emdash 1.1.0 → 1.3.0

package/src/mcp/json-schema.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+export function safeJsonSchemaToZod(
+	schema: Record<string, unknown>,
+	toolId: string,
+	kind: "input" | "output",
+): z.ZodType | undefined {
+	try {
+		return z.fromJSONSchema(schema);
+	} catch (error) {
+		console.warn(`[emdash] Invalid ${kind} schema for plugin MCP tool ${toolId}:`, error);
+		return undefined;
+	}
+}

package/src/mcp/plugin-tool-name.ts

@@ -0,0 +1,36 @@
+const FORWARD_SLASH_PATTERN = "/";
+const MCP_SAFE_PLUGIN_ID_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const PLUGIN_SCOPE_PREFIX_PATTERN = /^@/;
+const PLUGIN_ID_DASH_PATTERN = /-/g;
+const PLUGIN_ID_UNDERSCORE_PATTERN = /_/;
+const AMBIGUOUS_PLUGIN_SEGMENT_PATTERN = /__/;
+const AMBIGUOUS_JOINED_PLUGIN_ID_PATTERN = /_{3,}/;
+
+export function pluginToolName(pluginId: string, toolName: string): string {
+	if (MCP_SAFE_PLUGIN_ID_PATTERN.test(pluginId)) {
+		return `${pluginId}__${toolName}`;
+	}
+
+	const readableSegments = pluginId
+		.replace(PLUGIN_SCOPE_PREFIX_PATTERN, "")
+		.split(FORWARD_SLASH_PATTERN)
+		.map((segment) => segment.replace(PLUGIN_ID_DASH_PATTERN, "_"));
+	const readablePluginId = readableSegments.join("__");
+	if (
+		PLUGIN_ID_UNDERSCORE_PATTERN.test(pluginId) ||
+		AMBIGUOUS_JOINED_PLUGIN_ID_PATTERN.test(readablePluginId) ||
+		readableSegments.some((segment) => AMBIGUOUS_PLUGIN_SEGMENT_PATTERN.test(segment))
+	) {
+		return `${readablePluginId}__${stableToolNameHash(pluginId)}__${toolName}`;
+	}
+	return `${readablePluginId}__${toolName}`;
+}
+
+function stableToolNameHash(value: string): string {
+	let hash = 0x811c9dc5;
+	for (let index = 0; index < value.length; index++) {
+		hash ^= value.charCodeAt(index);
+		hash = Math.imul(hash, 0x01000193);
+	}
+	return (hash >>> 0).toString(16).padStart(8, "0");
+}

package/src/mcp/server.ts

@@ -31,11 +31,13 @@ import {
 } from "#api/schemas.js";
 
 import { after } from "../after.js";
+import { entryEditAccess } from "../api/authorize.js";
 import { claimEntryLockForWrite } from "../api/handlers/entry-lock.js";
 import type { MediaUsageRepairRequest } from "../api/schemas/media-usage.js";
 import type { EmDashHandlers } from "../astro/types.js";
 import { hasScope } from "../auth/api-tokens.js";
 import { menuTag, siteSettingsTag, taxonomyTag } from "../cache/chrome-tags.js";
+import { invalidateRouteCache } from "../cache/route-cache.js";
 import { convertDataForRead, convertDataForWrite } from "../client/portable-text.js";
 import type { FieldSchema } from "../client/portable-text.js";
 import { decodeCursor, InvalidCursorError } from "../database/repositories/types.js";
@@ -49,6 +51,7 @@ import { readSiteWriteFence, recordSiteWrite } from "../transfer/fence.js";
 import { toSha256Digest } from "../transfer/format/digest.js";
 import { siteImportDecisionsInputSchema } from "../transfer/format/plan.js";
 import { decodeBase64, encodeBase64 } from "../utils/base64.js";
+import { pluginToolName } from "./plugin-tool-name.js";
 import {
 	analyzeImport,
 	exportStatus,
@@ -177,6 +180,10 @@ const settingsSeoSchema = z.object({
 		.max(5000)
 		.optional()
 		.describe("Custom robots.txt body. Leave unset for the EmDash default."),
+	disallowAiTraining: z
+		.boolean()
+		.optional()
+		.describe("Add robots.txt rules asking AI crawlers not to use the site for training"),
 	googleVerification: z
 		.string()
 		.max(100)
@@ -577,8 +584,7 @@ async function unwrapAndInvalidate(
 	changedEarlier = false,
 ): Promise<SuccessEnvelope | ErrorEnvelope> {
 	if (result.success || changedEarlier) {
-		const { cache } = getExtra(extra);
-		if (cache?.enabled) await cache.invalidate({ tags });
+		await invalidateRouteCache(getExtra(extra).cache, tags);
 	}
 	return unwrap(result);
 }
@@ -828,6 +834,15 @@ async function refuseLockedEntry(
 	return refusal ? respondError(refusal.code, refusal.message, { ...refusal.details }) : null;
 }
 
+/** Extract the status from a content handler response. */
+function extractContentStatus(data: unknown): unknown {
+	if (!data || typeof data !== "object") return undefined;
+	const obj = data as Record<string, unknown>;
+	const item =
+		obj.item && typeof obj.item === "object" ? (obj.item as Record<string, unknown>) : obj;
+	return item?.status;
+}
+
 /** Extract the `_rev` token from a content handler response. */
 function extractContentRev(data: unknown): string | undefined {
 	if (!data || typeof data !== "object") return undefined;
@@ -905,10 +920,19 @@ export function createMcpServer(
 		)(name, config, wrapped);
 	}) as typeof server.registerTool;
 
+	const registeredPluginNames = new Set<string>();
 	for (const tool of pluginTools) {
 		if (!Object.hasOwn(Permissions, tool.permission)) continue;
+		const name = pluginToolName(tool.pluginId, tool.name);
+		if (registeredPluginNames.has(name)) {
+			console.warn(
+				`[emdash] Skipping duplicate MCP tool name ${name} from ${tool.pluginId}/${tool.name}`,
+			);
+			continue;
+		}
+		registeredPluginNames.add(name);
 		server.registerTool(
-			`${tool.pluginId}__${tool.name}`,
+			name,
 			{
 				description: tool.description,
 				inputSchema: tool.inputSchema,
@@ -1134,7 +1158,8 @@ export function createMcpServer(
 				"this. Pass a Portable Text JSON array only for complex content Markdown " +
 				"can't express (custom blocks, embeds). A slug is auto-generated if not " +
 				"provided. Items are created as 'draft' by default — use content_publish " +
-				"to make them live.",
+				"or pass status='published' to make them live. `seo` and `publishedAt` " +
+				"can be set in the same call; `publishedAt` requires content:publish_any.",
 			inputSchema: z.object({
 				collection: z.string().describe("Collection slug (e.g. 'posts', 'pages')"),
 				data: z
@@ -1175,6 +1200,18 @@ export function createMcpServer(
 					.describe(
 						"Taxonomy term assignments as { taxonomyName: [termSlug, ...] }. Term slugs are resolved in the entry's locale. Call taxonomy_list to see available taxonomies and taxonomy_list_terms to look up slugs. Missing keys leave that taxonomy unchanged.",
 					),
+				// Reuse the REST schema so `canonical` is gated through `httpUrl`,
+				// rejecting javascript:/data: URIs that would become stored XSS.
+				seo: contentSeoInput
+					.optional()
+					.describe(
+						"Per-content SEO metadata. Only valid for collections with SEO enabled (see schema_get_collection.hasSeo).",
+					),
+				publishedAt: contentDateTimeInputSchema
+					.nullish()
+					.describe(
+						"Override the publication timestamp (ISO 8601). Requires content:publish_any permission. Useful for content migrations.",
+					),
 			}),
 			annotations: { destructiveHint: false },
 		},
@@ -1184,6 +1221,19 @@ export function createMcpServer(
 			const { emdash, userId, userRole } = getExtra(extra);
 			const actor = { id: userId, role: userRole };
 
+			// Writing publishedAt directly (including clearing to null) overwrites
+			// historical record — gate behind publish_any, mirroring the REST POST
+			// route and the MCP content_update tool.
+			if (args.publishedAt !== undefined) {
+				const user = { id: userId, role: userRole };
+				if (!hasPermission(user, "content:publish_any")) {
+					throw new EmDashAuthError(
+						"Setting publishedAt requires content:publish_any permission",
+						"INSUFFICIENT_PERMISSIONS",
+					);
+				}
+			}
+
 			// Creating a translation requires edit permission on the source item
 			if (args.translationOf) {
 				const source = await emdash.handleContentGet(args.collection, args.translationOf);
@@ -1217,6 +1267,8 @@ export function createMcpServer(
 					taxonomies: args.taxonomies,
 					migrateBlocks: args.migrateBlocks,
 					replaceBlocks: args.replaceBlocks,
+					seo: args.seo,
+					publishedAt: args.publishedAt,
 					actor,
 				});
 				if (!result.success) return unwrap(result);
@@ -1225,6 +1277,7 @@ export function createMcpServer(
 					return unwrapAndInvalidate(
 						extra,
 						await emdash.handleContentPublish(args.collection, itemId, {
+							publishedAt: args.publishedAt ?? undefined,
 							actor: { ...actor, source: "mcp" },
 							origin: { source: "mcp" },
 						}),
@@ -1232,11 +1285,10 @@ export function createMcpServer(
 						true,
 					);
 				}
-				return unwrapAndInvalidate(extra, result, [args.collection]);
+				return unwrap(result);
 			}
 
-			return unwrapAndInvalidate(
-				extra,
+			return unwrap(
 				await emdash.handleContentCreate(args.collection, {
 					data,
 					slug: args.slug,
@@ -1247,9 +1299,10 @@ export function createMcpServer(
 					taxonomies: args.taxonomies,
 					migrateBlocks: args.migrateBlocks,
 					replaceBlocks: args.replaceBlocks,
+					seo: args.seo,
+					publishedAt: args.publishedAt,
 					actor,
 				}),
-				[args.collection],
 			);
 		},
 	);
@@ -1333,7 +1386,7 @@ export function createMcpServer(
 		},
 		async (args, extra) => {
 			requireScope(extra, "content:write");
-			requireRole(extra, Role.AUTHOR);
+			requireRole(extra, Role.CONTRIBUTOR);
 			const { emdash, userId, userRole } = getExtra(extra);
 			const actor = { id: userId, role: userRole };
 
@@ -1343,7 +1396,17 @@ export function createMcpServer(
 				return unwrap(existing);
 			}
 			const ownerId = extractContentAuthorId(existing.data);
-			requireOwnership(extra, ownerId, "content:edit_own", "content:edit_any");
+			if (
+				!entryEditAccess(
+					{ id: userId, role: userRole },
+					{ authorId: ownerId, status: extractContentStatus(existing.data) },
+				)
+			) {
+				throw new EmDashAuthError(
+					"Insufficient permissions for this operation",
+					"INSUFFICIENT_PERMISSIONS",
+				);
+			}
 
 			const data = args.data
 				? await convertWriteData(emdash, args.collection, args.data)
@@ -1896,11 +1959,7 @@ export function createMcpServer(
 				"content:edit_any",
 			);
 			const resolvedId = extractContentId(existing.data) ?? args.id;
-			return unwrapAndInvalidate(
-				extra,
-				await emdash.handleContentDuplicate(args.collection, resolvedId, userId),
-				[args.collection],
-			);
+			return unwrap(await emdash.handleContentDuplicate(args.collection, resolvedId, userId));
 		},
 	);
 

package/src/media/image-endpoint.ts

@@ -34,6 +34,17 @@ export const DEFAULT_TRANSFORM_QUALITY = 85;
 /** Upper bound for a requested dimension; caps the work a single request asks for. */
 export const MAX_TRANSFORM_DIMENSION = 4000;
 
+/** Weak prefix on an ETag, stripped for weak comparison per RFC 7232. */
+const WEAK_ETAG_PREFIX = /^W\//;
+
+/**
+ * Strip surrounding whitespace and the weak prefix from an ETag value for
+ * weak comparison. Defined at module scope so it is not recreated per request.
+ */
+function stripWeakEtagPrefix(value: string): string {
+	return value.trim().replace(WEAK_ETAG_PREFIX, "");
+}
+
 /** A format string accepted by {@link ImageTransformOptions.format}. */
 export type ImageTransformFormat = (typeof ALLOWED_TRANSFORM_FORMATS)[number];
 
@@ -56,6 +67,90 @@ export const IMMUTABLE_IMAGE_CACHE = "public, max-age=31536000, immutable";
 /** Cache policy for media keys that Replace original may overwrite. */
 export const MUTABLE_MEDIA_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 
+/**
+ * Format a Date as an HTTP-date (RFC 7231).
+ */
+export function formatHttpDate(date: Date): string {
+	return date.toUTCString();
+}
+
+/**
+ * Build a weak validator from representation metadata. Weak because it is based
+ * on size and modification time rather than a content hash. Keeps the same
+ * shape for stored files and derived transforms so replacements change the tag.
+ */
+export function makeWeakEtag(size: number, lastModified?: Date, suffix?: string): string {
+	let value = String(size);
+	if (lastModified) value += `-${lastModified.getTime()}`;
+	if (suffix) value += `-${suffix}`;
+	return `W/"${value}"`;
+}
+
+/**
+ * Build a canonical fingerprint of the transform query params that affect the
+ * derived /_image bytes. Used as the suffix of a transform's weak ETag.
+ */
+export function getTransformFingerprint(params: URLSearchParams): string {
+	const parts: string[] = [];
+	const append = (name: string) => {
+		const value = params.get(name);
+		if (value !== null) parts.push(`${name}=${value}`);
+	};
+	append("w");
+	append("h");
+	append("f");
+	append("q");
+	append("fit");
+	return parts.join("&");
+}
+
+/**
+ * Check whether a request's preconditions are satisfied for the given
+ * representation. Returns true when the client already has the current version.
+ */
+export function isNotModified(
+	request: Request,
+	size: number,
+	lastModified?: Date,
+	suffix?: string,
+): boolean {
+	const etag = makeWeakEtag(size, lastModified, suffix);
+	const ifNoneMatch = request.headers.get("If-None-Match");
+	if (ifNoneMatch !== null) {
+		if (ifNoneMatch.trim() === "*") return true;
+		// If-None-Match uses weak comparison: "W/" prefixes are ignored.
+		const requestedTags = ifNoneMatch.split(",").map(stripWeakEtagPrefix);
+		return requestedTags.includes(stripWeakEtagPrefix(etag));
+	}
+	const ifModifiedSince = request.headers.get("If-Modified-Since");
+	if (ifModifiedSince !== null && lastModified) {
+		const since = Date.parse(ifModifiedSince);
+		if (!Number.isNaN(since)) {
+			// HTTP-date has one-second precision; round the stored time down so
+			// a Last-Modified header replayed as If-Modified-Since always matches.
+			return Math.floor(lastModified.getTime() / 1000) * 1000 <= since;
+		}
+	}
+	return false;
+}
+
+/**
+ * Headers that make a mutable representation conditionally cacheable.
+ */
+export function validatorHeaders(
+	size: number,
+	lastModified?: Date,
+	suffix?: string,
+): Record<string, string> {
+	const headers: Record<string, string> = {
+		ETag: makeWeakEtag(size, lastModified, suffix),
+	};
+	if (lastModified) {
+		headers["Last-Modified"] = formatHttpDate(lastModified);
+	}
+	return headers;
+}
+
 /**
  * Raster types safe to render inline. Anything else (SVG, PDF, ...) is served
  * as an attachment so it can't execute as an active document. Mirrors the
@@ -77,7 +172,11 @@ const SAFE_INLINE_IMAGE_TYPES = new Set([
  * inline raster allowlist (so a stored SVG can't run scripts in the site
  * origin). Transformed output is always generated raster and doesn't need this.
  */
-export function originalMediaHeaders(contentType: string): Record<string, string> {
+export function originalMediaHeaders(
+	contentType: string,
+	size?: number,
+	lastModified?: Date,
+): Record<string, string> {
 	return {
 		"Content-Type": contentType,
 		"Cache-Control": MUTABLE_MEDIA_CACHE_CONTROL,
@@ -85,6 +184,7 @@ export function originalMediaHeaders(contentType: string): Record<string, string
 		"Content-Security-Policy":
 			"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'",
 		"Content-Disposition": SAFE_INLINE_IMAGE_TYPES.has(contentType) ? "inline" : "attachment",
+		...(size !== undefined ? validatorHeaders(size, lastModified) : {}),
 	};
 }
 

package/src/media/responsive.ts

@@ -18,12 +18,19 @@ const ABSOLUTE_HTTP_URL = /^https?:\/\//i;
 /**
  * Pick the srcset widths to generate for an image rendered at `maxWidth`.
  * Includes breakpoints up to 2x (retina) plus the rendered width itself, so the
- * browser always has an exact-fit candidate.
+ * browser always has an exact-fit candidate. A known `originalWidth` below 2x
+ * lowers that limit, so the source is never upscaled for a high-density
+ * candidate. The limit itself is a candidate up to the largest breakpoint, so
+ * images narrower than the first breakpoint still get one.
  */
-export function responsiveWidths(maxWidth: number): number[] {
-	const cap = maxWidth * 2;
+export function responsiveWidths(maxWidth: number, originalWidth?: number): number[] {
+	const width = Math.round(maxWidth);
+	if (!(width >= 1)) return [];
+	const original = Math.round(originalWidth ?? 0);
+	const cap = original >= 1 && original < width * 2 ? original : width * 2;
 	const widths = new Set(RESPONSIVE_BREAKPOINTS.filter((w) => w <= cap));
-	widths.add(maxWidth);
+	widths.add(width);
+	if (cap <= Math.max(...RESPONSIVE_BREAKPOINTS)) widths.add(cap);
 	return [...widths].toSorted((a, b) => a - b);
 }
 
@@ -120,9 +127,9 @@ export interface ResponsiveImage {
  */
 export async function buildResponsiveImage(
 	getImage: GetImage,
-	opts: { src: string; width?: number; height?: number },
+	opts: { src: string; width?: number; height?: number; originalWidth?: number },
 ): Promise<ResponsiveImage | null> {
-	const { src, width, height } = opts;
+	const { src, width, height, originalWidth } = opts;
 	if (!src || !width || !height) return null;
 	if (!ABSOLUTE_HTTP_URL.test(src)) return null;
 	try {
@@ -131,7 +138,7 @@ export async function buildResponsiveImage(
 			src,
 			width,
 			height,
-			widths: responsiveWidths(width),
+			widths: responsiveWidths(width, originalWidth),
 			sizes,
 		});
 		// Passthrough: the service returned the source unchanged (unauthorized

package/src/media/usage/collection-deletion.ts

@@ -1,6 +1,7 @@
 import { sql, type Kysely, type RawBuilder, type Selectable, type Transaction } from "kysely";
 import { ulid } from "ulidx";
 
+import { deleteSharedCollectionRecords } from "../../database/collection-cleanup.js";
 import { isPostgres } from "../../database/dialect-helpers.js";
 import {
 	decodeCursor,
@@ -555,6 +556,9 @@ export async function deleteActivatedMediaUsageCollection(
 			leaseToken: claim.leaseToken,
 		});
 		if (result.outcome !== "dropped") throw new Error("Collection deletion lost its table fence");
+		// The content table is gone, so the FKs from ec_* to revisions.id are
+		// released and the remaining shared-table records can be removed.
+		await deleteSharedCollectionRecords(db, claim.collectionSlug);
 		if (
 			!(await repository.checkpoint({
 				...lease,

package/src/media/usage/extractor.ts

@@ -1,3 +1,4 @@
+import { isPortableTextVideoBlock } from "../../content/converters/video.js";
 import { normalizeMime } from "../mime.js";
 import { INTERNAL_MEDIA_PREFIX } from "../normalize.js";
 import type {
@@ -141,6 +142,20 @@ function extractPortableTextOccurrences(
 				fieldSlug,
 				`${pathPrefix}[${blockIndex}]`,
 				block.asset,
+				"image",
+			);
+			continue;
+		}
+
+		// A plugin's own `video` block may hold a reference that isn't media.
+		if (isPortableTextVideoBlock(block)) {
+			addPortableTextAssetOccurrence(
+				occurrences,
+				seen,
+				fieldSlug,
+				`${pathPrefix}[${blockIndex}]`,
+				block.asset,
+				"video",
 			);
 			continue;
 		}
@@ -155,6 +170,7 @@ function extractPortableTextOccurrences(
 					fieldSlug,
 					`${pathPrefix}[${blockIndex}].images[${imageIndex}]`,
 					image.asset,
+					"image",
 				);
 			}
 		}
@@ -231,6 +247,7 @@ function addPortableTextAssetOccurrence(
 	fieldSlug: string,
 	pathPrefix: string,
 	asset: unknown,
+	kind: "image" | "video",
 ): void {
 	if (!isRecord(asset)) return;
 
@@ -241,12 +258,12 @@ function addPortableTextAssetOccurrence(
 	addRefOccurrence(occurrences, seen, {
 		fieldSlug,
 		fieldPath: `${pathPrefix}.asset.${ref.key}`,
-		referenceType: "portable_text_image",
+		referenceType: kind === "video" ? "portable_text_video" : "portable_text_image",
 		ref: buildMediaRef({
 			id: ref.id,
 			provider,
 			mimeType: normalizeMimeValue(asset.mimeType),
-			fallbackKind: "image",
+			fallbackKind: kind,
 		}),
 	});
 }

package/src/media/usage/types.ts

@@ -13,7 +13,11 @@ export type MediaKind =
 	| "text"
 	| "other";
 
-export type MediaUsageReferenceType = "image_field" | "file_field" | "portable_text_image";
+export type MediaUsageReferenceType =
+	| "image_field"
+	| "file_field"
+	| "portable_text_image"
+	| "portable_text_video";
 
 export interface MediaUsageExtractionSubField {
 	slug: string;

package/src/migrations/direct-executor.ts

@@ -1,6 +1,10 @@
 import { type Dialect, Kysely } from "kysely";
 
-import { clearMigrationLock, readMigrationLock } from "../database/migration-lock.js";
+import {
+	armMigrationLockTakeOver,
+	clearMigrationLock,
+	readMigrationLock,
+} from "../database/migration-lock.js";
 import {
 	getExactMigrationStatus,
 	runMigrations,
@@ -45,25 +49,47 @@ function createReport(
 	return report;
 }
 
-async function releaseLock(db: Kysely<Database>, lockId: string | undefined): Promise<void> {
+function confirmedLockId(lockId: string | undefined): number {
 	if (!lockId || !LOCK_ID_PATTERN.test(lockId)) {
-		throw new Error("Releasing the migration lock requires the lock id reported by status.");
+		throw new Error("The migration lock id must be the one reported by status.");
 	}
-	const lock = Number(lockId);
-	// Read before writing: on Postgres the lock column is a 32-bit integer that
-	// a lock id does not fit, and no Postgres lock is ever held in it.
-	const heldSince = await readMigrationLock(db);
-	if (heldSince === lock && (await clearMigrationLock(db, lock))) return;
-	const current = heldSince === lock ? await readMigrationLock(db) : heldSince;
+	return Number(lockId);
+}
+
+function lockMismatchError(current: number | null): Error {
 	// No lock ids here: the CLI's redaction can rewrite digits that match an
 	// environment value.
-	throw new Error(
+	return new Error(
 		current === null
 			? "The migration lock is not held."
-			: "The migration lock has a different id now. Check the status again before releasing it.",
+			: "The migration lock has a different id now. Check the status again.",
 	);
 }
 
+async function releaseLock(db: Kysely<Database>, lockId: string | undefined): Promise<void> {
+	const lock = confirmedLockId(lockId);
+	// Read before writing: on Postgres the lock column is a 32-bit integer that
+	// a lock id does not fit, and no Postgres lock is ever held in it.
+	const heldSince = await readMigrationLock(db);
+	if (heldSince === lock && (await clearMigrationLock(db, lock))) return;
+	throw lockMismatchError(heldSince === lock ? await readMigrationLock(db) : heldSince);
+}
+
+async function takeOverLock(
+	db: Kysely<Database>,
+	lockId: string | undefined,
+	pending: boolean,
+): Promise<void> {
+	const lock = confirmedLockId(lockId);
+	// With nothing pending no run takes the lock, so releasing it is enough.
+	if (!pending) return releaseLock(db, lockId);
+	const heldSince = await readMigrationLock(db);
+	if (heldSince !== lock) throw lockMismatchError(heldSince);
+	// No run on this database takes the lock in its row, so nothing can claim
+	// it between the release and this run.
+	if (!armMigrationLockTakeOver(db, lock)) await releaseLock(db, lockId);
+}
+
 async function verifyRequest(request: MigrationRequest): Promise<void> {
 	const identity = await getCoreMigrationIdentity();
 	if (
@@ -95,6 +121,9 @@ async function executeRequest(
 			`Cannot apply migrations with unknown applied migrations: ${initialStatus.unknownApplied.join(", ")}`,
 		);
 	}
+	if (request.action === "take-over-lock") {
+		await takeOverLock(db, request.lockId, initialStatus.pending.length > 0);
+	}
 	if (initialStatus.pending.length === 0) {
 		return createReport(target, initialStatus, []);
 	}
@@ -133,7 +162,8 @@ export function createDirectMigrationExecutor(
 			if (
 				request.action !== "check" &&
 				request.action !== "apply" &&
-				request.action !== "release-lock"
+				request.action !== "release-lock" &&
+				request.action !== "take-over-lock"
 			) {
 				throw new Error("Unsupported migration action.");
 			}

package/src/migrations/protocol.ts

@@ -1,6 +1,6 @@
 import type { I18nConfig } from "../i18n/config.js";
 
-export type MigrationAction = "check" | "apply" | "release-lock";
+export type MigrationAction = "check" | "apply" | "release-lock" | "take-over-lock";
 
 export interface MigrationRequest {
 	action: MigrationAction;
@@ -9,7 +9,11 @@ export interface MigrationRequest {
 		emdashVersion: string;
 		migrationSetFingerprint: string;
 	};
-	/** For `release-lock`: the lock id a `check` reported. Another lock is left alone. */
+	/**
+	 * For `release-lock` and `take-over-lock`: the lock id a `check` reported.
+	 * Another lock is left alone. `take-over-lock` applies pending migrations
+	 * under that lock without freeing it first.
+	 */
 	lockId?: string;
 }
 

package/src/plugin-utils.ts

@@ -64,7 +64,7 @@ export async function parseApiResponse<T>(
 	fallbackMessage = "Request failed",
 ): Promise<T> {
 	if (!response.ok) {
-		throw new Error(await getErrorMessage(response, `${fallbackMessage}: ${response.statusText}`));
+		throw new Error(await getErrorMessage(response, fallbackMessage));
 	}
 	const body: { data: T } = await response.json();
 	return body.data;