:publish_any permission. Pass null to clear. Useful for content migrations."),
-			_rev: z.string().optional().describe("Revision token from content_get for conflict detection")
+			publishedAt: contentDateTimeInputSchema.nullish().describe("Override the publication timestamp (ISO 8601). Requires content:publish_any permission. Pass null to clear. Useful for content migrations."),
+			_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION)
 		})
 	}, async (args, extra) => {
 		requireScope(extra, "content:write");
 		requireRole(extra, Role.AUTHOR);
 		const { emdash, userId, userRole } = getExtra(extra);
+		const actor = {
+			id: userId,
+			role: userRole
+		};
 		const existing = await emdash.handleContentGet(args.collection, args.id, args.locale);
 		if (!existing.success) return unwrap(existing);
 		const ownerId = extractContentAuthorId(existing.data);
@@ -546,11 +581,12 @@ function createMcpServer(pluginTools = [], request) {
 		const resolvedId = extractContentId(existing.data) ?? args.id;
 		if (args.status === "published") {
 			requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
+			let rev = args._rev;
 			if (args.data || args.slug || args.seo !== void 0 || args.bylines !== void 0 || args.taxonomies !== void 0 || args.publishedAt !== void 0) {
 				const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
 					data,
 					slug: args.slug,
-					authorId: userId,
+					actor,
 					locale: args.locale,
 					seo: args.seo,
 					bylines: args.bylines,
@@ -559,16 +595,18 @@ function createMcpServer(pluginTools = [], request) {
 					_rev: args._rev
 				});
 				if (!updateResult.success) return unwrap(updateResult);
+				rev = extractContentRev(updateResult.data);
 			}
-			return unwrap(await emdash.handleContentPublish(args.collection, resolvedId));
+			return unwrap(await emdash.handleContentPublish(args.collection, resolvedId, { _rev: rev }));
 		}
 		if (args.status === "draft") {
 			requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
+			let rev = args._rev;
 			if (args.data || args.slug || args.seo !== void 0 || args.bylines !== void 0 || args.taxonomies !== void 0 || args.publishedAt !== void 0) {
 				const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
 					data,
 					slug: args.slug,
-					authorId: userId,
+					actor,
 					locale: args.locale,
 					seo: args.seo,
 					bylines: args.bylines,
@@ -577,13 +615,14 @@ function createMcpServer(pluginTools = [], request) {
 					_rev: args._rev
 				});
 				if (!updateResult.success) return unwrap(updateResult);
+				rev = extractContentRev(updateResult.data);
 			}
-			return unwrap(await emdash.handleContentUnpublish(args.collection, resolvedId));
+			return unwrap(await emdash.handleContentUnpublish(args.collection, resolvedId, { _rev: rev }));
 		}
 		return unwrap(await emdash.handleContentUpdate(args.collection, resolvedId, {
 			data,
 			slug: args.slug,
-			authorId: userId,
+			actor,
 			locale: args.locale,
 			seo: args.seo,
 			bylines: args.bylines,
@@ -646,10 +685,8 @@ function createMcpServer(pluginTools = [], request) {
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug"),
 			id: z.string().describe("Content item ID or slug"),
-			publishedAt: z.iso.datetime({
-				offset: true,
-				message: "must be an ISO 8601 datetime"
-			}).optional().describe("Override publication timestamp (ISO 8601). Requires content:publish_any permission. Useful when importing content with original publish dates.")
+			_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION),
+			publishedAt: contentDateTimeInputSchema.optional().describe("Override publication timestamp (ISO 8601). Requires content:publish_any permission. Useful when importing content with original publish dates.")
 		})
 	}, async (args, extra) => {
 		requireScope(extra, "content:write");
@@ -665,14 +702,18 @@ function createMcpServer(pluginTools = [], request) {
 			}, "content:publish_any")) throw new EmDashAuthError("Setting publishedAt requires content:publish_any permission", "INSUFFICIENT_PERMISSIONS");
 		}
 		const resolvedId = extractContentId(existing.data) ?? args.id;
-		return unwrap(await emdash.handleContentPublish(args.collection, resolvedId, { publishedAt: args.publishedAt }));
+		return unwrap(await emdash.handleContentPublish(args.collection, resolvedId, {
+			publishedAt: args.publishedAt,
+			_rev: args._rev
+		}));
 	});
 	server.registerTool("content_unpublish", {
 		title: "Unpublish Content",
-		description: "Unpublish a content item, reverting it to draft status. It will no longer be visible on the live site but its content is preserved.",
+		description: "Unpublish a content item, reverting it to draft status. It will no longer be visible on the live site, but its content and publication date are preserved.",
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug"),
-			id: z.string().describe("Content item ID or slug")
+			id: z.string().describe("Content item ID or slug"),
+			_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION)
 		})
 	}, async (args, extra) => {
 		requireScope(extra, "content:write");
@@ -682,7 +723,7 @@ function createMcpServer(pluginTools = [], request) {
 		if (!existing.success) return unwrap(existing);
 		requireOwnership(extra, extractContentAuthorId(existing.data), "content:publish_own", "content:publish_any");
 		const resolvedId = extractContentId(existing.data) ?? args.id;
-		return unwrap(await ec.handleContentUnpublish(args.collection, resolvedId));
+		return unwrap(await ec.handleContentUnpublish(args.collection, resolvedId, { _rev: args._rev }));
 	});
 	server.registerTool("content_schedule", {
 		title: "Schedule Content",
@@ -737,7 +778,8 @@ function createMcpServer(pluginTools = [], request) {
 		description: "Discard the current draft changes and revert to the last published version. Only works on items that have been published at least once.",
 		inputSchema: z.object({
 			collection: z.string().describe("Collection slug"),
-			id: z.string().describe("Content item ID or slug")
+			id: z.string().describe("Content item ID or slug"),
+			_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION)
 		}),
 		annotations: { destructiveHint: true }
 	}, async (args, extra) => {
@@ -748,7 +790,7 @@ function createMcpServer(pluginTools = [], request) {
 		if (!existing.success) return unwrap(existing);
 		requireOwnership(extra, extractContentAuthorId(existing.data), "content:edit_own", "content:edit_any");
 		const resolvedId = extractContentId(existing.data) ?? args.id;
-		return unwrap(await ec.handleContentDiscardDraft(args.collection, resolvedId));
+		return unwrap(await ec.handleContentDiscardDraft(args.collection, resolvedId, { _rev: args._rev }));
 	});
 	server.registerTool("content_list_trashed", {
 		title: "List Trashed Content",
@@ -819,7 +861,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-Cpnwrje1.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-Vdi85CsZ.mjs").then((n) => n.n);
 			return jsonResult(await new BylineRepository(ec.db).findMany({
 				search: args.search,
 				isGuest: args.isGuest,
@@ -841,7 +883,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-Cpnwrje1.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-Vdi85CsZ.mjs").then((n) => n.n);
 			const byline = await new BylineRepository(ec.db).findById(args.id);
 			if (!byline) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 			return jsonResult(byline);
@@ -859,7 +901,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineCreate } = await import("../../../bylines-CHjvehVX.mjs").then((n) => n.t);
+			const { handleBylineCreate } = await import("../../../bylines-w-E1IEQd.mjs").then((n) => n.t);
 			const result = await handleBylineCreate(ec.db, args);
 			if (result.success) await invalidateBylines();
 			return unwrap(result);
@@ -879,7 +921,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineUpdate } = await import("../../../bylines-CHjvehVX.mjs").then((n) => n.t);
+			const { handleBylineUpdate } = await import("../../../bylines-w-E1IEQd.mjs").then((n) => n.t);
 			const { id, ...input } = args;
 			const result = await handleBylineUpdate(ec.db, id, input);
 			if (result.success) await invalidateBylines();
@@ -898,7 +940,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { BylineRepository } = await import("../../../byline-Cpnwrje1.mjs").then((n) => n.n);
+			const { BylineRepository } = await import("../../../byline-Vdi85CsZ.mjs").then((n) => n.n);
 			if (!await new BylineRepository(ec.db).delete(args.id)) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 			await invalidateBylines();
 			return jsonResult({ deleted: args.id });
@@ -915,7 +957,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleBylineTranslations } = await import("../../../bylines-CHjvehVX.mjs").then((n) => n.t);
+			const { handleBylineTranslations } = await import("../../../bylines-w-E1IEQd.mjs").then((n) => n.t);
 			return unwrap(await handleBylineTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "BYLINE_TRANSLATIONS_ERROR");
@@ -931,7 +973,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-BY-oVntF.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-CRu38Pr5.mjs").then((n) => n.t);
 			return jsonResult({ items: await new SchemaRegistry(ec.db).listCollections() });
 		} catch (error) {
 			return respondHandlerError(error, "SCHEMA_LIST_ERROR");
@@ -947,7 +989,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-BY-oVntF.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-CRu38Pr5.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).getCollectionWithFields(args.slug);
 			if (!collection) return respondError("NOT_FOUND", `Collection '${args.slug}' not found`);
 			return jsonResult(collection);
@@ -965,14 +1007,16 @@ function createMcpServer(pluginTools = [], request) {
 			description: z.string().optional().describe("Description of this collection"),
 			icon: z.string().optional().describe("Icon name for the admin UI"),
 			supports: createCollectionBody.shape.supports.describe("Features to enable (default: ['drafts', 'revisions'])"),
-			routable: createCollectionBody.shape.routable.describe("Require a slug before publishing (default: true)")
+			routable: createCollectionBody.shape.routable.describe("Require a slug before publishing (default: true)"),
+			editLocking: createCollectionBody.shape.editLocking.describe("Take an edit lock when an entry is opened (default: true)"),
+			group: createCollectionBody.shape.group.describe("Admin sidebar folder shared with other collections of the same group")
 		})
 	}, async (args, extra) => {
 		requireScope(extra, "schema:write");
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-BY-oVntF.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-CRu38Pr5.mjs").then((n) => n.t);
 			const collection = await new SchemaRegistry(ec.db).createCollection({
 				slug: args.slug,
 				label: args.label,
@@ -980,7 +1024,9 @@ function createMcpServer(pluginTools = [], request) {
 				description: args.description,
 				icon: args.icon,
 				supports: args.supports,
-				routable: args.routable
+				routable: args.routable,
+				editLocking: args.editLocking,
+				group: args.group
 			});
 			ec.invalidateUrlPatternCache();
 			return jsonResult(collection);
@@ -1001,7 +1047,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-BY-oVntF.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-CRu38Pr5.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteCollection(args.slug, { force: args.force });
 			ec.invalidateUrlPatternCache();
 			return jsonResult({ deleted: args.slug });
@@ -1020,7 +1066,7 @@ function createMcpServer(pluginTools = [], request) {
 		const ec = getEmDash(extra);
 		const { slug, ...input } = args;
 		try {
-			const { handleSchemaCollectionUpdate } = await import("../../../schema-Cw9kVK0I.mjs").then((n) => n.h);
+			const { handleSchemaCollectionUpdate } = await import("../../../schema-DifxndJx.mjs").then((n) => n.h);
 			const result = await handleSchemaCollectionUpdate(ec.db, slug, input);
 			if (result.success) ec.invalidateUrlPatternCache();
 			return unwrap(result);
@@ -1065,7 +1111,7 @@ function createMcpServer(pluginTools = [], request) {
 			options: z.object({
 				collection: z.string().optional().describe("Target collection slug for reference fields"),
 				rows: z.number().optional().describe("Number of rows for textarea")
-			}).passthrough().optional().describe("Widget configuration"),
+			}).loose().optional().describe("Widget configuration"),
 			searchable: z.boolean().optional().describe("Include in full-text search index (default false)"),
 			indexed: z.boolean().optional().describe("Create a physical index for structured sorting"),
 			translatable: z.boolean().optional().describe("Whether this field is translatable (default true). Non-translatable fields are synced across all locales in a translation group.")
@@ -1075,7 +1121,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-BY-oVntF.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-CRu38Pr5.mjs").then((n) => n.t);
 			return jsonResult(await new SchemaRegistry(ec.db).createField(args.collection, {
 				slug: args.slug,
 				label: args.label,
@@ -1106,7 +1152,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { SchemaRegistry } = await import("../../../schema-BY-oVntF.mjs").then((n) => n.t);
+			const { SchemaRegistry } = await import("../../../schema-CRu38Pr5.mjs").then((n) => n.t);
 			await new SchemaRegistry(ec.db).deleteField(args.collection, args.fieldSlug);
 			return jsonResult({
 				deleted: args.fieldSlug,
@@ -1127,7 +1173,7 @@ function createMcpServer(pluginTools = [], request) {
 		const ec = getEmDash(extra);
 		const { collection, fieldSlug, ...input } = args;
 		try {
-			const { handleSchemaFieldUpdate } = await import("../../../schema-Cw9kVK0I.mjs").then((n) => n.h);
+			const { handleSchemaFieldUpdate } = await import("../../../schema-DifxndJx.mjs").then((n) => n.h);
 			return unwrap(await handleSchemaFieldUpdate(ec.db, collection, fieldSlug, input));
 		} catch (error) {
 			return respondHandlerError(error, "SCHEMA_FIELD_UPDATE_ERROR");
@@ -1187,7 +1233,7 @@ function createMcpServer(pluginTools = [], request) {
 		inputSchema: z.object({
 			filename: z.string().min(1).describe("Filename including extension (e.g. 'cover.png')"),
 			base64: z.string().optional().describe("Base64-encoded file contents. Provide exactly one of base64 / url."),
-			url: z.string().url().optional().describe("Public http(s) URL to fetch the file from. Provide exactly one of base64 / url."),
+			url: z.url().optional().describe("Public http(s) URL to fetch the file from. Provide exactly one of base64 / url."),
 			contentType: z.string().regex(CONTENT_TYPE_RE, "Invalid content type").optional().describe("MIME type (e.g. 'image/png'). Required with base64; with url it defaults to the response's Content-Type header."),
 			alt: z.string().optional().describe("Alt text for accessibility")
 		}),
@@ -1198,7 +1244,7 @@ function createMcpServer(pluginTools = [], request) {
 		const { emdash, userId } = getExtra(extra);
 		if (!emdash.storage) return respondError("NO_STORAGE", "Storage not configured");
 		try {
-			const { handleMediaUpload } = await import("../../../media-upload-C7bLXGcI.mjs");
+			const { handleMediaUpload } = await import("../../../media-upload-C7_AQJ5v.mjs");
 			return unwrap(await handleMediaUpload(emdash.db, emdash.storage, {
 				filename: args.filename,
 				base64: args.base64,
@@ -1278,7 +1324,7 @@ function createMcpServer(pluginTools = [], request) {
 			};
 		} else input = { scope: "all" };
 		try {
-			const { handleMediaUsageRepair } = await import("../../../media-usage-BTRJvS6V.mjs").then((n) => n.o);
+			const { handleMediaUsageRepair } = await import("../../../media-usage-C1EswMTq.mjs").then((n) => n.o);
 			return unwrap(await handleMediaUsageRepair(ec.db, input));
 		} catch (error) {
 			return respondHandlerError(error, "MEDIA_USAGE_REPAIR_ERROR");
@@ -1299,7 +1345,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { searchWithDb } = await import("../../../search-CfT3KxO5.mjs").then((n) => n.t);
+			const { searchWithDb } = await import("../../../search-DEPFSBFq.mjs").then((n) => n.t);
 			return jsonResult(await searchWithDb(ec.db, args.query, {
 				collections: args.collections,
 				locale: args.locale,
@@ -1319,12 +1365,105 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-CPGxo-bn.mjs").then((n) => n.m);
+			const { handleTaxonomyList } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
 			return unwrap(await handleTaxonomyList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "TAXONOMY_LIST_ERROR");
 		}
 	});
+	server.registerTool("taxonomy_get", {
+		title: "Get Taxonomy Definition",
+		description: "Get a single taxonomy definition by name. Taxonomy definitions describe a classification system (e.g. categories or tags), which collections it applies to, and whether it is hierarchical. Pass `locale` to resolve a specific translation; otherwise the lowest matching locale is returned.",
+		inputSchema: z.object({
+			name: z.string().describe("Taxonomy name (e.g. 'categories', 'tags')"),
+			locale: z.string().optional().describe("Locale to resolve the definition for")
+		}),
+		annotations: { readOnlyHint: true }
+	}, async (args, extra) => {
+		requireScope(extra, "content:read");
+		const ec = getEmDash(extra);
+		try {
+			const { handleTaxonomyGet } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
+			return unwrap(await handleTaxonomyGet(ec.db, args.name, { locale: args.locale }));
+		} catch (error) {
+			return respondHandlerError(error, "TAXONOMY_GET_ERROR");
+		}
+	});
+	server.registerTool("taxonomy_create", {
+		title: "Create Taxonomy Definition",
+		description: "Create a new taxonomy definition. Definitions are per-locale; pass `locale` when the same taxonomy name exists in multiple translations. `collections` names which content types the taxonomy applies to. If `translationOf` is set, the new definition joins the source's translation group and inherits `hierarchical` and `collections` from the source when those fields are omitted.",
+		inputSchema: z.object({
+			name: createTaxonomyDefBody.shape.name.describe("Taxonomy name (lowercase letters, numbers, underscores)"),
+			label: createTaxonomyDefBody.shape.label.describe("Display name"),
+			labelSingular: createTaxonomyDefBody.shape.labelSingular.describe("Singular form of the display name"),
+			hierarchical: createTaxonomyDefBody.shape.hierarchical.describe("Whether the taxonomy supports parent/child terms (defaults to false, or inherited from translationOf)"),
+			collections: createTaxonomyDefBody.shape.collections.describe("Collection slugs this taxonomy applies to (defaults to [], or inherited from translationOf)"),
+			locale: z.string().optional().describe("Locale for this definition (e.g. 'fr-fr')"),
+			translationOf: z.string().optional().describe("Existing taxonomy definition id to create this locale variant from")
+		})
+	}, async (args, extra) => {
+		requireScope(extra, "taxonomies:manage");
+		requireRole(extra, Role.EDITOR);
+		const ec = getEmDash(extra);
+		try {
+			const { handleTaxonomyCreate } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
+			return unwrap(await handleTaxonomyCreate(ec.db, {
+				name: args.name,
+				label: args.label,
+				labelSingular: args.labelSingular,
+				hierarchical: args.hierarchical,
+				collections: args.collections,
+				locale: args.locale,
+				translationOf: args.translationOf
+			}));
+		} catch (error) {
+			return respondHandlerError(error, "TAXONOMY_CREATE_ERROR");
+		}
+	});
+	server.registerTool("taxonomy_update", {
+		title: "Update Taxonomy Definition",
+		description: "Update an existing taxonomy definition. The taxonomy `name` cannot be changed. Pass `locale` to update a specific translation; otherwise the lowest matching locale is updated. Any field may be omitted to leave it unchanged.",
+		inputSchema: z.object({
+			name: z.string().describe("Taxonomy name to update"),
+			label: updateTaxonomyDefBody.shape.label.describe("New display name"),
+			labelSingular: updateTaxonomyDefBody.shape.labelSingular.describe("New singular display name; pass null to clear"),
+			hierarchical: updateTaxonomyDefBody.shape.hierarchical.describe("Whether the taxonomy supports parent/child terms"),
+			collections: updateTaxonomyDefBody.shape.collections.describe("Collection slugs this taxonomy applies to"),
+			locale: z.string().optional().describe("Locale of the definition to update")
+		})
+	}, async (args, extra) => {
+		requireScope(extra, "taxonomies:manage");
+		requireRole(extra, Role.EDITOR);
+		const ec = getEmDash(extra);
+		try {
+			const { handleTaxonomyUpdate } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
+			return unwrap(await handleTaxonomyUpdate(ec.db, args.name, {
+				label: args.label,
+				labelSingular: args.labelSingular,
+				hierarchical: args.hierarchical,
+				collections: args.collections,
+				locale: args.locale
+			}));
+		} catch (error) {
+			return respondHandlerError(error, "TAXONOMY_UPDATE_ERROR");
+		}
+	});
+	server.registerTool("taxonomy_delete", {
+		title: "Delete Taxonomy Definition",
+		description: "Delete a taxonomy definition and all of its terms in every locale, along with any content assignments those terms hold. This cannot be undone.",
+		inputSchema: z.object({ name: z.string().describe("Taxonomy name to delete") }),
+		annotations: { destructiveHint: true }
+	}, async (args, extra) => {
+		requireScope(extra, "taxonomies:manage");
+		requireRole(extra, Role.EDITOR);
+		const ec = getEmDash(extra);
+		try {
+			const { handleTaxonomyDelete } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
+			return unwrap(await handleTaxonomyDelete(ec.db, args.name));
+		} catch (error) {
+			return respondHandlerError(error, "TAXONOMY_DELETE_ERROR");
+		}
+	});
 	server.registerTool("taxonomy_list_terms", {
 		title: "List Taxonomy Terms",
 		description: "List terms in a taxonomy with pagination. Terms are individual entries (e.g. specific categories or tags). Hierarchical taxonomies can have parent-child relationships.",
@@ -1339,11 +1478,11 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTaxonomyList } = await import("../../../taxonomies-CPGxo-bn.mjs").then((n) => n.m);
+			const { handleTaxonomyList } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
 			const listResult = await handleTaxonomyList(ec.db, { locale: args.locale });
 			if (!listResult.success) return unwrap(listResult);
 			if (!listResult.data.taxonomies.find((t) => t.name === args.taxonomy)) return respondError("NOT_FOUND", `Taxonomy '${args.taxonomy}' not found`);
-			const { TaxonomyRepository } = await import("../../../taxonomy-8X09dLN5.mjs").then((n) => n.n);
+			const { TaxonomyRepository } = await import("../../../taxonomy-DP1vny4K.mjs").then((n) => n.n);
 			const repo = new TaxonomyRepository(ec.db);
 			const limit = Math.min(args.limit ?? 50, 100);
 			let cursor;
@@ -1404,7 +1543,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermCreate } = await import("../../../taxonomies-CPGxo-bn.mjs").then((n) => n.m);
+			const { handleTermCreate } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
 			return unwrap(await handleTermCreate(ec.db, args.taxonomy, {
 				slug: args.slug,
 				label: args.label,
@@ -1433,7 +1572,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermUpdate } = await import("../../../taxonomies-CPGxo-bn.mjs").then((n) => n.m);
+			const { handleTermUpdate } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
 			return unwrap(await handleTermUpdate(ec.db, args.taxonomy, args.termSlug, {
 				slug: args.slug,
 				label: args.label,
@@ -1457,7 +1596,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermDelete } = await import("../../../taxonomies-CPGxo-bn.mjs").then((n) => n.m);
+			const { handleTermDelete } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
 			return unwrap(await handleTermDelete(ec.db, args.taxonomy, args.termSlug));
 		} catch (error) {
 			return respondHandlerError(error, "TAXONOMY_TERM_DELETE_ERROR");
@@ -1472,7 +1611,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleTermTranslations } = await import("../../../taxonomies-CPGxo-bn.mjs").then((n) => n.m);
+			const { handleTermTranslations } = await import("../../../taxonomies-BOdxuZpV.mjs").then((n) => n.m);
 			return unwrap(await handleTermTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "TERM_TRANSLATIONS_ERROR");
@@ -1487,7 +1626,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuList } = await import("../../../menus-CD7EFLwz.mjs").then((n) => n.d);
+			const { handleMenuList } = await import("../../../menus-UdwjHZJC.mjs").then((n) => n.d);
 			return unwrap(await handleMenuList(ec.db, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_LIST_ERROR");
@@ -1505,7 +1644,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuGet } = await import("../../../menus-CD7EFLwz.mjs").then((n) => n.d);
+			const { handleMenuGet } = await import("../../../menus-UdwjHZJC.mjs").then((n) => n.d);
 			return unwrap(await handleMenuGet(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_GET_ERROR");
@@ -1520,7 +1659,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireScope(extra, "content:read");
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuTranslations } = await import("../../../menus-CD7EFLwz.mjs").then((n) => n.d);
+			const { handleMenuTranslations } = await import("../../../menus-UdwjHZJC.mjs").then((n) => n.d);
 			return unwrap(await handleMenuTranslations(ec.db, args.id));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_TRANSLATIONS_ERROR");
@@ -1540,7 +1679,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuCreate } = await import("../../../menus-CD7EFLwz.mjs").then((n) => n.d);
+			const { handleMenuCreate } = await import("../../../menus-UdwjHZJC.mjs").then((n) => n.d);
 			return unwrap(await handleMenuCreate(ec.db, {
 				name: args.name,
 				label: args.label,
@@ -1564,7 +1703,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuUpdate } = await import("../../../menus-CD7EFLwz.mjs").then((n) => n.d);
+			const { handleMenuUpdate } = await import("../../../menus-UdwjHZJC.mjs").then((n) => n.d);
 			return unwrap(await handleMenuUpdate(ec.db, args.name, {
 				label: args.label,
 				locale: args.locale
@@ -1586,7 +1725,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuDelete } = await import("../../../menus-CD7EFLwz.mjs").then((n) => n.d);
+			const { handleMenuDelete } = await import("../../../menus-UdwjHZJC.mjs").then((n) => n.d);
 			return unwrap(await handleMenuDelete(ec.db, args.name, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_DELETE_ERROR");
@@ -1621,7 +1760,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleMenuSetItems } = await import("../../../menus-CD7EFLwz.mjs").then((n) => n.d);
+			const { handleMenuSetItems } = await import("../../../menus-UdwjHZJC.mjs").then((n) => n.d);
 			return unwrap(await handleMenuSetItems(ec.db, args.name, args.items, { locale: args.locale }));
 		} catch (error) {
 			return respondHandlerError(error, "MENU_SET_ITEMS_ERROR");
@@ -1668,7 +1807,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.EDITOR);
 		const ec = getEmDash(extra);
 		try {
-			const { handleSettingsGet } = await import("../../../settings-DjtkUo__.mjs").then((n) => n.r);
+			const { handleSettingsGet } = await import("../../../settings-AnEFYICn.mjs").then((n) => n.r);
 			return unwrap(await handleSettingsGet(ec.db, ec.storage));
 		} catch (error) {
 			return respondHandlerError(error, "SETTINGS_READ_ERROR");
@@ -1682,7 +1821,7 @@ function createMcpServer(pluginTools = [], request) {
 			tagline: z.string().optional().describe("Site tagline / short description"),
 			logo: settingsMediaReferenceSchema.optional().describe("Logo media reference ({ mediaId, alt? })"),
 			favicon: settingsMediaReferenceSchema.optional().describe("Favicon media reference ({ mediaId, alt? })"),
-			url: z.union([z.string().url().refine((u) => HTTP_SCHEME_PATTERN.test(u), "URL must use http or https"), z.literal("")]).optional().describe("Canonical site URL (http or https). Empty string clears it."),
+			url: z.union([z.url().refine((u) => HTTP_SCHEME_PATTERN.test(u), "URL must use http or https"), z.literal("")]).optional().describe("Canonical site URL (http or https). Empty string clears it."),
 			postsPerPage: z.number().int().min(1).max(100).optional().describe("Default page size for content listings"),
 			dateFormat: z.string().optional().describe("Date format token string"),
 			timezone: z.string().optional().describe("IANA timezone identifier"),
@@ -1694,7 +1833,7 @@ function createMcpServer(pluginTools = [], request) {
 		requireRole(extra, Role.ADMIN);
 		const ec = getEmDash(extra);
 		try {
-			const { handleSettingsUpdate } = await import("../../../settings-DjtkUo__.mjs").then((n) => n.r);
+			const { handleSettingsUpdate } = await import("../../../settings-AnEFYICn.mjs").then((n) => n.r);
 			return unwrap(await handleSettingsUpdate(ec.db, ec.storage, args));
 		} catch (error) {
 			return respondHandlerError(error, "SETTINGS_UPDATE_ERROR");