emdash 0.37.0 → 0.39.0

package/src/astro/routes/api/admin/plugins/registry/install.ts

@@ -18,10 +18,12 @@ import { z } from "zod";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, unwrapResult } from "#api/error.js";
-import { handleRegistryInstall } from "#api/index.js";
+import { handleRegistryInstall, handleRegistryUninstall } from "#api/index.js";
 import { checkMediaUsageActivationWriteFence } from "#api/media-usage-write-fence.js";
 import { isParseError, parseBody } from "#api/parse.js";
+import { finalizePluginInstall } from "#plugins/install-finalization.js";
 
+import { getRegistryConfigInput } from "../../../../../../registry/config.js";
 import { VERSION } from "../../../../../../version.js";
 
 export const prerender = false;
@@ -59,6 +61,7 @@ const installBodySchema = z.object({
 	 */
 	acknowledgedDeclaredAccess: z.unknown().optional(),
 	acknowledgedMcpTools: z.unknown().optional(),
+	acknowledgedPublicRoutes: z.unknown().optional(),
 	acknowledgedProfileCid: z.string().min(1).max(256).optional(),
 	acknowledgedReleaseCid: z.string().min(1).max(256).optional(),
 });
@@ -94,13 +97,14 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			emdash.db,
 			emdash.storage,
 			emdash.getSandboxRunner(),
-			emdash.config.experimental?.registry,
+			getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),
 			{
 				did: body.did,
 				slug: body.slug,
 				version: body.version,
 				acknowledgedDeclaredAccess: body.acknowledgedDeclaredAccess,
 				acknowledgedMcpTools: body.acknowledgedMcpTools,
+				acknowledgedPublicRoutes: body.acknowledgedPublicRoutes,
 				acknowledgedProfileCid: body.acknowledgedProfileCid,
 				acknowledgedReleaseCid: body.acknowledgedReleaseCid,
 			},
@@ -112,8 +116,15 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 		if (!result.success) return unwrapResult(result);
 
-		// Sync runtime so the new plugin becomes active without a worker restart.
-		await emdash.syncRegistryPlugins();
+		await finalizePluginInstall({
+			pluginId: result.data.pluginId,
+			syncRuntime: () => emdash.syncRegistryPlugins(),
+			runLifecycle: () => emdash.runPluginInstallLifecycle(result.data.pluginId),
+			rollback: () =>
+				handleRegistryUninstall(emdash.db, emdash.storage, result.data.pluginId, {
+					deleteData: true,
+				}),
+		});
 
 		return unwrapResult(result, 201);
 	} catch (error) {

package/src/astro/routes/api/admin/plugins/registry/verify.ts

@@ -7,6 +7,7 @@ import { apiError, handleError, unwrapResult } from "#api/error.js";
 import { handleRegistryInstall } from "#api/index.js";
 import { isParseError, parseBody } from "#api/parse.js";
 
+import { getRegistryConfigInput } from "../../../../../../registry/config.js";
 import { VERSION } from "../../../../../../version.js";
 
 export const prerender = false;
@@ -44,7 +45,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			emdash.db,
 			emdash.storage,
 			emdash.getSandboxRunner(),
-			emdash.config.experimental?.registry,
+			getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),
 			body,
 			{
 				configuredPluginIds: reservedPluginIds,

package/src/astro/routes/api/admin/plugins/updates.ts

@@ -18,6 +18,8 @@ import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess } from "#api/error.js";
 import { handleMarketplaceUpdateCheck, handleRegistryUpdateCheck } from "#api/index.js";
 
+import { getRegistryConfigInput } from "../../../../../registry/config.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ locals }) => {
@@ -39,7 +41,10 @@ export const GET: APIRoute = async ({ locals }) => {
 			console.warn("[plugins/updates] marketplace check threw:", err);
 			return null;
 		}),
-		handleRegistryUpdateCheck(emdash.db, emdash.config.experimental?.registry).catch((err) => {
+		handleRegistryUpdateCheck(
+			emdash.db,
+			getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),
+		).catch((err) => {
 			console.warn("[plugins/updates] registry check threw:", err);
 			return null;
 		}),

package/src/astro/routes/api/admin/scheduled-policy-rejections/[collection]/[id].ts

@@ -0,0 +1,34 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+import { scheduledPolicyRejectionKey } from "#plugins/content-policy.js";
+
+export const prerender = false;
+
+export const DELETE: APIRoute = async ({ params, locals, url }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:publish_any");
+	if (denied) return denied;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+
+	try {
+		const revision = url.searchParams.get("rev");
+		if (!revision) return apiError("INVALID_INPUT", "Rejection revision is required", 400);
+		const result = await new OptionsRepository(emdash.db).compareAndDelete(
+			scheduledPolicyRejectionKey(params.collection!, params.id!),
+			revision,
+		);
+		if (!result.applied) {
+			return apiError("CONFLICT", "Scheduled publication rejection has changed", 409);
+		}
+		return apiSuccess({ dismissed: true });
+	} catch (error) {
+		return handleError(
+			error,
+			"Failed to dismiss scheduled publication rejection",
+			"POLICY_REJECTION_DISMISS_ERROR",
+		);
+	}
+};

package/src/astro/routes/api/comments/[collection]/[contentId]/index.ts

@@ -7,19 +7,9 @@
 
 import type { APIRoute } from "astro";
 
-import { apiError, apiSuccess, handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleCommentList, checkRateLimit, hashIp } from "#api/handlers/comments.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createCommentBody } from "#api/schemas.js";
-import { getSiteBaseUrl } from "#api/site-url.js";
-import { sendCommentNotification } from "#comments/notifications.js";
-import { createComment, type CommentHookRunner } from "#comments/service.js";
-import { getTurnstileSecretKey, verifyTurnstileToken } from "#comments/turnstile.js";
-import { resolveSecretsCached } from "#config/secrets.js";
-import { CommentRepository } from "#db/repositories/comment.js";
-import { validateIdentifier } from "#db/validate.js";
-import { extractRequestMeta } from "#plugins/request-meta.js";
-import type { CollectionCommentSettings, ModerationDecision } from "#plugins/types.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleCommentList } from "#api/handlers/comments.js";
+import { submitPublicComment } from "#comments/public-submission.js";
 
 export const prerender = false;
 
@@ -82,250 +72,5 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
-
-	try {
-		// Parse and validate input
-		const body = await parseBody(request, createCommentBody);
-		if (isParseError(body)) return body;
-
-		// Check collection exists and has comments enabled
-		const collectionRow = await emdash.db
-			.selectFrom("_emdash_collections")
-			.select([
-				"comments_enabled",
-				"comments_moderation",
-				"comments_closed_after_days",
-				"comments_auto_approve_users",
-			])
-			.where("slug", "=", collection)
-			.executeTakeFirst();
-
-		if (!collectionRow) {
-			return apiError("NOT_FOUND", `Collection '${collection}' not found`, 404);
-		}
-
-		if (!collectionRow.comments_enabled) {
-			return apiError("COMMENTS_DISABLED", "Comments are not enabled for this collection", 403);
-		}
-
-		// Verify the content item exists, is published, and not soft-deleted
-		validateIdentifier(collection, "collection");
-		const contentRow = await emdash.db
-			.selectFrom(`ec_${collection}` as never)
-			.select(["id" as never, "slug" as never, "author_id" as never, "published_at" as never])
-			.where("id" as never, "=", contentId as never)
-			.where("status" as never, "=", "published" as never)
-			.where("deleted_at" as never, "is", null as never)
-			.executeTakeFirst();
-
-		if (!contentRow) {
-			return apiError("NOT_FOUND", "Content not found", 404);
-		}
-
-		// Check if comments are closed (published_at + closed_after_days)
-		if (collectionRow.comments_closed_after_days > 0) {
-			const publishedAt = (contentRow as { published_at: string | null }).published_at;
-			if (publishedAt) {
-				const closedDate = new Date(publishedAt);
-				closedDate.setDate(closedDate.getDate() + collectionRow.comments_closed_after_days);
-				if (new Date() > closedDate) {
-					return apiError("COMMENTS_CLOSED", "Comments are closed for this content", 403);
-				}
-			}
-		}
-
-		// Anti-spam: Honeypot — hidden field filled only by bots
-		if (body.website_url) {
-			// Silently accept — don't reveal the honeypot to bots
-			return apiSuccess({ status: "pending", message: "Comment submitted for review" });
-		}
-
-		// Anti-spam: Rate limiting
-		const meta = extractRequestMeta(request, emdash.config);
-		const { ipSalt } = await resolveSecretsCached(emdash.db);
-		let ipHash: string;
-		if (meta.ip) {
-			ipHash = await hashIp(meta.ip, ipSalt);
-		} else {
-			// No trusted IP — fail closed by bucketing all unidentifiable
-			// requests together. A larger limit reflects the shared bucket.
-			//
-			// Self-hosted operators behind a reverse proxy should set
-			// `trustedProxyHeaders` in the EmDash config (or the
-			// EMDASH_TRUSTED_PROXY_HEADERS env var) so this path isn't hit
-			// for legitimate traffic. UA-hashing was previously used here
-			// but was trivially rotatable — the shared bucket is stricter
-			// and forces operators toward a real fix.
-			ipHash = "unknown";
-		}
-		const unknownBucketLimit = ipHash === "unknown" ? 20 : undefined;
-		const rateLimited = await checkRateLimit(emdash.db, ipHash, unknownBucketLimit);
-		if (rateLimited) {
-			return apiError("RATE_LIMITED", "Too many comments. Please try again later.", 429);
-		}
-
-		// Anti-spam: Turnstile — enforced only when the operator configured a
-		// secret key. Runs after the free checks (honeypot, rate limit) so
-		// obvious spam never triggers a siteverify subrequest. Fails closed:
-		// missing token, failed verification, and siteverify errors all reject.
-		const turnstileSecretKey = getTurnstileSecretKey();
-		if (turnstileSecretKey) {
-			const verified = await verifyTurnstileToken(body.turnstileToken, turnstileSecretKey, meta.ip);
-			if (!verified) {
-				return apiError("TURNSTILE_FAILED", "CAPTCHA verification failed", 403);
-			}
-		}
-
-		// Build collection settings
-		const collectionSettings: CollectionCommentSettings = {
-			commentsEnabled: collectionRow.comments_enabled === 1,
-			commentsModeration:
-				collectionRow.comments_moderation as CollectionCommentSettings["commentsModeration"],
-			commentsClosedAfterDays: collectionRow.comments_closed_after_days,
-			commentsAutoApproveUsers: collectionRow.comments_auto_approve_users === 1,
-		};
-
-		// Determine author fields — authenticated user overrides form input
-		let authorName = body.authorName;
-		let authorEmail = body.authorEmail;
-		let authorUserId: string | null = null;
-
-		if (user) {
-			authorName = user.name || authorName;
-			authorEmail = user.email;
-			authorUserId = user.id;
-		}
-
-		// Validate parent exists and belongs to the same content.
-		// Enforce 1-level nesting: if the parent is itself a reply, attach to its root.
-		let resolvedParentId = body.parentId ?? null;
-		if (body.parentId) {
-			const repo = new CommentRepository(emdash.db);
-			const parent = await repo.findById(body.parentId);
-			if (!parent) {
-				return apiError("VALIDATION_ERROR", "Parent comment not found", 400);
-			}
-			if (parent.collection !== collection || parent.contentId !== contentId) {
-				return apiError("VALIDATION_ERROR", "Parent comment belongs to different content", 400);
-			}
-			// Flatten: if parent is a reply, use its parent (the root) instead
-			resolvedParentId = parent.parentId ?? parent.id;
-		}
-
-		// Wire the comment service to the real hook pipeline
-		const hookRunner: CommentHookRunner = {
-			async runBeforeCreate(event) {
-				return emdash.hooks.runCommentBeforeCreate(event);
-			},
-			async runModerate(event) {
-				const result = await emdash.hooks.invokeExclusiveHook("comment:moderate", event);
-				if (!result) return { status: "pending" as const, reason: "No moderator configured" };
-				if (result.error) {
-					console.error(`[comments] Moderation error (${result.pluginId}):`, result.error.message);
-					return { status: "pending" as const, reason: "Moderation error" };
-				}
-				return result.result as ModerationDecision;
-			},
-			fireAfterCreate(event) {
-				emdash.hooks
-					.runCommentAfterCreate(event)
-					.catch((err) =>
-						console.error(
-							"[comments] afterCreate error:",
-							err instanceof Error ? err.message : err,
-						),
-					);
-			},
-			fireAfterModerate(event) {
-				emdash.hooks
-					.runCommentAfterModerate(event)
-					.catch((err) =>
-						console.error(
-							"[comments] afterModerate error:",
-							err instanceof Error ? err.message : err,
-						),
-					);
-			},
-		};
-
-		// Build content info for afterCreate hooks (e.g. email notifications)
-		const typedContent = contentRow as {
-			id: string;
-			slug: string;
-			author_id: string | null;
-		};
-		let contentAuthor: { id: string; name: string | null; email: string } | undefined;
-		if (typedContent.author_id) {
-			const authorRow = await emdash.db
-				.selectFrom("users")
-				.select(["id", "name", "email", "email_verified"])
-				.where("id", "=", typedContent.author_id)
-				.executeTakeFirst();
-			if (authorRow && authorRow.email_verified) {
-				contentAuthor = {
-					id: authorRow.id,
-					name: authorRow.name,
-					email: authorRow.email,
-				};
-			}
-		}
-
-		const result = await createComment(
-			emdash.db,
-			{
-				collection,
-				contentId,
-				parentId: resolvedParentId,
-				authorName,
-				authorEmail,
-				authorUserId,
-				body: body.body,
-				ipHash,
-				userAgent: meta.userAgent,
-			},
-			collectionSettings,
-			hookRunner,
-			{
-				id: typedContent.id,
-				collection,
-				slug: typedContent.slug,
-				author: contentAuthor,
-			},
-		);
-
-		if (!result) {
-			return apiError("COMMENT_REJECTED", "Comment was rejected", 403);
-		}
-
-		// Send notification to content author (awaited so it completes before
-		// the response is sent — required for Cloudflare Workers where the
-		// isolate terminates after the response).
-		if (result.comment.status === "approved" && emdash.email && contentAuthor) {
-			try {
-				const adminBaseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
-				await sendCommentNotification({
-					email: emdash.email,
-					comment: result.comment,
-					contentAuthor,
-					adminBaseUrl,
-				});
-			} catch (err) {
-				console.error("[comments] notification error:", err instanceof Error ? err.message : err);
-			}
-		}
-
-		return apiSuccess(
-			{
-				id: result.comment.id,
-				status: result.comment.status,
-				message:
-					result.comment.status === "approved"
-						? "Comment published"
-						: "Comment submitted for review",
-			},
-			201,
-		);
-	} catch (error) {
-		return handleError(error, "Failed to submit comment", "COMMENT_CREATE_ERROR");
-	}
+	return submitPublicComment(emdash, collection, contentId, request, user);
 };

package/src/astro/routes/api/content/[collection]/[id]/discard-draft.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentRevisionConditionBody } from "#api/schemas.js";
 
@@ -52,6 +53,15 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: body?.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentDiscardDraft(collection, resolvedId, {
 		_rev: body?._rev,
 	});

package/src/astro/routes/api/content/[collection]/[id]/lock.ts

@@ -0,0 +1,133 @@
+/**
+ * Entry edit lock
+ *
+ * GET    /_emdash/api/content/{collection}/{id}/lock - Read the current holder
+ * POST   /_emdash/api/content/{collection}/{id}/lock - Take or refresh the lock
+ * DELETE /_emdash/api/content/{collection}/{id}/lock - Release the caller's lock
+ */
+
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm } from "#api/authorize.js";
+import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import {
+	handleEntryLockAcquire,
+	handleEntryLockRead,
+	handleEntryLockRelease,
+} from "#api/handlers/entry-lock.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { entryLockAcquireBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+interface ResolvedEntry {
+	resolvedId: string;
+	userId: string;
+}
+
+/**
+ * Resolves the entry the way every other single-entry route does, and applies
+ * the same edit permission, since holding a lock is the prelude to a write.
+ */
+async function resolveEntry(
+	locals: App.Locals,
+	collection: string,
+	id: string,
+	locale: string | undefined,
+): Promise<ResolvedEntry | Response> {
+	const { emdash, user } = locals;
+	if (!emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const existing = await emdash.handleContentGet(collection, id, locale);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+
+	const existingData =
+		existing.data && typeof existing.data === "object"
+			? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above
+				(existing.data as Record<string, unknown>)
+			: undefined;
+	const existingItem =
+		existingData?.item && typeof existingData.item === "object"
+			? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above
+				(existingData.item as Record<string, unknown>)
+			: existingData;
+	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
+	const denied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	if (denied) return denied;
+
+	return {
+		resolvedId: typeof existingItem?.id === "string" ? existingItem.id : id,
+		userId: user!.id,
+	};
+}
+
+export const GET: APIRoute = async ({ params, locals, url }) => {
+	const collection = params.collection!;
+	const id = params.id!;
+	const resolved = await resolveEntry(
+		locals,
+		collection,
+		id,
+		url.searchParams.get("locale") || undefined,
+	);
+	if (resolved instanceof Response) return resolved;
+
+	return unwrapResult(
+		await handleEntryLockRead(locals.emdash.db, collection, resolved.resolvedId, resolved.userId),
+	);
+};
+
+export const POST: APIRoute = async ({ params, request, locals, url }) => {
+	const collection = params.collection!;
+	const id = params.id!;
+	const body = await parseOptionalBody(request, entryLockAcquireBody, {});
+	if (isParseError(body)) return body;
+
+	const resolved = await resolveEntry(
+		locals,
+		collection,
+		id,
+		url.searchParams.get("locale") || undefined,
+	);
+	if (resolved instanceof Response) return resolved;
+
+	return unwrapResult(
+		await handleEntryLockAcquire(
+			locals.emdash.db,
+			collection,
+			resolved.resolvedId,
+			resolved.userId,
+			{ takeover: body?.takeover, token: body?.token },
+		),
+	);
+};
+
+export const DELETE: APIRoute = async ({ params, locals, url }) => {
+	const collection = params.collection!;
+	const id = params.id!;
+	const resolved = await resolveEntry(
+		locals,
+		collection,
+		id,
+		url.searchParams.get("locale") || undefined,
+	);
+	if (resolved instanceof Response) return resolved;
+
+	return unwrapResult(
+		await handleEntryLockRelease(
+			locals.emdash.db,
+			collection,
+			resolved.resolvedId,
+			resolved.userId,
+			{ token: url.searchParams.get("token") ?? undefined },
+		),
+	);
+};

package/src/astro/routes/api/content/[collection]/[id]/plugin-extensions/[pluginId]/[kind]/[extensionId].ts

@@ -0,0 +1,29 @@
+import type { APIRoute } from "astro";
+
+import { apiError } from "#api/error.js";
+import { dispatchPluginEditorExtensionApiRequest } from "#plugins/http-route-dispatch.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, request, locals, cache }) => {
+	const { emdash, user } = locals;
+	if (!emdash) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+
+	const kind = params.kind;
+	if (kind !== "panel" && kind !== "action") {
+		return apiError("NOT_FOUND", "Plugin editor extension not found", 404);
+	}
+
+	return dispatchPluginEditorExtensionApiRequest({
+		runtime: emdash,
+		pluginId: params.pluginId!,
+		kind,
+		extensionId: params.extensionId!,
+		collection: params.collection!,
+		entryId: params.id!,
+		request,
+		user,
+		tokenScopes: locals.tokenScopes,
+		invalidateContentCache: cache?.enabled ? (tags) => cache.invalidate({ tags }) : undefined,
+	});
+};

package/src/astro/routes/api/content/[collection]/[id]/publish.ts

@@ -3,7 +3,7 @@
  *
  * POST /_emdash/api/content/{collection}/{id}/publish
  *
- * Optional JSON body: { publishedAt?: string, _rev?: string }
+ * Optional JSON body: { publishedAt?: string, _rev?: string, overrideLock?: boolean }
  *   publishedAt — ISO 8601 datetime to backdate the publish (e.g. when
  *   migrating content). Writing publishedAt requires content:publish_any.
  *   Without it, the existing published_at is preserved on re-publish and
@@ -11,16 +11,20 @@
  */
 
 import { hasPermission } from "@emdash-cms/auth";
-import type { APIRoute } from "astro";
+import type { APIContext, APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentPublishBody } from "#api/schemas.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, request, locals, url, cache }) => {
+export async function publishContent(
+	{ params, request, locals, url, cache }: APIContext,
+	originSource: "api" | "visual-editor",
+): Promise<Response> {
 	const { emdash, user } = locals;
 	const collection = params.collection!;
 	const id = params.id!;
@@ -76,9 +80,20 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: body?.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentPublish(collection, resolvedId, {
 		publishedAt,
 		_rev: body?._rev,
+		actor: { id: user!.id, role: user!.role },
+		origin: { source: originSource },
 	});
 
 	if (!result.success) return unwrapResult(result);
@@ -86,4 +101,6 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
 
 	return unwrapResult(result);
-};
+}
+
+export const POST: APIRoute = (context) => publishContent(context, "api");