emdash 1.2.0 → 1.3.0

package/src/import/sources/wordpress-plugin.ts

@@ -10,6 +10,7 @@ import { gutenbergToPortableText } from "@emdash-cms/gutenberg-to-portable-text"
 import { encodeBase64 } from "../../utils/base64.js";
 import type { PluginComment } from "../comments.js";
 import type { PluginMenu } from "../menus.js";
+import { SiteChallengeError } from "../registry.js";
 import { ssrfSafeFetch, validateExternalUrl } from "../ssrf.js";
 import type {
 	ImportSource,
@@ -31,6 +32,7 @@ import {
 	normalizeUrl,
 	checkSchemaCompatibility,
 	isPluginBookkeepingMeta,
+	isTypeCompatible,
 	relativizeContentLinks,
 	sanitizeFieldSlug,
 } from "../utils.js";
@@ -128,6 +130,8 @@ interface PluginAnalyzeResponse {
 	acf?: Array<{
 		key: string;
 		title: string;
+		/** ACF location rules: OR-groups of AND-ed rules */
+		location?: Array<Array<{ param: string; operator: string; value: string }>>;
 		fields: Array<{
 			key: string;
 			name: string;
@@ -222,6 +226,16 @@ interface PluginMediaItem {
 /** Pattern to remove spaces from application passwords */
 const SPACE_PATTERN = /\s/g;
 
+/**
+ * Identifying User-Agent for outbound WordPress plugin importer requests.
+ *
+ * The importer sends this on both plugin API calls and direct media downloads.
+ * Cloudflare Workers' fetch() has no default User-Agent, and some hosts reject
+ * requests without one (returning 403). Using the same value everywhere keeps
+ * behavior predictable when the importer is retried against a bot-filtered host.
+ */
+const IMPORTER_USER_AGENT = "EmDash-Importer/1.0";
+
 /**
  * Build the REST API URL for a plugin endpoint.
  *
@@ -260,9 +274,12 @@ async function fetchPluginApi(
 	siteUrl: string,
 	path: string,
 	params: Record<string, string>,
-	headers: HeadersInit,
+	headersInit: HeadersInit,
 	timeoutMs: number,
 ): Promise<Response> {
+	const headers = new Headers(headersInit);
+	headers.set("User-Agent", IMPORTER_USER_AGENT);
+
 	let pretty: Response | null = null;
 	try {
 		pretty = await ssrfSafeFetch(pluginApiUrl(siteUrl, path, params), {
@@ -274,13 +291,17 @@ async function fetchPluginApi(
 	}
 	// Any response other than 404 (including 401/403/500) is authoritative:
 	// the route exists, so don't mask the real error with a fallback attempt.
-	if (pretty && pretty.status !== 404) {
-		return pretty;
+	const response =
+		pretty && pretty.status !== 404
+			? pretty
+			: await ssrfSafeFetch(pluginApiUrl(siteUrl, path, params, true), {
+					headers,
+					signal: AbortSignal.timeout(timeoutMs),
+				});
+	if (response.headers.get("cf-mitigated") === "challenge") {
+		throw new SiteChallengeError();
 	}
-	return ssrfSafeFetch(pluginApiUrl(siteUrl, path, params, true), {
-		headers,
-		signal: AbortSignal.timeout(timeoutMs),
-	});
+	return response;
 }
 
 // =============================================================================
@@ -353,7 +374,8 @@ export const wordpressPluginSource: ImportSource = {
 				},
 				i18n: pluginI18nToDetection(data.i18n),
 			};
-		} catch {
+		} catch (error) {
+			if (error instanceof SiteChallengeError) throw error;
 			return null;
 		}
 	},
@@ -399,8 +421,33 @@ export const wordpressPluginSource: ImportSource = {
 				// the prepare step creates them — without this, execute() has no
 				// matching schema fields and silently drops the values.
 				const knownSlugs = new Set(requiredFields.map((f) => f.slug));
+				const metaTypes = new Map(
+					(pt.custom_fields ?? []).map((field) => [
+						sanitizeFieldSlug(field.key),
+						mapInferredFieldType(field.inferred_type),
+					]),
+				);
+				const jsonAcfFields: AcfFieldInfo[] = [];
+				for (const acfField of acfFieldsForPostType(data.acf, pt.name)) {
+					const slug = sanitizeFieldSlug(acfField.name);
+					if (knownSlugs.has(slug)) continue;
+					knownSlugs.add(slug);
+					const type = acfImportFieldType(
+						acfField,
+						existingCollection?.fields.get(slug)?.type,
+						metaTypes.get(slug),
+					);
+					if (type === "json") jsonAcfFields.push(acfField);
+					requiredFields.push({
+						slug,
+						label: acfField.label || fieldLabelFromKey(acfField.name),
+						type,
+						required: false,
+					});
+				}
 				for (const customField of pt.custom_fields ?? []) {
 					if (isPluginBookkeepingMeta(customField.key)) continue;
+					if (isAcfRowMeta(customField.key, jsonAcfFields)) continue;
 					const slug = sanitizeFieldSlug(customField.key);
 					if (knownSlugs.has(slug)) continue;
 					knownSlugs.add(slug);
@@ -455,6 +502,7 @@ export const wordpressPluginSource: ImportSource = {
 					page++;
 				}
 			} catch (e) {
+				if (e instanceof SiteChallengeError) throw e;
 				console.warn("Failed to fetch media list:", e);
 			}
 		}
@@ -531,7 +579,11 @@ export const wordpressPluginSource: ImportSource = {
 		validateExternalUrl(url);
 
 		// Media URLs are publicly accessible on WP (ssrfSafeFetch validates redirects)
-		const response = await ssrfSafeFetch(url);
+		const response = await ssrfSafeFetch(url, {
+			headers: {
+				"User-Agent": IMPORTER_USER_AGENT,
+			},
+		});
 		if (!response.ok) {
 			throw new Error(`Failed to fetch media: ${response.statusText}`);
 		}
@@ -607,6 +659,96 @@ function mapInferredFieldType(inferredType: string): string {
 	return VALID_INFERRED_TYPES.has(inferredType) ? inferredType : "string";
 }
 
+/**
+ * EmDash field types for ACF field types that hold a single value and return
+ * a scalar by default. When a return format makes `get_fields()` give an
+ * array, the raw meta value fills the field instead. Every other ACF type
+ * (select, checkbox, relationship, repeater, gallery, ...) can return several
+ * values or an object and is stored as JSON.
+ */
+const ACF_FIELD_TYPES: Record<string, string> = {
+	text: "string",
+	email: "string",
+	url: "string",
+	password: "string",
+	radio: "string",
+	button_group: "string",
+	color_picker: "string",
+	oembed: "string",
+	date_picker: "string",
+	date_time_picker: "string",
+	time_picker: "string",
+	textarea: "text",
+	wysiwyg: "text",
+	number: "number",
+	range: "number",
+	true_false: "boolean",
+};
+
+type AcfFieldInfo = NonNullable<PluginAnalyzeResponse["acf"]>[number]["fields"][number];
+
+/**
+ * The field type for an ACF field. A collection created by an earlier
+ * import holds the type the raw meta suggested for that key; that type is
+ * kept so the collection still imports, and the field's flattened row
+ * keys then keep filling their own fields.
+ */
+function acfImportFieldType(
+	field: AcfFieldInfo,
+	existingType: string | undefined,
+	metaType: string | undefined,
+): string {
+	const acfType = ACF_FIELD_TYPES[field.type] ?? "json";
+	if (
+		existingType &&
+		metaType &&
+		!isTypeCompatible(acfType, existingType) &&
+		isTypeCompatible(metaType, existingType)
+	) {
+		return existingType;
+	}
+	return acfType;
+}
+
+/** ACF layout-only field types that hold no value */
+const ACF_LAYOUT_TYPES = new Set(["tab", "message", "accordion"]);
+
+/** Fields of the ACF field groups whose location rules include `post_type == <postType>` */
+function acfFieldsForPostType(
+	groups: PluginAnalyzeResponse["acf"],
+	postType: string,
+): AcfFieldInfo[] {
+	const fields: AcfFieldInfo[] = [];
+	for (const group of groups ?? []) {
+		const assigned = group.location?.some((rules) =>
+			rules.some(
+				(rule) => rule.param === "post_type" && rule.operator === "==" && rule.value === postType,
+			),
+		);
+		if (!assigned) continue;
+		for (const field of group.fields) {
+			if (field.name && !ACF_LAYOUT_TYPES.has(field.type)) fields.push(field);
+		}
+	}
+	return fields;
+}
+
+const ACF_ROW_SUFFIX = /^_\d+_/;
+
+/**
+ * ACF stores repeater and flexible content rows as `<name>_<row>_<sub>`
+ * meta keys. Their values already arrive whole under the parent field in
+ * `get_fields()`.
+ */
+function isAcfRowMeta(key: string, acfFields: AcfFieldInfo[]): boolean {
+	return acfFields.some(
+		(field) =>
+			(field.type === "repeater" || field.type === "flexible_content") &&
+			key.startsWith(field.name) &&
+			ACF_ROW_SUFFIX.test(key.slice(field.name.length)),
+	);
+}
+
 const FIELD_KEY_SEPARATORS = /[_-]+/;
 
 /** Derive a human label from a meta key: "event_start-date" -> "Event Start Date" */

package/src/import/types.ts

@@ -139,6 +139,8 @@ export interface ProbeResult {
 	bestMatch: SourceProbeResult | null;
 	/** All matching sources */
 	allMatches: SourceProbeResult[];
+	/** No source matched because a bot-protection challenge blocked the probe */
+	challenged?: boolean;
 }
 
 // =============================================================================
@@ -350,6 +352,7 @@ export interface FetchOptions {
 export interface ImportResult {
 	success: boolean;
 	imported: number;
+	/** Entries not imported because the slug already exists in the collection and locale. */
 	skipped: number;
 	errors: Array<{ title: string; error: string }>;
 	byCollection: Record<string, number>;

package/src/import/utils.ts

@@ -27,6 +27,11 @@ export const INTERNAL_POST_TYPES = [
 	"wp_template_part",
 	"attachment", // Handled separately as media
 	"wp_block", // Handled separately as sections (reusable blocks)
+	"acf-field-group",
+	"acf-field",
+	"acf-post-type",
+	"acf-taxonomy",
+	"acf-ui-options-page",
 ];
 
 /** Internal meta key prefixes to filter out */

package/src/loader.ts

@@ -16,6 +16,7 @@ import { Kysely, type RawBuilder, sql, type Dialect } from "kysely";
 
 import { buildStatusCondition, isPostgres } from "./database/dialect-helpers.js";
 import { kyselyLogOption } from "./database/instrumentation.js";
+import { jsonTextValues } from "./database/json-recordset.js";
 import { selectTaxonomyDefs } from "./database/repositories/taxonomy-def.js";
 import { decodeCursor, encodeCursor, InvalidCursorError } from "./database/repositories/types.js";
 import { validateIdentifier } from "./database/validate.js";
@@ -1094,13 +1095,34 @@ function bindableFilterValue(value: unknown): unknown {
  * Build AND conditions for non-taxonomy field filters.
  * Returns an array of sql fragments; empty if no field filters apply.
  * Field names are validated against FIELD_NAME_PATTERN to prevent injection.
+ *
+ * D1 allows 100 bound parameters per statement, and an array filter binds one
+ * per value. So when the arrays in `fields` hold more than `SQL_BATCH_SIZE`
+ * values between them, the longest arrays are bound as a single JSON parameter
+ * each (`IN (SELECT value FROM json_each(?))`, or `jsonb_array_elements_text`
+ * on PostgreSQL) until the rest fit. The statement stays one query, so
+ * ordering, cursors, limit and offset stay in the database. Values bound that
+ * way compare as text.
  */
 function buildFieldConditions(
+	db: Kysely<Database>,
 	fields: Record<string, WhereValue>,
 	tablePrefix?: string,
 ): ReturnType<typeof sql>[] {
 	const conditions: ReturnType<typeof sql>[] = [];
 
+	const arrayLengths = Object.entries(fields)
+		.filter((entry): entry is [string, string[]] => Array.isArray(entry[1]))
+		.map(([key, value]) => [key, value.length] as const)
+		.toSorted((a, b) => b[1] - a[1]);
+	let inlineValues = arrayLengths.reduce((sum, [, length]) => sum + length, 0);
+	const asJson = new Set<string>();
+	for (const [key, length] of arrayLengths) {
+		if (inlineValues <= SQL_BATCH_SIZE) break;
+		asJson.add(key);
+		inlineValues -= length;
+	}
+
 	for (const [key, value] of Object.entries(fields)) {
 		if (!FIELD_NAME_PATTERN.test(key)) {
 			console.warn(`[emdash] where filter: invalid field name "${key}" ignored`);
@@ -1111,12 +1133,24 @@ function buildFieldConditions(
 
 		if (isWhereRange(value)) {
 			const { gt, gte, lt, lte } = value;
+			if (gt === undefined && gte === undefined && lt === undefined && lte === undefined) {
+				// An object with no bound (for example `{ in: [...] }`) would add no
+				// condition, and the query would return unfiltered rows.
+				console.warn(
+					`[emdash] where filter: "${key}" is an object with none of gt/gte/lt/lte and was ignored (use an array for IN)`,
+				);
+				continue;
+			}
 			if (gt !== undefined) conditions.push(sql`${ref} > ${bindableFilterValue(gt)}`);
 			if (gte !== undefined) conditions.push(sql`${ref} >= ${bindableFilterValue(gte)}`);
 			if (lt !== undefined) conditions.push(sql`${ref} < ${bindableFilterValue(lt)}`);
 			if (lte !== undefined) conditions.push(sql`${ref} <= ${bindableFilterValue(lte)}`);
 		} else if (Array.isArray(value)) {
-			if (value.length > 0) {
+			if (value.length === 0) continue;
+			if (asJson.has(key)) {
+				const values = value.map((v) => String(bindableFilterValue(v)));
+				conditions.push(sql`${ref} IN (${jsonTextValues(db, values)})`);
+			} else {
 				conditions.push(
 					sql`${ref} IN (${sql.join(value.map((v) => sql`${bindableFilterValue(v)}`))})`,
 				);
@@ -1821,7 +1855,7 @@ export function emdashLoader(): LiveLoader<EntryData, EntryFilter, LoaderCollect
 					const statusCondition = buildStatusCondition(db, status);
 					const localeFilter = locale ? sql`AND locale = ${locale}` : sql``;
 					const cursorCond = cursorCondition ? sql`AND ${cursorCondition}` : sql``;
-					const fieldConds = buildFieldConditions(fieldFilters);
+					const fieldConds = buildFieldConditions(db, fieldFilters);
 					const fieldCondsSQL =
 						fieldConds.length > 0 ? sql`${sql.join(fieldConds, sql` AND `)}` : null;
 

package/src/mcp/json-schema.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+export function safeJsonSchemaToZod(
+	schema: Record<string, unknown>,
+	toolId: string,
+	kind: "input" | "output",
+): z.ZodType | undefined {
+	try {
+		return z.fromJSONSchema(schema);
+	} catch (error) {
+		console.warn(`[emdash] Invalid ${kind} schema for plugin MCP tool ${toolId}:`, error);
+		return undefined;
+	}
+}

package/src/mcp/plugin-tool-name.ts

@@ -0,0 +1,36 @@
+const FORWARD_SLASH_PATTERN = "/";
+const MCP_SAFE_PLUGIN_ID_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const PLUGIN_SCOPE_PREFIX_PATTERN = /^@/;
+const PLUGIN_ID_DASH_PATTERN = /-/g;
+const PLUGIN_ID_UNDERSCORE_PATTERN = /_/;
+const AMBIGUOUS_PLUGIN_SEGMENT_PATTERN = /__/;
+const AMBIGUOUS_JOINED_PLUGIN_ID_PATTERN = /_{3,}/;
+
+export function pluginToolName(pluginId: string, toolName: string): string {
+	if (MCP_SAFE_PLUGIN_ID_PATTERN.test(pluginId)) {
+		return `${pluginId}__${toolName}`;
+	}
+
+	const readableSegments = pluginId
+		.replace(PLUGIN_SCOPE_PREFIX_PATTERN, "")
+		.split(FORWARD_SLASH_PATTERN)
+		.map((segment) => segment.replace(PLUGIN_ID_DASH_PATTERN, "_"));
+	const readablePluginId = readableSegments.join("__");
+	if (
+		PLUGIN_ID_UNDERSCORE_PATTERN.test(pluginId) ||
+		AMBIGUOUS_JOINED_PLUGIN_ID_PATTERN.test(readablePluginId) ||
+		readableSegments.some((segment) => AMBIGUOUS_PLUGIN_SEGMENT_PATTERN.test(segment))
+	) {
+		return `${readablePluginId}__${stableToolNameHash(pluginId)}__${toolName}`;
+	}
+	return `${readablePluginId}__${toolName}`;
+}
+
+function stableToolNameHash(value: string): string {
+	let hash = 0x811c9dc5;
+	for (let index = 0; index < value.length; index++) {
+		hash ^= value.charCodeAt(index);
+		hash = Math.imul(hash, 0x01000193);
+	}
+	return (hash >>> 0).toString(16).padStart(8, "0");
+}

package/src/mcp/server.ts

@@ -31,11 +31,13 @@ import {
 } from "#api/schemas.js";
 
 import { after } from "../after.js";
+import { entryEditAccess } from "../api/authorize.js";
 import { claimEntryLockForWrite } from "../api/handlers/entry-lock.js";
 import type { MediaUsageRepairRequest } from "../api/schemas/media-usage.js";
 import type { EmDashHandlers } from "../astro/types.js";
 import { hasScope } from "../auth/api-tokens.js";
 import { menuTag, siteSettingsTag, taxonomyTag } from "../cache/chrome-tags.js";
+import { invalidateRouteCache } from "../cache/route-cache.js";
 import { convertDataForRead, convertDataForWrite } from "../client/portable-text.js";
 import type { FieldSchema } from "../client/portable-text.js";
 import { decodeCursor, InvalidCursorError } from "../database/repositories/types.js";
@@ -49,6 +51,7 @@ import { readSiteWriteFence, recordSiteWrite } from "../transfer/fence.js";
 import { toSha256Digest } from "../transfer/format/digest.js";
 import { siteImportDecisionsInputSchema } from "../transfer/format/plan.js";
 import { decodeBase64, encodeBase64 } from "../utils/base64.js";
+import { pluginToolName } from "./plugin-tool-name.js";
 import {
 	analyzeImport,
 	exportStatus,
@@ -177,6 +180,10 @@ const settingsSeoSchema = z.object({
 		.max(5000)
 		.optional()
 		.describe("Custom robots.txt body. Leave unset for the EmDash default."),
+	disallowAiTraining: z
+		.boolean()
+		.optional()
+		.describe("Add robots.txt rules asking AI crawlers not to use the site for training"),
 	googleVerification: z
 		.string()
 		.max(100)
@@ -577,8 +584,7 @@ async function unwrapAndInvalidate(
 	changedEarlier = false,
 ): Promise<SuccessEnvelope | ErrorEnvelope> {
 	if (result.success || changedEarlier) {
-		const { cache } = getExtra(extra);
-		if (cache?.enabled) await cache.invalidate({ tags });
+		await invalidateRouteCache(getExtra(extra).cache, tags);
 	}
 	return unwrap(result);
 }
@@ -828,6 +834,15 @@ async function refuseLockedEntry(
 	return refusal ? respondError(refusal.code, refusal.message, { ...refusal.details }) : null;
 }
 
+/** Extract the status from a content handler response. */
+function extractContentStatus(data: unknown): unknown {
+	if (!data || typeof data !== "object") return undefined;
+	const obj = data as Record<string, unknown>;
+	const item =
+		obj.item && typeof obj.item === "object" ? (obj.item as Record<string, unknown>) : obj;
+	return item?.status;
+}
+
 /** Extract the `_rev` token from a content handler response. */
 function extractContentRev(data: unknown): string | undefined {
 	if (!data || typeof data !== "object") return undefined;
@@ -905,10 +920,19 @@ export function createMcpServer(
 		)(name, config, wrapped);
 	}) as typeof server.registerTool;
 
+	const registeredPluginNames = new Set<string>();
 	for (const tool of pluginTools) {
 		if (!Object.hasOwn(Permissions, tool.permission)) continue;
+		const name = pluginToolName(tool.pluginId, tool.name);
+		if (registeredPluginNames.has(name)) {
+			console.warn(
+				`[emdash] Skipping duplicate MCP tool name ${name} from ${tool.pluginId}/${tool.name}`,
+			);
+			continue;
+		}
+		registeredPluginNames.add(name);
 		server.registerTool(
-			`${tool.pluginId}__${tool.name}`,
+			name,
 			{
 				description: tool.description,
 				inputSchema: tool.inputSchema,
@@ -1134,7 +1158,8 @@ export function createMcpServer(
 				"this. Pass a Portable Text JSON array only for complex content Markdown " +
 				"can't express (custom blocks, embeds). A slug is auto-generated if not " +
 				"provided. Items are created as 'draft' by default — use content_publish " +
-				"to make them live.",
+				"or pass status='published' to make them live. `seo` and `publishedAt` " +
+				"can be set in the same call; `publishedAt` requires content:publish_any.",
 			inputSchema: z.object({
 				collection: z.string().describe("Collection slug (e.g. 'posts', 'pages')"),
 				data: z
@@ -1175,6 +1200,18 @@ export function createMcpServer(
 					.describe(
 						"Taxonomy term assignments as { taxonomyName: [termSlug, ...] }. Term slugs are resolved in the entry's locale. Call taxonomy_list to see available taxonomies and taxonomy_list_terms to look up slugs. Missing keys leave that taxonomy unchanged.",
 					),
+				// Reuse the REST schema so `canonical` is gated through `httpUrl`,
+				// rejecting javascript:/data: URIs that would become stored XSS.
+				seo: contentSeoInput
+					.optional()
+					.describe(
+						"Per-content SEO metadata. Only valid for collections with SEO enabled (see schema_get_collection.hasSeo).",
+					),
+				publishedAt: contentDateTimeInputSchema
+					.nullish()
+					.describe(
+						"Override the publication timestamp (ISO 8601). Requires content:publish_any permission. Useful for content migrations.",
+					),
 			}),
 			annotations: { destructiveHint: false },
 		},
@@ -1184,6 +1221,19 @@ export function createMcpServer(
 			const { emdash, userId, userRole } = getExtra(extra);
 			const actor = { id: userId, role: userRole };
 
+			// Writing publishedAt directly (including clearing to null) overwrites
+			// historical record — gate behind publish_any, mirroring the REST POST
+			// route and the MCP content_update tool.
+			if (args.publishedAt !== undefined) {
+				const user = { id: userId, role: userRole };
+				if (!hasPermission(user, "content:publish_any")) {
+					throw new EmDashAuthError(
+						"Setting publishedAt requires content:publish_any permission",
+						"INSUFFICIENT_PERMISSIONS",
+					);
+				}
+			}
+
 			// Creating a translation requires edit permission on the source item
 			if (args.translationOf) {
 				const source = await emdash.handleContentGet(args.collection, args.translationOf);
@@ -1217,6 +1267,8 @@ export function createMcpServer(
 					taxonomies: args.taxonomies,
 					migrateBlocks: args.migrateBlocks,
 					replaceBlocks: args.replaceBlocks,
+					seo: args.seo,
+					publishedAt: args.publishedAt,
 					actor,
 				});
 				if (!result.success) return unwrap(result);
@@ -1225,6 +1277,7 @@ export function createMcpServer(
 					return unwrapAndInvalidate(
 						extra,
 						await emdash.handleContentPublish(args.collection, itemId, {
+							publishedAt: args.publishedAt ?? undefined,
 							actor: { ...actor, source: "mcp" },
 							origin: { source: "mcp" },
 						}),
@@ -1232,11 +1285,10 @@ export function createMcpServer(
 						true,
 					);
 				}
-				return unwrapAndInvalidate(extra, result, [args.collection]);
+				return unwrap(result);
 			}
 
-			return unwrapAndInvalidate(
-				extra,
+			return unwrap(
 				await emdash.handleContentCreate(args.collection, {
 					data,
 					slug: args.slug,
@@ -1247,9 +1299,10 @@ export function createMcpServer(
 					taxonomies: args.taxonomies,
 					migrateBlocks: args.migrateBlocks,
 					replaceBlocks: args.replaceBlocks,
+					seo: args.seo,
+					publishedAt: args.publishedAt,
 					actor,
 				}),
-				[args.collection],
 			);
 		},
 	);
@@ -1333,7 +1386,7 @@ export function createMcpServer(
 		},
 		async (args, extra) => {
 			requireScope(extra, "content:write");
-			requireRole(extra, Role.AUTHOR);
+			requireRole(extra, Role.CONTRIBUTOR);
 			const { emdash, userId, userRole } = getExtra(extra);
 			const actor = { id: userId, role: userRole };
 
@@ -1343,7 +1396,17 @@ export function createMcpServer(
 				return unwrap(existing);
 			}
 			const ownerId = extractContentAuthorId(existing.data);
-			requireOwnership(extra, ownerId, "content:edit_own", "content:edit_any");
+			if (
+				!entryEditAccess(
+					{ id: userId, role: userRole },
+					{ authorId: ownerId, status: extractContentStatus(existing.data) },
+				)
+			) {
+				throw new EmDashAuthError(
+					"Insufficient permissions for this operation",
+					"INSUFFICIENT_PERMISSIONS",
+				);
+			}
 
 			const data = args.data
 				? await convertWriteData(emdash, args.collection, args.data)
@@ -1896,11 +1959,7 @@ export function createMcpServer(
 				"content:edit_any",
 			);
 			const resolvedId = extractContentId(existing.data) ?? args.id;
-			return unwrapAndInvalidate(
-				extra,
-				await emdash.handleContentDuplicate(args.collection, resolvedId, userId),
-				[args.collection],
-			);
+			return unwrap(await emdash.handleContentDuplicate(args.collection, resolvedId, userId));
 		},
 	);
 

package/src/media/usage/collection-deletion.ts

@@ -1,6 +1,7 @@
 import { sql, type Kysely, type RawBuilder, type Selectable, type Transaction } from "kysely";
 import { ulid } from "ulidx";
 
+import { deleteSharedCollectionRecords } from "../../database/collection-cleanup.js";
 import { isPostgres } from "../../database/dialect-helpers.js";
 import {
 	decodeCursor,
@@ -555,6 +556,9 @@ export async function deleteActivatedMediaUsageCollection(
 			leaseToken: claim.leaseToken,
 		});
 		if (result.outcome !== "dropped") throw new Error("Collection deletion lost its table fence");
+		// The content table is gone, so the FKs from ec_* to revisions.id are
+		// released and the remaining shared-table records can be removed.
+		await deleteSharedCollectionRecords(db, claim.collectionSlug);
 		if (
 			!(await repository.checkpoint({
 				...lease,