emdash 0.41.0 → 0.42.0

package/src/media/usage/activation.ts

@@ -102,10 +102,17 @@ export async function canResumeMediaUsageCollectionCapture(
 	db: Kysely<Database>,
 	identity: { collectionId: string; collectionSlug: string; creationFingerprint?: string },
 ): Promise<boolean> {
+	return (await findResumableMediaUsageCollectionCaptureId(db, identity)) === identity.collectionId;
+}
+
+export async function findResumableMediaUsageCollectionCaptureId(
+	db: Kysely<Database>,
+	identity: { collectionSlug: string; creationFingerprint?: string },
+): Promise<string | null> {
 	const activation = await findActivationIfAvailable(db);
-	if (!activation) return false;
+	if (!activation) return null;
 	assertRuntimeGeneration(activation);
-	if (activation.state !== "active") return false;
+	if (activation.state !== "active") return null;
 
 	const lifecycle = await db
 		.selectFrom("_emdash_media_usage_index_status")
@@ -113,15 +120,17 @@ export async function canResumeMediaUsageCollectionCapture(
 		.where("adapter_id", "=", "content-media")
 		.where("scope_type", "=", "collection")
 		.where("scope_key", "=", identity.collectionSlug)
-		.where("collection_id", "=", identity.collectionId)
 		.where("capture_state", "in", ["installing", "ready"])
 		.executeTakeFirst();
-	return (
-		lifecycle?.collection_id === identity.collectionId &&
-		(identity.creationFingerprint
-			? lifecycle.cursor === identity.creationFingerprint
-			: lifecycle.cursor === null)
-	);
+	if (!lifecycle?.collection_id) return null;
+	if (
+		identity.creationFingerprint
+			? lifecycle.cursor !== identity.creationFingerprint
+			: lifecycle.cursor !== null
+	) {
+		return null;
+	}
+	return lifecycle.collection_id;
 }
 
 export async function prepareMediaUsageCollectionCapture(

package/src/migrations/config-loader.ts

@@ -121,11 +121,16 @@ async function loadProjectConfig(projectRoot: string, configFile: string): Promi
 			"The Vite installation used by project-local Astro does not export loadConfigFromFile",
 		);
 	}
+	// The runner transforms dependencies that publish TypeScript source. The
+	// default bundle loader leaves them to Node, which refuses to strip types
+	// under node_modules.
 	const loaded: unknown = await Reflect.apply(loadConfigFromFile, undefined, [
 		{ command: "build", mode: "production" },
 		configFile,
 		projectRoot,
 		"silent",
+		undefined,
+		"runner",
 	]);
 	if (!isRecord(loaded) || !Object.hasOwn(loaded, "config")) {
 		throw new MigrationConfigLoaderError(`Vite could not load Astro config: ${configFile}`);

package/src/object-cache/index.ts

@@ -398,13 +398,20 @@ function epochsMatch(stored: readonly number[], current: readonly number[]): boo
 
 /**
  * Requests that must always read live data and never populate the cache:
- * visual edit mode, preview tokens, and isolated databases (playground / DO
- * preview, whose schema and content diverge from the configured site).
+ * visual edit mode, preview tokens, isolated databases (playground / DO
+ * preview, whose schema and content diverge from the configured site), and
+ * Astro route-cache fills that must not rebuild a purged page from a stale
+ * object-cache snapshot.
  */
 function shouldBypass(): boolean {
 	const ctx = getRequestContext();
 	if (!ctx) return false;
-	return ctx.editMode === true || ctx.preview !== undefined || ctx.dbIsIsolated === true;
+	return (
+		ctx.editMode === true ||
+		ctx.preview !== undefined ||
+		ctx.dbIsIsolated === true ||
+		ctx.routeCacheFill === true
+	);
 }
 
 /**
@@ -782,11 +789,16 @@ function legacyContentNamespace(collection: string): string {
 }
 
 /**
- * Content epochs carried by current cache entries. The legacy epoch keeps
- * invalidation compatible with publishers from the previous release during a
- * rolling deployment; the versioned epoch makes old cached values unreachable.
+ * Content epochs carried by current cache entries. The versioned namespace
+ * makes snapshots written before the current cache format unreachable.
  */
 export function contentCacheNamespaces(collection: string): readonly string[] {
+	return [contentNamespace(collection)];
+}
+
+function contentInvalidationNamespaces(collection: string): readonly string[] {
+	// Keep bumping the legacy epoch so older readers remain safe during rolling
+	// deploys, but current readers no longer fetch that compatibility key.
 	return [contentNamespace(collection), legacyContentNamespace(collection)];
 }
 
@@ -803,7 +815,7 @@ export function contentNamespaces(collection: string): readonly string[] {
  * Call from every write path that mutates rows in `ec_<collection>`.
  */
 export function invalidateCollectionCache(collection: string): void {
-	for (const namespace of contentCacheNamespaces(collection)) {
+	for (const namespace of contentInvalidationNamespaces(collection)) {
 		invalidateObjectCache(namespace);
 	}
 }

package/src/object-cache/types.ts

@@ -79,8 +79,9 @@ export interface ObjectCacheRuntimeConfig {
 	 * is only part of the cross-isolate staleness: a distributed backend adds its
 	 * own propagation delay (KV's edge cache is eventually consistent, up to
 	 * ~60s), so on KV the effective window is that propagation plus this value.
-	 * Only anonymous visitors are affected — preview and edit requests bypass the
-	 * cache.
+	 * Preview and edit requests bypass the cache. Renders that may fill Astro's
+	 * route cache also bypass it, preventing an older KV snapshot from being
+	 * stored as a fresh HTML response after a purge.
 	 *
 	 * Set to `0` to re-read the epoch on every query (strongest freshness, more
 	 * backend reads).

package/src/plugin-types.ts

@@ -51,6 +51,8 @@ import type { ZodType } from "zod";
 import type { SandboxHookErrorEnvelope } from "./plugins/sandbox/hook-result.js";
 import type {
 	ActorInfo,
+	BylineAfterDeleteHandler,
+	BylineAfterSaveHandler,
 	CommentAfterCreateEvent,
 	CommentAfterCreateHandler,
 	CommentAfterModerateEvent,
@@ -140,6 +142,8 @@ export interface HookHandlers {
 	"comment:moderate": CommentModerateHandler;
 	"comment:afterCreate": CommentAfterCreateHandler;
 	"comment:afterModerate": CommentAfterModerateHandler;
+	"byline:afterSave": BylineAfterSaveHandler;
+	"byline:afterDelete": BylineAfterDeleteHandler;
 	"page:metadata": PageMetadataHandler;
 	"page:fragments": PageFragmentHandler;
 }
@@ -381,6 +385,9 @@ export type {
 };
 
 export type {
+	BylineAfterDeleteEvent,
+	BylineAfterSaveEvent,
+	BylineInfo,
 	PaginatedResult,
 	VersionedValue,
 	ConditionalWriteResult,

package/src/plugins/adapt-sandbox-entry.ts

@@ -10,17 +10,21 @@
  *
  */
 
+import { z } from "zod";
+
 import type { PluginDescriptor } from "../astro/integration/runtime.js";
 import type { RouteEntry, RouteHandler, SandboxedPlugin } from "../plugin-types.js";
 import { PLUGIN_CAPABILITIES, HOOK_NAMES } from "./manifest-schema.js";
 import { sanitizeHeadersForSandbox } from "./request-meta.js";
 import { normalizePluginCapabilities } from "./types.js";
 import type {
+	ManifestMcpTool,
 	ResolvedPlugin,
 	ResolvedPluginHooks,
 	ResolvedHook,
 	PluginRoute,
 	PluginCapability,
+	PluginMcpToolDefinition,
 	PluginStorageConfig,
 	PluginAdminConfig,
 } from "./types.js";
@@ -347,19 +351,50 @@ export function adaptSandboxEntry(
 		hooks: resolvedHooks,
 		routes: resolvedRoutes,
 		mcp: {
-			tools: Object.fromEntries(
-				Object.entries(definition.mcp?.tools ?? {}).map(([name, tool]) => [
-					name,
-					{
-						description: tool.description,
-						route: tool.route,
-						input: tool.input,
-						output: tool.output,
-						destructive: tool.destructive,
-					},
-				]),
-			),
+			tools: {
+				// `emdash-plugin build` removes `mcp` from the runtime module and
+				// ships the tools in the descriptor instead.
+				...Object.fromEntries(
+					(descriptor.mcp?.tools ?? []).map((tool) => [tool.name, toolFromManifest(tool)]),
+				),
+				...Object.fromEntries(
+					Object.entries(definition.mcp?.tools ?? {}).map(([name, tool]) => [
+						name,
+						{
+							description: tool.description,
+							route: tool.route,
+							input: tool.input,
+							output: tool.output,
+							destructive: tool.destructive,
+						},
+					]),
+				),
+			},
 		},
 		admin,
 	};
 }
+
+/**
+ * An MCP tool from its serialized manifest form. The schemas are converted
+ * on first use: turning JSON Schema back into Zod takes milliseconds per
+ * tool, and this adapter runs on every cold start, public requests included.
+ */
+function toolFromManifest(tool: ManifestMcpTool): PluginMcpToolDefinition {
+	let input: z.ZodType | undefined;
+	let output: z.ZodType | undefined;
+	return {
+		description: tool.description,
+		route: tool.route,
+		destructive: tool.destructive,
+		get input() {
+			input ??= z.fromJSONSchema({ ...tool.inputSchema });
+			return input;
+		},
+		get output() {
+			if (!tool.outputSchema) return undefined;
+			output ??= z.fromJSONSchema({ ...tool.outputSchema });
+			return output;
+		},
+	};
+}

package/src/plugins/byline-access.ts

@@ -0,0 +1,158 @@
+import { sql, type Kysely } from "kysely";
+
+import { resolveBylineCredits, type BylineEntry } from "../bylines/credits.js";
+import {
+	decodeCursor,
+	encodeCursor,
+	type ContentBylineCredit,
+} from "../database/repositories/types.js";
+import type { Database } from "../database/types.js";
+import { validateIdentifier } from "../database/validate.js";
+import { chunks, SQL_BATCH_SIZE } from "../utils/chunks.js";
+import type { BylineAccess, BylineCreditInfo, BylineInfo } from "./types.js";
+
+const MAX_BYLINE_ENTRY_IDS = 100;
+
+const DEFAULT_LIST_LIMIT = 50;
+const MAX_LIST_LIMIT = 100;
+
+interface PublicBylineFields {
+	id: string;
+	slug: string;
+	displayName: string;
+	bio: string | null;
+	websiteUrl: string | null;
+	avatarMediaId: string | null;
+	locale: string;
+	translationGroup: string | null;
+}
+
+export function toBylineInfo(byline: PublicBylineFields): BylineInfo {
+	return {
+		id: byline.id,
+		slug: byline.slug,
+		displayName: byline.displayName,
+		bio: byline.bio,
+		websiteUrl: byline.websiteUrl,
+		avatarMediaId: byline.avatarMediaId,
+		locale: byline.locale,
+		translationGroup: byline.translationGroup ?? byline.id,
+	};
+}
+
+function toCreditInfo(credit: ContentBylineCredit): BylineCreditInfo {
+	return {
+		byline: toBylineInfo(credit.byline),
+		sortOrder: credit.sortOrder,
+		roleLabel: credit.roleLabel,
+		source: credit.source ?? "explicit",
+	};
+}
+
+function clampListLimit(limit: number | undefined): number {
+	if (limit === undefined || !Number.isFinite(limit)) return DEFAULT_LIST_LIMIT;
+	return Math.min(Math.max(Math.trunc(limit), 1), MAX_LIST_LIMIT);
+}
+
+function selectPublicBylines(db: Kysely<Database>) {
+	return db
+		.selectFrom("_emdash_bylines")
+		.select([
+			"id",
+			"slug",
+			"display_name as displayName",
+			"bio",
+			"website_url as websiteUrl",
+			"avatar_media_id as avatarMediaId",
+			"locale",
+			"translation_group as translationGroup",
+			"created_at as createdAt",
+		]);
+}
+
+async function loadEntryRefs(
+	db: Kysely<Database>,
+	collection: string,
+	entryIds: string[],
+): Promise<BylineEntry[]> {
+	const tableName = `ec_${collection}`;
+	const refs: BylineEntry[] = [];
+	for (const chunk of chunks(entryIds, SQL_BATCH_SIZE)) {
+		const result = await sql<{
+			id: string;
+			author_id: string | null;
+			primary_byline_id: string | null;
+			locale: string | null;
+		}>`
+			SELECT id, author_id, primary_byline_id, locale FROM ${sql.ref(tableName)}
+			WHERE id IN (${sql.join(chunk)})
+			AND deleted_at IS NULL
+		`.execute(db);
+		for (const row of result.rows) {
+			refs.push({
+				id: row.id,
+				authorId: row.author_id,
+				primaryBylineId: row.primary_byline_id,
+				locale: row.locale,
+			});
+		}
+	}
+	return refs;
+}
+
+/**
+ * Create read-only byline access (gated on `bylines:read`).
+ */
+export function createBylineAccess(db: Kysely<Database>): BylineAccess {
+	return {
+		async get(id) {
+			const row = await selectPublicBylines(db).where("id", "=", id).executeTakeFirst();
+			return row ? toBylineInfo(row) : null;
+		},
+
+		async list(options) {
+			const limit = clampListLimit(options?.limit);
+			let query = selectPublicBylines(db)
+				.orderBy("created_at", "desc")
+				.orderBy("id", "desc")
+				.limit(limit + 1);
+			if (options?.locale !== undefined) query = query.where("locale", "=", options.locale);
+			if (options?.cursor) {
+				const decoded = decodeCursor(options.cursor);
+				query = query.where((eb) =>
+					eb.or([
+						eb("created_at", "<", decoded.orderValue),
+						eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)]),
+					]),
+				);
+			}
+
+			const rows = await query.execute();
+			const pageRows = rows.slice(0, limit);
+			const last = pageRows.at(-1);
+			return {
+				items: pageRows.map(toBylineInfo),
+				hasMore: rows.length > limit,
+				...(rows.length > limit && last ? { cursor: encodeCursor(last.createdAt, last.id) } : {}),
+			};
+		},
+
+		async getEntriesBylines(collection, entryIds) {
+			validateIdentifier(collection, "collection");
+			const uniqueIds = [...new Set(entryIds)];
+			if (uniqueIds.length > MAX_BYLINE_ENTRY_IDS) {
+				throw new Error(`Byline lookups accept at most ${MAX_BYLINE_ENTRY_IDS} entry IDs`);
+			}
+			if (uniqueIds.length === 0) return [];
+
+			const refs = await loadEntryRefs(db, collection, uniqueIds);
+			const credits = await resolveBylineCredits(db, collection, refs, {
+				hydrateCustomFields: false,
+			});
+			return uniqueIds.map((entryId) => ({
+				entryId,
+				bylines: (credits.get(entryId) ?? []).map(toCreditInfo),
+			}));
+		},
+	};
+}

package/src/plugins/context.ts

@@ -52,6 +52,7 @@ import { markContentMediaUsageCollectionStaleSafely } from "../media/usage/conte
 import { SchemaRegistry } from "../schema/registry.js";
 import { invalidateSiteSettingsCache } from "../settings/index.js";
 import type { Storage } from "../storage/types.js";
+import { createBylineAccess } from "./byline-access.js";
 import { assertStorageKey } from "./conditional-storage.js";
 import { createContentAccess } from "./content-access.js";
 import { CronAccessImpl } from "./cron.js";
@@ -182,7 +183,9 @@ export function createKVAccess(
 			const includesSettings =
 				"settings:".startsWith(requestedPrefix) || requestedPrefix.startsWith("settings:");
 			const fullPrefix = `${prefix}${requestedPrefix}`;
-			const entriesMap = await optionsRepo.getByPrefix(fullPrefix);
+			const entriesMap = requestedPrefix.startsWith("settings:")
+				? new Map<string, unknown>()
+				: await optionsRepo.getByPrefix(fullPrefix);
 			const result: Array<{ key: string; value: unknown }> = [];
 			for (const [fullKey, value] of entriesMap) {
 				if (includesSettings && fullKey.startsWith(`${prefix}settings:`)) continue;
@@ -1761,6 +1764,8 @@ export class PluginContextFactory {
 			taxonomies = createTaxonomyAccess(db);
 		}
 
+		const bylines = capabilities.has("bylines:read") ? createBylineAccess(db) : undefined;
+
 		let redirects: RedirectAccess | RedirectAccessWithWrite | undefined;
 		if (capabilities.has("redirects:write")) {
 			redirects = createRedirectAccess(db, true);
@@ -1857,6 +1862,7 @@ export class PluginContextFactory {
 			content,
 			schema,
 			taxonomies,
+			bylines,
 			redirects,
 			media,
 			http,

package/src/plugins/cron.ts

@@ -21,7 +21,8 @@ const CRON_TIMEZONE = "UTC";
 /** Stale lock threshold in minutes */
 const STALE_LOCK_MINUTES = 10;
 const ISO_DATETIME_PATTERN =
-	/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?$/;
+	/^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?$/;
+const ISO_TIMEZONE_PATTERN = /(?:Z|[+-]\d{2}:?\d{2})$/;
 
 /**
  * Callback to invoke a plugin's cron hook.
@@ -114,7 +115,7 @@ export class CronExecutor {
 					);
 					await sql`
 						UPDATE _emdash_cron_tasks
-						SET status = 'idle', locked_at = NULL
+						SET status = 'idle', locked_at = NULL, enabled = 0
 						WHERE id = ${task.id}
 					`.execute(this.db);
 					continue;
@@ -177,7 +178,22 @@ export class CronExecutor {
 				}
 			} else {
 				// Recurring: compute next run and reset
-				const nextRun = nextCronTime(task.schedule, currentTime);
+				let nextRun: string;
+				try {
+					nextRun = nextCronTime(task.schedule, currentTime);
+				} catch (error) {
+					console.error(
+						`[cron] Disabling unsatisfiable schedule for ${task.plugin_id}:${task.task_name}:`,
+						error,
+					);
+					await sql`
+						UPDATE _emdash_cron_tasks
+						SET status = 'idle', locked_at = NULL, last_run_at = ${now}, enabled = 0
+						WHERE id = ${task.id}
+					`.execute(this.db);
+					processed++;
+					continue;
+				}
 				await sql`
 					UPDATE _emdash_cron_tasks
 					SET status = 'idle',
@@ -248,7 +264,7 @@ export class CronAccessImpl implements CronAccess {
 		validateSchedule(opts.schedule);
 
 		const oneshot = isOneShot(opts.schedule);
-		const nextRun = oneshot ? opts.schedule : nextCronTime(opts.schedule, this.now());
+		const nextRun = oneshot ? oneShotTime(opts.schedule) : nextCronTime(opts.schedule, this.now());
 		const dataJson = opts.data ? JSON.stringify(opts.data) : null;
 		const id = ulid();
 
@@ -370,6 +386,13 @@ export function isOneShot(schedule: string): boolean {
 	return !isNaN(Date.parse(schedule));
 }
 
+function oneShotTime(schedule: string): string {
+	const withoutZone = ISO_DATETIME_PATTERN.test(schedule) && !ISO_TIMEZONE_PATTERN.test(schedule);
+	const normalized = ISO_DATETIME_PATTERN.test(schedule) ? schedule.replace(" ", "T") : schedule;
+	const input = withoutZone ? `${normalized}Z` : normalized;
+	return new Date(input).toISOString();
+}
+
 /** Max length for a task name */
 const MAX_TASK_NAME_LENGTH = 128;
 /** Task name pattern: alphanumeric, dashes, underscores */

package/src/plugins/hooks.ts

@@ -12,6 +12,8 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
 
+import type { BylineSummary } from "../database/repositories/types.js";
+import { toBylineInfo } from "./byline-access.js";
 import { inspectContentPolicyDecision } from "./content-policy.js";
 import { PluginContextFactory, type PluginContextFactoryOptions } from "./context.js";
 import type {
@@ -56,6 +58,8 @@ import type {
 	CommentAfterCreateHandler,
 	CommentAfterModerateEvent,
 	CommentAfterModerateHandler,
+	BylineAfterSaveHandler,
+	BylineAfterDeleteHandler,
 	PageMetadataEvent,
 	PageMetadataHandler,
 	PageMetadataContribution,
@@ -95,6 +99,8 @@ type HookNameV2 =
 	| "comment:moderate"
 	| "comment:afterCreate"
 	| "comment:afterModerate"
+	| "byline:afterSave"
+	| "byline:afterDelete"
 	| "page:metadata"
 	| "page:fragments";
 
@@ -150,6 +156,8 @@ interface HookHandlerMap {
 	"comment:moderate": CommentModerateHandler;
 	"comment:afterCreate": CommentAfterCreateHandler;
 	"comment:afterModerate": CommentAfterModerateHandler;
+	"byline:afterSave": BylineAfterSaveHandler;
+	"byline:afterDelete": BylineAfterDeleteHandler;
 	"page:metadata": PageMetadataHandler;
 	"page:fragments": PageFragmentHandler;
 }
@@ -295,6 +303,8 @@ export class HookPipeline {
 			this.registerPluginHook(plugin, "comment:moderate");
 			this.registerPluginHook(plugin, "comment:afterCreate");
 			this.registerPluginHook(plugin, "comment:afterModerate");
+			this.registerPluginHook(plugin, "byline:afterSave");
+			this.registerPluginHook(plugin, "byline:afterDelete");
 			this.registerPluginHook(plugin, "page:metadata");
 			this.registerPluginHook(plugin, "page:fragments");
 		}
@@ -343,6 +353,8 @@ export class HookPipeline {
 		["comment:moderate", "users:read"],
 		["comment:afterCreate", "users:read"],
 		["comment:afterModerate", "users:read"],
+		["byline:afterSave", "bylines:read"],
+		["byline:afterDelete", "bylines:read"],
 		// Page fragments — can inject arbitrary scripts into every public page
 		["page:fragments", "hooks.page-fragments:register"],
 	]);
@@ -1243,6 +1255,41 @@ export class HookPipeline {
 		}
 	}
 
+	// =========================================================================
+	// Byline Hooks
+	// =========================================================================
+
+	/** Run byline:afterSave hooks. Errors are logged and never propagate. */
+	async runBylineAfterSave(byline: BylineSummary, isNew: boolean): Promise<void> {
+		const event = { byline: toBylineInfo(byline), isNew };
+		for (const hook of this.getTypedHooks("byline:afterSave")) {
+			await this.runLoggedHook("byline:afterSave", hook, (ctx) => hook.handler(event, ctx));
+		}
+	}
+
+	/** Run byline:afterDelete hooks. Errors are logged and never propagate. */
+	async runBylineAfterDelete(byline: BylineSummary): Promise<void> {
+		const event = { byline: toBylineInfo(byline) };
+		for (const hook of this.getTypedHooks("byline:afterDelete")) {
+			await this.runLoggedHook("byline:afterDelete", hook, (ctx) => hook.handler(event, ctx));
+		}
+	}
+
+	private async runLoggedHook(
+		name: HookNameV2,
+		hook: { pluginId: string; timeout: number },
+		run: (ctx: PluginContext) => Promise<void>,
+	): Promise<void> {
+		try {
+			await this.executeWithTimeout(() => run(this.getContext(hook.pluginId)), hook.timeout);
+		} catch (error) {
+			console.error(
+				`[${name}] Plugin "${hook.pluginId}" error:`,
+				error instanceof Error ? error.message : error,
+			);
+		}
+	}
+
 	// =========================================================================
 	// Public Page Hooks
 	// =========================================================================

package/src/plugins/host.ts

@@ -3,6 +3,7 @@ export { OptionsRepository } from "../database/repositories/options.js";
 export { PluginStorageRepository } from "../database/repositories/plugin-storage.js";
 export { resolvePluginEncryptionKeys } from "../config/secrets.js";
 export { resolveContentCreateLocale } from "../i18n/config.js";
+export { createBylineAccess } from "./byline-access.js";
 export { createCommentAccess } from "./context.js";
 export { createContentAccess } from "./content-access.js";
 export { createMediaAccess } from "./context.js";

package/src/plugins/index.ts

@@ -42,6 +42,7 @@ export {
 	createUrlHelper,
 	createSiteInfo,
 } from "./context.js";
+export { createBylineAccess } from "./byline-access.js";
 export { createContentAccess } from "./content-access.js";
 export type { ContentActionCallbacks, PluginContextFactoryOptions } from "./context.js";
 export {
@@ -207,6 +208,11 @@ export type {
 	TaxonomyTermInfo,
 	TaxonomyTermCreateInput,
 	TaxonomyReadOptions,
+	BylineAccess,
+	BylineCreditInfo,
+	BylineInfo,
+	BylineListOptions,
+	EntryBylineCredits,
 	RedirectAccess,
 	RedirectAccessWithWrite,
 	RedirectCreateInput,
@@ -263,7 +269,10 @@ export type {
 	MediaAfterUploadHandler,
 	LifecycleHandler,
 	UninstallHandler,
-
+	BylineAfterSaveEvent,
+	BylineAfterDeleteEvent,
+	BylineAfterSaveHandler,
+	BylineAfterDeleteHandler,
 	// Comment types
 	CommentBeforeCreateEvent,
 	CommentModerateEvent,

package/src/plugins/manifest-schema.ts

@@ -4,7 +4,7 @@
  * Used to validate manifest.json from plugin bundles at every parse site:
  * - Client-side download (marketplace.ts extractBundle)
  * - R2 load (api/handlers/marketplace.ts loadBundleFromR2)
- * - CLI publish preview (cli/commands/publish.ts readManifestFromTarball)
+ * - marketplace and registry bundle validation
  * - Marketplace ingest extends this with publishing-specific fields
  */
 
@@ -43,6 +43,7 @@ export const CURRENT_PLUGIN_CAPABILITIES = [
 	"hooks.content-policy:register",
 	"taxonomies:read",
 	"taxonomies:write",
+	"bylines:read",
 	"redirects:read",
 	"redirects:write",
 	"media:read",
@@ -134,6 +135,8 @@ export const HOOK_NAMES = [
 	"comment:moderate",
 	"comment:afterCreate",
 	"comment:afterModerate",
+	"byline:afterSave",
+	"byline:afterDelete",
 	"page:metadata",
 	"page:fragments",
 ] as const;
@@ -401,6 +404,7 @@ const declaredAccessSchema = z.object({
 	taxonomies: z
 		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
 		.optional(),
+	bylines: z.object({ read: accessConstraints.optional() }).optional(),
 	redirects: z
 		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
 		.optional(),