emdash 0.39.0 → 0.40.0

package/dist/astro/routes/api/content/_collection_/_id_/discard-draft.mjs

@@ -1,19 +1,24 @@
-import "../../../../../../dialect-helpers-CtYdsX4W.mjs";
-import "../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../../../config-CvmjJcVw.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../entry-locks-CO_KaoU5.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-W3PA8HqB.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Cr379Av9.mjs";
-import "../../../../../../redirects-BCiTaIQ-.mjs";
-import { $n as contentRevisionConditionBody } from "../../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../../status-DLoBmcDz.mjs";
+import "../../../../../../entry-locks-D0foLdjQ.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../settings-DYidIB26.mjs";
+import "../../../../../../site-settings-DOgRUoFX.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../../redirects-Cv9apQKj.mjs";
+import { Lt as contentRevisionConditionBody } from "../../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../../media-Pu1L6xir.mjs";
+import "../../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../../status-DZKIG4a9.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as requireOwnerPerm } from "../../../../../../authorize-BXpfMpp0.mjs";
-import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-D9rnj2Lu.mjs";
+import { r as requireOwnerPerm } from "../../../../../../authorize-seCifOMJ.mjs";
+import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-DHQOxN7R.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/discard-draft.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/discard-draft.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"discard-draft.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/discard-draft.ts"],"sourcesContent":["/**\n * Discard draft changes - reverts to live version\n *\n * POST /_emdash/api/content/{collection}/{id}/discard-draft\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentRevisionConditionBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDiscardDraft || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst body = await parseOptionalBody(request, contentRevisionConditionBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (denied) return denied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentDiscardDraft(collection, resolvedId, {\n\t\t_rev: body?._rev,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,6BAA6B,CAAC,QAAQ,iBAClD,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,8BAA8B,EAAE,CAAC;AAC/E,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAEF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,oBAAoB,mBAAmB;AACvF,KAAI,OAAQ,QAAO;CAEnB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,0BAA0B,YAAY,YAAY,EAC7E,MAAM,MAAM,MACZ,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}
+{"version":3,"file":"discard-draft.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/discard-draft.ts"],"sourcesContent":["/**\n * Discard draft changes - reverts to live version\n *\n * POST /_emdash/api/content/{collection}/{id}/discard-draft\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentRevisionConditionBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDiscardDraft || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst body = await parseOptionalBody(request, contentRevisionConditionBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (denied) return denied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentDiscardDraft(collection, resolvedId, {\n\t\t_rev: body?._rev,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,6BAA6B,CAAC,QAAQ,iBAClD,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,8BAA8B,EAAE,CAAC;AAC/E,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAEF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,oBAAoB,mBAAmB;AACvF,KAAI,OAAQ,QAAO;CAEnB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,0BAA0B,YAAY,YAAY,EAC7E,MAAM,MAAM,MACZ,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}

package/dist/astro/routes/api/content/_collection_/_id_/duplicate.mjs

@@ -1,8 +1,9 @@
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-W3PA8HqB.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { n as requireOwnerPerm, r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { i as requirePerm, r as requireOwnerPerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/duplicate.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/duplicate.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/duplicate.ts"],"sourcesContent":["/**\n * Duplicate content endpoint - injected by EmDash integration\n *\n * POST /_emdash/api/content/{collection}/{id}/duplicate - Create a copy\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm, requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDuplicate || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:create\");\n\tif (denied) return denied;\n\n\t// Fetch item to check ownership — duplicating requires read access to the source\n\tconst existing = await emdash.handleContentGet(collection, id);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\t// Duplicating requires read access to the source — check ownership-based edit permissions\n\t// since content:read is flat (no own/any split). This ensures authors can only duplicate their own.\n\tconst readDenied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (readDenied) return readDenied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\tconst result = await emdash.handleContentDuplicate(collection, resolvedId, user?.id);\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection] });\n\n\treturn unwrapResult(result, 201);\n};\n"],"mappings":";;;;;;;AAWA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,QAAQ,YAAY;CAClE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,0BAA0B,CAAC,QAAQ,iBAC/C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;CAGnB,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,GAAG;AAC9D,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAIJ,MAAM,aAAa,iBAAiB,MAHnB,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IAGlC,oBAAoB,mBAAmB;AAC3F,KAAI,WAAY,QAAO;CAEvB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAC5E,MAAM,SAAS,MAAM,OAAO,uBAAuB,YAAY,YAAY,MAAM,GAAG;AAEpF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAElE,QAAO,aAAa,QAAQ,IAAI"}
+{"version":3,"file":"duplicate.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/duplicate.ts"],"sourcesContent":["/**\n * Duplicate content endpoint - injected by EmDash integration\n *\n * POST /_emdash/api/content/{collection}/{id}/duplicate - Create a copy\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm, requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDuplicate || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:create\");\n\tif (denied) return denied;\n\n\t// Fetch item to check ownership — duplicating requires read access to the source\n\tconst existing = await emdash.handleContentGet(collection, id);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\t// Duplicating requires read access to the source — check ownership-based edit permissions\n\t// since content:read is flat (no own/any split). This ensures authors can only duplicate their own.\n\tconst readDenied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (readDenied) return readDenied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\tconst result = await emdash.handleContentDuplicate(collection, resolvedId, user?.id);\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection] });\n\n\treturn unwrapResult(result, 201);\n};\n"],"mappings":";;;;;;;;AAWA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,QAAQ,YAAY;CAClE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,0BAA0B,CAAC,QAAQ,iBAC/C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;CAGnB,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,GAAG;AAC9D,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAIJ,MAAM,aAAa,iBAAiB,MAHnB,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IAGlC,oBAAoB,mBAAmB;AAC3F,KAAI,WAAY,QAAO;CAEvB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAC5E,MAAM,SAAS,MAAM,OAAO,uBAAuB,YAAY,YAAY,MAAM,GAAG;AAEpF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAElE,QAAO,aAAa,QAAQ,IAAI"}

package/dist/astro/routes/api/content/_collection_/_id_/lock.mjs

@@ -1,19 +1,24 @@
-import "../../../../../../dialect-helpers-CtYdsX4W.mjs";
-import "../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../../../config-CvmjJcVw.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../entry-locks-CO_KaoU5.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-W3PA8HqB.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Cr379Av9.mjs";
-import "../../../../../../redirects-BCiTaIQ-.mjs";
-import { t as entryLockAcquireBody } from "../../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../../status-DLoBmcDz.mjs";
+import "../../../../../../entry-locks-D0foLdjQ.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../settings-DYidIB26.mjs";
+import "../../../../../../site-settings-DOgRUoFX.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../../redirects-Cv9apQKj.mjs";
+import { t as entryLockAcquireBody } from "../../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../../media-Pu1L6xir.mjs";
+import "../../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../../status-DZKIG4a9.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as requireOwnerPerm } from "../../../../../../authorize-BXpfMpp0.mjs";
-import { i as handleEntryLockRelease, n as handleEntryLockAcquire, r as handleEntryLockRead } from "../../../../../../entry-lock-D9rnj2Lu.mjs";
+import { r as requireOwnerPerm } from "../../../../../../authorize-seCifOMJ.mjs";
+import { i as handleEntryLockRelease, n as handleEntryLockAcquire, r as handleEntryLockRead } from "../../../../../../entry-lock-DHQOxN7R.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/lock.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/lock.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"lock.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/lock.ts"],"sourcesContent":["/**\n * Entry edit lock\n *\n * GET    /_emdash/api/content/{collection}/{id}/lock - Read the current holder\n * POST   /_emdash/api/content/{collection}/{id}/lock - Take or refresh the lock\n * DELETE /_emdash/api/content/{collection}/{id}/lock - Release the caller's lock\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleEntryLockAcquire,\n\thandleEntryLockRead,\n\thandleEntryLockRelease,\n} from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { entryLockAcquireBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\ninterface ResolvedEntry {\n\tresolvedId: string;\n\tuserId: string;\n}\n\n/**\n * Resolves the entry the way every other single-entry route does, and applies\n * the same edit permission, since holding a lock is the prelude to a write.\n */\nasync function resolveEntry(\n\tlocals: App.Locals,\n\tcollection: string,\n\tid: string,\n\tlocale: string | undefined,\n): Promise<ResolvedEntry | Response> {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (denied) return denied;\n\n\treturn {\n\t\tresolvedId: typeof existingItem?.id === \"string\" ? existingItem.id : id,\n\t\tuserId: user!.id,\n\t};\n}\n\nexport const GET: APIRoute = async ({ params, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockRead(locals.emdash.db, collection, resolved.resolvedId, resolved.userId),\n\t);\n};\n\nexport const POST: APIRoute = async ({ params, request, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst body = await parseOptionalBody(request, entryLockAcquireBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockAcquire(\n\t\t\tlocals.emdash.db,\n\t\t\tcollection,\n\t\t\tresolved.resolvedId,\n\t\t\tresolved.userId,\n\t\t\t{ takeover: body?.takeover, token: body?.token },\n\t\t),\n\t);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockRelease(\n\t\t\tlocals.emdash.db,\n\t\t\tcollection,\n\t\t\tresolved.resolvedId,\n\t\t\tresolved.userId,\n\t\t\t{ token: url.searchParams.get(\"token\") ?? undefined },\n\t\t),\n\t);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,MAAa,YAAY;;;;;AAWzB,eAAe,aACd,QACA,YACA,IACA,QACoC;CACpC,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,oBAAoB,mBAAmB;AACvF,KAAI,OAAQ,QAAO;AAEnB,QAAO;EACN,YAAY,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;EACrE,QAAQ,KAAM;EACd;;AAGF,MAAa,MAAgB,OAAO,EAAE,QAAQ,QAAQ,UAAU;CAC/D,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,oBAAoB,OAAO,OAAO,IAAI,YAAY,SAAS,YAAY,SAAS,OAAO,CAC7F;;AAGF,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,UAAU;CACzE,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,OAAO,MAAM,kBAAkB,SAAS,sBAAsB,EAAE,CAAC;AACvE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,uBACL,OAAO,OAAO,IACd,YACA,SAAS,YACT,SAAS,QACT;EAAE,UAAU,MAAM;EAAU,OAAO,MAAM;EAAO,CAChD,CACD;;AAGF,MAAa,SAAmB,OAAO,EAAE,QAAQ,QAAQ,UAAU;CAClE,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,uBACL,OAAO,OAAO,IACd,YACA,SAAS,YACT,SAAS,QACT,EAAE,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,QAAW,CACrD,CACD"}
+{"version":3,"file":"lock.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/lock.ts"],"sourcesContent":["/**\n * Entry edit lock\n *\n * GET    /_emdash/api/content/{collection}/{id}/lock - Read the current holder\n * POST   /_emdash/api/content/{collection}/{id}/lock - Take or refresh the lock\n * DELETE /_emdash/api/content/{collection}/{id}/lock - Release the caller's lock\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport {\n\thandleEntryLockAcquire,\n\thandleEntryLockRead,\n\thandleEntryLockRelease,\n} from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { entryLockAcquireBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\ninterface ResolvedEntry {\n\tresolvedId: string;\n\tuserId: string;\n}\n\n/**\n * Resolves the entry the way every other single-entry route does, and applies\n * the same edit permission, since holding a lock is the prelude to a write.\n */\nasync function resolveEntry(\n\tlocals: App.Locals,\n\tcollection: string,\n\tid: string,\n\tlocale: string | undefined,\n): Promise<ResolvedEntry | Response> {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (denied) return denied;\n\n\treturn {\n\t\tresolvedId: typeof existingItem?.id === \"string\" ? existingItem.id : id,\n\t\tuserId: user!.id,\n\t};\n}\n\nexport const GET: APIRoute = async ({ params, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockRead(locals.emdash.db, collection, resolved.resolvedId, resolved.userId),\n\t);\n};\n\nexport const POST: APIRoute = async ({ params, request, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst body = await parseOptionalBody(request, entryLockAcquireBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockAcquire(\n\t\t\tlocals.emdash.db,\n\t\t\tcollection,\n\t\t\tresolved.resolvedId,\n\t\t\tresolved.userId,\n\t\t\t{ takeover: body?.takeover, token: body?.token },\n\t\t),\n\t);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals, url }) => {\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst resolved = await resolveEntry(\n\t\tlocals,\n\t\tcollection,\n\t\tid,\n\t\turl.searchParams.get(\"locale\") || undefined,\n\t);\n\tif (resolved instanceof Response) return resolved;\n\n\treturn unwrapResult(\n\t\tawait handleEntryLockRelease(\n\t\t\tlocals.emdash.db,\n\t\t\tcollection,\n\t\t\tresolved.resolvedId,\n\t\t\tresolved.userId,\n\t\t\t{ token: url.searchParams.get(\"token\") ?? undefined },\n\t\t),\n\t);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoBA,MAAa,YAAY;;;;;AAWzB,eAAe,aACd,QACA,YACA,IACA,QACoC;CACpC,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,oBAAoB,mBAAmB;AACvF,KAAI,OAAQ,QAAO;AAEnB,QAAO;EACN,YAAY,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;EACrE,QAAQ,KAAM;EACd;;AAGF,MAAa,MAAgB,OAAO,EAAE,QAAQ,QAAQ,UAAU;CAC/D,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,oBAAoB,OAAO,OAAO,IAAI,YAAY,SAAS,YAAY,SAAS,OAAO,CAC7F;;AAGF,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,UAAU;CACzE,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,OAAO,MAAM,kBAAkB,SAAS,sBAAsB,EAAE,CAAC;AACvE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,uBACL,OAAO,OAAO,IACd,YACA,SAAS,YACT,SAAS,QACT;EAAE,UAAU,MAAM;EAAU,OAAO,MAAM;EAAO,CAChD,CACD;;AAGF,MAAa,SAAmB,OAAO,EAAE,QAAQ,QAAQ,UAAU;CAClE,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,WAAW,MAAM,aACtB,QACA,YACA,IACA,IAAI,aAAa,IAAI,SAAS,IAAI,OAClC;AACD,KAAI,oBAAoB,SAAU,QAAO;AAEzC,QAAO,aACN,MAAM,uBACL,OAAO,OAAO,IACd,YACA,SAAS,YACT,SAAS,QACT,EAAE,OAAO,IAAI,aAAa,IAAI,QAAQ,IAAI,QAAW,CACrD,CACD"}

package/dist/astro/routes/api/content/_collection_/_id_/permanent.mjs

@@ -1,7 +1,9 @@
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { i as requirePerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/permanent.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/permanent.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"permanent.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/permanent.ts"],"sourcesContent":["/**\n * Permanent delete content endpoint - injected by EmDash integration\n *\n * DELETE /_emdash/api/content/{collection}/{id}/permanent - Permanently delete (no undo)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\n\nexport const prerender = false;\n\nexport const DELETE: APIRoute = async ({ params, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentPermanentDelete) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:delete_permanent\");\n\tif (denied) return denied;\n\n\tconst result = await emdash.handleContentPermanentDelete(collection, id);\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, id] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;AAWA,MAAa,YAAY;AAEzB,MAAa,SAAmB,OAAO,EAAE,QAAQ,QAAQ,YAAY;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,6BACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,2BAA2B;AAC5D,KAAI,OAAQ,QAAO;CAEnB,MAAM,SAAS,MAAM,OAAO,6BAA6B,YAAY,GAAG;AAExE,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;AAEtE,QAAO,aAAa,OAAO"}
+{"version":3,"file":"permanent.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/permanent.ts"],"sourcesContent":["/**\n * Permanent delete content endpoint - injected by EmDash integration\n *\n * DELETE /_emdash/api/content/{collection}/{id}/permanent - Permanently delete (no undo)\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\n\nexport const prerender = false;\n\nexport const DELETE: APIRoute = async ({ params, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentPermanentDelete) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:delete_permanent\");\n\tif (denied) return denied;\n\n\tconst result = await emdash.handleContentPermanentDelete(collection, id);\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, id] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;AAWA,MAAa,YAAY;AAEzB,MAAa,SAAmB,OAAO,EAAE,QAAQ,QAAQ,YAAY;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,6BACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,2BAA2B;AAC5D,KAAI,OAAQ,QAAO;CAEnB,MAAM,SAAS,MAAM,OAAO,6BAA6B,YAAY,GAAG;AAExE,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;AAEtE,QAAO,aAAa,OAAO"}

package/dist/astro/routes/api/content/_collection_/_id_/plugin-extensions/_pluginId_/_kind_/_extensionId_.mjs

@@ -1,13 +1,15 @@
 import "../../../../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../../../../hash-CLVFzWvx.mjs";
-import "../../../../../../../../../zod-generator-D_yHIWfs.mjs";
-import { t as apiError } from "../../../../../../../../../error-CCTCskie.mjs";
-import "../../../../../../../../../route-wire-D66L2oaZ.mjs";
-import "../../../../../../../../../api-tokens-DS1VzN7_.mjs";
-import "../../../../../../../../../authorize-BXpfMpp0.mjs";
-import "../../../../../../../../../scopes-Bn8_rCSt.mjs";
-import { n as dispatchPluginEditorExtensionApiRequest } from "../../../../../../../../../http-route-dispatch-DAKlanXb.mjs";
+import "../../../../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../../../../hash-SDAW6zC-.mjs";
+import "../../../../../../../../../zod-generator-D6uE4WiS.mjs";
+import "../../../../../../../../../errors-BF0_LFhW.mjs";
+import { t as apiError } from "../../../../../../../../../error-CfvOHP0M.mjs";
+import "../../../../../../../../../route-wire--1hLuACz.mjs";
+import "../../../../../../../../../api-tokens-CE1ECIg0.mjs";
+import "../../../../../../../../../authorize-seCifOMJ.mjs";
+import "../../../../../../../../../scopes-Dbk-ElhT.mjs";
+import { n as dispatchPluginEditorExtensionApiRequest } from "../../../../../../../../../http-route-dispatch-BitqzwMy.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/plugin-extensions/[pluginId]/[kind]/[extensionId].ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/_id_/plugin-extensions/_pluginId_/_kind_/_extensionId_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_extensionId_.mjs","names":[],"sources":["../../../../../../../../../../src/astro/routes/api/content/[collection]/[id]/plugin-extensions/[pluginId]/[kind]/[extensionId].ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { apiError } from \"#api/error.js\";\nimport { dispatchPluginEditorExtensionApiRequest } from \"#plugins/http-route-dispatch.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst kind = params.kind;\n\tif (kind !== \"panel\" && kind !== \"action\") {\n\t\treturn apiError(\"NOT_FOUND\", \"Plugin editor extension not found\", 404);\n\t}\n\n\treturn dispatchPluginEditorExtensionApiRequest({\n\t\truntime: emdash,\n\t\tpluginId: params.pluginId!,\n\t\tkind,\n\t\textensionId: params.extensionId!,\n\t\tcollection: params.collection!,\n\t\tentryId: params.id!,\n\t\trequest,\n\t\tuser,\n\t\ttokenScopes: locals.tokenScopes,\n\t\tinvalidateContentCache: cache?.enabled ? (tags) => cache.invalidate({ tags }) : undefined,\n\t});\n};\n"],"mappings":";;;;;;;;;;;;AAKA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,OAAO;AACpB,KAAI,SAAS,WAAW,SAAS,SAChC,QAAO,SAAS,aAAa,qCAAqC,IAAI;AAGvE,QAAO,wCAAwC;EAC9C,SAAS;EACT,UAAU,OAAO;EACjB;EACA,aAAa,OAAO;EACpB,YAAY,OAAO;EACnB,SAAS,OAAO;EAChB;EACA;EACA,aAAa,OAAO;EACpB,wBAAwB,OAAO,WAAW,SAAS,MAAM,WAAW,EAAE,MAAM,CAAC,GAAG;EAChF,CAAC"}
+{"version":3,"file":"_extensionId_.mjs","names":[],"sources":["../../../../../../../../../../src/astro/routes/api/content/[collection]/[id]/plugin-extensions/[pluginId]/[kind]/[extensionId].ts"],"sourcesContent":["import type { APIRoute } from \"astro\";\n\nimport { apiError } from \"#api/error.js\";\nimport { dispatchPluginEditorExtensionApiRequest } from \"#plugins/http-route-dispatch.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash) return apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\n\tconst kind = params.kind;\n\tif (kind !== \"panel\" && kind !== \"action\") {\n\t\treturn apiError(\"NOT_FOUND\", \"Plugin editor extension not found\", 404);\n\t}\n\n\treturn dispatchPluginEditorExtensionApiRequest({\n\t\truntime: emdash,\n\t\tpluginId: params.pluginId!,\n\t\tkind,\n\t\textensionId: params.extensionId!,\n\t\tcollection: params.collection!,\n\t\tentryId: params.id!,\n\t\trequest,\n\t\tuser,\n\t\ttokenScopes: locals.tokenScopes,\n\t\tinvalidateContentCache: cache?.enabled ? (tags) => cache.invalidate({ tags }) : undefined,\n\t});\n};\n"],"mappings":";;;;;;;;;;;;;;AAKA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,OAAQ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEhF,MAAM,OAAO,OAAO;AACpB,KAAI,SAAS,WAAW,SAAS,SAChC,QAAO,SAAS,aAAa,qCAAqC,IAAI;AAGvE,QAAO,wCAAwC;EAC9C,SAAS;EACT,UAAU,OAAO;EACjB;EACA,aAAa,OAAO;EACpB,YAAY,OAAO;EACnB,SAAS,OAAO;EAChB;EACA;EACA,aAAa,OAAO;EACpB,wBAAwB,OAAO,WAAW,SAAS,MAAM,WAAW,EAAE,MAAM,CAAC,GAAG;EAChF,CAAC"}

package/dist/astro/routes/api/content/_collection_/_id_/preview-url.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-url.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/preview-url.ts"],"mappings":";;;cA6Ba,SAAA;AAAA,cAIA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"preview-url.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/preview-url.ts"],"mappings":";;;cAwCa,SAAA;AAAA,cAIA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/content/_collection_/_id_/preview-url.mjs

@@ -1,20 +1,42 @@
-import { r as getI18nConfig } from "../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import { r as getI18nConfig } from "../../../../../../config-CvmjJcVw.mjs";
 import "../../../../../../after-PcEvMY_6.mjs";
-import "../../../../../../options-D5WcorD5.mjs";
+import "../../../../../../options-DhrI7eMv.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
-import { a as resolveSecretsCached } from "../../../../../../secrets-DNgVgz_e.mjs";
+import { a as resolveSecretsCached } from "../../../../../../secrets-CIi0nFiR.mjs";
+import "../../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Cr379Av9.mjs";
-import "../../../../../../redirects-BCiTaIQ-.mjs";
-import { Yn as contentPreviewUrlBody } from "../../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../../status-DLoBmcDz.mjs";
+import { n as localizePath, t as interpolateUrlPattern } from "../../../../../../resolve-2WbQsCvT.mjs";
+import "../../../../../../request-cache-DzLYKm_x.mjs";
+import "../../../../../../fts-manager-S-K0laoS.mjs";
+import "../../../../../../loader-BzqeR1ZN.mjs";
+import "../../../../../../collection-slugs-cache-CjGk__zp.mjs";
+import "../../../../../../capture-triggers-kJyl_yyM.mjs";
+import "../../../../../../activation-LOkDM5WT.mjs";
+import "../../../../../../block-type-registry-DUI_3KxT.mjs";
+import "../../../../../../collection-deletion-BIm28mo3.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../canonical-YhEQezjg.mjs";
+import "../../../../../../digest-BarSh-pN.mjs";
+import "../../../../../../hash-SDAW6zC-.mjs";
+import "../../../../../../zod-generator-D6uE4WiS.mjs";
+import "../../../../../../settings-DYidIB26.mjs";
+import "../../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../../errors-BF0_LFhW.mjs";
+import { n as getCollectionInfoWithDb } from "../../../../../../query-C4IH0uhR.mjs";
+import { a as unwrapResult, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../../redirects-Cv9apQKj.mjs";
+import { Nt as contentPreviewUrlBody } from "../../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../../media-Pu1L6xir.mjs";
+import "../../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../../status-DZKIG4a9.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import "../../../../../../tokens-Ns02GAma.mjs";
-import { i as getPreviewUrl } from "../../../../../../preview-Cup2bj8c.mjs";
-import { r as requirePerm } from "../../../../../../authorize-BXpfMpp0.mjs";
+import { t as generatePreviewToken } from "../../../../../../tokens-u78jETkX.mjs";
+import { i as getPreviewUrl, r as buildPreviewUrl } from "../../../../../../preview-CIUcPYr6.mjs";
+import { i as requirePerm } from "../../../../../../authorize-seCifOMJ.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/preview-url.ts
 const prerender = false;
@@ -28,16 +50,17 @@ const POST = async ({ params, request, locals }) => {
 	const id = params.id;
 	const { previewSecret } = await resolveSecretsCached(emdash.db);
 	let entryLocale = null;
+	let entrySlug = null;
 	if (emdash?.handleContentGet) {
 		const result = await emdash.handleContentGet(collection, id);
 		if (!result.success) return unwrapResult(result);
 		entryLocale = result.data?.item?.locale ?? null;
+		entrySlug = result.data?.item?.slug ?? null;
 	}
 	const body = await parseOptionalBody(request, contentPreviewUrlBody, {});
 	if (isParseError(body)) return body;
 	const expiresIn = body.expiresIn || "1h";
-	const defaultPathPattern = import.meta.env.EMDASH_PREVIEW_PATH_PATTERN || "/{collection}/{id}";
-	const pathPattern = body.pathPattern || defaultPathPattern;
+	const explicitPattern = body.pathPattern || import.meta.env.EMDASH_PREVIEW_PATH_PATTERN || null;
 	const i18n = getI18nConfig();
 	let localeSegment = "";
 	if (entryLocale && i18n) localeSegment = entryLocale === i18n.defaultLocale && !i18n.prefixDefaultLocale ? "" : entryLocale;
@@ -45,13 +68,42 @@ const POST = async ({ params, request, locals }) => {
 	const expiresInSeconds = typeof expiresIn === "number" ? expiresIn : parseExpiresIn(expiresIn);
 	const expiresAt = Math.floor(Date.now() / 1e3) + expiresInSeconds;
 	try {
+		if (!explicitPattern) {
+			let collectionInfo;
+			try {
+				collectionInfo = await getCollectionInfoWithDb(emdash.db, collection);
+			} catch (error) {
+				return handleError(error, "Failed to resolve the collection URL pattern", "PREVIEW_URL_ERROR");
+			}
+			if (collectionInfo?.urlPattern) {
+				const path = interpolateUrlPattern({
+					pattern: collectionInfo.urlPattern,
+					collection,
+					slug: entrySlug || id,
+					id
+				});
+				const localized = await localizePath(path, entryLocale ?? "");
+				const token = await generatePreviewToken({
+					contentId: `${collection}:${id}`,
+					expiresIn,
+					secret: previewSecret
+				});
+				return apiSuccess({
+					url: buildPreviewUrl({
+						path: localized ?? path,
+						token
+					}),
+					expiresAt
+				});
+			}
+		}
 		return apiSuccess({
 			url: await getPreviewUrl({
 				collection,
 				id,
 				secret: previewSecret,
 				expiresIn,
-				pathPattern,
+				pathPattern: explicitPattern || "/{collection}/{id}",
 				locale: localeSegment
 			}),
 			expiresAt

package/dist/astro/routes/api/content/_collection_/_id_/preview-url.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"preview-url.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/preview-url.ts"],"sourcesContent":["/**\n * Preview URL endpoint - generates a signed preview URL for content\n *\n * POST /_emdash/api/content/{collection}/{id}/preview-url\n *\n * Request body:\n * {\n *   expiresIn?: string | number;  // Default: \"1h\"\n *   pathPattern?: string;         // Default: \"/{collection}/{id}\" (or EMDASH_PREVIEW_PATH_PATTERN)\n * }\n *\n * Response:\n * {\n *   url: string;      // The preview URL with token\n *   expiresAt: number; // Unix timestamp when token expires\n * }\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { parseOptionalBody, isParseError } from \"#api/parse.js\";\nimport { contentPreviewUrlBody } from \"#api/schemas.js\";\nimport { resolveSecretsCached } from \"#config/secrets.js\";\nimport { getPreviewUrl } from \"#preview/index.js\";\n\nimport { getI18nConfig } from \"../../../../../../i18n/config.js\";\n\nexport const prerender = false;\n\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read_drafts\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\t// Resolve the preview secret. Env override wins; otherwise a stable\n\t// site-specific value is read from (or generated into) the options table.\n\t// The resolver always returns a usable secret, so this path can no\n\t// longer be silently disabled by a missing env var.\n\tconst { previewSecret } = await resolveSecretsCached(emdash.db);\n\n\t// Verify the content exists. The fetched item also yields the entry's\n\t// locale, used below to resolve the `{locale}` placeholder.\n\tlet entryLocale: string | null = null;\n\tif (emdash?.handleContentGet) {\n\t\tconst result = await emdash.handleContentGet(collection, id);\n\t\tif (!result.success) return unwrapResult(result);\n\t\tentryLocale = result.data?.item?.locale ?? null;\n\t}\n\n\t// Parse request body\n\tconst body = await parseOptionalBody(request, contentPreviewUrlBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst expiresIn = body.expiresIn || \"1h\";\n\t// Allow a project-wide default `pathPattern` so the admin's \"View on site\"\n\t// link can match the site's actual route shape without each call having\n\t// to override the default `/{collection}/{id}`.\n\tconst defaultPathPattern = import.meta.env.EMDASH_PREVIEW_PATH_PATTERN || \"/{collection}/{id}\";\n\tconst pathPattern = body.pathPattern || defaultPathPattern;\n\n\t// Resolve the locale segment substituted for `{locale}`: empty when the\n\t// entry is in the default locale and `prefixDefaultLocale` is `false`,\n\t// the entry's own locale otherwise.\n\tconst i18n = getI18nConfig();\n\tlet localeSegment = \"\";\n\tif (entryLocale && i18n) {\n\t\tconst isDefault = entryLocale === i18n.defaultLocale;\n\t\tlocaleSegment = isDefault && !i18n.prefixDefaultLocale ? \"\" : entryLocale;\n\t} else if (entryLocale) {\n\t\tlocaleSegment = entryLocale;\n\t}\n\n\t// Calculate expiry timestamp\n\tconst expiresInSeconds = typeof expiresIn === \"number\" ? expiresIn : parseExpiresIn(expiresIn);\n\tconst expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;\n\n\ttry {\n\t\tconst url = await getPreviewUrl({\n\t\t\tcollection,\n\t\t\tid,\n\t\t\tsecret: previewSecret,\n\t\t\texpiresIn,\n\t\t\tpathPattern,\n\t\t\tlocale: localeSegment,\n\t\t});\n\n\t\treturn apiSuccess({ url, expiresAt });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate preview URL\", \"TOKEN_ERROR\");\n\t}\n};\n\n/**\n * Parse duration string to seconds\n */\nfunction parseExpiresIn(duration: string): number {\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\treturn 3600; // Default 1 hour\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\treturn 3600;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA6BA,MAAa,YAAY;AAEzB,MAAM,mBAAmB;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,sBAAsB;AACvD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAMlB,MAAM,EAAE,kBAAkB,MAAM,qBAAqB,OAAO,GAAG;CAI/D,IAAI,cAA6B;AACjC,KAAI,QAAQ,kBAAkB;EAC7B,MAAM,SAAS,MAAM,OAAO,iBAAiB,YAAY,GAAG;AAC5D,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,gBAAc,OAAO,MAAM,MAAM,UAAU;;CAI5C,MAAM,OAAO,MAAM,kBAAkB,SAAS,uBAAuB,EAAE,CAAC;AACxE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,YAAY,KAAK,aAAa;CAIpC,MAAM,qBAAqB,OAAO,KAAK,IAAI,+BAA+B;CAC1E,MAAM,cAAc,KAAK,eAAe;CAKxC,MAAM,OAAO,eAAe;CAC5B,IAAI,gBAAgB;AACpB,KAAI,eAAe,KAElB,iBADkB,gBAAgB,KAAK,iBACV,CAAC,KAAK,sBAAsB,KAAK;UACpD,YACV,iBAAgB;CAIjB,MAAM,mBAAmB,OAAO,cAAc,WAAW,YAAY,eAAe,UAAU;CAC9F,MAAM,YAAY,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAElD,KAAI;AAUH,SAAO,WAAW;GAAE,KATR,MAAM,cAAc;IAC/B;IACA;IACA,QAAQ;IACR;IACA;IACA,QAAQ;IACR,CAAC;GAEuB;GAAW,CAAC;UAC7B,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,cAAc;;;;;;AAO5E,SAAS,eAAe,UAA0B;CACjD,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;AAGpC,SAFa,MAAM,IAEnB;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,QAAO"}
+{"version":3,"file":"preview-url.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/preview-url.ts"],"sourcesContent":["/**\n * Preview URL endpoint - generates a signed preview URL for content\n *\n * POST /_emdash/api/content/{collection}/{id}/preview-url\n *\n * Request body:\n * {\n *   expiresIn?: string | number;  // Default: \"1h\"\n *   pathPattern?: string;         // Overrides the resolved default (see below)\n * }\n *\n * Path resolution precedence (highest first):\n *   1. `pathPattern` in the request body (per-call override)\n *   2. `EMDASH_PREVIEW_PATH_PATTERN` env (project-wide override)\n *   3. the collection's configured `url_pattern` — so preview links match the\n *      same routes the sitemap and \"View published\" links already use (incl.\n *      custom permalinks like `/blog/{slug}`), resolved via the shared\n *      `interpolateUrlPattern` + `localizePath` helpers.\n *   4. the generic `/{collection}/{id}` fallback.\n *\n * Response:\n * {\n *   url: string;      // The preview URL with token\n *   expiresAt: number; // Unix timestamp when token expires\n * }\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, unwrapResult } from \"#api/error.js\";\nimport { parseOptionalBody, isParseError } from \"#api/parse.js\";\nimport { contentPreviewUrlBody } from \"#api/schemas.js\";\nimport { resolveSecretsCached } from \"#config/secrets.js\";\nimport { buildPreviewUrl, generatePreviewToken, getPreviewUrl } from \"#preview/index.js\";\nimport { getCollectionInfoWithDb } from \"#schema/query.js\";\n\nimport { getI18nConfig } from \"../../../../../../i18n/config.js\";\nimport { interpolateUrlPattern, localizePath } from \"../../../../../../i18n/resolve.js\";\n\nexport const prerender = false;\n\nconst DURATION_PATTERN = /^(\\d+)([smhdw])$/;\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read_drafts\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\t// Resolve the preview secret. Env override wins; otherwise a stable\n\t// site-specific value is read from (or generated into) the options table.\n\t// The resolver always returns a usable secret, so this path can no\n\t// longer be silently disabled by a missing env var.\n\tconst { previewSecret } = await resolveSecretsCached(emdash.db);\n\n\t// Verify the content exists. The fetched item also yields the entry's\n\t// locale and slug, used below to resolve the public path.\n\tlet entryLocale: string | null = null;\n\tlet entrySlug: string | null = null;\n\tif (emdash?.handleContentGet) {\n\t\tconst result = await emdash.handleContentGet(collection, id);\n\t\tif (!result.success) return unwrapResult(result);\n\t\tentryLocale = result.data?.item?.locale ?? null;\n\t\tentrySlug = result.data?.item?.slug ?? null;\n\t}\n\n\t// Parse request body\n\tconst body = await parseOptionalBody(request, contentPreviewUrlBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst expiresIn = body.expiresIn || \"1h\";\n\t// A project-wide default `pathPattern` (body or env) always wins so callers\n\t// can force a specific shape. When neither is set we resolve the\n\t// collection's own `url_pattern` below.\n\tconst explicitPattern = body.pathPattern || import.meta.env.EMDASH_PREVIEW_PATH_PATTERN || null;\n\n\t// Resolve the locale segment substituted for the `{locale}` placeholder in\n\t// an explicit pattern: empty when the entry is in the default locale and\n\t// `prefixDefaultLocale` is `false`, the entry's own locale otherwise.\n\tconst i18n = getI18nConfig();\n\tlet localeSegment = \"\";\n\tif (entryLocale && i18n) {\n\t\tconst isDefault = entryLocale === i18n.defaultLocale;\n\t\tlocaleSegment = isDefault && !i18n.prefixDefaultLocale ? \"\" : entryLocale;\n\t} else if (entryLocale) {\n\t\tlocaleSegment = entryLocale;\n\t}\n\n\t// Calculate expiry timestamp\n\tconst expiresInSeconds = typeof expiresIn === \"number\" ? expiresIn : parseExpiresIn(expiresIn);\n\tconst expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;\n\n\ttry {\n\t\t// No explicit override: reuse the collection's `url_pattern` so the\n\t\t// preview link points at the same route the sitemap and \"View\n\t\t// published\" links already use (custom permalinks like `/blog/{slug}`).\n\t\t// Without this the generic `/{collection}/{id}` fallback 404s on any\n\t\t// site whose content isn't served at that path.\n\t\tif (!explicitPattern) {\n\t\t\t// Resolved outside the shared catch: a schema lookup failure is a\n\t\t\t// pattern-resolution problem, not a token-signing one.\n\t\t\tlet collectionInfo;\n\t\t\ttry {\n\t\t\t\tcollectionInfo = await getCollectionInfoWithDb(emdash.db, collection);\n\t\t\t} catch (error) {\n\t\t\t\treturn handleError(\n\t\t\t\t\terror,\n\t\t\t\t\t\"Failed to resolve the collection URL pattern\",\n\t\t\t\t\t\"PREVIEW_URL_ERROR\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (collectionInfo?.urlPattern) {\n\t\t\t\tconst path = interpolateUrlPattern({\n\t\t\t\t\tpattern: collectionInfo.urlPattern,\n\t\t\t\t\tcollection,\n\t\t\t\t\tslug: entrySlug || id,\n\t\t\t\t\tid,\n\t\t\t\t});\n\t\t\t\t// `localizePath` returns null when the entry's locale isn't in the\n\t\t\t\t// configured i18n list; fall back to the un-prefixed path so we\n\t\t\t\t// still hand back a usable preview link rather than failing.\n\t\t\t\tconst localized = await localizePath(path, entryLocale ?? \"\");\n\t\t\t\tconst token = await generatePreviewToken({\n\t\t\t\t\tcontentId: `${collection}:${id}`,\n\t\t\t\t\texpiresIn,\n\t\t\t\t\tsecret: previewSecret,\n\t\t\t\t});\n\t\t\t\tconst url = buildPreviewUrl({ path: localized ?? path, token });\n\t\t\t\treturn apiSuccess({ url, expiresAt });\n\t\t\t}\n\t\t}\n\n\t\tconst url = await getPreviewUrl({\n\t\t\tcollection,\n\t\t\tid,\n\t\t\tsecret: previewSecret,\n\t\t\texpiresIn,\n\t\t\tpathPattern: explicitPattern || \"/{collection}/{id}\",\n\t\t\tlocale: localeSegment,\n\t\t});\n\n\t\treturn apiSuccess({ url, expiresAt });\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to generate preview URL\", \"TOKEN_ERROR\");\n\t}\n};\n\n/**\n * Parse duration string to seconds\n */\nfunction parseExpiresIn(duration: string): number {\n\tconst match = duration.match(DURATION_PATTERN);\n\tif (!match) {\n\t\treturn 3600; // Default 1 hour\n\t}\n\n\tconst value = parseInt(match[1], 10);\n\tconst unit = match[2];\n\n\tswitch (unit) {\n\t\tcase \"s\":\n\t\t\treturn value;\n\t\tcase \"m\":\n\t\t\treturn value * 60;\n\t\tcase \"h\":\n\t\t\treturn value * 60 * 60;\n\t\tcase \"d\":\n\t\t\treturn value * 60 * 60 * 24;\n\t\tcase \"w\":\n\t\t\treturn value * 60 * 60 * 24 * 7;\n\t\tdefault:\n\t\t\treturn 3600;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAa,YAAY;AAEzB,MAAM,mBAAmB;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,GACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,sBAAsB;AACvD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAMlB,MAAM,EAAE,kBAAkB,MAAM,qBAAqB,OAAO,GAAG;CAI/D,IAAI,cAA6B;CACjC,IAAI,YAA2B;AAC/B,KAAI,QAAQ,kBAAkB;EAC7B,MAAM,SAAS,MAAM,OAAO,iBAAiB,YAAY,GAAG;AAC5D,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAChD,gBAAc,OAAO,MAAM,MAAM,UAAU;AAC3C,cAAY,OAAO,MAAM,MAAM,QAAQ;;CAIxC,MAAM,OAAO,MAAM,kBAAkB,SAAS,uBAAuB,EAAE,CAAC;AACxE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,YAAY,KAAK,aAAa;CAIpC,MAAM,kBAAkB,KAAK,eAAe,OAAO,KAAK,IAAI,+BAA+B;CAK3F,MAAM,OAAO,eAAe;CAC5B,IAAI,gBAAgB;AACpB,KAAI,eAAe,KAElB,iBADkB,gBAAgB,KAAK,iBACV,CAAC,KAAK,sBAAsB,KAAK;UACpD,YACV,iBAAgB;CAIjB,MAAM,mBAAmB,OAAO,cAAc,WAAW,YAAY,eAAe,UAAU;CAC9F,MAAM,YAAY,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAElD,KAAI;AAMH,MAAI,CAAC,iBAAiB;GAGrB,IAAI;AACJ,OAAI;AACH,qBAAiB,MAAM,wBAAwB,OAAO,IAAI,WAAW;YAC7D,OAAO;AACf,WAAO,YACN,OACA,gDACA,oBACA;;AAEF,OAAI,gBAAgB,YAAY;IAC/B,MAAM,OAAO,sBAAsB;KAClC,SAAS,eAAe;KACxB;KACA,MAAM,aAAa;KACnB;KACA,CAAC;IAIF,MAAM,YAAY,MAAM,aAAa,MAAM,eAAe,GAAG;IAC7D,MAAM,QAAQ,MAAM,qBAAqB;KACxC,WAAW,GAAG,WAAW,GAAG;KAC5B;KACA,QAAQ;KACR,CAAC;AAEF,WAAO,WAAW;KAAE,KADR,gBAAgB;MAAE,MAAM,aAAa;MAAM;MAAO,CAAC;KACtC;KAAW,CAAC;;;AAavC,SAAO,WAAW;GAAE,KATR,MAAM,cAAc;IAC/B;IACA;IACA,QAAQ;IACR;IACA,aAAa,mBAAmB;IAChC,QAAQ;IACR,CAAC;GAEuB;GAAW,CAAC;UAC7B,OAAO;AACf,SAAO,YAAY,OAAO,kCAAkC,cAAc;;;;;;AAO5E,SAAS,eAAe,UAA0B;CACjD,MAAM,QAAQ,SAAS,MAAM,iBAAiB;AAC9C,KAAI,CAAC,MACJ,QAAO;CAGR,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;AAGpC,SAFa,MAAM,IAEnB;EACC,KAAK,IACJ,QAAO;EACR,KAAK,IACJ,QAAO,QAAQ;EAChB,KAAK,IACJ,QAAO,QAAQ,KAAK;EACrB,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK;EAC1B,KAAK,IACJ,QAAO,QAAQ,KAAK,KAAK,KAAK;EAC/B,QACC,QAAO"}

package/dist/astro/routes/api/content/_collection_/_id_/publish.mjs

@@ -1,19 +1,24 @@
-import "../../../../../../dialect-helpers-CtYdsX4W.mjs";
-import "../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../../../config-CvmjJcVw.mjs";
 import "../../../../../../base64-DvnNgP7e.mjs";
 import "../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../entry-locks-CO_KaoU5.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-W3PA8HqB.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-CCTCskie.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Cr379Av9.mjs";
-import "../../../../../../redirects-BCiTaIQ-.mjs";
-import { Xn as contentPublishBody } from "../../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../../comments-BVzzt6x5.mjs";
-import "../../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../../status-DLoBmcDz.mjs";
+import "../../../../../../entry-locks-D0foLdjQ.mjs";
+import "../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../settings-DYidIB26.mjs";
+import "../../../../../../site-settings-DOgRUoFX.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CfvOHP0M.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-DY6OD1j_.mjs";
+import "../../../../../../redirects-Cv9apQKj.mjs";
+import { Pt as contentPublishBody } from "../../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../../media-Pu1L6xir.mjs";
+import "../../../../../../comments-fHZ8ON9O.mjs";
+import "../../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../../status-DZKIG4a9.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { n as requireOwnerPerm } from "../../../../../../authorize-BXpfMpp0.mjs";
-import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-D9rnj2Lu.mjs";
+import { r as requireOwnerPerm } from "../../../../../../authorize-seCifOMJ.mjs";
+import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-DHQOxN7R.mjs";
 import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/[id]/publish.ts

package/dist/astro/routes/api/content/_collection_/_id_/publish.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"publish.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/publish.ts"],"sourcesContent":["/**\n * Publish content - promotes draft to live\n *\n * POST /_emdash/api/content/{collection}/{id}/publish\n *\n * Optional JSON body: { publishedAt?: string, _rev?: string, overrideLock?: boolean }\n *   publishedAt — ISO 8601 datetime to backdate the publish (e.g. when\n *   migrating content). Writing publishedAt requires content:publish_any.\n *   Without it, the existing published_at is preserved on re-publish and\n *   falls back to the current time on first publish.\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIContext, APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentPublishBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport async function publishContent(\n\t{ params, request, locals, url, cache }: APIContext,\n\toriginSource: \"api\" | \"visual-editor\",\n): Promise<Response> {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentPublish || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Body is optional — empty body means use the legacy behavior (preserve\n\t// or default published_at). Pass `publishedAt` to backdate.\n\tconst body = await parseOptionalBody(request, contentPublishBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:publish_own\", \"content:publish_any\");\n\tif (denied) return denied;\n\n\t// Schema narrows `publishedAt` to `string | undefined`; null is rejected\n\t// at the schema layer (publish has no semantic meaning for \"clear\").\n\tconst publishedAt = body?.publishedAt;\n\n\t// Backdating overwrites historical record — gate behind publish_any\n\t// regardless of ownership.\n\tif (publishedAt !== undefined && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Setting publishedAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentPublish(collection, resolvedId, {\n\t\tpublishedAt,\n\t\t_rev: body?._rev,\n\t\tactor: { id: user!.id, role: user!.role },\n\t\torigin: { source: originSource },\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n}\n\nexport const POST: APIRoute = (context) => publishContent(context, \"api\");\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,eAAsB,eACrB,EAAE,QAAQ,SAAS,QAAQ,KAAK,SAChC,cACoB;CACpB,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,wBAAwB,CAAC,QAAQ,iBAC7C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAKpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,uBAAuB,sBAAsB;AAC7F,KAAI,OAAQ,QAAO;CAInB,MAAM,cAAc,MAAM;AAI1B,KAAI,gBAAgB,UAAa,CAAC,cAAc,MAAM,sBAAsB,CAC3E,QAAO,SACN,aACA,+DACA,IACA;CAGF,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,qBAAqB,YAAY,YAAY;EACxE;EACA,MAAM,MAAM;EACZ,OAAO;GAAE,IAAI,KAAM;GAAI,MAAM,KAAM;GAAM;EACzC,QAAQ,EAAE,QAAQ,cAAc;EAChC,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO;;AAG5B,MAAa,QAAkB,YAAY,eAAe,SAAS,MAAM"}
+{"version":3,"file":"publish.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/publish.ts"],"sourcesContent":["/**\n * Publish content - promotes draft to live\n *\n * POST /_emdash/api/content/{collection}/{id}/publish\n *\n * Optional JSON body: { publishedAt?: string, _rev?: string, overrideLock?: boolean }\n *   publishedAt — ISO 8601 datetime to backdate the publish (e.g. when\n *   migrating content). Writing publishedAt requires content:publish_any.\n *   Without it, the existing published_at is preserved on re-publish and\n *   falls back to the current time on first publish.\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIContext, APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentPublishBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport async function publishContent(\n\t{ params, request, locals, url, cache }: APIContext,\n\toriginSource: \"api\" | \"visual-editor\",\n): Promise<Response> {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentPublish || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Body is optional — empty body means use the legacy behavior (preserve\n\t// or default published_at). Pass `publishedAt` to backdate.\n\tconst body = await parseOptionalBody(request, contentPublishBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:publish_own\", \"content:publish_any\");\n\tif (denied) return denied;\n\n\t// Schema narrows `publishedAt` to `string | undefined`; null is rejected\n\t// at the schema layer (publish has no semantic meaning for \"clear\").\n\tconst publishedAt = body?.publishedAt;\n\n\t// Backdating overwrites historical record — gate behind publish_any\n\t// regardless of ownership.\n\tif (publishedAt !== undefined && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Setting publishedAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentPublish(collection, resolvedId, {\n\t\tpublishedAt,\n\t\t_rev: body?._rev,\n\t\tactor: { id: user!.id, role: user!.role },\n\t\torigin: { source: originSource },\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n}\n\nexport const POST: APIRoute = (context) => publishContent(context, \"api\");\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,YAAY;AAEzB,eAAsB,eACrB,EAAE,QAAQ,SAAS,QAAQ,KAAK,SAChC,cACoB;CACpB,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,wBAAwB,CAAC,QAAQ,iBAC7C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAKpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,oBAAoB,EAAE,CAAC;AACrE,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,uBAAuB,sBAAsB;AAC7F,KAAI,OAAQ,QAAO;CAInB,MAAM,cAAc,MAAM;AAI1B,KAAI,gBAAgB,UAAa,CAAC,cAAc,MAAM,sBAAsB,CAC3E,QAAO,SACN,aACA,+DACA,IACA;CAGF,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,qBAAqB,YAAY,YAAY;EACxE;EACA,MAAM,MAAM;EACZ,OAAO;GAAE,IAAI,KAAM;GAAI,MAAM,KAAM;GAAM;EACzC,QAAQ,EAAE,QAAQ,cAAc;EAChC,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO;;AAG5B,MAAa,QAAkB,YAAY,eAAe,SAAS,MAAM"}

package/dist/astro/routes/api/content/_collection_/_id_/references/_relation_/children.mjs

@@ -1,31 +1,40 @@
-import "../../../../../../../../dialect-helpers-CtYdsX4W.mjs";
-import "../../../../../../../../config-CGVeT8Hc.mjs";
+import "../../../../../../../../dialect-helpers-7_IqPdh9.mjs";
+import "../../../../../../../../config-CvmjJcVw.mjs";
 import "../../../../../../../../datetime-normalization-PeiEdcRY.mjs";
 import "../../../../../../../../after-PcEvMY_6.mjs";
 import "../../../../../../../../base64-DvnNgP7e.mjs";
-import { t as ContentRepository } from "../../../../../../../../content-DZ3B5qtA.mjs";
-import "../../../../../../../../object-cache-DlSVbn5Y.mjs";
+import { t as ContentRepository } from "../../../../../../../../content-DFaIEDj9.mjs";
+import "../../../../../../../../object-cache-CqWNY5uP.mjs";
 import "../../../../../../../../slugify-T5GHH42D.mjs";
 import "../../../../../../../../types-BkUg2yHx.mjs";
-import "../../../../../../../../request-cache-DaMhSQdx.mjs";
-import "../../../../../../../../relation-XTAtOpJO.mjs";
-import "../../../../../../../../fts-manager-DMb0sbIQ.mjs";
-import "../../../../../../../../collection-slugs-cache-D9auiKmI.mjs";
-import "../../../../../../../../capture-triggers-gxQxnxrJ.mjs";
-import "../../../../../../../../activation-CaMfdBt1.mjs";
-import "../../../../../../../../collection-deletion-C3Xixmkx.mjs";
-import "../../../../../../../../content-refresh-BHLHJgyt.mjs";
-import "../../../../../../../../registry-CkuPoZs7.mjs";
-import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../../../error-CCTCskie.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../../../parse-Cr379Av9.mjs";
-import { g as cursorPaginationQuery } from "../../../../../../../../redirects-BCiTaIQ-.mjs";
-import "../../../../../../../../entry-lock-D3C99MXS.mjs";
-import "../../../../../../../../comments-BVzzt6x5.mjs";
-import { l as setReferenceChildrenBody } from "../../../../../../../../relations-B4w-G5U9.mjs";
-import "../../../../../../../../status-DLoBmcDz.mjs";
+import "../../../../../../../../request-cache-DzLYKm_x.mjs";
+import "../../../../../../../../relation-M4NUCb0b.mjs";
+import "../../../../../../../../fts-manager-S-K0laoS.mjs";
+import "../../../../../../../../collection-slugs-cache-CjGk__zp.mjs";
+import "../../../../../../../../capture-triggers-kJyl_yyM.mjs";
+import "../../../../../../../../activation-LOkDM5WT.mjs";
+import "../../../../../../../../block-type-registry-DUI_3KxT.mjs";
+import "../../../../../../../../collection-deletion-BIm28mo3.mjs";
+import "../../../../../../../../errors-DgE1zJGG.mjs";
+import "../../../../../../../../canonical-YhEQezjg.mjs";
+import "../../../../../../../../digest-BarSh-pN.mjs";
+import "../../../../../../../../hash-SDAW6zC-.mjs";
+import "../../../../../../../../zod-generator-D6uE4WiS.mjs";
+import "../../../../../../../../settings-DYidIB26.mjs";
+import "../../../../../../../../site-settings-DOgRUoFX.mjs";
+import "../../../../../../../../errors-BF0_LFhW.mjs";
+import { a as unwrapResult, i as requireDb, r as handleError, t as apiError } from "../../../../../../../../error-CfvOHP0M.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../../../../parse-DY6OD1j_.mjs";
+import { g as cursorPaginationQuery } from "../../../../../../../../redirects-Cv9apQKj.mjs";
+import "../../../../../../../../entry-lock-BJYdBfXb.mjs";
+import "../../../../../../../../media-Pu1L6xir.mjs";
+import "../../../../../../../../comments-fHZ8ON9O.mjs";
+import { l as setReferenceChildrenBody } from "../../../../../../../../relations-CK9CYUyr.mjs";
+import "../../../../../../../../menus-BM7BPLOb.mjs";
+import "../../../../../../../../status-DZKIG4a9.mjs";
 import "../../../../../../../../api/schemas/index.mjs";
-import { n as requireOwnerPerm, r as requirePerm } from "../../../../../../../../authorize-BXpfMpp0.mjs";
-import { n as handleReferenceChildrenSet, t as handleReferenceChildrenGet } from "../../../../../../../../relations-O63JWBRj.mjs";
+import { i as requirePerm, r as requireOwnerPerm } from "../../../../../../../../authorize-seCifOMJ.mjs";
+import { n as handleReferenceChildrenSet, t as handleReferenceChildrenGet } from "../../../../../../../../relations-CCif47Oq.mjs";
 import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts

package/dist/astro/routes/api/content/_collection_/_id_/references/_relation_/children.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"children.mjs","names":[],"sources":["../../../../../../../../../src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts"],"sourcesContent":["/**\n * Content-entry reference children endpoint (parent side)\n *\n * GET  /_emdash/api/content/:collection/:id/references/:relation/children\n * POST /_emdash/api/content/:collection/:id/references/:relation/children\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleReferenceChildrenGet, handleReferenceChildrenSet } from \"#api/handlers/relations.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { cursorPaginationQuery, setReferenceChildrenBody } from \"#api/schemas.js\";\nimport { ContentRepository } from \"#db/repositories/content.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst query = parseQuery(new URL(request.url), cursorPaginationQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleReferenceChildrenGet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\t{ limit: query.limit, cursor: query.cursor },\n\t\t\thasPermission(user, \"content:read_drafts\"),\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get references\", \"REFERENCES_GET_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\t// Gate on the base edit capability BEFORE the existence lookup. Resolving the\n\t// entry first would let a user with no edit permission distinguish real ids\n\t// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy\n\t// edge POST, which checks `content:edit_own` before fetching the entry.\n\tconst denied = requirePerm(user, \"content:edit_own\");\n\tif (denied) return denied;\n\n\t// Resolve the parent entry to gate on its author (ownership-aware write).\n\tconst parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);\n\tif (!parent) return apiError(\"NOT_FOUND\", \"Content not found\", 404);\n\n\tconst editDenied = requireOwnerPerm(\n\t\tuser,\n\t\tparent.authorId ?? \"\",\n\t\t\"content:edit_own\",\n\t\t\"content:edit_any\",\n\t);\n\tif (editDenied) return editDenied;\n\n\ttry {\n\t\tconst body = await parseBody(request, setReferenceChildrenBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleReferenceChildrenSet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\tbody.childIds,\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to set references\", \"REFERENCES_SET_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;CAErC,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,sBAAsB;AACrE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AASH,SAAO,aARQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA;GAAE,OAAO,MAAM;GAAO,QAAQ,MAAM;GAAQ,EAC5C,cAAc,MAAM,sBAAsB,CAC1C,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;AAI/E,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;AAErC,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAKlB,MAAM,SAAS,YAAY,MAAM,mBAAmB;AACpD,KAAI,OAAQ,QAAO;CAGnB,MAAM,SAAS,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,eAAe,YAAY,GAAG;AACpF,KAAI,CAAC,OAAQ,QAAO,SAAS,aAAa,qBAAqB,IAAI;CAEnE,MAAM,aAAa,iBAClB,MACA,OAAO,YAAY,IACnB,oBACA,mBACA;AACD,KAAI,WAAY,QAAO;AAEvB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,yBAAyB;AAC/D,MAAI,aAAa,KAAK,CAAE,QAAO;AAS/B,SAAO,aAPQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA,KAAK,SACL,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}
+{"version":3,"file":"children.mjs","names":[],"sources":["../../../../../../../../../src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts"],"sourcesContent":["/**\n * Content-entry reference children endpoint (parent side)\n *\n * GET  /_emdash/api/content/:collection/:id/references/:relation/children\n * POST /_emdash/api/content/:collection/:id/references/:relation/children\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, handleError, requireDb, unwrapResult } from \"#api/error.js\";\nimport { handleReferenceChildrenGet, handleReferenceChildrenSet } from \"#api/handlers/relations.js\";\nimport { isParseError, parseBody, parseQuery } from \"#api/parse.js\";\nimport { cursorPaginationQuery, setReferenceChildrenBody } from \"#api/schemas.js\";\nimport { ContentRepository } from \"#db/repositories/content.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst query = parseQuery(new URL(request.url), cursorPaginationQuery);\n\tif (isParseError(query)) return query;\n\n\ttry {\n\t\tconst result = await handleReferenceChildrenGet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\t{ limit: query.limit, cursor: query.cursor },\n\t\t\thasPermission(user, \"content:read_drafts\"),\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get references\", \"REFERENCES_GET_ERROR\");\n\t}\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, relation } = params;\n\n\tif (!collection || !id || !relation) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and relation required\", 400);\n\t}\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\t// Gate on the base edit capability BEFORE the existence lookup. Resolving the\n\t// entry first would let a user with no edit permission distinguish real ids\n\t// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy\n\t// edge POST, which checks `content:edit_own` before fetching the entry.\n\tconst denied = requirePerm(user, \"content:edit_own\");\n\tif (denied) return denied;\n\n\t// Resolve the parent entry to gate on its author (ownership-aware write).\n\tconst parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);\n\tif (!parent) return apiError(\"NOT_FOUND\", \"Content not found\", 404);\n\n\tconst editDenied = requireOwnerPerm(\n\t\tuser,\n\t\tparent.authorId ?? \"\",\n\t\t\"content:edit_own\",\n\t\t\"content:edit_any\",\n\t);\n\tif (editDenied) return editDenied;\n\n\ttry {\n\t\tconst body = await parseBody(request, setReferenceChildrenBody);\n\t\tif (isParseError(body)) return body;\n\n\t\tconst result = await handleReferenceChildrenSet(\n\t\t\temdash.db,\n\t\t\tcollection,\n\t\t\tid,\n\t\t\trelation,\n\t\t\tbody.childIds,\n\t\t);\n\t\treturn unwrapResult(result);\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to set references\", \"REFERENCES_SET_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACnE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;CAErC,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,WAAW,IAAI,IAAI,QAAQ,IAAI,EAAE,sBAAsB;AACrE,KAAI,aAAa,MAAM,CAAE,QAAO;AAEhC,KAAI;AASH,SAAO,aARQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA;GAAE,OAAO,MAAM;GAAO,QAAQ,MAAM;GAAQ,EAC5C,cAAc,MAAM,sBAAsB,CAC1C,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB;;;AAI/E,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;AAErC,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAKlB,MAAM,SAAS,YAAY,MAAM,mBAAmB;AACpD,KAAI,OAAQ,QAAO;CAGnB,MAAM,SAAS,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,eAAe,YAAY,GAAG;AACpF,KAAI,CAAC,OAAQ,QAAO,SAAS,aAAa,qBAAqB,IAAI;CAEnE,MAAM,aAAa,iBAClB,MACA,OAAO,YAAY,IACnB,oBACA,mBACA;AACD,KAAI,WAAY,QAAO;AAEvB,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,yBAAyB;AAC/D,MAAI,aAAa,KAAK,CAAE,QAAO;AAS/B,SAAO,aAPQ,MAAM,2BACpB,OAAO,IACP,YACA,IACA,UACA,KAAK,SACL,CAC0B;UACnB,OAAO;AACf,SAAO,YAAY,OAAO,4BAA4B,uBAAuB"}