emdash 0.41.0 → 0.42.0

package/src/import/wxr-taxonomies.ts

@@ -179,60 +179,132 @@ export async function loadTaxonomyPlanFromDb(db: Kysely<Database>): Promise<Taxo
 	return state.plan;
 }
 
+interface TermDescriptor {
+	taxonomyName: string;
+	slug: string;
+	label: string;
+	description?: string;
+}
+
+function termKey(taxonomyName: string, slug: string): string {
+	return `${taxonomyName}\u0000${slug}`;
+}
+
 /**
- * Find or create a term in the given taxonomy. Returns the term id. Callers
- * must verify the taxonomy def exists before calling — this helper assumes
- * the def is present.
+ * Find or create many terms in a small number of batched SELECTs instead of
+ * one SELECT per term. This is the dominant fixed cost for WXR imports with
+ * large category/tag vocabularies: a site with 100+ categories would otherwise
+ * spend one D1 round-trip per category before writing any posts.
  *
- * Note: we don't resolve WordPress parent slugs into EmDash parent ids in
- * this pass. WXR exports list categories in arbitrary order, so a category's
- * parent may not exist yet when we first see it. Hierarchy is preserved at
- * the data level (the parent slug is on `WxrCategory.parent`) but flattens
- * in EmDash for now; restoring the tree is a follow-up improvement.
+ * Batching rules:
+ *   - Descriptors already resolved in `state.plan.termIdByNameAndSlug` are
+ *     skipped (same idempotency as the old per-term loop).
+ *   - Remaining descriptors are deduplicated by `(taxonomy, slug)`; the first
+ *     label/description seen wins, matching the old behaviour where the first
+ *     `ensureTerm` call cached the id.
+ *   - One batched SELECT resolves existing rows at the requested locale.
+ *   - One batched SELECT resolves any-locale rows for use as `translationOf`.
+ *   - Missing rows are still created one at a time because each insert needs
+ *     its own ULID/translation_group/sort_order bookkeeping, but the reads are
+ *     where the round-trip bottleneck lives.
  */
-async function ensureTerm(
-	repo: TaxonomyRepository,
+async function ensureTermsBatch(
+	db: Kysely<Database>,
 	state: TaxonomyImportState,
-	taxonomyName: string,
-	slug: string,
-	label: string,
-	description: string | undefined,
+	descriptors: TermDescriptor[],
 	locale: string | undefined,
-): Promise<string> {
-	// Already resolved in this run (e.g. seen in `wp:category` AND in a per-
-	// item `<category>` element).
-	const cached = state.plan.termIdByNameAndSlug.get(taxonomyName)?.get(slug);
-	if (cached) return cached;
-
-	const existing = await repo.findBySlug(taxonomyName, slug, locale);
-	if (existing) {
-		bump(state.plan.termsReused, taxonomyName);
-		rememberTerm(state, taxonomyName, slug, existing.id);
-		return existing.id;
+): Promise<void> {
+	if (descriptors.length === 0) return;
+
+	const repo = new TaxonomyRepository(db);
+
+	const needed: TermDescriptor[] = [];
+	const seenKeys = new Set<string>();
+	for (const d of descriptors) {
+		if (state.plan.termIdByNameAndSlug.get(d.taxonomyName)?.has(d.slug)) continue;
+		const key = termKey(d.taxonomyName, d.slug);
+		if (seenKeys.has(key)) continue;
+		seenKeys.add(key);
+		needed.push(d);
+	}
+	if (needed.length === 0) return;
+
+	// Resolve existing rows at the requested locale in one round-trip.
+	const existingAtLocale = await findExistingTerms(db, needed, locale);
+	for (const row of existingAtLocale) {
+		bump(state.plan.termsReused, row.name);
+		rememberTerm(state, row.name, row.slug, row.id);
+	}
+
+	// Build the list of descriptors that still need creation.
+	const stillNeeded: TermDescriptor[] = [];
+	for (const d of needed) {
+		if (!state.plan.termIdByNameAndSlug.get(d.taxonomyName)?.has(d.slug)) {
+			stillNeeded.push(d);
+		}
+	}
+	if (stillNeeded.length === 0) return;
+
+	// Resolve any-locale rows once for translationOf linking.
+	const anyLocaleRows = await findExistingTerms(db, stillNeeded, undefined);
+	const translationOfByKey = new Map<string, string>();
+	for (const row of anyLocaleRows) {
+		const key = termKey(row.name, row.slug);
+		if (!translationOfByKey.has(key)) translationOfByKey.set(key, row.id);
 	}
 
-	// No row at the requested locale. Before creating, check whether a
-	// `(name, slug)` row exists in some OTHER locale -- e.g. the admin
-	// pre-created an Arabic translation, and now an `en` import wants the
-	// canonical row. We need to mint the new row inside the existing row's
-	// `translation_group` so per-locale lookups across the family work.
-	// Without this, the mirror pass would later refuse to reconcile (it
-	// sees pre-existing rows in a different group as a no-op) and pivots
-	// would point at a group that has no row in the requested locale.
-	const anyLocale = await repo.findBySlug(taxonomyName, slug);
-	const translationOf = anyLocale?.id;
-
-	const created = await repo.create({
-		name: taxonomyName,
-		slug,
-		label,
-		data: description ? { description } : undefined,
-		locale,
-		translationOf,
-	});
-	bump(state.plan.termsCreated, taxonomyName);
-	rememberTerm(state, taxonomyName, slug, created.id);
-	return created.id;
+	for (const d of stillNeeded) {
+		const created = await repo.create({
+			name: d.taxonomyName,
+			slug: d.slug,
+			label: d.label,
+			data: d.description ? { description: d.description } : undefined,
+			locale,
+			translationOf: translationOfByKey.get(termKey(d.taxonomyName, d.slug)),
+		});
+		bump(state.plan.termsCreated, d.taxonomyName);
+		rememberTerm(state, d.taxonomyName, d.slug, created.id);
+	}
+}
+
+/**
+ * Batched lookup of term rows for a list of `(taxonomy, slug)` pairs.
+ * Chunks at `SQL_BATCH_SIZE / 2` because each pair consumes two bind
+ * parameters (`name` and `slug`). When `locale` is omitted, returns rows
+ * for all locales ordered by locale ascending so callers can pick the first
+ * row per pair (mirroring `TaxonomyRepository.findBySlug` without a locale
+ * argument).
+ */
+async function findExistingTerms(
+	db: Kysely<Database>,
+	descriptors: TermDescriptor[],
+	locale: string | undefined,
+): Promise<Array<{ id: string; name: string; slug: string }>> {
+	const { chunks, SQL_BATCH_SIZE } = await import("../utils/chunks.js");
+	const rows: Array<{ id: string; name: string; slug: string }> = [];
+	const seenKeys = new Set<string>();
+
+	// Each pair uses 2 bind params, so limit each batch to SQL_BATCH_SIZE / 2 pairs.
+	for (const batch of chunks(descriptors, Math.floor(SQL_BATCH_SIZE / 2))) {
+		const batchRows = await db
+			.selectFrom("taxonomies")
+			.select(["id", "name", "slug"])
+			.where((eb) =>
+				eb.or(batch.map((d) => eb.and([eb("name", "=", d.taxonomyName), eb("slug", "=", d.slug)]))),
+			)
+			.$if(locale !== undefined, (qb) => qb.where("locale", "=", locale!))
+			.orderBy("locale", "asc")
+			.execute();
+
+		for (const row of batchRows) {
+			const key = termKey(row.name, row.slug);
+			if (seenKeys.has(key)) continue;
+			seenKeys.add(key);
+			rows.push(row);
+		}
+	}
+
+	return rows;
 }
 
 /**
@@ -269,7 +341,6 @@ export async function preImportWxrTaxonomies(
 	locale: string | undefined,
 ): Promise<TaxonomyImportPlan> {
 	const state = makeState();
-	const repo = new TaxonomyRepository(db);
 
 	// Cache def lookups for the duration of the import. Keyed by name; value
 	// is `null` when we've already determined the taxonomy is missing (so we
@@ -287,38 +358,40 @@ export async function preImportWxrTaxonomies(
 		return def;
 	};
 
-	// Pass 1: top-level <wp:category> blocks -> EmDash `category` taxonomy.
+	// Pass 1-3: collect every term declared at the top of the WXR, then
+	// resolve them in a few batched queries instead of one round-trip per term.
 	const categoryDef = await lookupDef("category");
+	const tagDef = await lookupDef("tag");
+	const topLevel: TermDescriptor[] = [];
+
 	if (categoryDef) {
 		for (const cat of categories) {
-			const slug = cat.nicename;
-			const label = cat.name;
-			if (!slug || !label) continue;
-			await ensureTerm(repo, state, "category", slug, label, cat.description, locale);
+			if (!cat.nicename || !cat.name) continue;
+			topLevel.push({
+				taxonomyName: "category",
+				slug: cat.nicename,
+				label: cat.name,
+				description: cat.description,
+			});
 		}
 	} else if (categories.length > 0) {
-		// Seeded `category` def was deleted by the user — record so the
-		// import response can surface why none of the categories landed.
 		state.plan.missingTaxonomies.push("category");
 	}
 
-	// Pass 2: top-level <wp:tag> blocks -> EmDash `tag` taxonomy.
-	const tagDef = await lookupDef("tag");
 	if (tagDef) {
 		for (const tag of tags) {
-			const slug = tag.slug;
-			const label = tag.name;
-			if (!slug || !label) continue;
-			await ensureTerm(repo, state, "tag", slug, label, tag.description, locale);
+			if (!tag.slug || !tag.name) continue;
+			topLevel.push({
+				taxonomyName: "tag",
+				slug: tag.slug,
+				label: tag.name,
+				description: tag.description,
+			});
 		}
 	} else if (tags.length > 0) {
 		state.plan.missingTaxonomies.push("tag");
 	}
 
-	// Pass 3: <wp:term> blocks for custom taxonomies (genre, etc.). Skipped:
-	//   - `nav_menu`: menus are handled by `importMenusFromWxr`.
-	//   - `language`: Polylang's locale signal; promoted to `WxrPost.locale`
-	//     by the parser and not a content taxonomy in EmDash.
 	for (const term of terms) {
 		if (term.taxonomy === "nav_menu" || term.taxonomy === "language") continue;
 		// Normalize WordPress' `post_tag` synonym -> EmDash `tag`. WordPress
@@ -332,16 +405,23 @@ export async function preImportWxrTaxonomies(
 			}
 			continue;
 		}
-		await ensureTerm(repo, state, taxonomyName, term.slug, term.name, term.description, locale);
+		topLevel.push({
+			taxonomyName,
+			slug: term.slug,
+			label: term.name,
+			description: term.description,
+		});
 	}
 
+	await ensureTermsBatch(db, state, topLevel, locale);
+
 	// Pass 4: per-item assignments. Backfills terms missing from the top-
 	// level blocks (rare, but observed in hand-edited or partial exports).
-	// Labels come from the per-item `<category>` text body when the parser
-	// captured one; otherwise we fall back to the slug. This is the path
-	// for older exports that skip top-level `<wp:category>` definitions.
+	// Collect every assignment first so we can batch-resolve them too.
+	const fromPosts: TermDescriptor[] = [];
 	let recordedMissingCategoryFromPosts = false;
 	let recordedMissingTagFromPosts = false;
+
 	for (const post of posts) {
 		for (const slug of post.categories) {
 			if (!categoryDef) {
@@ -355,15 +435,11 @@ export async function preImportWxrTaxonomies(
 				break;
 			}
 			if (state.plan.termIdByNameAndSlug.get("category")?.has(slug)) continue;
-			await ensureTerm(
-				repo,
-				state,
-				"category",
+			fromPosts.push({
+				taxonomyName: "category",
 				slug,
-				labelFor(post, "category", slug),
-				undefined,
-				locale,
-			);
+				label: labelFor(post, "category", slug),
+			});
 		}
 		for (const slug of post.tags) {
 			if (!tagDef) {
@@ -374,13 +450,14 @@ export async function preImportWxrTaxonomies(
 				break;
 			}
 			if (state.plan.termIdByNameAndSlug.get("tag")?.has(slug)) continue;
-			await ensureTerm(repo, state, "tag", slug, labelFor(post, "tag", slug), undefined, locale);
+			fromPosts.push({
+				taxonomyName: "tag",
+				slug,
+				label: labelFor(post, "tag", slug),
+			});
 		}
 		if (post.customTaxonomies) {
 			for (const [rawName, slugs] of post.customTaxonomies) {
-				// `nav_menu` is handled by the menu importer; `language` is
-				// Polylang's per-post locale signal, already promoted by the
-				// parser.
 				if (rawName === "nav_menu" || rawName === "language") continue;
 				const taxonomyName = rawName === "post_tag" ? "tag" : rawName;
 				const def = await lookupDef(taxonomyName);
@@ -392,20 +469,18 @@ export async function preImportWxrTaxonomies(
 				}
 				for (const slug of slugs) {
 					if (state.plan.termIdByNameAndSlug.get(taxonomyName)?.has(slug)) continue;
-					await ensureTerm(
-						repo,
-						state,
+					fromPosts.push({
 						taxonomyName,
 						slug,
-						labelFor(post, taxonomyName, slug),
-						undefined,
-						locale,
-					);
+						label: labelFor(post, taxonomyName, slug),
+					});
 				}
 			}
 		}
 	}
 
+	await ensureTermsBatch(db, state, fromPosts, locale);
+
 	// `content_taxonomies` writes happen later in `attachPostTaxonomies`, but
 	// term inserts above already invalidate the in-memory "has any terms" probe.
 	// We flush once at the end of the pre-import to keep the runtime cache hot.

package/src/index.ts

@@ -321,6 +321,7 @@ export {
 	createRedirectAccess,
 	RedirectAccessError,
 	createSchemaAccess,
+	createBylineAccess,
 	createMediaAccess,
 	DEFAULT_PLUGIN_MEDIA_READ_BYTES,
 	MAX_PLUGIN_MEDIA_READ_BYTES,
@@ -375,6 +376,11 @@ export type {
 	TaxonomyTermInfo,
 	TaxonomyTermCreateInput,
 	TaxonomyReadOptions,
+	BylineAccess,
+	BylineCreditInfo,
+	BylineInfo,
+	BylineListOptions,
+	EntryBylineCredits,
 	RedirectAccess,
 	RedirectAccessWithWrite,
 	RedirectCreateInput,
@@ -414,6 +420,10 @@ export type {
 	FieldWidgetConfig,
 	PortableTextBlockConfig,
 	PortableTextBlockField,
+	BylineAfterSaveEvent,
+	BylineAfterDeleteEvent,
+	BylineAfterSaveHandler,
+	BylineAfterDeleteHandler,
 	// Comment types
 	CommentBeforeCreateEvent,
 	CommentModerateEvent,

package/src/loader.ts

@@ -1100,7 +1100,14 @@ export function buildTaxonomyPivotQuery(
 	// by primary key, and short-circuit at `LIMIT`. A `CROSS JOIN` pin would
 	// force `content_taxonomies` as the outer table and require a temp sort,
 	// producing a full nested loop over the collection on D1.
-	const pivotContentJoin = sql`JOIN`;
+	//
+	// The temp-sort branch keeps the pin. Its `picked` collects every tagged
+	// entry with no `LIMIT`, so starting from `ec_*` can never stop early, and
+	// D1 does start there when `ANALYZE` has underestimated
+	// `deleted_at IS NULL` (a trash with many distinct deletion times): it
+	// walks the collection's `(deleted_at, status)` index and probes the pivot
+	// once per published row.
+	const pivotContentJoin = isPostgres(db) || isIndexedSort ? sql`JOIN` : sql`CROSS JOIN`;
 	const {
 		terms: termsSelect,
 		bylines: bylinesSelect,

package/src/mcp/server.ts

@@ -30,6 +30,8 @@ import {
 	updateTaxonomyDefBody,
 } from "#api/schemas.js";
 
+import { after } from "../after.js";
+import { claimEntryLockForWrite } from "../api/handlers/entry-lock.js";
 import type { MediaUsageRepairRequest } from "../api/schemas/media-usage.js";
 import type { EmDashHandlers } from "../astro/types.js";
 import { hasScope } from "../auth/api-tokens.js";
@@ -80,6 +82,17 @@ const REV_PARAM_DESCRIPTION =
 const REV_MISSING_ERROR =
 	"_rev is required: call content_get for this item and pass back the _rev it returns.";
 
+/**
+ * Shared wording for the `overrideLock` parameter on write tools. Agents only
+ * see the tool schema, and re-reading never clears ENTRY_LOCKED, so when to
+ * override is stated here.
+ */
+const OVERRIDE_LOCK_PARAM_DESCRIPTION =
+	"Write even though someone else has this item open in the admin. Without it, " +
+	"the call fails with ENTRY_LOCKED and the error names who is editing; calling " +
+	"content_get again does not clear it. Tell the user who holds the item, and " +
+	"set this only if they ask you to write anyway.";
+
 const SHA256_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
 const TRANSFER_OPERATION_ID_PATTERN = /^[0-9A-Za-z_-]{1,64}$/;
 
@@ -220,7 +233,7 @@ const schemaUpdateCollectionToolSchema = z.object({
 		"Complete feature list to enable; omit to preserve the current list",
 	),
 	urlPattern: updateCollectionBody.shape.urlPattern.describe(
-		"New public URL pattern; pass null to clear it",
+		"New public URL pattern such as /blog/{slug}, with at most one placeholder per path segment; pass null to clear it",
 	),
 	routable: updateCollectionBody.shape.routable.describe(
 		"Whether entries require a slug before they can be published",
@@ -797,6 +810,24 @@ function extractContentId(data: unknown): string | undefined {
 	return typeof item?.id === "string" ? item.id : undefined;
 }
 
+/**
+ * Refuses a write while another user holds the entry's edit lock. Resolves to
+ * `null` when the write may proceed, and extends the caller's own lease if they
+ * hold it.
+ */
+async function refuseLockedEntry(
+	extra: { authInfo?: { extra?: Record<string, unknown> } },
+	collection: string,
+	entryId: string,
+	overrideLock: boolean | undefined,
+): Promise<ErrorEnvelope | null> {
+	const { emdash, userId } = getExtra(extra);
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, entryId, userId, {
+		override: overrideLock,
+	});
+	return refusal ? respondError(refusal.code, refusal.message, { ...refusal.details }) : null;
+}
+
 /** Extract the `_rev` token from a content handler response. */
 function extractContentRev(data: unknown): string | undefined {
 	if (!data || typeof data !== "object") return undefined;
@@ -1293,6 +1324,7 @@ export function createMcpServer(
 					.optional()
 					.describe("Treat an entirely keyless blocks array as an explicit replacement"),
 				_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1328,9 +1360,15 @@ export function createMcpServer(
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
 
+			if (args.status !== undefined) {
+				requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
+			}
+
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
+
 			// Status transitions route through dedicated handlers for proper revision management
 			if (args.status === "published") {
-				requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
 				let rev: string | undefined = args._rev;
 				let liveChanged = false;
 				if (
@@ -1371,7 +1409,6 @@ export function createMcpServer(
 			}
 
 			if (args.status === "draft") {
-				requireOwnership(extra, ownerId, "content:publish_own", "content:publish_any");
 				let rev: string | undefined = args._rev;
 				let liveChanged = false;
 				if (
@@ -1440,6 +1477,7 @@ export function createMcpServer(
 			inputSchema: z.object({
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 			annotations: { destructiveHint: true },
 		},
@@ -1461,6 +1499,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(extra, await ec.handleContentDelete(args.collection, resolvedId), [
 				args.collection,
 				resolvedId,
@@ -1552,6 +1592,7 @@ export function createMcpServer(
 					.describe(
 						"Override publication timestamp (ISO 8601). Requires content:publish_any permission. Useful when importing content with original publish dates.",
 					),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1580,6 +1621,8 @@ export function createMcpServer(
 			}
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await emdash.handleContentPublish(args.collection, resolvedId, {
@@ -1605,6 +1648,7 @@ export function createMcpServer(
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
 				_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1625,6 +1669,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentUnpublish(args.collection, resolvedId, {
@@ -1652,6 +1698,7 @@ export function createMcpServer(
 				scheduledAt: contentDateTimeInputSchema.describe(
 					"ISO 8601 datetime for publication (e.g. '2025-06-01T09:00:00Z')",
 				),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1672,6 +1719,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentSchedule(args.collection, resolvedId, args.scheduledAt, {
@@ -1695,6 +1744,7 @@ export function createMcpServer(
 			inputSchema: z.object({
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -1714,6 +1764,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentUnschedule(args.collection, resolvedId),
@@ -1755,6 +1807,7 @@ export function createMcpServer(
 				collection: z.string().describe("Collection slug"),
 				id: z.string().describe("Content item ID or slug"),
 				_rev: z.string({ error: REV_MISSING_ERROR }).describe(REV_PARAM_DESCRIPTION),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 			annotations: { destructiveHint: true },
 		},
@@ -1776,6 +1829,8 @@ export function createMcpServer(
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+			const locked = await refuseLockedEntry(extra, args.collection, resolvedId, args.overrideLock);
+			if (locked) return locked;
 			return unwrapAndInvalidate(
 				extra,
 				await ec.handleContentDiscardDraft(args.collection, resolvedId, { _rev: args._rev }),
@@ -1972,7 +2027,11 @@ export function createMcpServer(
 			try {
 				const { handleBylineCreate } = await import("../api/handlers/bylines.js");
 				const result = await handleBylineCreate(ec.db, args);
-				if (result.success) await invalidateBylines();
+				if (result.success) {
+					await invalidateBylines();
+					const byline = result.data;
+					after(() => ec.hooks.runBylineAfterSave(byline, true));
+				}
 				return unwrap(result);
 			} catch (error) {
 				return respondHandlerError(error, "BYLINE_CREATE_ERROR");
@@ -2000,7 +2059,11 @@ export function createMcpServer(
 				const { handleBylineUpdate } = await import("../api/handlers/bylines.js");
 				const { id, ...input } = args;
 				const result = await handleBylineUpdate(ec.db, id, input);
-				if (result.success) await invalidateBylines();
+				if (result.success) {
+					await invalidateBylines();
+					const byline = result.data;
+					after(() => ec.hooks.runBylineAfterSave(byline, false));
+				}
 				return unwrap(result);
 			} catch (error) {
 				return respondHandlerError(error, "BYLINE_UPDATE_ERROR");
@@ -2026,9 +2089,14 @@ export function createMcpServer(
 			const ec = getEmDash(extra);
 			try {
 				const { BylineRepository } = await import("../database/repositories/byline.js");
-				const deleted = await new BylineRepository(ec.db).delete(args.id);
+				const repo = new BylineRepository(ec.db);
+				const existing = ec.hooks.hasHooks("byline:afterDelete")
+					? await repo.findById(args.id)
+					: null;
+				const deleted = await repo.delete(args.id);
 				if (!deleted) return respondError("NOT_FOUND", `Byline '${args.id}' not found`);
 				await invalidateBylines();
+				if (existing) after(() => ec.hooks.runBylineAfterDelete(existing));
 				return jsonResult({ deleted: args.id });
 			} catch (error) {
 				return respondHandlerError(error, "BYLINE_DELETE_ERROR");
@@ -2242,7 +2310,7 @@ export function createMcpServer(
 				label: z.string().describe("Display name (plural, e.g. 'Blog Posts')"),
 				labelSingular: z.string().optional().describe("Singular display name (e.g. 'Blog Post')"),
 				description: z.string().optional().describe("Description of this collection"),
-				icon: z.string().optional().describe("Icon name for the admin UI"),
+				icon: createCollectionBody.shape.icon.describe("Icon name for the admin UI"),
 				supports: createCollectionBody.shape.supports.describe(
 					"Features to enable (default: ['drafts', 'revisions'])",
 				),
@@ -2591,6 +2659,10 @@ export function createMcpServer(
 					.regex(CONTENT_TYPE_RE, "Invalid content type")
 					.describe("MIME type (e.g. 'image/png')."),
 				alt: z.string().optional().describe("Alt text for accessibility"),
+				caption: z
+					.string()
+					.optional()
+					.describe("Caption stored on the media record, such as the credit"),
 			}),
 			annotations: { destructiveHint: false },
 		},
@@ -2608,6 +2680,7 @@ export function createMcpServer(
 						base64: args.base64,
 						contentType: args.contentType,
 						alt: args.alt,
+						caption: args.caption,
 						authorId: userId,
 						maxUploadSize: emdash.config.maxUploadSize,
 					}),
@@ -3025,7 +3098,7 @@ export function createMcpServer(
 
 				const { TaxonomyRepository } = await import("../database/repositories/taxonomy.js");
 				const repo = new TaxonomyRepository(ec.db);
-				const limit = Math.min(args.limit ?? 50, 100);
+				const limit = Math.max(1, Math.min(args.limit ?? 50, 100));
 				let cursor: TaxonomyListCursor | undefined;
 				if (args.cursor) {
 					try {
@@ -3537,6 +3610,7 @@ export function createMcpServer(
 				"use content_publish afterward if needed.",
 			inputSchema: z.object({
 				revisionId: z.string().describe("Revision ID to restore"),
+				overrideLock: z.boolean().optional().describe(OVERRIDE_LOCK_PARAM_DESCRIPTION),
 			}),
 		},
 		async (args, extra) => {
@@ -3569,6 +3643,14 @@ export function createMcpServer(
 				"content:edit_any",
 			);
 
+			const locked = await refuseLockedEntry(
+				extra,
+				revItem.collection,
+				revItem.entryId,
+				args.overrideLock,
+			);
+			if (locked) return locked;
+
 			return unwrap(await emdash.handleRevisionRestore(args.revisionId, userId));
 		},
 	);