emdash 0.37.0 → 0.38.0

package/dist/astro/routes/api/auth/passkey/verify.mjs

@@ -1,18 +1,18 @@
 import "../../../../../config-C3EBstHi.mjs";
 import "../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../types-CQPWhPxE.mjs";
-import { t as OptionsRepository } from "../../../../../options-BHPeIbBd.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DFrQjppn.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../media-BHjus86Y.mjs";
-import "../../../../../redirects-BLNOWQTn.mjs";
-import { L as passkeyVerifyBody } from "../../../../../relations-C4htk5sb.mjs";
-import "../../../../../status-B777-dXz.mjs";
+import { t as OptionsRepository } from "../../../../../options-D1FBiAv1.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BDcFyoRt.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../media-C1EIZKh1.mjs";
+import "../../../../../entry-lock-DIYHAaSw.mjs";
+import { L as passkeyVerifyBody } from "../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../status-Cenfk_r5.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-CarhZJgf.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-BGglilcs.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-DQN_Yrck.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-O_lj3y0k.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-FWWAvnre.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-GFUVavRj.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-BIOak-tp.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-qIdO-wF6.mjs";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { PasskeyAuthenticationError, authenticateWithPasskey } from "@emdash-cms/auth/passkey";
 

package/dist/astro/routes/api/auth/signup/complete.mjs

@@ -1,18 +1,18 @@
 import "../../../../../config-C3EBstHi.mjs";
 import "../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../types-CQPWhPxE.mjs";
-import { t as OptionsRepository } from "../../../../../options-BHPeIbBd.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DFrQjppn.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../media-BHjus86Y.mjs";
-import "../../../../../redirects-BLNOWQTn.mjs";
-import { R as signupCompleteBody } from "../../../../../relations-C4htk5sb.mjs";
-import "../../../../../status-B777-dXz.mjs";
+import { t as OptionsRepository } from "../../../../../options-D1FBiAv1.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BDcFyoRt.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../media-C1EIZKh1.mjs";
+import "../../../../../entry-lock-DIYHAaSw.mjs";
+import { R as signupCompleteBody } from "../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../status-Cenfk_r5.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { r as getPublicOrigin } from "../../../../../public-url-CarhZJgf.mjs";
-import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-BGglilcs.mjs";
-import { n as createChallengeStore } from "../../../../../challenge-store-DQN_Yrck.mjs";
-import { t as getPasskeyConfig } from "../../../../../passkey-config-O_lj3y0k.mjs";
+import { r as getPublicOrigin } from "../../../../../public-url-FWWAvnre.mjs";
+import { n as validateAllowedOrigins, t as getConfiguredAllowedOrigins } from "../../../../../allowed-origins-GFUVavRj.mjs";
+import { n as createChallengeStore } from "../../../../../challenge-store-BIOak-tp.mjs";
+import { t as getPasskeyConfig } from "../../../../../passkey-config-qIdO-wF6.mjs";
 import { SignupError, completeSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { registerPasskey, verifyRegistrationResponse } from "@emdash-cms/auth/passkey";

package/dist/astro/routes/api/auth/signup/request.mjs

@@ -1,17 +1,17 @@
 import "../../../../../config-C3EBstHi.mjs";
 import "../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../types-CQPWhPxE.mjs";
-import { t as OptionsRepository } from "../../../../../options-BHPeIbBd.mjs";
-import { n as apiSuccess, t as apiError } from "../../../../../error-DFrQjppn.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../media-BHjus86Y.mjs";
-import "../../../../../redirects-BLNOWQTn.mjs";
-import { z as signupRequestBody } from "../../../../../relations-C4htk5sb.mjs";
-import "../../../../../status-B777-dXz.mjs";
+import { t as OptionsRepository } from "../../../../../options-D1FBiAv1.mjs";
+import { n as apiSuccess, t as apiError } from "../../../../../error-BDcFyoRt.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../media-C1EIZKh1.mjs";
+import "../../../../../entry-lock-DIYHAaSw.mjs";
+import { z as signupRequestBody } from "../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../status-Cenfk_r5.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-BR5F1Otp.mjs";
-import { t as getSiteBaseUrl } from "../../../../../site-url-BrxA_E9H.mjs";
-import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-BZmATC6W.mjs";
+import { t as getTrustedProxyHeaders } from "../../../../../trusted-proxy-BTM6UxqD.mjs";
+import { t as getSiteBaseUrl } from "../../../../../site-url-Bqf-ea3N.mjs";
+import { n as getClientIp, t as checkRateLimit } from "../../../../../rate-limit-CQUPm0dh.mjs";
 import { requestSignup } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/auth/signup/verify.mjs

@@ -1,6 +1,6 @@
 import "../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../types-CQPWhPxE.mjs";
-import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-DFrQjppn.mjs";
+import { n as apiSuccess, r as handleError, t as apiError } from "../../../../../error-BDcFyoRt.mjs";
 import { SignupError, roleFromLevel, validateSignupToken } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 

package/dist/astro/routes/api/comments/_collection_/_contentId_/index.mjs

@@ -5,19 +5,19 @@ import "../../../../../../object-cache-DVKnyOfy.mjs";
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
 import { t as CommentRepository } from "../../../../../../comment-vxOzWbZN.mjs";
-import "../../../../../../options-BHPeIbBd.mjs";
-import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../../media-BHjus86Y.mjs";
-import { wt as createCommentBody } from "../../../../../../redirects-BLNOWQTn.mjs";
-import "../../../../../../relations-C4htk5sb.mjs";
-import "../../../../../../status-B777-dXz.mjs";
+import "../../../../../../options-D1FBiAv1.mjs";
+import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../../media-C1EIZKh1.mjs";
+import { kt as createCommentBody } from "../../../../../../entry-lock-DIYHAaSw.mjs";
+import "../../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../../status-Cenfk_r5.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { t as extractRequestMeta } from "../../../../../../request-meta-DYxLlnmz.mjs";
-import { i as resolveSecretsCached } from "../../../../../../secrets-rEtHt-6z.mjs";
-import { c as hashIp, s as handleCommentList, t as checkRateLimit } from "../../../../../../comments-Ct4ensnf.mjs";
-import { t as getSiteBaseUrl } from "../../../../../../site-url-BrxA_E9H.mjs";
-import { i as sendCommentNotification, t as createComment } from "../../../../../../service-CJl3ZAYs.mjs";
+import { t as extractRequestMeta } from "../../../../../../request-meta-BgjUQLQ-.mjs";
+import { i as resolveSecretsCached } from "../../../../../../secrets-CdfzLdoO.mjs";
+import { c as hashIp, s as handleCommentList, t as checkRateLimit } from "../../../../../../comments-VzmVLyaC.mjs";
+import { t as getSiteBaseUrl } from "../../../../../../site-url-Bqf-ea3N.mjs";
+import { i as sendCommentNotification, t as createComment } from "../../../../../../service-J_-Vgo7R.mjs";
 
 //#region src/comments/turnstile.ts
 /**

package/dist/astro/routes/api/comments/_collection_/_contentId_/reactions.mjs

@@ -4,18 +4,18 @@ import { l as invalidateCommentObjectCache } from "../../../../../../object-cach
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
 import "../../../../../../comment-vxOzWbZN.mjs";
-import "../../../../../../options-BHPeIbBd.mjs";
-import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../../media-BHjus86Y.mjs";
-import { Tt as createReactionBody } from "../../../../../../redirects-BLNOWQTn.mjs";
-import "../../../../../../relations-C4htk5sb.mjs";
-import "../../../../../../status-B777-dXz.mjs";
+import "../../../../../../options-D1FBiAv1.mjs";
+import { a as unwrapResult, i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../../media-C1EIZKh1.mjs";
+import { At as createReactionBody } from "../../../../../../entry-lock-DIYHAaSw.mjs";
+import "../../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../../status-Cenfk_r5.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { t as extractRequestMeta } from "../../../../../../request-meta-DYxLlnmz.mjs";
-import { t as CommentReactionRepository } from "../../../../../../comment-reaction-BhrvSHml.mjs";
-import { i as resolveSecretsCached } from "../../../../../../secrets-rEtHt-6z.mjs";
-import { c as hashIp } from "../../../../../../comments-Ct4ensnf.mjs";
+import { t as extractRequestMeta } from "../../../../../../request-meta-BgjUQLQ-.mjs";
+import { t as CommentReactionRepository } from "../../../../../../comment-reaction-CDyvPQRj.mjs";
+import { i as resolveSecretsCached } from "../../../../../../secrets-CdfzLdoO.mjs";
+import { c as hashIp } from "../../../../../../comments-VzmVLyaC.mjs";
 
 //#region src/api/handlers/comment-reactions.ts
 /** Max reactions a single voter may register per window before throttling. */

package/dist/astro/routes/api/content/_collection_/_id_/compare.mjs

@@ -1,7 +1,7 @@
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { r as requirePerm } from "../../../../../../authorize-Bkf_UHhD.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { r as requirePerm } from "../../../../../../authorize-C2QHlWSS.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/compare.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/discard-draft.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"discard-draft.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/discard-draft.ts"],"mappings":";;;cAaa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"discard-draft.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/discard-draft.ts"],"mappings":";;;cAca,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/content/_collection_/_id_/discard-draft.mjs

@@ -1,15 +1,18 @@
+import "../../../../../../dialect-helpers-BcQvkHgn.mjs";
 import "../../../../../../config-C3EBstHi.mjs";
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-DsVoDUjJ.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../../media-BHjus86Y.mjs";
-import { rn as contentRevisionConditionBody } from "../../../../../../redirects-BLNOWQTn.mjs";
-import "../../../../../../relations-C4htk5sb.mjs";
-import "../../../../../../status-B777-dXz.mjs";
+import "../../../../../../entry-locks-BEcX7ET0.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-DvMdNrgf.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../../media-C1EIZKh1.mjs";
+import { cn as contentRevisionConditionBody } from "../../../../../../entry-lock-DIYHAaSw.mjs";
+import "../../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../../status-Cenfk_r5.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as requireOwnerPerm } from "../../../../../../authorize-Bkf_UHhD.mjs";
+import { n as requireOwnerPerm } from "../../../../../../authorize-C2QHlWSS.mjs";
+import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-BEr8gDkG.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/discard-draft.ts
 const prerender = false;
@@ -28,6 +31,8 @@ const POST = async ({ params, request, locals, url, cache }) => {
 	const denied = requireOwnerPerm(user, typeof existingItem?.authorId === "string" ? existingItem.authorId : "", "content:edit_own", "content:edit_any");
 	if (denied) return denied;
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user.id, { override: body?.overrideLock });
+	if (refusal) return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), { ...refusal.details });
 	const result = await emdash.handleContentDiscardDraft(collection, resolvedId, { _rev: body?._rev });
 	if (!result.success) return unwrapResult(result);
 	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });

package/dist/astro/routes/api/content/_collection_/_id_/discard-draft.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"discard-draft.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/discard-draft.ts"],"sourcesContent":["/**\n * Discard draft changes - reverts to live version\n *\n * POST /_emdash/api/content/{collection}/{id}/discard-draft\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentRevisionConditionBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDiscardDraft || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst body = await parseOptionalBody(request, contentRevisionConditionBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (denied) return denied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst result = await emdash.handleContentDiscardDraft(collection, resolvedId, {\n\t\t_rev: body?._rev,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;AAaA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,6BAA6B,CAAC,QAAQ,iBAClD,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,8BAA8B,EAAE,CAAC;AAC/E,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAEF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,oBAAoB,mBAAmB;AACvF,KAAI,OAAQ,QAAO;CAEnB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,SAAS,MAAM,OAAO,0BAA0B,YAAY,YAAY,EAC7E,MAAM,MAAM,MACZ,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}
+{"version":3,"file":"discard-draft.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/discard-draft.ts"],"sourcesContent":["/**\n * Discard draft changes - reverts to live version\n *\n * POST /_emdash/api/content/{collection}/{id}/discard-draft\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentRevisionConditionBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDiscardDraft || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst body = await parseOptionalBody(request, contentRevisionConditionBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (denied) return denied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentDiscardDraft(collection, resolvedId, {\n\t\t_rev: body?._rev,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,6BAA6B,CAAC,QAAQ,iBAClD,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,8BAA8B,EAAE,CAAC;AAC/E,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAEF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,oBAAoB,mBAAmB;AACvF,KAAI,OAAQ,QAAO;CAEnB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,0BAA0B,YAAY,YAAY,EAC7E,MAAM,MAAM,MACZ,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}

package/dist/astro/routes/api/content/_collection_/_id_/duplicate.mjs

@@ -1,8 +1,8 @@
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-DsVoDUjJ.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { n as requireOwnerPerm, r as requirePerm } from "../../../../../../authorize-Bkf_UHhD.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-DvMdNrgf.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { n as requireOwnerPerm, r as requirePerm } from "../../../../../../authorize-C2QHlWSS.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/duplicate.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/lock.d.mts

@@ -0,0 +1,10 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/content/[collection]/[id]/lock.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+declare const POST: APIRoute;
+declare const DELETE: APIRoute;
+//#endregion
+export { DELETE, GET, POST, prerender };
+//# sourceMappingURL=lock.d.mts.map

package/dist/astro/routes/api/content/_collection_/_id_/lock.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/lock.ts"],"mappings":";;;cAoBa,SAAA;AAAA,cAmDA,GAAA,EAAK,QAAA;AAAA,cAgBL,IAAA,EAAM,QAAA;AAAA,cAyBN,MAAA,EAAQ,QAAA"}

package/dist/astro/routes/api/content/_collection_/_id_/lock.mjs

@@ -0,0 +1,66 @@
+import "../../../../../../dialect-helpers-BcQvkHgn.mjs";
+import "../../../../../../config-C3EBstHi.mjs";
+import "../../../../../../base64-CvLhUKQv.mjs";
+import "../../../../../../types-CQPWhPxE.mjs";
+import "../../../../../../entry-locks-BEcX7ET0.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-DvMdNrgf.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../../media-C1EIZKh1.mjs";
+import { t as entryLockAcquireBody } from "../../../../../../entry-lock-DIYHAaSw.mjs";
+import "../../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../../status-Cenfk_r5.mjs";
+import "../../../../../../api/schemas/index.mjs";
+import { n as requireOwnerPerm } from "../../../../../../authorize-C2QHlWSS.mjs";
+import { i as handleEntryLockRelease, n as handleEntryLockAcquire, r as handleEntryLockRead } from "../../../../../../entry-lock-BEr8gDkG.mjs";
+
+//#region src/astro/routes/api/content/[collection]/[id]/lock.ts
+const prerender = false;
+/**
+* Resolves the entry the way every other single-entry route does, and applies
+* the same edit permission, since holding a lock is the prelude to a write.
+*/
+async function resolveEntry(locals, collection, id, locale) {
+	const { emdash, user } = locals;
+	if (!emdash?.handleContentGet) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const existing = await emdash.handleContentGet(collection, id, locale);
+	if (!existing.success) return apiError(existing.error?.code ?? "UNKNOWN_ERROR", existing.error?.message ?? "Unknown error", mapErrorStatus(existing.error?.code));
+	const existingData = existing.data && typeof existing.data === "object" ? existing.data : void 0;
+	const existingItem = existingData?.item && typeof existingData.item === "object" ? existingData.item : existingData;
+	const denied = requireOwnerPerm(user, typeof existingItem?.authorId === "string" ? existingItem.authorId : "", "content:edit_own", "content:edit_any");
+	if (denied) return denied;
+	return {
+		resolvedId: typeof existingItem?.id === "string" ? existingItem.id : id,
+		userId: user.id
+	};
+}
+const GET = async ({ params, locals, url }) => {
+	const collection = params.collection;
+	const id = params.id;
+	const resolved = await resolveEntry(locals, collection, id, url.searchParams.get("locale") || void 0);
+	if (resolved instanceof Response) return resolved;
+	return unwrapResult(await handleEntryLockRead(locals.emdash.db, collection, resolved.resolvedId, resolved.userId));
+};
+const POST = async ({ params, request, locals, url }) => {
+	const collection = params.collection;
+	const id = params.id;
+	const body = await parseOptionalBody(request, entryLockAcquireBody, {});
+	if (isParseError(body)) return body;
+	const resolved = await resolveEntry(locals, collection, id, url.searchParams.get("locale") || void 0);
+	if (resolved instanceof Response) return resolved;
+	return unwrapResult(await handleEntryLockAcquire(locals.emdash.db, collection, resolved.resolvedId, resolved.userId, {
+		takeover: body?.takeover,
+		token: body?.token
+	}));
+};
+const DELETE = async ({ params, locals, url }) => {
+	const collection = params.collection;
+	const id = params.id;
+	const resolved = await resolveEntry(locals, collection, id, url.searchParams.get("locale") || void 0);
+	if (resolved instanceof Response) return resolved;
+	return unwrapResult(await handleEntryLockRelease(locals.emdash.db, collection, resolved.resolvedId, resolved.userId, { token: url.searchParams.get("token") ?? void 0 }));
+};
+
+//#endregion
+export { DELETE, GET, POST, prerender };
+//# sourceMappingURL=lock.mjs.map

package/dist/astro/routes/api/content/_collection_/_id_/lock.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/lock.ts"],"sourcesContent":["/**\n * Entry edit lock\n *\n * GET    /_emdash/api/content/{collection}/{id}/lock - Read the current holder\n * POST   /_emdash/api/content/{collection}/{id}/lock - Take or refresh the lock\n * DELETE /_emdash/api/content/{collection}/{id}/lock - Release the caller's lock\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleEntryLockAcquire,\n\thandleEntryLockRead,\n\thandleEntryLockRelease,\n} from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { entryLockAcquireBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\ninterface ResolvedEntry {\n\tresolvedId: string;\n\tuserId: string;\n}\n\n/**\n * Resolves the entry the way every other single-entry route does, and applies\n * the same edit permission, since holding a lock is the prelude to a write.\n */\nasync function resolveEntry(\n\tlocals: App.Locals,\n\tcollection: string,\n\tid: string,\n\tlocale: string | undefined,\n): Promise<ResolvedEntry | Response> {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (denied) return denied;\n\n\treturn {\n\t\tresolvedId: typeof existingItem?.id === \"string\" ? existingItem.id : id,\n\t\tuserId: user!.id,\n\t};\n}\n\nexport const GET: APIRoute = async ({ params, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockRead(locals.emdash.db, collection, resolved.resolvedId, resolved.userId),\n\t);\n};\n\nexport const POST: APIRoute = async ({ params, request, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst body = await parseOptionalBody(request, entryLockAcquireBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockAcquire(\n\t\t\tlocals.emdash.db,\n\t\t\tcollection,\n\t\t\tresolved.resolvedId,\n\t\t\tresolved.userId,\n\t\t\t{ takeover: body?.takeover, token: body?.token },\n\t\t),\n\t);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockRelease(\n\t\t\tlocals.emdash.db,\n\t\t\tcollection,\n\t\t\tresolved.resolvedId,\n\t\t\tresolved.userId,\n\t\t\t{ token: url.searchParams.get(\"token\") ?? undefined },\n\t\t),\n\t);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAoBA,MAAa,YAAY;;;;;AAWzB,eAAe,aACd,QACA,YACA,IACA,QACoC;CACpC,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,oBAAoB,mBAAmB;AACvF,KAAI,OAAQ,QAAO;AAEnB,QAAO;EACN,YAAY,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;EACrE,QAAQ,KAAM;EACd;;AAGF,MAAa,MAAgB,OAAO,EAAE,QAAQ,QAAQ,UAAU;CAC/D,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,oBAAoB,OAAO,OAAO,IAAI,YAAY,SAAS,YAAY,SAAS,OAAO,CAC7F;;AAGF,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,UAAU;CACzE,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,OAAO,MAAM,kBAAkB,SAAS,sBAAsB,EAAE,CAAC;AACvE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,uBACL,OAAO,OAAO,IACd,YACA,SAAS,YACT,SAAS,QACT;EAAE,UAAU,MAAM;EAAU,OAAO,MAAM;EAAO,CAChD,CACD;;AAGF,MAAa,SAAmB,OAAO,EAAE,QAAQ,QAAQ,UAAU;CAClE,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,uBACL,OAAO,OAAO,IACd,YACA,SAAS,YACT,SAAS,QACT,EAAE,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,QAAW,CACrD,CACD"}

package/dist/astro/routes/api/content/_collection_/_id_/permanent.mjs

@@ -1,7 +1,7 @@
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { r as requirePerm } from "../../../../../../authorize-Bkf_UHhD.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { r as requirePerm } from "../../../../../../authorize-C2QHlWSS.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/permanent.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/preview-url.mjs

@@ -2,18 +2,18 @@ import { r as getI18nConfig } from "../../../../../../config-C3EBstHi.mjs";
 import "../../../../../../after-CBU2vkoO.mjs";
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
-import "../../../../../../options-BHPeIbBd.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../../media-BHjus86Y.mjs";
-import { en as contentPreviewUrlBody } from "../../../../../../redirects-BLNOWQTn.mjs";
-import "../../../../../../relations-C4htk5sb.mjs";
-import "../../../../../../status-B777-dXz.mjs";
+import "../../../../../../options-D1FBiAv1.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../../media-C1EIZKh1.mjs";
+import { an as contentPreviewUrlBody } from "../../../../../../entry-lock-DIYHAaSw.mjs";
+import "../../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../../status-Cenfk_r5.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import "../../../../../../tokens-BCO1oruF.mjs";
-import { i as getPreviewUrl } from "../../../../../../preview-B_vJLvf8.mjs";
-import { i as resolveSecretsCached } from "../../../../../../secrets-rEtHt-6z.mjs";
-import { r as requirePerm } from "../../../../../../authorize-Bkf_UHhD.mjs";
+import "../../../../../../tokens-CDk8ox9p.mjs";
+import { i as getPreviewUrl } from "../../../../../../preview-BxwsGgGp.mjs";
+import { i as resolveSecretsCached } from "../../../../../../secrets-CdfzLdoO.mjs";
+import { r as requirePerm } from "../../../../../../authorize-C2QHlWSS.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/preview-url.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/publish.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/publish.ts"],"mappings":";;;cAoBa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"publish.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/publish.ts"],"mappings":";;;cAqBa,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/content/_collection_/_id_/publish.mjs

@@ -1,15 +1,18 @@
+import "../../../../../../dialect-helpers-BcQvkHgn.mjs";
 import "../../../../../../config-C3EBstHi.mjs";
 import "../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../types-CQPWhPxE.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-DsVoDUjJ.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-DFrQjppn.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Ckpg-Qfp.mjs";
-import "../../../../../../media-BHjus86Y.mjs";
-import { tn as contentPublishBody } from "../../../../../../redirects-BLNOWQTn.mjs";
-import "../../../../../../relations-C4htk5sb.mjs";
-import "../../../../../../status-B777-dXz.mjs";
+import "../../../../../../entry-locks-BEcX7ET0.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-DvMdNrgf.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-BDcFyoRt.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-WRg5C3NX.mjs";
+import "../../../../../../media-C1EIZKh1.mjs";
+import { on as contentPublishBody } from "../../../../../../entry-lock-DIYHAaSw.mjs";
+import "../../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../../status-Cenfk_r5.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as requireOwnerPerm } from "../../../../../../authorize-Bkf_UHhD.mjs";
+import { n as requireOwnerPerm } from "../../../../../../authorize-C2QHlWSS.mjs";
+import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-BEr8gDkG.mjs";
 import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/[id]/publish.ts
@@ -18,7 +21,7 @@ import { hasPermission } from "@emdash-cms/auth";
 *
 * POST /_emdash/api/content/{collection}/{id}/publish
 *
-* Optional JSON body: { publishedAt?: string, _rev?: string }
+* Optional JSON body: { publishedAt?: string, _rev?: string, overrideLock?: boolean }
 *   publishedAt — ISO 8601 datetime to backdate the publish (e.g. when
 *   migrating content). Writing publishedAt requires content:publish_any.
 *   Without it, the existing published_at is preserved on re-publish and
@@ -42,6 +45,8 @@ const POST = async ({ params, request, locals, url, cache }) => {
 	const publishedAt = body?.publishedAt;
 	if (publishedAt !== void 0 && !hasPermission(user, "content:publish_any")) return apiError("FORBIDDEN", "Setting publishedAt requires content:publish_any permission", 403);
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user.id, { override: body?.overrideLock });
+	if (refusal) return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), { ...refusal.details });
 	const result = await emdash.handleContentPublish(collection, resolvedId, {
 		publishedAt,
 		_rev: body?._rev

package/dist/astro/routes/api/content/_collection_/_id_/publish.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"publish.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/publish.ts"],"sourcesContent":["/**\n * Publish content - promotes draft to live\n *\n * POST /_emdash/api/content/{collection}/{id}/publish\n *\n * Optional JSON body: { publishedAt?: string, _rev?: string }\n *   publishedAt — ISO 8601 datetime to backdate the publish (e.g. when\n *   migrating content). Writing publishedAt requires content:publish_any.\n *   Without it, the existing published_at is preserved on re-publish and\n *   falls back to the current time on first publish.\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentPublishBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentPublish || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Body is optional — empty body means use the legacy behavior (preserve\n\t// or default published_at). Pass `publishedAt` to backdate.\n\tconst body = await parseOptionalBody(request, contentPublishBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:publish_own\", \"content:publish_any\");\n\tif (denied) return denied;\n\n\t// Schema narrows `publishedAt` to `string | undefined`; null is rejected\n\t// at the schema layer (publish has no semantic meaning for \"clear\").\n\tconst publishedAt = body?.publishedAt;\n\n\t// Backdating overwrites historical record — gate behind publish_any\n\t// regardless of ownership.\n\tif (publishedAt !== undefined && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Setting publishedAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst result = await emdash.handleContentPublish(collection, resolvedId, {\n\t\tpublishedAt,\n\t\t_rev: body?._rev,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,wBAAwB,CAAC,QAAQ,iBAC7C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAKpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,uBAAuB,sBAAsB;AAC7F,KAAI,OAAQ,QAAO;CAInB,MAAM,cAAc,MAAM;AAI1B,KAAI,gBAAgB,UAAa,CAAC,cAAc,MAAM,sBAAsB,CAC3E,QAAO,SACN,aACA,+DACA,IACA;CAGF,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,SAAS,MAAM,OAAO,qBAAqB,YAAY,YAAY;EACxE;EACA,MAAM,MAAM;EACZ,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}
+{"version":3,"file":"publish.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/publish.ts"],"sourcesContent":["/**\n * Publish content - promotes draft to live\n *\n * POST /_emdash/api/content/{collection}/{id}/publish\n *\n * Optional JSON body: { publishedAt?: string, _rev?: string, overrideLock?: boolean }\n *   publishedAt — ISO 8601 datetime to backdate the publish (e.g. when\n *   migrating content). Writing publishedAt requires content:publish_any.\n *   Without it, the existing published_at is preserved on re-publish and\n *   falls back to the current time on first publish.\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentPublishBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentPublish || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Body is optional — empty body means use the legacy behavior (preserve\n\t// or default published_at). Pass `publishedAt` to backdate.\n\tconst body = await parseOptionalBody(request, contentPublishBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:publish_own\", \"content:publish_any\");\n\tif (denied) return denied;\n\n\t// Schema narrows `publishedAt` to `string | undefined`; null is rejected\n\t// at the schema layer (publish has no semantic meaning for \"clear\").\n\tconst publishedAt = body?.publishedAt;\n\n\t// Backdating overwrites historical record — gate behind publish_any\n\t// regardless of ownership.\n\tif (publishedAt !== undefined && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Setting publishedAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentPublish(collection, resolvedId, {\n\t\tpublishedAt,\n\t\t_rev: body?._rev,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,wBAAwB,CAAC,QAAQ,iBAC7C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAKpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,uBAAuB,sBAAsB;AAC7F,KAAI,OAAQ,QAAO;CAInB,MAAM,cAAc,MAAM;AAI1B,KAAI,gBAAgB,UAAa,CAAC,cAAc,MAAM,sBAAsB,CAC3E,QAAO,SACN,aACA,+DACA,IACA;CAGF,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,qBAAqB,YAAY,YAAY;EACxE;EACA,MAAM,MAAM;EACZ,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}

package/dist/astro/routes/api/content/_collection_/_id_/references/_relation_/children.mjs

@@ -1,27 +1,29 @@
-import "../../../../../../../../dialect-helpers-BSbfaO3F.mjs";
+import "../../../../../../../../dialect-helpers-BcQvkHgn.mjs";
 import "../../../../../../../../config-C3EBstHi.mjs";
 import "../../../../../../../../after-CBU2vkoO.mjs";
 import "../../../../../../../../object-cache-DVKnyOfy.mjs";
-import { t as ContentRepository } from "../../../../../../../../content-DjvM0T92.mjs";
+import { t as ContentRepository } from "../../../../../../../../content-CNfMWuhY.mjs";
 import "../../../../../../../../slugify-B994zkXC.mjs";
 import "../../../../../../../../base64-CvLhUKQv.mjs";
 import "../../../../../../../../types-CQPWhPxE.mjs";
-import "../../../../../../../../relation-04DfKRTO.mjs";
-import "../../../../../../../../fts-manager-Do1BlW2r.mjs";
-import "../../../../../../../../capture-triggers-CNW1q3HK.mjs";
-import "../../../../../../../../activation-K0kGBWuJ.mjs";
-import "../../../../../../../../collection-deletion-Bj07NHbj.mjs";
-import "../../../../../../../../content-refresh-Bwp-8yGy.mjs";
-import "../../../../../../../../registry-AZAsRsor.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../../../error-DFrQjppn.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../../../parse-Ckpg-Qfp.mjs";
-import { gt as cursorPaginationQuery } from "../../../../../../../../media-BHjus86Y.mjs";
-import "../../../../../../../../redirects-BLNOWQTn.mjs";
-import { l as setReferenceChildrenBody } from "../../../../../../../../relations-C4htk5sb.mjs";
-import "../../../../../../../../status-B777-dXz.mjs";
+import "../../../../../../../../request-cache-DAZZmesc.mjs";
+import "../../../../../../../../relation-DxgCHOBw.mjs";
+import "../../../../../../../../fts-manager-iddym8cd.mjs";
+import "../../../../../../../../collection-slugs-cache-7lTmNzeA.mjs";
+import "../../../../../../../../capture-triggers-CeAsC76Z.mjs";
+import "../../../../../../../../activation-DyNTe_Tl.mjs";
+import "../../../../../../../../collection-deletion-BCwaWTDw.mjs";
+import "../../../../../../../../content-refresh-GTMyi2Xy.mjs";
+import "../../../../../../../../registry-DTqaqxed.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../../../error-BDcFyoRt.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../../../parse-WRg5C3NX.mjs";
+import { gt as cursorPaginationQuery } from "../../../../../../../../media-C1EIZKh1.mjs";
+import "../../../../../../../../entry-lock-DIYHAaSw.mjs";
+import { l as setReferenceChildrenBody } from "../../../../../../../../relations-rOmbndUJ.mjs";
+import "../../../../../../../../status-Cenfk_r5.mjs";
 import "../../../../../../../../api/schemas/index.mjs";
-import { n as requireOwnerPerm, r as requirePerm } from "../../../../../../../../authorize-Bkf_UHhD.mjs";
-import { n as handleReferenceChildrenSet, t as handleReferenceChildrenGet } from "../../../../../../../../relations-CcFwDJdJ.mjs";
+import { n as requireOwnerPerm, r as requirePerm } from "../../../../../../../../authorize-C2QHlWSS.mjs";
+import { n as handleReferenceChildrenSet, t as handleReferenceChildrenGet } from "../../../../../../../../relations-KKDSLUwS.mjs";
 import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts

package/dist/astro/routes/api/content/_collection_/_id_/references/_relation_/children.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"children.mjs","names":[],"sources":["../../../../../../../../../src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts"],"sourcesContent":["/**\n * Content-entry reference children endpoint (parent side)\n *\n * GET  /_emdash/api/content/:collection/:id/references/:relation/children\n * POST /_emdash/api/content/:collection/:id/references/:relation/children\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleReferenceChildrenGet, handleReferenceChildrenSet } from \"#api/handlers/relations.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { cursorPaginationQuery, setReferenceChildrenBody } from \"#api/schemas.js\";\nimport { ContentRepository } from \"#db/repositories/content.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst query = parseQuery(new URL(request.url), cursorPaginationQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleReferenceChildrenGet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\t{ limit: query.limit, cursor: query.cursor },\n\t\t\thasPermission(user, \"content:read_drafts\"),\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get references\", \"REFERENCES_GET_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\t// Gate on the base edit capability BEFORE the existence lookup. Resolving the\n\t// entry first would let a user with no edit permission distinguish real ids\n\t// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy\n\t// edge POST, which checks `content:edit_own` before fetching the entry.\n\tconst denied = requirePerm(user, \"content:edit_own\");\n\tif (denied) return denied;\n\n\t// Resolve the parent entry to gate on its author (ownership-aware write).\n\tconst parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);\n\tif (!parent) return apiError(\"NOT_FOUND\", \"Content not found\", 404);\n\n\tconst editDenied = requireOwnerPerm(\n\t\tuser,\n\t\tparent.authorId ?? \"\",\n\t\t\"content:edit_own\",\n\t\t\"content:edit_any\",\n\t);\n\tif (editDenied) return editDenied;\n\n\ttry {\n\t\tconst body = await parseBody(request, setReferenceChildrenBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleReferenceChildrenSet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\tbody.childIds,\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to set references\", \"REFERENCES_SET_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;CAErC,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,sBAAsB;AACrE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AASH,SAAO,aARQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA;GAAE,OAAO,MAAM;GAAO,QAAQ,MAAM;GAAQ,EAC5C,cAAc,MAAM,sBAAsB,CAC1C,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;AAI/E,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;AAErC,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAKlB,MAAM,SAAS,YAAY,MAAM,mBAAmB;AACpD,KAAI,OAAQ,QAAO;CAGnB,MAAM,SAAS,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,eAAe,YAAY,GAAG;AACpF,KAAI,CAAC,OAAQ,QAAO,SAAS,aAAa,qBAAqB,IAAI;CAEnE,MAAM,aAAa,iBAClB,MACA,OAAO,YAAY,IACnB,oBACA,mBACA;AACD,KAAI,WAAY,QAAO;AAEvB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,yBAAyB;AAC/D,MAAI,aAAa,KAAK,CAAE,QAAO;AAS/B,SAAO,aAPQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA,KAAK,SACL,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}
+{"version":3,"file":"children.mjs","names":[],"sources":["../../../../../../../../../src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts"],"sourcesContent":["/**\n * Content-entry reference children endpoint (parent side)\n *\n * GET  /_emdash/api/content/:collection/:id/references/:relation/children\n * POST /_emdash/api/content/:collection/:id/references/:relation/children\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleReferenceChildrenGet, handleReferenceChildrenSet } from \"#api/handlers/relations.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { cursorPaginationQuery, setReferenceChildrenBody } from \"#api/schemas.js\";\nimport { ContentRepository } from \"#db/repositories/content.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst query = parseQuery(new URL(request.url), cursorPaginationQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleReferenceChildrenGet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\t{ limit: query.limit, cursor: query.cursor },\n\t\t\thasPermission(user, \"content:read_drafts\"),\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get references\", \"REFERENCES_GET_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\t// Gate on the base edit capability BEFORE the existence lookup. Resolving the\n\t// entry first would let a user with no edit permission distinguish real ids\n\t// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy\n\t// edge POST, which checks `content:edit_own` before fetching the entry.\n\tconst denied = requirePerm(user, \"content:edit_own\");\n\tif (denied) return denied;\n\n\t// Resolve the parent entry to gate on its author (ownership-aware write).\n\tconst parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);\n\tif (!parent) return apiError(\"NOT_FOUND\", \"Content not found\", 404);\n\n\tconst editDenied = requireOwnerPerm(\n\t\tuser,\n\t\tparent.authorId ?? \"\",\n\t\t\"content:edit_own\",\n\t\t\"content:edit_any\",\n\t);\n\tif (editDenied) return editDenied;\n\n\ttry {\n\t\tconst body = await parseBody(request, setReferenceChildrenBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleReferenceChildrenSet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\tbody.childIds,\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to set references\", \"REFERENCES_SET_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;CAErC,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,sBAAsB;AACrE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AASH,SAAO,aARQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA;GAAE,OAAO,MAAM;GAAO,QAAQ,MAAM;GAAQ,EAC5C,cAAc,MAAM,sBAAsB,CAC1C,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;AAI/E,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;AAErC,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAKlB,MAAM,SAAS,YAAY,MAAM,mBAAmB;AACpD,KAAI,OAAQ,QAAO;CAGnB,MAAM,SAAS,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,eAAe,YAAY,GAAG;AACpF,KAAI,CAAC,OAAQ,QAAO,SAAS,aAAa,qBAAqB,IAAI;CAEnE,MAAM,aAAa,iBAClB,MACA,OAAO,YAAY,IACnB,oBACA,mBACA;AACD,KAAI,WAAY,QAAO;AAEvB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,yBAAyB;AAC/D,MAAI,aAAa,KAAK,CAAE,QAAO;AAS/B,SAAO,aAPQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA,KAAK,SACL,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}