emdash 0.40.1 → 0.42.0

package/src/mcp/server.ts

@@ -30,6 +30,8 @@ import {
 	updateTaxonomyDefBody,
 } from "#api/schemas.js";
 
+import { after } from "../after.js";
+import { claimEntryLockForWrite } from "../api/handlers/entry-lock.js";
 import type { MediaUsageRepairRequest } from "../api/schemas/media-usage.js";
 import type { EmDashHandlers } from "../astro/types.js";
 import { hasScope } from "../auth/api-tokens.js";
@@ -80,6 +82,17 @@ const REV_PARAM_DESCRIPTION =
 const REV_MISSING_ERROR =
 	"_rev is required: call content_get for this item and pass back the _rev it returns.";
 
+/**
+ * Shared wording for the `overrideLock` parameter on write tools. Agents only
+ * see the tool schema, and re-reading never clears ENTRY_LOCKED, so when to
+ * override is stated here.
+ */
+const OVERRIDE_LOCK_PARAM_DESCRIPTION =
+	"Write even though someone else has this item open in the admin. Without it, " +
+	"the call fails with ENTRY_LOCKED and the error names who is editing; calling " +
+	"content_get again does not clear it. Tell the user who holds the item, and " +
+	"set this only if they ask you to write anyway.";
+
 const SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
 const TRANSFER_OPERATION_ID_PATTERN = /^[0-9A-Za-z_-]{1,64}$/;
 
@@ -220,7 +233,7 @@ const schemaUpdateCollectionToolSchema = z.object({
 		"Complete feature list to enable; omit to preserve the current list",
 	),
 	urlPattern: updateCollectionBody.shape.urlPattern.describe(
-		"New public URL pattern; pass null to clear it",
+		"New public URL pattern such as /blog/{slug}, with at most one placeholder per path segment; pass null to clear it",
 	),
 	routable: updateCollectionBody.shape.routable.describe(
 		"Whether entries require a slug before they can be published",
@@ -797,6 +810,24 @@ function extractContentId(data: unknown): string | undefined {
 	return typeof item?.id === "string" ? item.id : undefined;
 }
 
+/**
+ * Refuses a write while another user holds the entry's edit lock. Resolves to
+ * `null` when the write may proceed, and extends the caller's own lease if they
+ * hold it.
+ */
+async function refuseLockedEntry(
+	extra: { authInfo?: { extra?: Record<string, unknown> } },
+	collection: string,
+	entryId: string,
+	overrideLock: boolean | undefined,
+): Promise<ErrorEnvelope | null> {
+	const { emdash, userId } = getExtra(extra);
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, entryId, userId, {
+		override: overrideLock,
+	});
+	return refusal ? respondError(refusal.code, refusal.message, { ...refusal.details }) : null;
+}
+
 /** Extract the `_rev` token from a content handler response. */
 function extractContentRev(data: unknown): string | undefined {
 	if (!data || typeof data !== "object") return undefined;
@@ -1293,6 +1324,7 @@ export function createMcpServer(
 					.optional()
 					.describe("Treat an entirely keyless blocks array as an explicit replacement"),
 				_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1328,9 +1360,15 @@ export function createMcpServer(
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
 
+			if (args.status !== undefined) {
+				requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
+			}
+
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
+
 			// Status transitions route through dedicated handlers for proper revision management
 			if (args.status === "published") {
-				requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
 				let rev: string | undefined = args._rev;
 				let liveChanged = false;
 				if (
@@ -1371,7 +1409,6 @@ export function createMcpServer(
 			}
 
 			if (args.status === "draft") {
-				requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
 				let rev: string | undefined = args._rev;
 				let liveChanged = false;
 				if (
@@ -1440,6 +1477,7 @@ export function createMcpServer(
 			inputSchema: z.object({
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 			annotations: { destructiveHint: true },
 		},
@@ -1461,6 +1499,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(extra, await ec.handleContentDelete(args.collection, resolvedId), [
 				args.collection,
 				resolvedId,
@@ -1552,6 +1592,7 @@ export function createMcpServer(
 					.describe(
 						"Override publication timestamp (ISO 8601). Requires content:publish_any permission. Useful when importing content with original publish dates.",
 					),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1580,6 +1621,8 @@ export function createMcpServer(
 			}
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await emdash.handleContentPublish(args.collection, resolvedId, {
@@ -1605,6 +1648,7 @@ export function createMcpServer(
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
 				_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1625,6 +1669,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentUnpublish(args.collection, resolvedId, {
@@ -1652,6 +1698,7 @@ export function createMcpServer(
 				scheduledAt: contentDateTimeInputSchema.describe(
 					"ISO 8601 datetime for publication (e.g. '2025-06-01T09:00:00Z')",
 				),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1672,6 +1719,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentSchedule(args.collection, resolvedId, args.scheduledAt, {
@@ -1695,6 +1744,7 @@ export function createMcpServer(
 			inputSchema: z.object({
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1714,6 +1764,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentUnschedule(args.collection, resolvedId),
@@ -1755,6 +1807,7 @@ export function createMcpServer(
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
 				_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 			annotations: { destructiveHint: true },
 		},
@@ -1776,6 +1829,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentDiscardDraft(args.collection, resolvedId, { _rev: args._rev }),
@@ -1972,7 +2027,11 @@ export function createMcpServer(
 			try {
 				const { handleBylineCreate } = await import("../api/handlers/bylines.js");
 				const result = await handleBylineCreate(ec.db, args);
-				if (result.success) await invalidateBylines();
+				if (result.success) {
+					await invalidateBylines();
+					const byline = result.data;
+					after(() => ec.hooks.runBylineAfterSave(byline, true));
+				}
 				return unwrap(result);
 			} catch (error) {
 				return respondHandlerError(error, "BYLINE_CREATE_ERROR");
@@ -2000,7 +2059,11 @@ export function createMcpServer(
 				const { handleBylineUpdate } = await import("../api/handlers/bylines.js");
 				const { id, ...input } = args;
 				const result = await handleBylineUpdate(ec.db, id, input);
-				if (result.success) await invalidateBylines();
+				if (result.success) {
+					await invalidateBylines();
+					const byline = result.data;
+					after(() => ec.hooks.runBylineAfterSave(byline, false));
+				}
 				return unwrap(result);
 			} catch (error) {
 				return respondHandlerError(error, "BYLINE_UPDATE_ERROR");
@@ -2026,9 +2089,14 @@ export function createMcpServer(
 			const ec = getEmDash(extra);
 			try {
 				const { BylineRepository } = await import("../database/repositories/byline.js");
-				const deleted = await new BylineRepository(ec.db).delete(args.id);
+				const repo = new BylineRepository(ec.db);
+				const existing = ec.hooks.hasHooks("byline:afterDelete")
+					? await repo.findById(args.id)
+					: null;
+				const deleted = await repo.delete(args.id);
 				if (!deleted) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 				await invalidateBylines();
+				if (existing) after(() => ec.hooks.runBylineAfterDelete(existing));
 				return jsonResult({ deleted: args.id });
 			} catch (error) {
 				return respondHandlerError(error, "BYLINE_DELETE_ERROR");
@@ -2242,7 +2310,7 @@ export function createMcpServer(
 				label: z.string().describe("Display name (plural, e.g. 'Blog Posts')"),
 				labelSingular: z.string().optional().describe("Singular display name (e.g. 'Blog Post')"),
 				description: z.string().optional().describe("Description of this collection"),
-				icon: z.string().optional().describe("Icon name for the admin UI"),
+				icon: createCollectionBody.shape.icon.describe("Icon name for the admin UI"),
 				supports: createCollectionBody.shape.supports.describe(
 					"Features to enable (default: ['drafts', 'revisions'])",
 				),
@@ -2591,6 +2659,10 @@ export function createMcpServer(
 					.regex(CONTENT_TYPE_RE, "Invalid content type")
 					.describe("MIME type (e.g. 'image/png')."),
 				alt: z.string().optional().describe("Alt text for accessibility"),
+				caption: z
+					.string()
+					.optional()
+					.describe("Caption stored on the media record, such as the credit"),
 			}),
 			annotations: { destructiveHint: false },
 		},
@@ -2608,6 +2680,7 @@ export function createMcpServer(
 						base64: args.base64,
 						contentType: args.contentType,
 						alt: args.alt,
+						caption: args.caption,
 						authorId: userId,
 						maxUploadSize: emdash.config.maxUploadSize,
 					}),
@@ -3025,7 +3098,7 @@ export function createMcpServer(
 
 				const { TaxonomyRepository } = await import("../database/repositories/taxonomy.js");
 				const repo = new TaxonomyRepository(ec.db);
-				const limit = Math.min(args.limit ?? 50, 100);
+				const limit = Math.max(1, Math.min(args.limit ?? 50, 100));
 				let cursor: TaxonomyListCursor | undefined;
 				if (args.cursor) {
 					try {
@@ -3537,6 +3610,7 @@ export function createMcpServer(
 				"use content_publish afterward if needed.",
 			inputSchema: z.object({
 				revisionId: z.string().describe("Revision ID to restore"),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -3569,6 +3643,14 @@ export function createMcpServer(
 				"content:edit_any",
 			);
 
+			const locked = await refuseLockedEntry(
+				extra,
+				revItem.collection,
+				revItem.entryId,
+				args.overrideLock,
+			);
+			if (locked) return locked;
+
 			return unwrap(await emdash.handleRevisionRestore(args.revisionId, userId));
 		},
 	);

package/src/media/usage/activation.ts

@@ -102,10 +102,17 @@ export async function canResumeMediaUsageCollectionCapture(
 	db: Kysely<Database>,
 	identity: { collectionId: string; collectionSlug: string; creationFingerprint?: string },
 ): Promise<boolean> {
+	return (await findResumableMediaUsageCollectionCaptureId(db, identity)) === identity.collectionId;
+}
+
+export async function findResumableMediaUsageCollectionCaptureId(
+	db: Kysely<Database>,
+	identity: { collectionSlug: string; creationFingerprint?: string },
+): Promise<string | null> {
 	const activation = await findActivationIfAvailable(db);
-	if (!activation) return false;
+	if (!activation) return null;
 	assertRuntimeGeneration(activation);
-	if (activation.state !== "active") return false;
+	if (activation.state !== "active") return null;
 
 	const lifecycle = await db
 		.selectFrom("_emdash_media_usage_index_status")
@@ -113,15 +120,17 @@ export async function canResumeMediaUsageCollectionCapture(
 		.where("adapter_id", "=", "content-media")
 		.where("scope_type", "=", "collection")
 		.where("scope_key", "=", identity.collectionSlug)
-		.where("collection_id", "=", identity.collectionId)
 		.where("capture_state", "in", ["installing", "ready"])
 		.executeTakeFirst();
-	return (
-		lifecycle?.collection_id === identity.collectionId &&
-		(identity.creationFingerprint
-			? lifecycle.cursor === identity.creationFingerprint
-			: lifecycle.cursor === null)
-	);
+	if (!lifecycle?.collection_id) return null;
+	if (
+		identity.creationFingerprint
+			? lifecycle.cursor !== identity.creationFingerprint
+			: lifecycle.cursor !== null
+	) {
+		return null;
+	}
+	return lifecycle.collection_id;
 }
 
 export async function prepareMediaUsageCollectionCapture(

package/src/migrations/config-loader.ts

@@ -121,11 +121,16 @@ async function loadProjectConfig(projectRoot: string, configFile: string): Promi
 			"The Vite installation used by project-local Astro does not export loadConfigFromFile",
 		);
 	}
+	// The runner transforms dependencies that publish TypeScript source. The
+	// default bundle loader leaves them to Node, which refuses to strip types
+	// under node_modules.
 	const loaded: unknown = await Reflect.apply(loadConfigFromFile, undefined, [
 		{ command: "build", mode: "production" },
 		configFile,
 		projectRoot,
 		"silent",
+		undefined,
+		"runner",
 	]);
 	if (!isRecord(loaded) || !Object.hasOwn(loaded, "config")) {
 		throw new MigrationConfigLoaderError(`Vite could not load Astro config: ${configFile}`);

package/src/object-cache/index.ts

@@ -398,13 +398,20 @@ function epochsMatch(stored: readonly number[], current: readonly number[]): boo
 
 /**
  * Requests that must always read live data and never populate the cache:
- * visual edit mode, preview tokens, and isolated databases (playground / DO
- * preview, whose schema and content diverge from the configured site).
+ * visual edit mode, preview tokens, isolated databases (playground / DO
+ * preview, whose schema and content diverge from the configured site), and
+ * Astro route-cache fills that must not rebuild a purged page from a stale
+ * object-cache snapshot.
  */
 function shouldBypass(): boolean {
 	const ctx = getRequestContext();
 	if (!ctx) return false;
-	return ctx.editMode === true || ctx.preview !== undefined || ctx.dbIsIsolated === true;
+	return (
+		ctx.editMode === true ||
+		ctx.preview !== undefined ||
+		ctx.dbIsIsolated === true ||
+		ctx.routeCacheFill === true
+	);
 }
 
 /**
@@ -782,11 +789,16 @@ function legacyContentNamespace(collection: string): string {
 }
 
 /**
- * Content epochs carried by current cache entries. The legacy epoch keeps
- * invalidation compatible with publishers from the previous release during a
- * rolling deployment; the versioned epoch makes old cached values unreachable.
+ * Content epochs carried by current cache entries. The versioned namespace
+ * makes snapshots written before the current cache format unreachable.
  */
 export function contentCacheNamespaces(collection: string): readonly string[] {
+	return [contentNamespace(collection)];
+}
+
+function contentInvalidationNamespaces(collection: string): readonly string[] {
+	// Keep bumping the legacy epoch so older readers remain safe during rolling
+	// deploys, but current readers no longer fetch that compatibility key.
 	return [contentNamespace(collection), legacyContentNamespace(collection)];
 }
 
@@ -803,7 +815,7 @@ export function contentNamespaces(collection: string): readonly string[] {
  * Call from every write path that mutates rows in `ec_<collection>`.
  */
 export function invalidateCollectionCache(collection: string): void {
-	for (const namespace of contentCacheNamespaces(collection)) {
+	for (const namespace of contentInvalidationNamespaces(collection)) {
 		invalidateObjectCache(namespace);
 	}
 }

package/src/object-cache/types.ts

@@ -79,8 +79,9 @@ export interface ObjectCacheRuntimeConfig {
 	 * is only part of the cross-isolate staleness: a distributed backend adds its
 	 * own propagation delay (KV's edge cache is eventually consistent, up to
 	 * ~60s), so on KV the effective window is that propagation plus this value.
-	 * Only anonymous visitors are affected — preview and edit requests bypass the
-	 * cache.
+	 * Preview and edit requests bypass the cache. Renders that may fill Astro's
+	 * route cache also bypass it, preventing an older KV snapshot from being
+	 * stored as a fresh HTML response after a purge.
 	 *
 	 * Set to `0` to re-read the epoch on every query (strongest freshness, more
 	 * backend reads).

package/src/plugin-types.ts

@@ -51,6 +51,8 @@ import type { ZodType } from "zod";
 import type { SandboxHookErrorEnvelope } from "./plugins/sandbox/hook-result.js";
 import type {
 	ActorInfo,
+	BylineAfterDeleteHandler,
+	BylineAfterSaveHandler,
 	CommentAfterCreateEvent,
 	CommentAfterCreateHandler,
 	CommentAfterModerateEvent,
@@ -140,6 +142,8 @@ export interface HookHandlers {
 	"comment:moderate": CommentModerateHandler;
 	"comment:afterCreate": CommentAfterCreateHandler;
 	"comment:afterModerate": CommentAfterModerateHandler;
+	"byline:afterSave": BylineAfterSaveHandler;
+	"byline:afterDelete": BylineAfterDeleteHandler;
 	"page:metadata": PageMetadataHandler;
 	"page:fragments": PageFragmentHandler;
 }
@@ -381,6 +385,9 @@ export type {
 };
 
 export type {
+	BylineAfterDeleteEvent,
+	BylineAfterSaveEvent,
+	BylineInfo,
 	PaginatedResult,
 	VersionedValue,
 	ConditionalWriteResult,

package/src/plugins/adapt-sandbox-entry.ts

@@ -10,17 +10,21 @@
  *
  */
 
+import { z } from "zod";
+
 import type { PluginDescriptor } from "../astro/integration/runtime.js";
 import type { RouteEntry, RouteHandler, SandboxedPlugin } from "../plugin-types.js";
 import { PLUGIN_CAPABILITIES, HOOK_NAMES } from "./manifest-schema.js";
 import { sanitizeHeadersForSandbox } from "./request-meta.js";
 import { normalizePluginCapabilities } from "./types.js";
 import type {
+	ManifestMcpTool,
 	ResolvedPlugin,
 	ResolvedPluginHooks,
 	ResolvedHook,
 	PluginRoute,
 	PluginCapability,
+	PluginMcpToolDefinition,
 	PluginStorageConfig,
 	PluginAdminConfig,
 } from "./types.js";
@@ -347,19 +351,50 @@ export function adaptSandboxEntry(
 		hooks: resolvedHooks,
 		routes: resolvedRoutes,
 		mcp: {
-			tools: Object.fromEntries(
-				Object.entries(definition.mcp?.tools ?? {}).map(([name, tool]) => [
-					name,
-					{
-						description: tool.description,
-						route: tool.route,
-						input: tool.input,
-						output: tool.output,
-						destructive: tool.destructive,
-					},
-				]),
-			),
+			tools: {
+				// `emdash-plugin build` removes `mcp` from the runtime module and
+				// ships the tools in the descriptor instead.
+				...Object.fromEntries(
+					(descriptor.mcp?.tools ?? []).map((tool) => [tool.name, toolFromManifest(tool)]),
+				),
+				...Object.fromEntries(
+					Object.entries(definition.mcp?.tools ?? {}).map(([name, tool]) => [
+						name,
+						{
+							description: tool.description,
+							route: tool.route,
+							input: tool.input,
+							output: tool.output,
+							destructive: tool.destructive,
+						},
+					]),
+				),
+			},
 		},
 		admin,
 	};
 }
+
+/**
+ * An MCP tool from its serialized manifest form. The schemas are converted
+ * on first use: turning JSON Schema back into Zod takes milliseconds per
+ * tool, and this adapter runs on every cold start, public requests included.
+ */
+function toolFromManifest(tool: ManifestMcpTool): PluginMcpToolDefinition {
+	let input: z.ZodType | undefined;
+	let output: z.ZodType | undefined;
+	return {
+		description: tool.description,
+		route: tool.route,
+		destructive: tool.destructive,
+		get input() {
+			input ??= z.fromJSONSchema({ ...tool.inputSchema });
+			return input;
+		},
+		get output() {
+			if (!tool.outputSchema) return undefined;
+			output ??= z.fromJSONSchema({ ...tool.outputSchema });
+			return output;
+		},
+	};
+}

package/src/plugins/byline-access.ts

@@ -0,0 +1,158 @@
+import { sql, type Kysely } from "kysely";
+
+import { resolveBylineCredits, type BylineEntry } from "../bylines/credits.js";
+import {
+	decodeCursor,
+	encodeCursor,
+	type ContentBylineCredit,
+} from "../database/repositories/types.js";
+import type { Database } from "../database/types.js";
+import { validateIdentifier } from "../database/validate.js";
+import { chunks, SQL_BATCH_SIZE } from "../utils/chunks.js";
+import type { BylineAccess, BylineCreditInfo, BylineInfo } from "./types.js";
+
+const MAX_BYLINE_ENTRY_IDS = 100;
+
+const DEFAULT_LIST_LIMIT = 50;
+const MAX_LIST_LIMIT = 100;
+
+interface PublicBylineFields {
+	id: string;
+	slug: string;
+	displayName: string;
+	bio: string | null;
+	websiteUrl: string | null;
+	avatarMediaId: string | null;
+	locale: string;
+	translationGroup: string | null;
+}
+
+export function toBylineInfo(byline: PublicBylineFields): BylineInfo {
+	return {
+		id: byline.id,
+		slug: byline.slug,
+		displayName: byline.displayName,
+		bio: byline.bio,
+		websiteUrl: byline.websiteUrl,
+		avatarMediaId: byline.avatarMediaId,
+		locale: byline.locale,
+		translationGroup: byline.translationGroup ?? byline.id,
+	};
+}
+
+function toCreditInfo(credit: ContentBylineCredit): BylineCreditInfo {
+	return {
+		byline: toBylineInfo(credit.byline),
+		sortOrder: credit.sortOrder,
+		roleLabel: credit.roleLabel,
+		source: credit.source ?? "explicit",
+	};
+}
+
+function clampListLimit(limit: number | undefined): number {
+	if (limit === undefined || !Number.isFinite(limit)) return DEFAULT_LIST_LIMIT;
+	return Math.min(Math.max(Math.trunc(limit), 1), MAX_LIST_LIMIT);
+}
+
+function selectPublicBylines(db: Kysely<Database>) {
+	return db
+		.selectFrom("_emdash_bylines")
+		.select([
+			"id",
+			"slug",
+			"display_name as displayName",
+			"bio",
+			"website_url as websiteUrl",
+			"avatar_media_id as avatarMediaId",
+			"locale",
+			"translation_group as translationGroup",
+			"created_at as createdAt",
+		]);
+}
+
+async function loadEntryRefs(
+	db: Kysely<Database>,
+	collection: string,
+	entryIds: string[],
+): Promise<BylineEntry[]> {
+	const tableName = `ec_${collection}`;
+	const refs: BylineEntry[] = [];
+	for (const chunk of chunks(entryIds, SQL_BATCH_SIZE)) {
+		const result = await sql<{
+			id: string;
+			author_id: string | null;
+			primary_byline_id: string | null;
+			locale: string | null;
+		}>`
+			SELECT id, author_id, primary_byline_id, locale FROM ${sql.ref(tableName)}
+			WHERE id IN (${sql.join(chunk)})
+			AND deleted_at IS NULL
+		`.execute(db);
+		for (const row of result.rows) {
+			refs.push({
+				id: row.id,
+				authorId: row.author_id,
+				primaryBylineId: row.primary_byline_id,
+				locale: row.locale,
+			});
+		}
+	}
+	return refs;
+}
+
+/**
+ * Create read-only byline access (gated on `bylines:read`).
+ */
+export function createBylineAccess(db: Kysely<Database>): BylineAccess {
+	return {
+		async get(id) {
+			const row = await selectPublicBylines(db).where("id", "=", id).executeTakeFirst();
+			return row ? toBylineInfo(row) : null;
+		},
+
+		async list(options) {
+			const limit = clampListLimit(options?.limit);
+			let query = selectPublicBylines(db)
+				.orderBy("created_at", "desc")
+				.orderBy("id", "desc")
+				.limit(limit + 1);
+			if (options?.locale !== undefined) query = query.where("locale", "=", options.locale);
+			if (options?.cursor) {
+				const decoded = decodeCursor(options.cursor);
+				query = query.where((eb) =>
+					eb.or([
+						eb("created_at", "<", decoded.orderValue),
+						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+					]),
+				);
+			}
+
+			const rows = await query.execute();
+			const pageRows = rows.slice(0, limit);
+			const last = pageRows.at(-1);
+			return {
+				items: pageRows.map(toBylineInfo),
+				hasMore: rows.length > limit,
+				...(rows.length > limit && last ? { cursor: encodeCursor(last.createdAt, last.id) } : {}),
+			};
+		},
+
+		async getEntriesBylines(collection, entryIds) {
+			validateIdentifier(collection, "collection");
+			const uniqueIds = [...new Set(entryIds)];
+			if (uniqueIds.length > MAX_BYLINE_ENTRY_IDS) {
+				throw new Error(`Byline lookups accept at most ${MAX_BYLINE_ENTRY_IDS} entry IDs`);
+			}
+			if (uniqueIds.length === 0) return [];
+
+			const refs = await loadEntryRefs(db, collection, uniqueIds);
+			const credits = await resolveBylineCredits(db, collection, refs, {
+				hydrateCustomFields: false,
+			});
+			return uniqueIds.map((entryId) => ({
+				entryId,
+				bylines: (credits.get(entryId) ?? []).map(toCreditInfo),
+			}));
+		},
+	};
+}