feat(mcp): add safe schema update tools

[masonjames]

What does this PR do?

Adds schema_update_collection and schema_update_field MCP tools so agents can update existing schemas without deleting tables, columns, content, or stored field values.

Both tools reuse the canonical REST handlers and validation, require schema:write plus the Admin role, preserve omitted properties during concurrent partial updates, invalidate affected caches, and return explicit migration errors for changes that cannot be represented safely as metadata-only updates. The MCP reference documents the new surface and migration limits.

Closes #1681

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main. N/A: no admin UI strings are changed.
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: Add MCP tools for safe schema updates (schema_update_collection, schema_update_field) - #1681 #1876 (also scoped by maintainer-authored 1.0 roadmap issue Add MCP tools for safe schema updates #1681)

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: OpenAI Codex (GPT-5); RepoPrompt Oracle was used for adversarial review

Screenshots / test output

No visual changes.

• pnpm typecheck — passed
• pnpm lint:json | jq '.diagnostics | length' — 0
• MCP integration and schema registry tests — 374 passed
• Full MCP integration suite — 335 passed
• Workspace build — passed
• Docs build — passed
• Changeset status and git diff --check — passed
• Full core suite — 5,188 passed; one unrelated macOS path assertion compares /var/... with its /private/var/... resolved path
• Package validation — publint passed; attw 0.18.2 exited with its internal Cannot read properties of undefined (reading 'filename') error

[changeset-bot]

🦋 Changeset detected

Latest commit: b628703

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 17 packages

Name	Type
emdash	Minor
@emdash-cms/cloudflare	Minor
@emdash-cms/sandbox-workerd	Patch
@emdash-cms/plugin-mcp-smoke	Major
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/admin	Minor
@emdash-cms/auth	Minor
@emdash-cms/blocks	Minor
@emdash-cms/gutenberg-to-portable-text	Minor
@emdash-cms/x402	Minor
create-emdash	Minor
@emdash-cms/auth-atproto	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Scope check

This PR changes 964 lines across 12 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@2354

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@2354

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@2354

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@2354

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@2354

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@2354

emdash

npm i https://pkg.pr.new/emdash@2354

create-emdash

npm i https://pkg.pr.new/create-emdash@2354

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@2354

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@2354

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@2354

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@2354

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@2354

@emdash-cms/registry-verification

npm i https://pkg.pr.new/@emdash-cms/registry-verification@2354

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@2354

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@2354

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@2354

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@2354

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@2354

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@2354

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@2354

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@2354

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@2354

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@2354

commit: b628703

[emdashbot]

This PR is a focused, well-scoped feature addition: two new MCP tools (schema_update_collection, schema_update_field) that delegate to the existing REST handlers and validation, plus the underlying registry changes needed to make partial updates safe and concurrent-friendly.

Approach: The approach is sound and fits EmDash. Reusing updateCollectionBody/updateFieldBody for the MCP input schemas keeps the REST and MCP surfaces in sync, and the registry rewrite of updateCollection/updateField moves the read-modify-write logic inside the transaction so omitted fields are preserved. The narrowing of in-place type changes to the safe string/text/slug aliases (even when the SQLite column type happens to match) is the right conservative choice for a "safe update" tool.

What I checked:

• Diff and full changed files in packages/core/src/{api,mcp,schema,query}.
• Caching/invalidation paths: field writes now call both invalidateCollectionCache and invalidateSchemaCache; collection writes go through invalidateUrlPatternCache() which also busts the schema object-cache namespace.
• Validation: updateCollectionBody and updateFieldBody are used by both REST and MCP; new urlPatternValue and fieldValidation refinements close validation gaps without increasing the logged-out query count.
• Security: schema writes require schema:write + Role.ADMIN; SQL is built with Kysely/parameterized values; no interpolation into SQL.
• Tests: new integration tests cover happy paths, migration errors, invalid validation, concurrent partial updates, and permission gating.

I did not find any blocking issues. The changeset, docs, and tests are all in place, and the implementation matches the PR's stated goals.

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat(content): filter indexed custom fields #2213 (6 shared files)
• feat(content): support indexed custom field sorting #2212 (6 shared files)
• feat(admin): explicit collection order in the sidebar #2267 (5 shared files)
• feat: reference field type (storage-less edges + admin UI) #1928 (4 shared files)
• feat(admin): allow hiding a collection from the admin sidebar #2264 (4 shared files)
• feat(admin): allow trusted plugins to add content list columns #2195 (4 shared files)
• feat(admin): show configured fields in content lists #2194 (4 shared files)
• feat(admin): add date-only content field #1365 (5 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.