emdash 0.37.0 → 0.39.0

package/src/astro/routes/api/content/[collection]/[id]/schedule.ts

@@ -9,6 +9,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentScheduleBody } from "#api/schemas.js";
 
@@ -61,7 +62,25 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 	const denied = requireOwnerPerm(user, authorId, "content:publish_own", "content:publish_any");
 	if (denied) return denied;
 
-	const result = await emdash.handleContentSchedule(collection, resolvedId ?? id, body.scheduledAt);
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId ?? id, user!.id, {
+		override: body.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
+	const result = await emdash.handleContentSchedule(
+		collection,
+		resolvedId ?? id,
+		body.scheduledAt,
+		{
+			_rev: body._rev,
+			actor: { id: user!.id, role: user!.role },
+			origin: { source: "api" },
+		},
+	);
 
 	if (!result.success) return unwrapResult(result);
 
@@ -95,6 +114,16 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 	const denied = requireOwnerPerm(user, authorId, "content:publish_own", "content:publish_any");
 	if (denied) return denied;
 
+	// DELETE carries no body, so the lock opt-out rides on the query string.
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId ?? id, user!.id, {
+		override: url.searchParams.get("overrideLock") === "true",
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentUnschedule(collection, resolvedId ?? id);
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/content/[collection]/[id]/unpublish.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentRevisionConditionBody } from "#api/schemas.js";
 
@@ -52,7 +53,20 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 
-	const result = await emdash.handleContentUnpublish(collection, resolvedId, { _rev: body?._rev });
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: body?.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
+	const result = await emdash.handleContentUnpublish(collection, resolvedId, {
+		_rev: body?._rev,
+		actor: { id: user!.id, role: user!.role },
+		origin: { source: "api" },
+	});
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentUpdateBody } from "#api/schemas.js";
 
@@ -112,16 +113,30 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 	// Use the resolved ID (handles slug → ID resolution)
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: body.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	// Only allow authorId changes if user has content:edit_any permission (editor+)
 	const canChangeAuthor =
 		body.authorId !== undefined && user && hasPermission(user, "content:edit_any");
-	const updateBody = canChangeAuthor ? body : { ...body, authorId: undefined };
+	const { overrideLock: _overrideLock, ...writeBody } = canChangeAuthor
+		? body
+		: { ...body, authorId: undefined };
+
+	const actor = user ? { id: user.id, role: user.role } : undefined;
 
 	// Pass _rev through for optimistic concurrency validation
 	const result = await emdash.handleContentUpdate(collection, resolvedId, {
-		...updateBody,
+		...writeBody,
 		locale,
 		_rev: body._rev,
+		actor,
 	});
 
 	if (!result.success) return unwrapResult(result);
@@ -172,6 +187,16 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 	// Use the resolved ID (handles slug → ID resolution)
 	const resolvedId = typeof deleteItem?.id === "string" ? deleteItem.id : id;
 
+	// DELETE carries no body, so the lock opt-out rides on the query string.
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: url.searchParams.get("overrideLock") === "true",
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentDelete(collection, resolvedId);
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/content/[collection]/index.ts

@@ -79,12 +79,15 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 		);
 	}
 
+	const actor = user ? { id: user.id, role: user.role } : undefined;
+
 	// Auto-set authorId to current user when creating content
 	const result = await emdash.handleContentCreate(collection, {
 		...body,
 		authorId: user?.id,
 		locale: body.locale,
 		translationOf: body.translationOf,
+		actor,
 	});
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/health.ts

@@ -0,0 +1,23 @@
+import type { APIRoute } from "astro";
+
+import { apiSuccess } from "#api/error.js";
+
+import { getRegistryConfigInput } from "../../../registry/config.js";
+import { VERSION } from "../../../version.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = ({ locals }) => {
+	const response = apiSuccess({
+		product: "emdash",
+		version: VERSION,
+		registry: Boolean(
+			getRegistryConfigInput(
+				locals.emdash?.config.registry,
+				locals.emdash?.config.experimental?.registry,
+			),
+		),
+	});
+	response.headers.set("Access-Control-Allow-Origin", "*");
+	return response;
+};

package/src/astro/routes/api/manifest.ts

@@ -41,18 +41,26 @@ export const GET: APIRoute = async ({ locals }) => {
 		// null and the React SPA never received custom logo/siteName/favicon.
 		// See issue #835.
 		let adminBranding = emdash?.config?.admin;
+		let siteTimezone = "UTC";
 
-		// When no build-time `admin.siteName` is configured, brand the admin with
+		// Read the site timezone alongside the title fallback so datetime controls
+		// and branding share one options query. When no build-time `admin.siteName`
+		// is configured, brand the admin with
 		// the site's own title so multi-site operators can tell backends apart
 		// (WordPress-style: wp-admin always shows the site name). Precedence:
 		// explicit `admin.siteName` → Site Title (Settings → General) → the title
 		// captured by the setup wizard → the bundled "EmDash" default in the SPA.
-		if (!adminBranding?.siteName && emdash?.db) {
+		if (emdash?.db) {
 			try {
 				const options = new OptionsRepository(emdash.db);
-				const titles = await options.getMany<string>(["site:title", "emdash:site_title"]);
+				const titles = await options.getMany<string>([
+					"site:title",
+					"emdash:site_title",
+					"site:timezone",
+				]);
 				const siteTitle = titles.get("site:title") || titles.get("emdash:site_title");
-				if (siteTitle) {
+				siteTimezone = titles.get("site:timezone") || "UTC";
+				if (!adminBranding?.siteName && siteTitle) {
 					adminBranding = { ...adminBranding, siteName: siteTitle };
 				}
 			} catch {
@@ -78,6 +86,7 @@ export const GET: APIRoute = async ({ locals }) => {
 		const manifest: EmDashManifest = emdashManifest
 			? {
 					...emdashManifest,
+					timezone: siteTimezone,
 					authMode: authMode.type === "external" ? authMode.providerType : "passkey",
 					signupEnabled,
 					admin: adminBranding,
@@ -88,6 +97,7 @@ export const GET: APIRoute = async ({ locals }) => {
 					hash: "default",
 					collections: {},
 					plugins: {},
+					timezone: siteTimezone,
 					taxonomies: [],
 					authMode: "passkey",
 					signupEnabled,

package/src/astro/routes/api/mcp.ts

@@ -19,7 +19,7 @@ import { createMcpServer } from "#mcp/server.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ request, locals }) => {
+export const POST: APIRoute = async ({ request, locals, cache }) => {
 	const { emdash, user } = locals;
 
 	if (!emdash) {
@@ -52,6 +52,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 					userId: user.id,
 					userRole: user.role,
 					tokenScopes: locals.tokenScopes,
+					cache,
 				},
 			},
 		});

package/src/astro/routes/api/media/asset/[id]/[filename].ts

@@ -0,0 +1,50 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError } from "#api/error.js";
+import { MediaRepository } from "#db/repositories/media.js";
+
+export const prerender = false;
+
+const SAFE_INLINE_TYPES = new Set([
+	"image/jpeg",
+	"image/png",
+	"image/gif",
+	"image/webp",
+	"image/avif",
+	"image/x-icon",
+	"video/mp4",
+	"video/webm",
+	"audio/mpeg",
+	"audio/wav",
+	"audio/ogg",
+]);
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { id, filename } = params;
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "media:read");
+	if (denied) return denied;
+	if (!id || !filename) return apiError("NOT_FOUND", "File not found", 404);
+	if (!emdash?.storage) return apiError("NOT_CONFIGURED", "Storage not configured", 500);
+
+	try {
+		const item = await new MediaRepository(emdash.db).findById(id);
+		if (!item || item.status !== "ready" || item.filename !== filename) {
+			return apiError("NOT_FOUND", "File not found", 404);
+		}
+		const result = await emdash.storage.download(item.storageKey);
+		const headers: Record<string, string> = {
+			"Content-Type": result.contentType,
+			"Cache-Control": "private, max-age=0, must-revalidate",
+			"X-Content-Type-Options": "nosniff",
+			"Content-Security-Policy":
+				"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'",
+			"Content-Disposition": SAFE_INLINE_TYPES.has(result.contentType) ? "inline" : "attachment",
+		};
+		if (result.size) headers["Content-Length"] = String(result.size);
+		return new Response(result.body, { status: 200, headers });
+	} catch (error) {
+		return handleError(error, "Failed to serve file", "FILE_SERVE_ERROR");
+	}
+};

package/src/astro/routes/api/plugins/[pluginId]/[...path].ts

@@ -9,105 +9,37 @@
  * Private routes (the default) require authentication and appropriate permissions.
  */
 
-import { Permissions, type Permission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
-import { requirePerm } from "#api/authorize.js";
-import { apiError, apiSuccess } from "#api/error.js";
-import { requireScope } from "#auth/scopes.js";
+import { apiError } from "#api/error.js";
+import { dispatchPluginApiRequest } from "#plugins/http-route-dispatch.js";
 
 export const prerender = false;
 
 /**
  * Handle all methods by matching against plugin-defined routes
  */
-const handleRequest: APIRoute = async ({ params, request, locals }) => {
+const handleRequest: APIRoute = async ({ params, request, locals, cache }) => {
 	const { emdash, user } = locals;
 	const pluginId = params.pluginId!;
 	const path = params.path || "";
-	const method = request.method.toUpperCase();
-
 	if (!emdash?.handlePluginApiRoute) {
 		return apiError("NOT_CONFIGURED", "EmDash not configured", 500);
 	}
-
-	// Resolve route metadata to decide auth before dispatch
-	const routeMeta = emdash.getPluginRouteMeta(pluginId, `/${path}`);
-
-	if (!routeMeta) {
-		return apiError("NOT_FOUND", "Plugin route not found", 404);
-	}
-
-	// Public routes skip auth, CSRF, and scope checks entirely
-	if (!routeMeta.public) {
-		// Plugin routes are dispatched by name only — the HTTP method never
-		// selects a different handler, so a route reached via GET or HEAD runs
-		// exactly the same code (and side effects) as one reached via POST.
-		// Method-based tiering is therefore unsafe: gating GET/HEAD/OPTIONS on
-		// `plugins:read` with no CSRF let an editor (or a cross-origin page,
-		// since HEAD is CORS-safe) invoke a mutating admin route by choosing the
-		// method (#1853). Astro also dispatches HEAD to the GET export, so no
-		// explicit HEAD handler is needed to reach a "GET" route. Gate every
-		// private invocation on the route's declared permission (defaulting to
-		// `plugins:manage`) + CSRF regardless of method.
-		const permission = routeMeta.permission ?? "plugins:manage";
-		if (!(permission in Permissions)) {
-			return apiError("INVALID_PLUGIN_ROUTE", "Plugin route declares an invalid permission", 500);
-		}
-		const denied = requirePerm(user, permission as Permission);
-		if (denied) return denied;
-
-		// Token scope enforcement — plugin routes require "admin" scope.
-		// Session auth is implicitly full-access (requireScope returns null).
-		const scopeError = requireScope(locals, "admin");
-		if (scopeError) return scopeError;
-
-		// CSRF protection on private routes. Plugin routes use soft auth in the
-		// middleware (user resolved but not required), so the middleware's CSRF
-		// check doesn't run — enforce it here. Applied to every method because
-		// any method can trigger a state change (see above). Token-authed
-		// requests (which set tokenScopes) are exempt — tokens aren't ambient
-		// credentials like cookies.
-		if (!locals.tokenScopes && request.headers.get("X-EmDash-Request") !== "1") {
-			return apiError("CSRF_REJECTED", "Missing required header", 403);
-		}
-	}
-
-	// Forward the caller only for private routes: it was validated by the
-	// requirePerm/requireScope checks above, so plugins can trust ctx.user.
-	// Public routes skip auth, so no caller is bound even when an ambient
-	// session happens to exist.
-	const caller = routeMeta.public ? undefined : user;
-
-	const result = await emdash.handlePluginApiRoute(pluginId, method, `/${path}`, request, caller);
-
-	if (!result.success) {
-		const code = result.error?.code ?? "PLUGIN_ERROR";
-		// Pass through messages from known plugin errors (PluginRouteError),
-		// but mask internal errors (unhandled exceptions) to avoid leaking
-		// database errors, file paths, etc. from sandboxed plugins.
-		const message =
-			code === "INTERNAL_ERROR"
-				? "Plugin route error"
-				: (result.error?.message ?? "Plugin route error");
-		// PluginRouteError status is returned at the top level of the result
-		const status = (result as { status?: number }).status ?? (code === "NOT_FOUND" ? 404 : 400);
-		return apiError(code, message, status);
-	}
-
-	const response = apiSuccess(result.data);
-	// Public routes may opt in to CDN/browser caching for GET responses.
-	// getRouteMeta only ever exposes cacheControl on public routes, and errors
-	// above keep the default private, no-store. Astro serves HEAD via this GET
-	// export, which is fine: same headers, no body.
-	if (routeMeta.cacheControl && (method === "GET" || method === "HEAD")) {
-		response.headers.set("Cache-Control", routeMeta.cacheControl);
-	}
-	return response;
+	return dispatchPluginApiRequest({
+		runtime: emdash,
+		pluginId,
+		path: `/${path}`,
+		request,
+		user,
+		tokenScopes: locals.tokenScopes,
+		invalidateContentCache: cache?.enabled ? (tags) => cache.invalidate({ tags }) : undefined,
+	});
 };
 
 // Export handlers for all HTTP methods
 export const GET = handleRequest;
+export const HEAD = handleRequest;
 export const POST = handleRequest;
 export const PUT = handleRequest;
 export const PATCH = handleRequest;

package/src/astro/routes/api/redirects/[id].ts

@@ -17,7 +17,6 @@ import {
 } from "#api/handlers/redirects.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { updateRedirectBody } from "#api/schemas.js";
-import { invalidateRedirectCache } from "#redirects/cache.js";
 
 export const prerender = false;
 
@@ -62,7 +61,6 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 		if (isParseError(body)) return body;
 
 		const result = await handleRedirectUpdate(db, id, body);
-		invalidateRedirectCache();
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update redirect", "REDIRECT_UPDATE_ERROR");
@@ -85,7 +83,6 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 
 	try {
 		const result = await handleRedirectDelete(db, id);
-		invalidateRedirectCache();
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to delete redirect", "REDIRECT_DELETE_ERROR");

package/src/astro/routes/api/redirects/index.ts

@@ -12,7 +12,6 @@ import { handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleRedirectCreate, handleRedirectList } from "#api/handlers/redirects.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { createRedirectBody, redirectsListQuery } from "#api/schemas.js";
-import { invalidateRedirectCache } from "#redirects/cache.js";
 
 export const prerender = false;
 
@@ -50,7 +49,6 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		if (isParseError(body)) return body;
 
 		const result = await handleRedirectCreate(db, body);
-		invalidateRedirectCache();
 		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create redirect", "REDIRECT_CREATE_ERROR");

package/src/astro/routes/api/search/index.ts

@@ -56,6 +56,7 @@ export const GET: APIRoute = async ({ url, locals }) => {
 			locale: query.locale,
 			limit: query.limit,
 			cursor: query.cursor,
+			scope: query.scope,
 		});
 
 		return apiSuccess(result);

package/src/astro/routes/api/visual-editing/action-token.ts

@@ -0,0 +1,36 @@
+import type { APIRoute } from "astro";
+
+import { apiError, apiSuccess } from "#api/error.js";
+import { resolveSecretsCached } from "#config/secrets.js";
+
+import {
+	generateVisualEditingActionToken,
+	VISUAL_ACTION_TOKEN_INVALID,
+	verifyVisualEditingActionToken,
+} from "../../../../visual-editing/action-token.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ locals, request }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+
+	const token = request.headers.get("x-emdash-visual-action");
+	if (!token) {
+		return apiError(VISUAL_ACTION_TOKEN_INVALID, "Visual editing action token is required", 403);
+	}
+
+	const { previewSecret } = await resolveSecretsCached(emdash.db);
+	if (!(await verifyVisualEditingActionToken(token, previewSecret, user.id))) {
+		return apiError(
+			VISUAL_ACTION_TOKEN_INVALID,
+			"Visual editing action token is invalid or expired",
+			403,
+		);
+	}
+
+	return apiSuccess({
+		token: await generateVisualEditingActionToken(previewSecret, user.id),
+	});
+};

package/src/astro/routes/api/visual-editing/content/[collection]/[id]/publish.ts

@@ -0,0 +1,32 @@
+import type { APIRoute } from "astro";
+
+import { apiError } from "#api/error.js";
+import { resolveSecretsCached } from "#config/secrets.js";
+
+import {
+	VISUAL_ACTION_TOKEN_INVALID,
+	verifyVisualEditingActionToken,
+} from "../../../../../../../visual-editing/action-token.js";
+import { publishContent } from "../../../../content/[collection]/[id]/publish.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async (context) => {
+	const { emdash, user } = context.locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	if (!user) return apiError("UNAUTHORIZED", "Authentication required", 401);
+	const token = context.request.headers.get("x-emdash-visual-action");
+	if (!token) {
+		return apiError(VISUAL_ACTION_TOKEN_INVALID, "Visual editing action token is required", 403);
+	}
+
+	const { previewSecret } = await resolveSecretsCached(emdash.db);
+	if (!(await verifyVisualEditingActionToken(token, previewSecret, user.id))) {
+		return apiError(
+			VISUAL_ACTION_TOKEN_INVALID,
+			"Visual editing action token is invalid or expired",
+			403,
+		);
+	}
+	return publishContent(context, "visual-editor");
+};

package/src/astro/routes/api/visual-editing/toolbar-labels.ts

@@ -0,0 +1,16 @@
+export const prerender = false;
+
+import { loadVisualEditingToolbarLabels } from "@emdash-cms/admin/locales/server";
+import type { APIRoute } from "astro";
+
+import { apiSuccess } from "#api/error.js";
+
+export const GET: APIRoute = async ({ request }) => {
+	const labels = await loadVisualEditingToolbarLabels(request);
+	const response = apiSuccess({
+		editMode: labels.editMode,
+		hideToolbar: labels.hideToolbar,
+	});
+	response.headers.set("Cache-Control", "private, no-store");
+	return response;
+};

package/src/astro/routes/sitemap-[collection].xml.ts

@@ -16,13 +16,15 @@
  */
 
 import type { APIRoute } from "astro";
+// @ts-ignore - virtual module
+import virtualConfig from "virtual:emdash/config";
 
 import { handleSitemapData } from "#api/handlers/seo.js";
 import { getPublicOrigin } from "#api/public-url.js";
 import { getSiteSettingsWithDb } from "#settings/index.js";
 
 import { getI18nConfig, isI18nEnabled } from "../../i18n/config.js";
-import { interpolateUrlPattern, localizePath } from "../../i18n/resolve.js";
+import { resolveLocalizedContentRoutePath } from "../../i18n/resolve.js";
 import { buildSeoImageUrl } from "../../seo/media-url.js";
 
 export const prerender = false;
@@ -97,14 +99,19 @@ export const GET: APIRoute = async ({ params, locals, url }) => {
 		const urlByEntry = new Map<string, string | null>();
 		const resolveEntryUrl = async (entry: Entry): Promise<string | null> => {
 			if (urlByEntry.has(entry.id)) return urlByEntry.get(entry.id) ?? null;
-			const path = interpolateUrlPattern({
+			const absolutePath = await resolveLocalizedContentRoutePath({
 				pattern: col.urlPattern,
 				collection: col.collection,
 				slug: entry.slug || entry.id,
 				id: entry.id,
+				// Published date keeps date-token permalinks stable across edits;
+				// no updatedAt fallback — tokens stay literal without a publish
+				// date, consistent with the resolver's documented behavior.
+				date: entry.publishedAt,
+				locale: entry.locale,
+				trailingSlash: virtualConfig?.trailingSlash,
 			});
-			const localized = await localizePath(path, entry.locale);
-			const absolute = localized === null ? null : `${siteUrl}${localized}`;
+			const absolute = absolutePath === null ? null : `${siteUrl}${absolutePath}`;
 			urlByEntry.set(entry.id, absolute);
 			return absolute;
 		};