emdash 1.2.0 → 1.3.1

package/dist/astro/routes/api/content/_collection_/_id_/terms/_taxonomy_.mjs

@@ -1,39 +1,49 @@
 import "../../../../../../../dialect-helpers-7_IqPdh9.mjs";
-import { r as getI18nConfig } from "../../../../../../../config-CvmjJcVw.mjs";
+import { r as getI18nConfig } from "../../../../../../../config-Cs_AwWXI.mjs";
 import "../../../../../../../datetime-normalization-PeiEdcRY.mjs";
 import "../../../../../../../after-PcEvMY_6.mjs";
 import "../../../../../../../base64-BQBZwXCx.mjs";
-import { t as ContentRepository } from "../../../../../../../content-CcHrqkgp.mjs";
-import "../../../../../../../object-cache-Bo6DGaC9.mjs";
-import { n as chunks } from "../../../../../../../chunks-Dr5Vr0zA.mjs";
-import "../../../../../../../slugify-bu2-jKia.mjs";
-import "../../../../../../../request-cache-C4CIo5ad.mjs";
-import "../../../../../../../url-Dn3IStq8.mjs";
-import "../../../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../../../revision-BWEH2qQB.mjs";
-import { t as TaxonomyRepository } from "../../../../../../../taxonomy-QrNmTfIZ.mjs";
-import "../../../../../../../resolve-D-kqyKns.mjs";
-import { r as taxonomyTag } from "../../../../../../../chrome-tags-BIKBMZYO.mjs";
-import "../../../../../../../loader-CetY659y.mjs";
-import "../../../../../../../collection-slugs-cache-B2Gs9Jwx.mjs";
-import { d as invalidateTermCache } from "../../../../../../../taxonomies-DQSywBvX.mjs";
-import "../../../../../../../errors-CjtE5aWF.mjs";
-import "../../../../../../../errors-hskQ0C8G.mjs";
-import "../../../../../../../settings-GaZ5sVgg.mjs";
-import "../../../../../../../site-settings-CDdT4mVm.mjs";
-import { i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../../error-DxgQdaZ_.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../../../parse-Cn5aSk1N.mjs";
-import "../../../../../../../redirects-DFT7Wr-e.mjs";
-import { Ht as contentTermsBody } from "../../../../../../../entry-lock-Cjz0h45X.mjs";
-import "../../../../../../../media-CRKsKlfK.mjs";
-import "../../../../../../../comments-BzmIKVb2.mjs";
-import "../../../../../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../../../../../menus-D1HC8npj.mjs";
-import "../../../../../../../status-Dl85BK39.mjs";
+import { t as ContentRepository } from "../../../../../../../content-Dt0Os_WQ.mjs";
+import "../../../../../../../query-BFHjCzSh.mjs";
+import "../../../../../../../object-cache-EjasjtoQ.mjs";
+import { n as chunks } from "../../../../../../../chunks-CYBOL-zn.mjs";
+import "../../../../../../../slugify-BDEG9pLk.mjs";
+import "../../../../../../../request-cache-5z2WzWmh.mjs";
+import "../../../../../../../url-DTfGDJhI.mjs";
+import "../../../../../../../types-DwhEvIVb.mjs";
+import "../../../../../../../revision-Dx7Uth1X.mjs";
+import { t as TaxonomyRepository } from "../../../../../../../taxonomy-BG_xu2Qf.mjs";
+import "../../../../../../../resolve-DdNXBJSr.mjs";
+import { r as taxonomyTag } from "../../../../../../../chrome-tags-BDs29G3g.mjs";
+import "../../../../../../../loader-D4w4XE7q.mjs";
+import "../../../../../../../json-recordset-BjYIWFkV.mjs";
+import "../../../../../../../collection-slugs-cache-B2J5aESO.mjs";
+import { d as invalidateTermCache } from "../../../../../../../taxonomies-By2aGvq2.mjs";
+import "../../../../../../../errors-DlJwot7q.mjs";
+import "../../../../../../../errors-BMaCpLeS.mjs";
+import "../../../../../../../settings-B3ZmPF_8.mjs";
+import "../../../../../../../site-settings-uPkW0e6o.mjs";
+import { i as requireDb, n as apiSuccess, r as handleError, t as apiError } from "../../../../../../../error-CT2SsX5S.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../../../parse-2W-E2f7w.mjs";
+import "../../../../../../../redirects-BA_TvtuH.mjs";
+import { Ht as contentTermsBody } from "../../../../../../../entry-lock-DDuWaAiP.mjs";
+import "../../../../../../../media-qTTHVkls.mjs";
+import "../../../../../../../comments-DVjWJm8X.mjs";
+import "../../../../../../../byline-fields-B1qHvRps.mjs";
+import "../../../../../../../menus-BI6oBXco.mjs";
+import "../../../../../../../status-DSURZwKS.mjs";
 import "../../../../../../../api/schemas/index.mjs";
-import { i as requirePerm, r as requireOwnerPerm } from "../../../../../../../authorize-TdIGpRSE.mjs";
+import { i as requireEntryEditPerm, o as requirePerm, r as requireAnyPerm } from "../../../../../../../authorize-CoDsRRp5.mjs";
+import { t as invalidateRouteCache } from "../../../../../../../route-cache-DAG5dPhh.mjs";
+import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/[id]/terms/[taxonomy].ts
+/**
+* Content-taxonomy association endpoint
+*
+* GET /_emdash/api/content/:collection/:id/terms/:taxonomy - Get terms for an entry
+* POST /_emdash/api/content/:collection/:id/terms/:taxonomy - Set terms for an entry
+*/
 const prerender = false;
 const MAX_CACHE_PURGE_TAGS = 100;
 function assignmentResponse(assignments, entryLocale) {
@@ -72,7 +82,7 @@ const GET = async ({ params, locals }) => {
 	if (!collection || !id || !taxonomy) return apiError("VALIDATION_ERROR", "Collection, id, and taxonomy required", 400);
 	try {
 		const entry = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);
-		if (!entry) return apiError("NOT_FOUND", "Content not found", 404);
+		if (!entry || entry.status !== "published" && !hasPermission(user, "content:read_drafts")) return apiError("NOT_FOUND", "Content not found", 404);
 		const locale = entry.locale || getI18nConfig()?.defaultLocale || "en";
 		const defaultLocale = getI18nConfig()?.defaultLocale ?? "en";
 		return apiSuccess(assignmentResponse(await new TaxonomyRepository(emdash.db).getTermAssignmentsForEntry(collection, entry.id, taxonomy, locale, defaultLocale), locale));
@@ -89,14 +99,17 @@ const POST = async ({ params, request, locals, cache }) => {
 	if (!collection || !id || !taxonomy) return apiError("VALIDATION_ERROR", "Collection, id, and taxonomy required", 400);
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
-	const denied = requirePerm(user, "content:edit_own");
+	const denied = requireAnyPerm(user, ["content:edit_own", "content:edit_own_drafts"]);
 	if (denied) return denied;
 	if (!emdash.handleContentGet) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	const existing = await emdash.handleContentGet(collection, id);
 	if (!existing.success) return apiError(existing.error?.code ?? "NOT_FOUND", existing.error?.message ?? "Content not found", existing.error?.code === "NOT_FOUND" ? 404 : 500);
 	const existingData = existing.data && typeof existing.data === "object" ? existing.data : void 0;
 	const existingItem = existingData?.item && typeof existingData.item === "object" ? existingData.item : existingData;
-	const editDenied = requireOwnerPerm(user, typeof existingItem?.authorId === "string" ? existingItem.authorId : "", "content:edit_own", "content:edit_any");
+	const editDenied = requireEntryEditPerm(user, {
+		authorId: typeof existingItem?.authorId === "string" ? existingItem.authorId : "",
+		status: existingItem?.status
+	});
 	if (editDenied) return editDenied;
 	const canonicalId = typeof existingItem?.id === "string" ? existingItem.id : id;
 	const entryLocale = typeof existingItem?.locale === "string" ? existingItem.locale : getI18nConfig()?.defaultLocale ?? "en";
@@ -120,7 +133,7 @@ const POST = async ({ params, request, locals, cache }) => {
 				...new Set([canonicalId, ...siblingIds]),
 				taxonomyTag(taxonomy)
 			];
-			for (const tagBatch of chunks(tags, MAX_CACHE_PURGE_TAGS)) await cache.invalidate({ tags: tagBatch });
+			for (const tagBatch of chunks(tags, MAX_CACHE_PURGE_TAGS)) await invalidateRouteCache(cache, tagBatch);
 		}
 		return apiSuccess(assignmentResponse(await repo.getTermAssignmentsForEntry(collection, canonicalId, taxonomy, entryLocale, getI18nConfig()?.defaultLocale ?? "en"), entryLocale));
 	} catch (error) {

package/dist/astro/routes/api/content/_collection_/_id_/terms/_taxonomy_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_taxonomy_.mjs","names":[],"sources":["../../../../../../../../src/astro/routes/api/content/[collection]/[id]/terms/[taxonomy].ts"],"sourcesContent":["/**\n * Content-taxonomy association endpoint\n *\n * GET /_emdash/api/content/:collection/:id/terms/:taxonomy - Get terms for an entry\n * POST /_emdash/api/content/:collection/:id/terms/:taxonomy - Set terms for an entry\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm, requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, requireDb } from \"#api/error.js\";\nimport { parseBody, isParseError } from \"#api/parse.js\";\nimport { contentTermsBody } from \"#api/schemas.js\";\nimport { taxonomyTag } from \"#cache/chrome-tags.js\";\nimport { ContentRepository } from \"#db/repositories/content.js\";\nimport {\n\tTaxonomyRepository,\n\ttype TaxonomyAssignmentResolution,\n} from \"#db/repositories/taxonomy.js\";\nimport { invalidateTermCache } from \"#taxonomies/index.js\";\nimport { chunks } from \"#utils/chunks.js\";\n\nimport { getI18nConfig } from \"../../../../../../../i18n/config.js\";\n\nexport const prerender = false;\n\nconst MAX_CACHE_PURGE_TAGS = 100;\n\nfunction assignmentResponse(assignments: TaxonomyAssignmentResolution[], entryLocale: string) {\n\tconst config = getI18nConfig();\n\tconst defaultLocale = config?.defaultLocale ?? \"en\";\n\treturn {\n\t\tterms: assignments.flatMap(({ term }) =>\n\t\t\tterm\n\t\t\t\t? [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tid: term.id,\n\t\t\t\t\t\t\tname: term.name,\n\t\t\t\t\t\t\tslug: term.slug,\n\t\t\t\t\t\t\tlabel: term.label,\n\t\t\t\t\t\t\tparentId: term.parentId,\n\t\t\t\t\t\t\tlocale: term.locale,\n\t\t\t\t\t\t\ttranslationGroup: term.translationGroup,\n\t\t\t\t\t\t},\n\t\t\t\t\t]\n\t\t\t\t: [],\n\t\t),\n\t\tunresolved: assignments\n\t\t\t.filter(({ term }) => term === null)\n\t\t\t.map(({ translationGroup, availableLocales, translations }) => ({\n\t\t\t\ttranslationGroup,\n\t\t\t\tavailableLocales,\n\t\t\t\ttranslations,\n\t\t\t})),\n\t\tentryLocale,\n\t\tdefaultLocale,\n\t\timplicitDefaultLocale: config === null,\n\t};\n}\n\n/**\n * Get terms assigned to an entry\n */\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, taxonomy } = params;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\n\tif (!collection || !id || !taxonomy) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and taxonomy required\", 400);\n\t}\n\n\ttry {\n\t\t// Assignments store content and term translation groups. Resolve the\n\t\t// entry's locale server-side so the response includes only that locale's\n\t\t// term variant.\n\t\tconst entry = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);\n\t\tif (!entry) return apiError(\"NOT_FOUND\", \"Content not found\", 404);\n\t\tconst locale = entry.locale || getI18nConfig()?.defaultLocale || \"en\";\n\t\tconst defaultLocale = getI18nConfig()?.defaultLocale ?? \"en\";\n\n\t\tconst repo = new TaxonomyRepository(emdash.db);\n\t\tconst assignments = await repo.getTermAssignmentsForEntry(\n\t\t\tcollection,\n\t\t\tentry.id,\n\t\t\ttaxonomy,\n\t\t\tlocale,\n\t\t\tdefaultLocale,\n\t\t);\n\n\t\treturn apiSuccess(assignmentResponse(assignments, locale));\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get entry terms\", \"TERMS_GET_ERROR\");\n\t}\n};\n\n/**\n * Set terms for an entry (replaces existing)\n */\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, taxonomy } = params;\n\n\tif (!collection || !id || !taxonomy) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and taxonomy required\", 400);\n\t}\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requirePerm(user, \"content:edit_own\");\n\tif (denied) return denied;\n\n\tif (!emdash.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Verify the content exists before modifying its terms\n\tconst existing = await emdash.handleContentGet(collection, id);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"NOT_FOUND\",\n\t\t\texisting.error?.message ?? \"Content not found\",\n\t\t\texisting.error?.code === \"NOT_FOUND\" ? 404 : 500,\n\t\t);\n\t}\n\n\t// Check ownership for edit permission\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst editDenied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (editDenied) return editDenied;\n\n\t// Resolve the canonical content ID from the handler result.\n\t// The URL `id` param may be a slug; we must use the real ID for term storage.\n\tconst canonicalId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\t// The assignment spans the content translation group, while the response\n\t// includes only the term variant matching this entry's locale.\n\tconst entryLocale =\n\t\ttypeof existingItem?.locale === \"string\"\n\t\t\t? existingItem.locale\n\t\t\t: (getI18nConfig()?.defaultLocale ?? \"en\");\n\n\ttry {\n\t\tconst body = await parseBody(request, contentTermsBody);\n\t\tif (isParseError(body)) return body;\n\t\tconst { termIds } = body;\n\n\t\tconst repo = new TaxonomyRepository(emdash.db);\n\n\t\t// Verify all term IDs exist and belong to the correct taxonomy\n\t\tfor (const termId of termIds) {\n\t\t\tconst term = await repo.findById(termId);\n\t\t\tif (!term) {\n\t\t\t\treturn apiError(\"NOT_FOUND\", `Term ID '${termId}' not found`, 404);\n\t\t\t}\n\t\t\tif (term.name !== taxonomy) {\n\t\t\t\treturn apiError(\n\t\t\t\t\t\"VALIDATION_ERROR\",\n\t\t\t\t\t`Term ID '${termId}' does not belong to taxonomy '${taxonomy}'`,\n\t\t\t\t\t400,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Set the terms (replaces existing) using the canonical ID\n\t\tawait repo.setTermsForEntry(collection, canonicalId, taxonomy, termIds);\n\n\t\t// Term assignments changed — invalidate the hasAnyTermAssignments cache\n\t\t// so hydration on subsequent reads issues a fresh query.\n\t\tinvalidateTermCache();\n\t\tif (cache?.enabled) {\n\t\t\tconst translationGroup = existingItem?.translationGroup;\n\t\t\tconst siblingIds =\n\t\t\t\ttypeof translationGroup === \"string\"\n\t\t\t\t\t? await new ContentRepository(emdash.db).findTranslationIds(collection, translationGroup)\n\t\t\t\t\t: [];\n\t\t\tconst tags = [collection, ...new Set([canonicalId, ...siblingIds]), taxonomyTag(taxonomy)];\n\t\t\tfor (const tagBatch of chunks(tags, MAX_CACHE_PURGE_TAGS)) {\n\t\t\t\tawait cache.invalidate({ tags: tagBatch });\n\t\t\t}\n\t\t}\n\n\t\t// Get the updated terms using the canonical ID, scoped to the entry locale\n\t\tconst assignments = await repo.getTermAssignmentsForEntry(\n\t\t\tcollection,\n\t\t\tcanonicalId,\n\t\t\ttaxonomy,\n\t\t\tentryLocale,\n\t\t\tgetI18nConfig()?.defaultLocale ?? \"en\",\n\t\t);\n\n\t\treturn apiSuccess(assignmentResponse(assignments, entryLocale));\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to set entry terms\", \"TERMS_SET_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,YAAY;AAEzB,MAAM,uBAAuB;AAE7B,SAAS,mBAAmB,aAA6C,aAAqB;CAC7F,MAAM,SAAS,eAAe;CAC9B,MAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAO;EACN,OAAO,YAAY,SAAS,EAAE,WAC7B,OACG,CACA;GACC,IAAI,KAAK;GACT,MAAM,KAAK;GACX,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,kBAAkB,KAAK;GACvB,CACD,GACA,EAAE,CACL;EACD,YAAY,YACV,QAAQ,EAAE,WAAW,SAAS,KAAK,CACnC,KAAK,EAAE,kBAAkB,kBAAkB,oBAAoB;GAC/D;GACA;GACA;GACA,EAAE;EACJ;EACA;EACA,uBAAuB,WAAW;EAClC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;CAErC,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;AAGlF,KAAI;EAIH,MAAM,QAAQ,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,eAAe,YAAY,GAAG;AACnF,MAAI,CAAC,MAAO,QAAO,SAAS,aAAa,qBAAqB,IAAI;EAClE,MAAM,SAAS,MAAM,UAAU,eAAe,EAAE,iBAAiB;EACjE,MAAM,gBAAgB,eAAe,EAAE,iBAAiB;AAWxD,SAAO,WAAW,mBARE,MADP,IAAI,mBAAmB,OAAO,GAAG,CACf,2BAC9B,YACA,MAAM,IACN,UACA,QACA,cACA,EAEiD,OAAO,CAAC;UAClD,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,kBAAkB;;;;;;AAO3E,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;AAErC,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,YAAY,MAAM,mBAAmB;AACpD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OAAO,iBACX,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,GAAG;AAC9D,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,aACxB,SAAS,OAAO,WAAW,qBAC3B,SAAS,OAAO,SAAS,cAAc,MAAM,IAC7C;CAIF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,aAAa,iBAAiB,MADnB,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IAClC,oBAAoB,mBAAmB;AAC3F,KAAI,WAAY,QAAO;CAIvB,MAAM,cAAc,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAG7E,MAAM,cACL,OAAO,cAAc,WAAW,WAC7B,aAAa,SACZ,eAAe,EAAE,iBAAiB;AAEvC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAC/B,MAAM,EAAE,YAAY;EAEpB,MAAM,OAAO,IAAI,mBAAmB,OAAO,GAAG;AAG9C,OAAK,MAAM,UAAU,SAAS;GAC7B,MAAM,OAAO,MAAM,KAAK,SAAS,OAAO;AACxC,OAAI,CAAC,KACJ,QAAO,SAAS,aAAa,YAAY,OAAO,cAAc,IAAI;AAEnE,OAAI,KAAK,SAAS,SACjB,QAAO,SACN,oBACA,YAAY,OAAO,iCAAiC,SAAS,IAC7D,IACA;;AAKH,QAAM,KAAK,iBAAiB,YAAY,aAAa,UAAU,QAAQ;AAIvE,uBAAqB;AACrB,MAAI,OAAO,SAAS;GACnB,MAAM,mBAAmB,cAAc;GACvC,MAAM,aACL,OAAO,qBAAqB,WACzB,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,mBAAmB,YAAY,iBAAiB,GACvF,EAAE;GACN,MAAM,OAAO;IAAC;IAAY,GAAG,IAAI,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC;IAAE,YAAY,SAAS;IAAC;AAC1F,QAAK,MAAM,YAAY,OAAO,MAAM,qBAAqB,CACxD,OAAM,MAAM,WAAW,EAAE,MAAM,UAAU,CAAC;;AAa5C,SAAO,WAAW,mBARE,MAAM,KAAK,2BAC9B,YACA,aACA,UACA,aACA,eAAe,EAAE,iBAAiB,KAClC,EAEiD,YAAY,CAAC;UACvD,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,kBAAkB"}
+{"version":3,"file":"_taxonomy_.mjs","names":[],"sources":["../../../../../../../../src/astro/routes/api/content/[collection]/[id]/terms/[taxonomy].ts"],"sourcesContent":["/**\n * Content-taxonomy association endpoint\n *\n * GET /_emdash/api/content/:collection/:id/terms/:taxonomy - Get terms for an entry\n * POST /_emdash/api/content/:collection/:id/terms/:taxonomy - Set terms for an entry\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requireAnyPerm, requireEntryEditPerm, requirePerm } from \"#api/authorize.js\";\nimport { apiError, apiSuccess, handleError, requireDb } from \"#api/error.js\";\nimport { parseBody, isParseError } from \"#api/parse.js\";\nimport { contentTermsBody } from \"#api/schemas.js\";\nimport { taxonomyTag } from \"#cache/chrome-tags.js\";\nimport { invalidateRouteCache } from \"#cache/route-cache.js\";\nimport { ContentRepository } from \"#db/repositories/content.js\";\nimport {\n\tTaxonomyRepository,\n\ttype TaxonomyAssignmentResolution,\n} from \"#db/repositories/taxonomy.js\";\nimport { invalidateTermCache } from \"#taxonomies/index.js\";\nimport { chunks } from \"#utils/chunks.js\";\n\nimport { getI18nConfig } from \"../../../../../../../i18n/config.js\";\n\nexport const prerender = false;\n\nconst MAX_CACHE_PURGE_TAGS = 100;\n\nfunction assignmentResponse(assignments: TaxonomyAssignmentResolution[], entryLocale: string) {\n\tconst config = getI18nConfig();\n\tconst defaultLocale = config?.defaultLocale ?? \"en\";\n\treturn {\n\t\tterms: assignments.flatMap(({ term }) =>\n\t\t\tterm\n\t\t\t\t? [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tid: term.id,\n\t\t\t\t\t\t\tname: term.name,\n\t\t\t\t\t\t\tslug: term.slug,\n\t\t\t\t\t\t\tlabel: term.label,\n\t\t\t\t\t\t\tparentId: term.parentId,\n\t\t\t\t\t\t\tlocale: term.locale,\n\t\t\t\t\t\t\ttranslationGroup: term.translationGroup,\n\t\t\t\t\t\t},\n\t\t\t\t\t]\n\t\t\t\t: [],\n\t\t),\n\t\tunresolved: assignments\n\t\t\t.filter(({ term }) => term === null)\n\t\t\t.map(({ translationGroup, availableLocales, translations }) => ({\n\t\t\t\ttranslationGroup,\n\t\t\t\tavailableLocales,\n\t\t\t\ttranslations,\n\t\t\t})),\n\t\tentryLocale,\n\t\tdefaultLocale,\n\t\timplicitDefaultLocale: config === null,\n\t};\n}\n\n/**\n * Get terms assigned to an entry\n */\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, taxonomy } = params;\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\n\tif (!collection || !id || !taxonomy) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and taxonomy required\", 400);\n\t}\n\n\ttry {\n\t\t// Assignments store content and term translation groups. Resolve the\n\t\t// entry's locale server-side so the response includes only that locale's\n\t\t// term variant.\n\t\tconst entry = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);\n\t\tif (!entry || (entry.status !== \"published\" && !hasPermission(user, \"content:read_drafts\"))) {\n\t\t\treturn apiError(\"NOT_FOUND\", \"Content not found\", 404);\n\t\t}\n\t\tconst locale = entry.locale || getI18nConfig()?.defaultLocale || \"en\";\n\t\tconst defaultLocale = getI18nConfig()?.defaultLocale ?? \"en\";\n\n\t\tconst repo = new TaxonomyRepository(emdash.db);\n\t\tconst assignments = await repo.getTermAssignmentsForEntry(\n\t\t\tcollection,\n\t\t\tentry.id,\n\t\t\ttaxonomy,\n\t\t\tlocale,\n\t\t\tdefaultLocale,\n\t\t);\n\n\t\treturn apiSuccess(assignmentResponse(assignments, locale));\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to get entry terms\", \"TERMS_GET_ERROR\");\n\t}\n};\n\n/**\n * Set terms for an entry (replaces existing)\n */\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst { collection, id, taxonomy } = params;\n\n\tif (!collection || !id || !taxonomy) {\n\t\treturn apiError(\"VALIDATION_ERROR\", \"Collection, id, and taxonomy required\", 400);\n\t}\n\n\tconst dbErr = requireDb(emdash?.db);\n\tif (dbErr) return dbErr;\n\tconst denied = requireAnyPerm(user, [\"content:edit_own\", \"content:edit_own_drafts\"]);\n\tif (denied) return denied;\n\n\tif (!emdash.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Verify the content exists before modifying its terms\n\tconst existing = await emdash.handleContentGet(collection, id);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"NOT_FOUND\",\n\t\t\texisting.error?.message ?? \"Content not found\",\n\t\t\texisting.error?.code === \"NOT_FOUND\" ? 404 : 500,\n\t\t);\n\t}\n\n\t// Check ownership for edit permission\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership check\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst editDenied = requireEntryEditPerm(user, { authorId, status: existingItem?.status });\n\tif (editDenied) return editDenied;\n\n\t// Resolve the canonical content ID from the handler result.\n\t// The URL `id` param may be a slug; we must use the real ID for term storage.\n\tconst canonicalId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\t// The assignment spans the content translation group, while the response\n\t// includes only the term variant matching this entry's locale.\n\tconst entryLocale =\n\t\ttypeof existingItem?.locale === \"string\"\n\t\t\t? existingItem.locale\n\t\t\t: (getI18nConfig()?.defaultLocale ?? \"en\");\n\n\ttry {\n\t\tconst body = await parseBody(request, contentTermsBody);\n\t\tif (isParseError(body)) return body;\n\t\tconst { termIds } = body;\n\n\t\tconst repo = new TaxonomyRepository(emdash.db);\n\n\t\t// Verify all term IDs exist and belong to the correct taxonomy\n\t\tfor (const termId of termIds) {\n\t\t\tconst term = await repo.findById(termId);\n\t\t\tif (!term) {\n\t\t\t\treturn apiError(\"NOT_FOUND\", `Term ID '${termId}' not found`, 404);\n\t\t\t}\n\t\t\tif (term.name !== taxonomy) {\n\t\t\t\treturn apiError(\n\t\t\t\t\t\"VALIDATION_ERROR\",\n\t\t\t\t\t`Term ID '${termId}' does not belong to taxonomy '${taxonomy}'`,\n\t\t\t\t\t400,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Set the terms (replaces existing) using the canonical ID\n\t\tawait repo.setTermsForEntry(collection, canonicalId, taxonomy, termIds);\n\n\t\t// Term assignments changed — invalidate the hasAnyTermAssignments cache\n\t\t// so hydration on subsequent reads issues a fresh query.\n\t\tinvalidateTermCache();\n\t\tif (cache?.enabled) {\n\t\t\tconst translationGroup = existingItem?.translationGroup;\n\t\t\tconst siblingIds =\n\t\t\t\ttypeof translationGroup === \"string\"\n\t\t\t\t\t? await new ContentRepository(emdash.db).findTranslationIds(collection, translationGroup)\n\t\t\t\t\t: [];\n\t\t\tconst tags = [collection, ...new Set([canonicalId, ...siblingIds]), taxonomyTag(taxonomy)];\n\t\t\tfor (const tagBatch of chunks(tags, MAX_CACHE_PURGE_TAGS)) {\n\t\t\t\tawait invalidateRouteCache(cache, tagBatch);\n\t\t\t}\n\t\t}\n\n\t\t// Get the updated terms using the canonical ID, scoped to the entry locale\n\t\tconst assignments = await repo.getTermAssignmentsForEntry(\n\t\t\tcollection,\n\t\t\tcanonicalId,\n\t\t\ttaxonomy,\n\t\t\tentryLocale,\n\t\t\tgetI18nConfig()?.defaultLocale ?? \"en\",\n\t\t);\n\n\t\treturn apiSuccess(assignmentResponse(assignments, entryLocale));\n\t} catch (error) {\n\t\treturn handleError(error, \"Failed to set entry terms\", \"TERMS_SET_ERROR\");\n\t}\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,YAAY;AAEzB,MAAM,uBAAuB;AAE7B,SAAS,mBAAmB,aAA6C,aAAqB;CAC7F,MAAM,SAAS,eAAe;CAC9B,MAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAO;EACN,OAAO,YAAY,SAAS,EAAE,WAC7B,OACG,CACA;GACC,IAAI,KAAK;GACT,MAAM,KAAK;GACX,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,UAAU,KAAK;GACf,QAAQ,KAAK;GACb,kBAAkB,KAAK;GACvB,CACD,GACA,EAAE,CACL;EACD,YAAY,YACV,QAAQ,EAAE,WAAW,SAAS,KAAK,CACnC,KAAK,EAAE,kBAAkB,kBAAkB,oBAAoB;GAC/D;GACA;GACA;GACA,EAAE;EACJ;EACA;EACA,uBAAuB,WAAW;EAClC;;;;;AAMF,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;CAErC,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;AAGlF,KAAI;EAIH,MAAM,QAAQ,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,eAAe,YAAY,GAAG;AACnF,MAAI,CAAC,SAAU,MAAM,WAAW,eAAe,CAAC,cAAc,MAAM,sBAAsB,CACzF,QAAO,SAAS,aAAa,qBAAqB,IAAI;EAEvD,MAAM,SAAS,MAAM,UAAU,eAAe,EAAE,iBAAiB;EACjE,MAAM,gBAAgB,eAAe,EAAE,iBAAiB;AAWxD,SAAO,WAAW,mBARE,MADP,IAAI,mBAAmB,OAAO,GAAG,CACf,2BAC9B,YACA,MAAM,IACN,UACA,QACA,cACA,EAEiD,OAAO,CAAC;UAClD,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,kBAAkB;;;;;;AAO3E,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,EAAE,YAAY,IAAI,aAAa;AAErC,KAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAC1B,QAAO,SAAS,oBAAoB,yCAAyC,IAAI;CAGlF,MAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,KAAI,MAAO,QAAO;CAClB,MAAM,SAAS,eAAe,MAAM,CAAC,oBAAoB,0BAA0B,CAAC;AACpF,KAAI,OAAQ,QAAO;AAEnB,KAAI,CAAC,OAAO,iBACX,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,GAAG;AAC9D,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,aACxB,SAAS,OAAO,WAAW,qBAC3B,SAAS,OAAO,SAAS,cAAc,MAAM,IAC7C;CAIF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,aAAa,qBAAqB,MAAM;EAAE,UAD/B,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW;EAC5B,QAAQ,cAAc;EAAQ,CAAC;AACzF,KAAI,WAAY,QAAO;CAIvB,MAAM,cAAc,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAG7E,MAAM,cACL,OAAO,cAAc,WAAW,WAC7B,aAAa,SACZ,eAAe,EAAE,iBAAiB;AAEvC,KAAI;EACH,MAAM,OAAO,MAAM,UAAU,SAAS,iBAAiB;AACvD,MAAI,aAAa,KAAK,CAAE,QAAO;EAC/B,MAAM,EAAE,YAAY;EAEpB,MAAM,OAAO,IAAI,mBAAmB,OAAO,GAAG;AAG9C,OAAK,MAAM,UAAU,SAAS;GAC7B,MAAM,OAAO,MAAM,KAAK,SAAS,OAAO;AACxC,OAAI,CAAC,KACJ,QAAO,SAAS,aAAa,YAAY,OAAO,cAAc,IAAI;AAEnE,OAAI,KAAK,SAAS,SACjB,QAAO,SACN,oBACA,YAAY,OAAO,iCAAiC,SAAS,IAC7D,IACA;;AAKH,QAAM,KAAK,iBAAiB,YAAY,aAAa,UAAU,QAAQ;AAIvE,uBAAqB;AACrB,MAAI,OAAO,SAAS;GACnB,MAAM,mBAAmB,cAAc;GACvC,MAAM,aACL,OAAO,qBAAqB,WACzB,MAAM,IAAI,kBAAkB,OAAO,GAAG,CAAC,mBAAmB,YAAY,iBAAiB,GACvF,EAAE;GACN,MAAM,OAAO;IAAC;IAAY,GAAG,IAAI,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC;IAAE,YAAY,SAAS;IAAC;AAC1F,QAAK,MAAM,YAAY,OAAO,MAAM,qBAAqB,CACxD,OAAM,qBAAqB,OAAO,SAAS;;AAa7C,SAAO,WAAW,mBARE,MAAM,KAAK,2BAC9B,YACA,aACA,UACA,aACA,eAAe,EAAE,iBAAiB,KAClC,EAEiD,YAAY,CAAC;UACvD,OAAO;AACf,SAAO,YAAY,OAAO,6BAA6B,kBAAkB"}

package/dist/astro/routes/api/content/_collection_/_id_/translations.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"translations.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/translations.ts"],"mappings":";;;cAca,SAAA;AAAA,cAWA,GAAA,EAAK,QAAA"}
+{"version":3,"file":"translations.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/translations.ts"],"mappings":";;;cAca,SAAA;AAAA,cAmBA,GAAA,EAAK,QAAA"}

package/dist/astro/routes/api/content/_collection_/_id_/translations.mjs

@@ -1,9 +1,9 @@
 import "../../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../../errors-CjtE5aWF.mjs";
-import "../../../../../../errors-hskQ0C8G.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-DxgQdaZ_.mjs";
-import { i as requirePerm } from "../../../../../../authorize-TdIGpRSE.mjs";
+import "../../../../../../types-DwhEvIVb.mjs";
+import "../../../../../../errors-DlJwot7q.mjs";
+import "../../../../../../errors-BMaCpLeS.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CT2SsX5S.mjs";
+import { o as requirePerm } from "../../../../../../authorize-CoDsRRp5.mjs";
 import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/[id]/translations.ts
@@ -18,6 +18,9 @@ const prerender = false;
 function isPublished(t) {
 	return typeof t === "object" && t !== null && "status" in t && t.status === "published";
 }
+function isEntry(t, idOrSlug) {
+	return typeof t === "object" && t !== null && ("id" in t && t.id === idOrSlug || "slug" in t && t.slug === idOrSlug);
+}
 const GET = async ({ params, locals }) => {
 	const { emdash, user } = locals;
 	if (!emdash?.handleContentTranslations) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
@@ -29,6 +32,7 @@ const GET = async ({ params, locals }) => {
 	if (result.success && !hasPermission(user, "content:read_drafts")) {
 		const data = result.data && typeof result.data === "object" ? result.data : void 0;
 		const filtered = (Array.isArray(data?.translations) ? data.translations : []).filter(isPublished);
+		if (!filtered.some((t) => isEntry(t, id))) return apiError("NOT_FOUND", `Content item not found: ${id}`, 404);
 		return unwrapResult({
 			success: true,
 			data: {

package/dist/astro/routes/api/content/_collection_/_id_/translations.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/translations.ts"],"sourcesContent":["/**\n * Content translations endpoint\n *\n * GET /_emdash/api/content/{collection}/{id}/translations\n *\n * Returns all locale variants linked to the same translation group.\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\n\nexport const prerender = false;\n\nfunction isPublished(t: unknown): boolean {\n\treturn (\n\t\ttypeof t === \"object\" &&\n\t\tt !== null &&\n\t\t\"status\" in t &&\n\t\t(t as Record<string, unknown>).status === \"published\"\n\t);\n}\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentTranslations) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tconst result = await emdash.handleContentTranslations(collection, id);\n\n\t// Filter out non-published translations for users without read_drafts so a\n\t// subscriber can't enumerate locales that aren't yet live.\n\tif (result.success && !hasPermission(user, \"content:read_drafts\")) {\n\t\tconst data =\n\t\t\tresult.data && typeof result.data === \"object\"\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check\n\t\t\t\t\t(result.data as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\tconst translations = Array.isArray(data?.translations) ? data.translations : [];\n\t\tconst filtered = translations.filter(isPublished);\n\t\treturn unwrapResult({\n\t\t\tsuccess: true,\n\t\t\tdata: { ...data, translations: filtered },\n\t\t});\n\t}\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,SAAS,YAAY,GAAqB;AACzC,QACC,OAAO,MAAM,YACb,MAAM,QACN,YAAY,KACX,EAA8B,WAAW;;AAI5C,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,0BACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAElB,MAAM,SAAS,MAAM,OAAO,0BAA0B,YAAY,GAAG;AAIrE,KAAI,OAAO,WAAW,CAAC,cAAc,MAAM,sBAAsB,EAAE;EAClE,MAAM,OACL,OAAO,QAAQ,OAAO,OAAO,SAAS,WAEnC,OAAO,OACP;EAEJ,MAAM,YADe,MAAM,QAAQ,MAAM,aAAa,GAAG,KAAK,eAAe,EAAE,EACjD,OAAO,YAAY;AACjD,SAAO,aAAa;GACnB,SAAS;GACT,MAAM;IAAE,GAAG;IAAM,cAAc;IAAU;GACzC,CAAC;;AAGH,QAAO,aAAa,OAAO"}
+{"version":3,"file":"translations.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/translations.ts"],"sourcesContent":["/**\n * Content translations endpoint\n *\n * GET /_emdash/api/content/{collection}/{id}/translations\n *\n * Returns all locale variants linked to the same translation group.\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm } from \"#api/authorize.js\";\nimport { apiError, unwrapResult } from \"#api/error.js\";\n\nexport const prerender = false;\n\nfunction isPublished(t: unknown): boolean {\n\treturn (\n\t\ttypeof t === \"object\" &&\n\t\tt !== null &&\n\t\t\"status\" in t &&\n\t\t(t as Record<string, unknown>).status === \"published\"\n\t);\n}\n\nfunction isEntry(t: unknown, idOrSlug: string): boolean {\n\treturn (\n\t\ttypeof t === \"object\" &&\n\t\tt !== null &&\n\t\t((\"id\" in t && t.id === idOrSlug) || (\"slug\" in t && t.slug === idOrSlug))\n\t);\n}\n\nexport const GET: APIRoute = async ({ params, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentTranslations) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tconst result = await emdash.handleContentTranslations(collection, id);\n\n\t// Filter out non-published translations for users without read_drafts so a\n\t// subscriber can't enumerate locales that aren't yet live. The requested\n\t// entry is one of the translations; if it isn't published, return 404 so\n\t// its id or slug can't be probed either.\n\tif (result.success && !hasPermission(user, \"content:read_drafts\")) {\n\t\tconst data =\n\t\t\tresult.data && typeof result.data === \"object\"\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check\n\t\t\t\t\t(result.data as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\tconst translations = Array.isArray(data?.translations) ? data.translations : [];\n\t\tconst filtered = translations.filter(isPublished);\n\t\tif (!filtered.some((t) => isEntry(t, id))) {\n\t\t\treturn apiError(\"NOT_FOUND\", `Content item not found: ${id}`, 404);\n\t\t}\n\t\treturn unwrapResult({\n\t\t\tsuccess: true,\n\t\t\tdata: { ...data, translations: filtered },\n\t\t});\n\t}\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,SAAS,YAAY,GAAqB;AACzC,QACC,OAAO,MAAM,YACb,MAAM,QACN,YAAY,KACX,EAA8B,WAAW;;AAI5C,SAAS,QAAQ,GAAY,UAA2B;AACvD,QACC,OAAO,MAAM,YACb,MAAM,SACJ,QAAQ,KAAK,EAAE,OAAO,YAAc,UAAU,KAAK,EAAE,SAAS;;AAIlE,MAAa,MAAgB,OAAO,EAAE,QAAQ,aAAa;CAC1D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,0BACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAElB,MAAM,SAAS,MAAM,OAAO,0BAA0B,YAAY,GAAG;AAMrE,KAAI,OAAO,WAAW,CAAC,cAAc,MAAM,sBAAsB,EAAE;EAClE,MAAM,OACL,OAAO,QAAQ,OAAO,OAAO,SAAS,WAEnC,OAAO,OACP;EAEJ,MAAM,YADe,MAAM,QAAQ,MAAM,aAAa,GAAG,KAAK,eAAe,EAAE,EACjD,OAAO,YAAY;AACjD,MAAI,CAAC,SAAS,MAAM,MAAM,QAAQ,GAAG,GAAG,CAAC,CACxC,QAAO,SAAS,aAAa,2BAA2B,MAAM,IAAI;AAEnE,SAAO,aAAa;GACnB,SAAS;GACT,MAAM;IAAE,GAAG;IAAM,cAAc;IAAU;GACzC,CAAC;;AAGH,QAAO,aAAa,OAAO"}

package/dist/astro/routes/api/content/_collection_/_id_/unpublish.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"unpublish.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/unpublish.ts"],"mappings":";;;cAca,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}
+{"version":3,"file":"unpublish.d.mts","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/unpublish.ts"],"mappings":";;;cAea,SAAA;AAAA,cAEA,IAAA,EAAM,QAAA"}

package/dist/astro/routes/api/content/_collection_/_id_/unpublish.mjs

@@ -1,25 +1,26 @@
 import "../../../../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../../../../config-CvmjJcVw.mjs";
+import "../../../../../../config-Cs_AwWXI.mjs";
 import "../../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../../url-Dn3IStq8.mjs";
-import "../../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../../entry-locks-DJAqVweV.mjs";
-import "../../../../../../errors-CjtE5aWF.mjs";
-import { n as mapErrorStatus } from "../../../../../../errors-hskQ0C8G.mjs";
-import "../../../../../../settings-GaZ5sVgg.mjs";
-import "../../../../../../site-settings-CDdT4mVm.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../../error-DxgQdaZ_.mjs";
-import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-Cn5aSk1N.mjs";
-import "../../../../../../redirects-DFT7Wr-e.mjs";
-import { Rt as contentRevisionConditionBody } from "../../../../../../entry-lock-Cjz0h45X.mjs";
-import "../../../../../../media-CRKsKlfK.mjs";
-import "../../../../../../comments-BzmIKVb2.mjs";
-import "../../../../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../../../../menus-D1HC8npj.mjs";
-import "../../../../../../status-Dl85BK39.mjs";
+import "../../../../../../url-DTfGDJhI.mjs";
+import "../../../../../../types-DwhEvIVb.mjs";
+import "../../../../../../entry-locks-Cp8_BcQQ.mjs";
+import "../../../../../../errors-DlJwot7q.mjs";
+import { n as mapErrorStatus } from "../../../../../../errors-BMaCpLeS.mjs";
+import "../../../../../../settings-B3ZmPF_8.mjs";
+import "../../../../../../site-settings-uPkW0e6o.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../../error-CT2SsX5S.mjs";
+import { r as parseOptionalBody, t as isParseError } from "../../../../../../parse-2W-E2f7w.mjs";
+import "../../../../../../redirects-BA_TvtuH.mjs";
+import { Rt as contentRevisionConditionBody } from "../../../../../../entry-lock-DDuWaAiP.mjs";
+import "../../../../../../media-qTTHVkls.mjs";
+import "../../../../../../comments-DVjWJm8X.mjs";
+import "../../../../../../byline-fields-B1qHvRps.mjs";
+import "../../../../../../menus-BI6oBXco.mjs";
+import "../../../../../../status-DSURZwKS.mjs";
 import "../../../../../../api/schemas/index.mjs";
-import { r as requireOwnerPerm } from "../../../../../../authorize-TdIGpRSE.mjs";
-import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-B4n0HdQ_.mjs";
+import { a as requireOwnerPerm } from "../../../../../../authorize-CoDsRRp5.mjs";
+import { t as claimEntryLockForWrite } from "../../../../../../entry-lock-D_Og9Gy3.mjs";
+import { t as invalidateRouteCache } from "../../../../../../route-cache-DAG5dPhh.mjs";
 
 //#region src/astro/routes/api/content/[collection]/[id]/unpublish.ts
 const prerender = false;
@@ -49,7 +50,7 @@ const POST = async ({ params, request, locals, url, cache }) => {
 		origin: { source: "api" }
 	});
 	if (!result.success) return unwrapResult(result);
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 	return unwrapResult(result);
 };
 

package/dist/astro/routes/api/content/_collection_/_id_/unpublish.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"unpublish.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/unpublish.ts"],"sourcesContent":["/**\n * Unpublish content - removes from public view, preserves draft\n *\n * POST /_emdash/api/content/{collection}/{id}/unpublish\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentRevisionConditionBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentUnpublish || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst body = await parseOptionalBody(request, contentRevisionConditionBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:publish_own\", \"content:publish_any\");\n\tif (denied) return denied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentUnpublish(collection, resolvedId, {\n\t\t_rev: body?._rev,\n\t\tactor: { id: user!.id, role: user!.role },\n\t\torigin: { source: \"api\" },\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,0BAA0B,CAAC,QAAQ,iBAC/C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,8BAA8B,EAAE,CAAC;AAC/E,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,uBAAuB,sBAAsB;AAC7F,KAAI,OAAQ,QAAO;CAEnB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,uBAAuB,YAAY,YAAY;EAC1E,MAAM,MAAM;EACZ,OAAO;GAAE,IAAI,KAAM;GAAI,MAAM,KAAM;GAAM;EACzC,QAAQ,EAAE,QAAQ,OAAO;EACzB,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}
+{"version":3,"file":"unpublish.mjs","names":[],"sources":["../../../../../../../src/astro/routes/api/content/[collection]/[id]/unpublish.ts"],"sourcesContent":["/**\n * Unpublish content - removes from public view, preserves draft\n *\n * POST /_emdash/api/content/{collection}/{id}/unpublish\n */\n\nimport type { APIRoute } from \"astro\";\n\nimport { requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { isParseError, parseOptionalBody } from \"#api/parse.js\";\nimport { contentRevisionConditionBody } from \"#api/schemas.js\";\nimport { invalidateRouteCache } from \"#cache/route-cache.js\";\n\nexport const prerender = false;\n\nexport const POST: APIRoute = async ({ params, request, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentUnpublish || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst body = await parseOptionalBody(request, contentRevisionConditionBody, {});\n\tif (isParseError(body)) return body;\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst denied = requireOwnerPerm(user, authorId, \"content:publish_own\", \"content:publish_any\");\n\tif (denied) return denied;\n\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body?.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentUnpublish(collection, resolvedId, {\n\t\t_rev: body?._rev,\n\t\tactor: { id: user!.id, role: user!.role },\n\t\torigin: { source: \"api\" },\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tawait invalidateRouteCache(cache, [collection, resolvedId]);\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK,YAAY;CAChF,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,0BAA0B,CAAC,QAAQ,iBAC/C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,OAAO,MAAM,kBAAkB,SAAS,8BAA8B,EAAE,CAAC;AAC/E,KAAI,aAAa,KAAK,CAAE,QAAO;CAE/B,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CACJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,SAAS,iBAAiB,MADf,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IACtC,uBAAuB,sBAAsB;AAC7F,KAAI,OAAQ,QAAO;CAEnB,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,MAAM,cAChB,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,uBAAuB,YAAY,YAAY;EAC1E,MAAM,MAAM;EACZ,OAAO;GAAE,IAAI,KAAM;GAAI,MAAM,KAAM;GAAM;EACzC,QAAQ,EAAE,QAAQ,OAAO;EACzB,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,OAAM,qBAAqB,OAAO,CAAC,YAAY,WAAW,CAAC;AAE3D,QAAO,aAAa,OAAO"}

package/dist/astro/routes/api/content/_collection_/_id_.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/content/[collection]/[id].ts"],"mappings":";;;cAiBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA;AAAA,cAiDL,GAAA,EAAK,QAAA;AAAA,cAoFL,MAAA,EAAQ,QAAA"}
+{"version":3,"file":"_id_.d.mts","names":[],"sources":["../../../../../../src/astro/routes/api/content/[collection]/[id].ts"],"mappings":";;;cAuBa,SAAA;AAAA,cAEA,GAAA,EAAK,QAAA;AAAA,cAiDL,GAAA,EAAK,QAAA;AAAA,cA0FL,MAAA,EAAQ,QAAA"}

package/dist/astro/routes/api/content/_collection_/_id_.mjs

@@ -1,25 +1,26 @@
 import "../../../../../dialect-helpers-7_IqPdh9.mjs";
-import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../config-Cs_AwWXI.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../entry-locks-DJAqVweV.mjs";
-import "../../../../../errors-CjtE5aWF.mjs";
-import { n as mapErrorStatus } from "../../../../../errors-hskQ0C8G.mjs";
-import "../../../../../settings-GaZ5sVgg.mjs";
-import "../../../../../site-settings-CDdT4mVm.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
-import { n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
-import "../../../../../redirects-DFT7Wr-e.mjs";
-import { qt as contentUpdateBody } from "../../../../../entry-lock-Cjz0h45X.mjs";
-import "../../../../../media-CRKsKlfK.mjs";
-import "../../../../../comments-BzmIKVb2.mjs";
-import "../../../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../../../menus-D1HC8npj.mjs";
-import "../../../../../status-Dl85BK39.mjs";
+import "../../../../../url-DTfGDJhI.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import "../../../../../entry-locks-Cp8_BcQQ.mjs";
+import "../../../../../errors-DlJwot7q.mjs";
+import { n as mapErrorStatus } from "../../../../../errors-BMaCpLeS.mjs";
+import "../../../../../settings-B3ZmPF_8.mjs";
+import "../../../../../site-settings-uPkW0e6o.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CT2SsX5S.mjs";
+import { n as parseBody, t as isParseError } from "../../../../../parse-2W-E2f7w.mjs";
+import "../../../../../redirects-BA_TvtuH.mjs";
+import { qt as contentUpdateBody } from "../../../../../entry-lock-DDuWaAiP.mjs";
+import "../../../../../media-qTTHVkls.mjs";
+import "../../../../../comments-DVjWJm8X.mjs";
+import "../../../../../byline-fields-B1qHvRps.mjs";
+import "../../../../../menus-BI6oBXco.mjs";
+import "../../../../../status-DSURZwKS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { i as requirePerm, r as requireOwnerPerm } from "../../../../../authorize-TdIGpRSE.mjs";
-import { t as claimEntryLockForWrite } from "../../../../../entry-lock-B4n0HdQ_.mjs";
+import { a as requireOwnerPerm, i as requireEntryEditPerm, n as entryEditAccess, o as requirePerm } from "../../../../../authorize-CoDsRRp5.mjs";
+import { t as claimEntryLockForWrite } from "../../../../../entry-lock-D_Og9Gy3.mjs";
+import { t as invalidateRouteCache } from "../../../../../route-cache-DAG5dPhh.mjs";
 import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/[id].ts
@@ -64,8 +65,14 @@ const PUT = async ({ params, request, locals, cache }) => {
 	if (!existing.success) return apiError(existing.error?.code ?? "UNKNOWN_ERROR", existing.error?.message ?? "Unknown error", mapErrorStatus(existing.error?.code));
 	const existingData = existing.data && typeof existing.data === "object" ? existing.data : void 0;
 	const existingItem = existingData?.item && typeof existingData.item === "object" ? existingData.item : existingData;
-	const editDenied = requireOwnerPerm(user, typeof existingItem?.authorId === "string" ? existingItem.authorId : "", "content:edit_own", "content:edit_any");
+	const entry = {
+		authorId: typeof existingItem?.authorId === "string" ? existingItem.authorId : "",
+		status: existingItem?.status
+	};
+	const editDenied = requireEntryEditPerm(user, entry);
 	if (editDenied) return editDenied;
+	const checkedRev = typeof existingData?._rev === "string" ? existingData._rev : void 0;
+	const rev = entryEditAccess(user, entry) === "draft" ? body._rev ?? checkedRev : body._rev;
 	if (body.publishedAt !== void 0 && !hasPermission(user, "content:publish_any")) return apiError("FORBIDDEN", "Writing publishedAt requires content:publish_any permission", 403);
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user.id, { override: body.overrideLock });
@@ -81,11 +88,11 @@ const PUT = async ({ params, request, locals, cache }) => {
 	const result = await emdash.handleContentUpdate(collection, resolvedId, {
 		...writeBody,
 		locale,
-		_rev: body._rev,
+		_rev: rev,
 		actor
 	});
 	if (!result.success) return unwrapResult(result);
-	if (cache?.enabled && result.liveContentChanged !== false) await cache.invalidate({ tags: [collection, resolvedId] });
+	if (result.liveContentChanged !== false) await invalidateRouteCache(cache, [collection, resolvedId]);
 	return unwrapResult(result);
 };
 const DELETE = async ({ params, locals, url, cache }) => {
@@ -105,7 +112,7 @@ const DELETE = async ({ params, locals, url, cache }) => {
 	if (refusal) return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), { ...refusal.details });
 	const result = await emdash.handleContentDelete(collection, resolvedId);
 	if (!result.success) return unwrapResult(result);
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 	return unwrapResult(result);
 };
 

package/dist/astro/routes/api/content/_collection_/_id_.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/content/[collection]/[id].ts"],"sourcesContent":["/**\n * Single content item endpoints - injected by EmDash integration\n *\n * GET    /_emdash/api/content/{collection}/{id} - Get content\n * PUT    /_emdash/api/content/{collection}/{id} - Update content\n * DELETE /_emdash/api/content/{collection}/{id} - Delete content\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm, requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { parseBody, isParseError } from \"#api/parse.js\";\nimport { contentUpdateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, url, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\tconst result = await emdash.handleContentGet(collection, id, locale, {\n\t\tincludeDrafts: hasPermission(user, \"content:read_drafts\"),\n\t});\n\n\t// Hide non-published items from users without content:read_drafts. Return\n\t// 404 (not 403) so subscribers can't enumerate draft IDs by status code.\n\tif (result.success && !hasPermission(user, \"content:read_drafts\")) {\n\t\tconst data =\n\t\t\tresult.data && typeof result.data === \"object\"\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check\n\t\t\t\t\t(result.data as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\tconst item =\n\t\t\tdata?.item && typeof data.item === \"object\"\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check\n\t\t\t\t\t(data.item as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\tconst status = typeof item?.status === \"string\" ? item.status : null;\n\t\tif (status !== \"published\") {\n\t\t\treturn apiError(\"NOT_FOUND\", `Content item not found: ${id}`, 404);\n\t\t}\n\n\t\t// Strip draft hydration data from response for users without read_drafts.\n\t\t// handleContentGet overlays draft revision data onto item.data and exposes\n\t\t// the published values in item.liveData. Without this, subscribers see\n\t\t// unpublished edits in the data field.\n\t\tif (item) {\n\t\t\tif (item.liveData && typeof item.liveData === \"object\") {\n\t\t\t\titem.data = item.liveData;\n\t\t\t}\n\t\t\tdelete item.liveData;\n\t\t\tdelete item.draftRevisionId;\n\t\t}\n\t}\n\n\treturn unwrapResult(result);\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst locale = new URL(request.url).searchParams.get(\"locale\") || undefined;\n\tconst body = await parseBody(request, contentUpdateBody);\n\tif (isParseError(body)) return body;\n\n\tif (!emdash?.handleContentUpdate || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership and ID resolution\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst editDenied = requireOwnerPerm(user, authorId, \"content:edit_own\", \"content:edit_any\");\n\tif (editDenied) return editDenied;\n\n\t// Only EDITOR+ can write publishedAt directly — incl. clearing to null.\n\tif (body.publishedAt !== undefined && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Writing publishedAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\t// Use the resolved ID (handles slug → ID resolution)\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\t// Only allow authorId changes if user has content:edit_any permission (editor+)\n\tconst canChangeAuthor =\n\t\tbody.authorId !== undefined && user && hasPermission(user, \"content:edit_any\");\n\tconst { overrideLock: _overrideLock, ...writeBody } = canChangeAuthor\n\t\t? body\n\t\t: { ...body, authorId: undefined };\n\n\tconst actor = user ? { id: user.id, role: user.role } : undefined;\n\n\t// Pass _rev through for optimistic concurrency validation\n\tconst result = await emdash.handleContentUpdate(collection, resolvedId, {\n\t\t...writeBody,\n\t\tlocale,\n\t\t_rev: body._rev,\n\t\tactor,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled && result.liveContentChanged !== false) {\n\t\tawait cache.invalidate({ tags: [collection, resolvedId] });\n\t}\n\n\treturn unwrapResult(result);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDelete || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst deleteData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership and ID resolution\n\tconst deleteItem =\n\t\tdeleteData?.item && typeof deleteData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(deleteData.item as Record<string, unknown>)\n\t\t\t: deleteData;\n\tconst authorId = typeof deleteItem?.authorId === \"string\" ? deleteItem.authorId : \"\";\n\tconst deleteDenied = requireOwnerPerm(user, authorId, \"content:delete_own\", \"content:delete_any\");\n\tif (deleteDenied) return deleteDenied;\n\n\t// Use the resolved ID (handles slug → ID resolution)\n\tconst resolvedId = typeof deleteItem?.id === \"string\" ? deleteItem.id : id;\n\n\t// DELETE carries no body, so the lock opt-out rides on the query string.\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: url.searchParams.get(\"overrideLock\") === \"true\",\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentDelete(collection, resolvedId);\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,KAAK,aAAa;CAC/D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAEjD,MAAM,SAAS,MAAM,OAAO,iBAAiB,YAAY,IAAI,QAAQ,EACpE,eAAe,cAAc,MAAM,sBAAsB,EACzD,CAAC;AAIF,KAAI,OAAO,WAAW,CAAC,cAAc,MAAM,sBAAsB,EAAE;EAClE,MAAM,OACL,OAAO,QAAQ,OAAO,OAAO,SAAS,WAEnC,OAAO,OACP;EACJ,MAAM,OACL,MAAM,QAAQ,OAAO,KAAK,SAAS,WAEhC,KAAK,OACL;AAEJ,OADe,OAAO,MAAM,WAAW,WAAW,KAAK,SAAS,UACjD,YACd,QAAO,SAAS,aAAa,2BAA2B,MAAM,IAAI;AAOnE,MAAI,MAAM;AACT,OAAI,KAAK,YAAY,OAAO,KAAK,aAAa,SAC7C,MAAK,OAAO,KAAK;AAElB,UAAO,KAAK;AACZ,UAAO,KAAK;;;AAId,QAAO,aAAa,OAAO;;AAG5B,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC1E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,SAAS,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,IAAI,SAAS,IAAI;CAClE,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,KAAI,aAAa,KAAK,CAAE,QAAO;AAE/B,KAAI,CAAC,QAAQ,uBAAuB,CAAC,QAAQ,iBAC5C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,aAAa,iBAAiB,MADnB,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW,IAClC,oBAAoB,mBAAmB;AAC3F,KAAI,WAAY,QAAO;AAGvB,KAAI,KAAK,gBAAgB,UAAa,CAAC,cAAc,MAAM,sBAAsB,CAChF,QAAO,SACN,aACA,+DACA,IACA;CAIF,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,KAAK,cACf,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAMH,MAAM,EAAE,cAAc,eAAe,GAAG,cADvC,KAAK,aAAa,UAAa,QAAQ,cAAc,MAAM,mBAAmB,GAE5E,OACA;EAAE,GAAG;EAAM,UAAU;EAAW;CAEnC,MAAM,QAAQ,OAAO;EAAE,IAAI,KAAK;EAAI,MAAM,KAAK;EAAM,GAAG;CAGxD,MAAM,SAAS,MAAM,OAAO,oBAAoB,YAAY,YAAY;EACvE,GAAG;EACH;EACA,MAAM,KAAK;EACX;EACA,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,WAAW,OAAO,uBAAuB,MACnD,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAG3D,QAAO,aAAa,OAAO;;AAG5B,MAAa,SAAmB,OAAO,EAAE,QAAQ,QAAQ,KAAK,YAAY;CACzE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,uBAAuB,CAAC,QAAQ,iBAC5C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,aACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,aACL,YAAY,QAAQ,OAAO,WAAW,SAAS,WAE5C,WAAW,OACX;CAEJ,MAAM,eAAe,iBAAiB,MADrB,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW,IAC5B,sBAAsB,qBAAqB;AACjG,KAAI,aAAc,QAAO;CAGzB,MAAM,aAAa,OAAO,YAAY,OAAO,WAAW,WAAW,KAAK;CAGxE,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,IAAI,aAAa,IAAI,eAAe,KAAK,QACnD,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,oBAAoB,YAAY,WAAW;AAEvE,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,WAAW,EAAE,CAAC;AAE9E,QAAO,aAAa,OAAO"}
+{"version":3,"file":"_id_.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/content/[collection]/[id].ts"],"sourcesContent":["/**\n * Single content item endpoints - injected by EmDash integration\n *\n * GET    /_emdash/api/content/{collection}/{id} - Get content\n * PUT    /_emdash/api/content/{collection}/{id} - Update content\n * DELETE /_emdash/api/content/{collection}/{id} - Delete content\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport {\n\tentryEditAccess,\n\trequireEntryEditPerm,\n\trequireOwnerPerm,\n\trequirePerm,\n} from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { claimEntryLockForWrite } from \"#api/handlers/entry-lock.js\";\nimport { parseBody, isParseError } from \"#api/parse.js\";\nimport { contentUpdateBody } from \"#api/schemas.js\";\nimport { invalidateRouteCache } from \"#cache/route-cache.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, url, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\tconst result = await emdash.handleContentGet(collection, id, locale, {\n\t\tincludeDrafts: hasPermission(user, \"content:read_drafts\"),\n\t});\n\n\t// Hide non-published items from users without content:read_drafts. Return\n\t// 404 (not 403) so subscribers can't enumerate draft IDs by status code.\n\tif (result.success && !hasPermission(user, \"content:read_drafts\")) {\n\t\tconst data =\n\t\t\tresult.data && typeof result.data === \"object\"\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check\n\t\t\t\t\t(result.data as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\tconst item =\n\t\t\tdata?.item && typeof data.item === \"object\"\n\t\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check\n\t\t\t\t\t(data.item as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\tconst status = typeof item?.status === \"string\" ? item.status : null;\n\t\tif (status !== \"published\") {\n\t\t\treturn apiError(\"NOT_FOUND\", `Content item not found: ${id}`, 404);\n\t\t}\n\n\t\t// Strip draft hydration data from response for users without read_drafts.\n\t\t// handleContentGet overlays draft revision data onto item.data and exposes\n\t\t// the published values in item.liveData. Without this, subscribers see\n\t\t// unpublished edits in the data field.\n\t\tif (item) {\n\t\t\tif (item.liveData && typeof item.liveData === \"object\") {\n\t\t\t\titem.data = item.liveData;\n\t\t\t}\n\t\t\tdelete item.liveData;\n\t\t\tdelete item.draftRevisionId;\n\t\t}\n\t}\n\n\treturn unwrapResult(result);\n};\n\nexport const PUT: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\tconst locale = new URL(request.url).searchParams.get(\"locale\") || undefined;\n\tconst body = await parseBody(request, contentUpdateBody);\n\tif (isParseError(body)) return body;\n\n\tif (!emdash?.handleContentUpdate || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst existingData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership and ID resolution\n\tconst existingItem =\n\t\texistingData?.item && typeof existingData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(existingData.item as Record<string, unknown>)\n\t\t\t: existingData;\n\tconst authorId = typeof existingItem?.authorId === \"string\" ? existingItem.authorId : \"\";\n\tconst entry = { authorId, status: existingItem?.status };\n\tconst editDenied = requireEntryEditPerm(user, entry);\n\tif (editDenied) return editDenied;\n\t// A draft-only grant covers the entry only while it is a draft. Conditioning\n\t// the save on the checked revision makes it fail if the entry is published\n\t// between this check and the write.\n\tconst checkedRev = typeof existingData?._rev === \"string\" ? existingData._rev : undefined;\n\tconst rev = entryEditAccess(user, entry) === \"draft\" ? (body._rev ?? checkedRev) : body._rev;\n\n\t// Only EDITOR+ can write publishedAt directly — incl. clearing to null.\n\tif (body.publishedAt !== undefined && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Writing publishedAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\t// Use the resolved ID (handles slug → ID resolution)\n\tconst resolvedId = typeof existingItem?.id === \"string\" ? existingItem.id : id;\n\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: body.overrideLock,\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\t// Only allow authorId changes if user has content:edit_any permission (editor+)\n\tconst canChangeAuthor =\n\t\tbody.authorId !== undefined && user && hasPermission(user, \"content:edit_any\");\n\tconst { overrideLock: _overrideLock, ...writeBody } = canChangeAuthor\n\t\t? body\n\t\t: { ...body, authorId: undefined };\n\n\tconst actor = user ? { id: user.id, role: user.role } : undefined;\n\n\t// Pass _rev through for optimistic concurrency validation\n\tconst result = await emdash.handleContentUpdate(collection, resolvedId, {\n\t\t...writeBody,\n\t\tlocale,\n\t\t_rev: rev,\n\t\tactor,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (result.liveContentChanged !== false) {\n\t\tawait invalidateRouteCache(cache, [collection, resolvedId]);\n\t}\n\n\treturn unwrapResult(result);\n};\n\nexport const DELETE: APIRoute = async ({ params, locals, url, cache }) => {\n\tconst { emdash, user } = locals;\n\tconst collection = params.collection!;\n\tconst id = params.id!;\n\n\tif (!emdash?.handleContentDelete || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\n\tconst locale = url.searchParams.get(\"locale\") || undefined;\n\n\t// Fetch item to check ownership\n\tconst existing = await emdash.handleContentGet(collection, id, locale);\n\tif (!existing.success) {\n\t\treturn apiError(\n\t\t\texisting.error?.code ?? \"UNKNOWN_ERROR\",\n\t\t\texisting.error?.message ?? \"Unknown error\",\n\t\t\tmapErrorStatus(existing.error?.code),\n\t\t);\n\t}\n\n\tconst deleteData =\n\t\texisting.data && typeof existing.data === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above\n\t\t\t\t(existing.data as Record<string, unknown>)\n\t\t\t: undefined;\n\t// Handler returns { item, _rev } — extract the item for ownership and ID resolution\n\tconst deleteItem =\n\t\tdeleteData?.item && typeof deleteData.item === \"object\"\n\t\t\t? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above\n\t\t\t\t(deleteData.item as Record<string, unknown>)\n\t\t\t: deleteData;\n\tconst authorId = typeof deleteItem?.authorId === \"string\" ? deleteItem.authorId : \"\";\n\tconst deleteDenied = requireOwnerPerm(user, authorId, \"content:delete_own\", \"content:delete_any\");\n\tif (deleteDenied) return deleteDenied;\n\n\t// Use the resolved ID (handles slug → ID resolution)\n\tconst resolvedId = typeof deleteItem?.id === \"string\" ? deleteItem.id : id;\n\n\t// DELETE carries no body, so the lock opt-out rides on the query string.\n\tconst refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {\n\t\toverride: url.searchParams.get(\"overrideLock\") === \"true\",\n\t});\n\tif (refusal) {\n\t\treturn apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {\n\t\t\t...refusal.details,\n\t\t});\n\t}\n\n\tconst result = await emdash.handleContentDelete(collection, resolvedId);\n\n\tif (!result.success) return unwrapResult(result);\n\n\tawait invalidateRouteCache(cache, [collection, resolvedId]);\n\n\treturn unwrapResult(result);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,KAAK,aAAa;CAC/D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,iBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAEjD,MAAM,SAAS,MAAM,OAAO,iBAAiB,YAAY,IAAI,QAAQ,EACpE,eAAe,cAAc,MAAM,sBAAsB,EACzD,CAAC;AAIF,KAAI,OAAO,WAAW,CAAC,cAAc,MAAM,sBAAsB,EAAE;EAClE,MAAM,OACL,OAAO,QAAQ,OAAO,OAAO,SAAS,WAEnC,OAAO,OACP;EACJ,MAAM,OACL,MAAM,QAAQ,OAAO,KAAK,SAAS,WAEhC,KAAK,OACL;AAEJ,OADe,OAAO,MAAM,WAAW,WAAW,KAAK,SAAS,UACjD,YACd,QAAO,SAAS,aAAa,2BAA2B,MAAM,IAAI;AAOnE,MAAI,MAAM;AACT,OAAI,KAAK,YAAY,OAAO,KAAK,aAAa,SAC7C,MAAK,OAAO,KAAK;AAElB,UAAO,KAAK;AACZ,UAAO,KAAK;;;AAId,QAAO,aAAa,OAAO;;AAG5B,MAAa,MAAgB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC1E,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;CAClB,MAAM,SAAS,IAAI,IAAI,QAAQ,IAAI,CAAC,aAAa,IAAI,SAAS,IAAI;CAClE,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,KAAI,aAAa,KAAK,CAAE,QAAO;AAE/B,KAAI,CAAC,QAAQ,uBAAuB,CAAC,QAAQ,iBAC5C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAIpE,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,eACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,eACL,cAAc,QAAQ,OAAO,aAAa,SAAS,WAEhD,aAAa,OACb;CAEJ,MAAM,QAAQ;EAAE,UADC,OAAO,cAAc,aAAa,WAAW,aAAa,WAAW;EAC5D,QAAQ,cAAc;EAAQ;CACxD,MAAM,aAAa,qBAAqB,MAAM,MAAM;AACpD,KAAI,WAAY,QAAO;CAIvB,MAAM,aAAa,OAAO,cAAc,SAAS,WAAW,aAAa,OAAO;CAChF,MAAM,MAAM,gBAAgB,MAAM,MAAM,KAAK,UAAW,KAAK,QAAQ,aAAc,KAAK;AAGxF,KAAI,KAAK,gBAAgB,UAAa,CAAC,cAAc,MAAM,sBAAsB,CAChF,QAAO,SACN,aACA,+DACA,IACA;CAIF,MAAM,aAAa,OAAO,cAAc,OAAO,WAAW,aAAa,KAAK;CAE5E,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,KAAK,cACf,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAMH,MAAM,EAAE,cAAc,eAAe,GAAG,cADvC,KAAK,aAAa,UAAa,QAAQ,cAAc,MAAM,mBAAmB,GAE5E,OACA;EAAE,GAAG;EAAM,UAAU;EAAW;CAEnC,MAAM,QAAQ,OAAO;EAAE,IAAI,KAAK;EAAI,MAAM,KAAK;EAAM,GAAG;CAGxD,MAAM,SAAS,MAAM,OAAO,oBAAoB,YAAY,YAAY;EACvE,GAAG;EACH;EACA,MAAM;EACN;EACA,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,uBAAuB,MACjC,OAAM,qBAAqB,OAAO,CAAC,YAAY,WAAW,CAAC;AAG5D,QAAO,aAAa,OAAO;;AAG5B,MAAa,SAAmB,OAAO,EAAE,QAAQ,QAAQ,KAAK,YAAY;CACzE,MAAM,EAAE,QAAQ,SAAS;CACzB,MAAM,aAAa,OAAO;CAC1B,MAAM,KAAK,OAAO;AAElB,KAAI,CAAC,QAAQ,uBAAuB,CAAC,QAAQ,iBAC5C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAGpE,MAAM,SAAS,IAAI,aAAa,IAAI,SAAS,IAAI;CAGjD,MAAM,WAAW,MAAM,OAAO,iBAAiB,YAAY,IAAI,OAAO;AACtE,KAAI,CAAC,SAAS,QACb,QAAO,SACN,SAAS,OAAO,QAAQ,iBACxB,SAAS,OAAO,WAAW,iBAC3B,eAAe,SAAS,OAAO,KAAK,CACpC;CAGF,MAAM,aACL,SAAS,QAAQ,OAAO,SAAS,SAAS,WAEvC,SAAS,OACT;CAEJ,MAAM,aACL,YAAY,QAAQ,OAAO,WAAW,SAAS,WAE5C,WAAW,OACX;CAEJ,MAAM,eAAe,iBAAiB,MADrB,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW,IAC5B,sBAAsB,qBAAqB;AACjG,KAAI,aAAc,QAAO;CAGzB,MAAM,aAAa,OAAO,YAAY,OAAO,WAAW,WAAW,KAAK;CAGxE,MAAM,UAAU,MAAM,uBAAuB,OAAO,IAAI,YAAY,YAAY,KAAM,IAAI,EACzF,UAAU,IAAI,aAAa,IAAI,eAAe,KAAK,QACnD,CAAC;AACF,KAAI,QACH,QAAO,SAAS,QAAQ,MAAM,QAAQ,SAAS,eAAe,QAAQ,KAAK,EAAE,EAC5E,GAAG,QAAQ,SACX,CAAC;CAGH,MAAM,SAAS,MAAM,OAAO,oBAAoB,YAAY,WAAW;AAEvE,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,OAAM,qBAAqB,OAAO,CAAC,YAAY,WAAW,CAAC;AAE3D,QAAO,aAAa,OAAO"}

package/dist/astro/routes/api/content/_collection_/authors.mjs

@@ -1,9 +1,9 @@
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CjtE5aWF.mjs";
-import "../../../../../errors-hskQ0C8G.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
-import { i as requirePerm } from "../../../../../authorize-TdIGpRSE.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import "../../../../../errors-DlJwot7q.mjs";
+import "../../../../../errors-BMaCpLeS.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CT2SsX5S.mjs";
+import { o as requirePerm } from "../../../../../authorize-CoDsRRp5.mjs";
 
 //#region src/astro/routes/api/content/[collection]/authors.ts
 const prerender = false;

package/dist/astro/routes/api/content/_collection_/index.mjs

@@ -1,22 +1,22 @@
-import "../../../../../config-CvmjJcVw.mjs";
+import "../../../../../config-Cs_AwWXI.mjs";
 import "../../../../../base64-BQBZwXCx.mjs";
-import "../../../../../url-Dn3IStq8.mjs";
-import "../../../../../types-C-Xp0CcN.mjs";
-import "../../../../../errors-CjtE5aWF.mjs";
-import { n as mapErrorStatus } from "../../../../../errors-hskQ0C8G.mjs";
-import "../../../../../settings-GaZ5sVgg.mjs";
-import "../../../../../site-settings-CDdT4mVm.mjs";
-import { a as unwrapResult, t as apiError } from "../../../../../error-DxgQdaZ_.mjs";
-import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-Cn5aSk1N.mjs";
-import "../../../../../redirects-DFT7Wr-e.mjs";
-import { Mt as contentListQuery, kt as contentCreateBody } from "../../../../../entry-lock-Cjz0h45X.mjs";
-import "../../../../../media-CRKsKlfK.mjs";
-import "../../../../../comments-BzmIKVb2.mjs";
-import "../../../../../byline-fields-Bze3ZdAw.mjs";
-import "../../../../../menus-D1HC8npj.mjs";
-import "../../../../../status-Dl85BK39.mjs";
+import "../../../../../url-DTfGDJhI.mjs";
+import "../../../../../types-DwhEvIVb.mjs";
+import "../../../../../errors-DlJwot7q.mjs";
+import { n as mapErrorStatus } from "../../../../../errors-BMaCpLeS.mjs";
+import "../../../../../settings-B3ZmPF_8.mjs";
+import "../../../../../site-settings-uPkW0e6o.mjs";
+import { a as unwrapResult, t as apiError } from "../../../../../error-CT2SsX5S.mjs";
+import { i as parseQuery, n as parseBody, t as isParseError } from "../../../../../parse-2W-E2f7w.mjs";
+import "../../../../../redirects-BA_TvtuH.mjs";
+import { Mt as contentListQuery, kt as contentCreateBody } from "../../../../../entry-lock-DDuWaAiP.mjs";
+import "../../../../../media-qTTHVkls.mjs";
+import "../../../../../comments-DVjWJm8X.mjs";
+import "../../../../../byline-fields-B1qHvRps.mjs";
+import "../../../../../menus-BI6oBXco.mjs";
+import "../../../../../status-DSURZwKS.mjs";
 import "../../../../../api/schemas/index.mjs";
-import { i as requirePerm, r as requireOwnerPerm } from "../../../../../authorize-TdIGpRSE.mjs";
+import { a as requireOwnerPerm, o as requirePerm } from "../../../../../authorize-CoDsRRp5.mjs";
 import { hasPermission } from "@emdash-cms/auth";
 
 //#region src/astro/routes/api/content/[collection]/index.ts
@@ -41,7 +41,7 @@ const GET = async ({ params, url, locals }) => {
 	};
 	return unwrapResult(await emdash.handleContentList(collection, params_));
 };
-const POST = async ({ params, request, locals, cache }) => {
+const POST = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	if (!emdash?.handleContentCreate || !emdash?.handleContentGet) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	const denied = requirePerm(user, "content:create");
@@ -60,16 +60,13 @@ const POST = async ({ params, request, locals, cache }) => {
 		id: user.id,
 		role: user.role
 	} : void 0;
-	const result = await emdash.handleContentCreate(collection, {
+	return unwrapResult(await emdash.handleContentCreate(collection, {
 		...body,
 		authorId: user?.id,
 		locale: body.locale,
 		translationOf: body.translationOf,
 		actor
-	});
-	if (!result.success) return unwrapResult(result);
-	if (cache?.enabled) await cache.invalidate({ tags: [collection] });
-	return unwrapResult(result, 201);
+	}), 201);
 };
 
 //#endregion

package/dist/astro/routes/api/content/_collection_/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/content/[collection]/index.ts"],"sourcesContent":["/**\n * Content list and create endpoints - injected by EmDash integration\n *\n * GET  /_emdash/api/content/{collection} - List content\n * POST /_emdash/api/content/{collection} - Create content\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm, requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { parseBody, parseQuery, isParseError } from \"#api/parse.js\";\nimport { contentListQuery, contentCreateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, url, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst query = parseQuery(url, contentListQuery);\n\tif (isParseError(query)) return query;\n\n\t// Subscribers must only see published content; force the status filter\n\t// regardless of caller-supplied value. Any user with content:read_drafts\n\t// (CONTRIBUTOR+) keeps the requested filter.\n\tconst params_ = hasPermission(user, \"content:read_drafts\")\n\t\t? query\n\t\t: { ...query, status: \"published\" };\n\n\tconst result = await emdash.handleContentList(collection, params_);\n\n\treturn unwrapResult(result);\n};\n\nexport const POST: APIRoute = async ({ params, request, locals, cache }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentCreate || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:create\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst body = await parseBody(request, contentCreateBody);\n\tif (isParseError(body)) return body;\n\n\t// Creating a translation requires edit permission on the source item\n\tif (body.translationOf) {\n\t\tconst source = await emdash.handleContentGet(collection, body.translationOf);\n\t\tif (!source.success) {\n\t\t\treturn apiError(\n\t\t\t\tsource.error?.code ?? \"NOT_FOUND\",\n\t\t\t\tsource.error?.message ?? \"Translation source not found\",\n\t\t\t\tmapErrorStatus(source.error?.code),\n\t\t\t);\n\t\t}\n\t\tconst sourceAuthor = source.data.item.authorId ?? \"\";\n\t\tconst translationDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\tsourceAuthor,\n\t\t\t\"content:edit_own\",\n\t\t\t\"content:edit_any\",\n\t\t);\n\t\tif (translationDenied) return translationDenied;\n\t}\n\n\t// Only EDITOR+ can write publishedAt / createdAt directly — incl. clearing to null.\n\tconst hasDateOverride = body.publishedAt !== undefined || body.createdAt !== undefined;\n\tif (hasDateOverride && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Writing publishedAt or createdAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\tconst actor = user ? { id: user.id, role: user.role } : undefined;\n\n\t// Auto-set authorId to current user when creating content\n\tconst result = await emdash.handleContentCreate(collection, {\n\t\t...body,\n\t\tauthorId: user?.id,\n\t\tlocale: body.locale,\n\t\ttranslationOf: body.translationOf,\n\t\tactor,\n\t});\n\n\tif (!result.success) return unwrapResult(result);\n\n\tif (cache?.enabled) await cache.invalidate({ tags: [collection] });\n\n\treturn unwrapResult(result, 201);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,KAAK,aAAa;CAC/D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,kBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,QAAQ,WAAW,KAAK,iBAAiB;AAC/C,KAAI,aAAa,MAAM,CAAE,QAAO;CAKhC,MAAM,UAAU,cAAc,MAAM,sBAAsB,GACvD,QACA;EAAE,GAAG;EAAO,QAAQ;EAAa;AAIpC,QAAO,aAFQ,MAAM,OAAO,kBAAkB,YAAY,QAAQ,CAEvC;;AAG5B,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,QAAQ,YAAY;CAC3E,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,uBAAuB,CAAC,QAAQ,iBAC5C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,KAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,KAAI,KAAK,eAAe;EACvB,MAAM,SAAS,MAAM,OAAO,iBAAiB,YAAY,KAAK,cAAc;AAC5E,MAAI,CAAC,OAAO,QACX,QAAO,SACN,OAAO,OAAO,QAAQ,aACtB,OAAO,OAAO,WAAW,gCACzB,eAAe,OAAO,OAAO,KAAK,CAClC;EAGF,MAAM,oBAAoB,iBACzB,MAFoB,OAAO,KAAK,KAAK,YAAY,IAIjD,oBACA,mBACA;AACD,MAAI,kBAAmB,QAAO;;AAK/B,MADwB,KAAK,gBAAgB,UAAa,KAAK,cAAc,WACtD,CAAC,cAAc,MAAM,sBAAsB,CACjE,QAAO,SACN,aACA,4EACA,IACA;CAGF,MAAM,QAAQ,OAAO;EAAE,IAAI,KAAK;EAAI,MAAM,KAAK;EAAM,GAAG;CAGxD,MAAM,SAAS,MAAM,OAAO,oBAAoB,YAAY;EAC3D,GAAG;EACH,UAAU,MAAM;EAChB,QAAQ,KAAK;EACb,eAAe,KAAK;EACpB;EACA,CAAC;AAEF,KAAI,CAAC,OAAO,QAAS,QAAO,aAAa,OAAO;AAEhD,KAAI,OAAO,QAAS,OAAM,MAAM,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AAElE,QAAO,aAAa,QAAQ,IAAI"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../src/astro/routes/api/content/[collection]/index.ts"],"sourcesContent":["/**\n * Content list and create endpoints - injected by EmDash integration\n *\n * GET  /_emdash/api/content/{collection} - List content\n * POST /_emdash/api/content/{collection} - Create content\n */\n\nimport { hasPermission } from \"@emdash-cms/auth\";\nimport type { APIRoute } from \"astro\";\n\nimport { requirePerm, requireOwnerPerm } from \"#api/authorize.js\";\nimport { apiError, mapErrorStatus, unwrapResult } from \"#api/error.js\";\nimport { parseBody, parseQuery, isParseError } from \"#api/parse.js\";\nimport { contentListQuery, contentCreateBody } from \"#api/schemas.js\";\n\nexport const prerender = false;\n\nexport const GET: APIRoute = async ({ params, url, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentList) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:read\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst query = parseQuery(url, contentListQuery);\n\tif (isParseError(query)) return query;\n\n\t// Subscribers must only see published content; force the status filter\n\t// regardless of caller-supplied value. Any user with content:read_drafts\n\t// (CONTRIBUTOR+) keeps the requested filter.\n\tconst params_ = hasPermission(user, \"content:read_drafts\")\n\t\t? query\n\t\t: { ...query, status: \"published\" };\n\n\tconst result = await emdash.handleContentList(collection, params_);\n\n\treturn unwrapResult(result);\n};\n\nexport const POST: APIRoute = async ({ params, request, locals }) => {\n\tconst { emdash, user } = locals;\n\tif (!emdash?.handleContentCreate || !emdash?.handleContentGet) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\tconst denied = requirePerm(user, \"content:create\");\n\tif (denied) return denied;\n\tconst collection = params.collection!;\n\tconst body = await parseBody(request, contentCreateBody);\n\tif (isParseError(body)) return body;\n\n\t// Creating a translation requires edit permission on the source item\n\tif (body.translationOf) {\n\t\tconst source = await emdash.handleContentGet(collection, body.translationOf);\n\t\tif (!source.success) {\n\t\t\treturn apiError(\n\t\t\t\tsource.error?.code ?? \"NOT_FOUND\",\n\t\t\t\tsource.error?.message ?? \"Translation source not found\",\n\t\t\t\tmapErrorStatus(source.error?.code),\n\t\t\t);\n\t\t}\n\t\tconst sourceAuthor = source.data.item.authorId ?? \"\";\n\t\tconst translationDenied = requireOwnerPerm(\n\t\t\tuser,\n\t\t\tsourceAuthor,\n\t\t\t\"content:edit_own\",\n\t\t\t\"content:edit_any\",\n\t\t);\n\t\tif (translationDenied) return translationDenied;\n\t}\n\n\t// Only EDITOR+ can write publishedAt / createdAt directly — incl. clearing to null.\n\tconst hasDateOverride = body.publishedAt !== undefined || body.createdAt !== undefined;\n\tif (hasDateOverride && !hasPermission(user, \"content:publish_any\")) {\n\t\treturn apiError(\n\t\t\t\"FORBIDDEN\",\n\t\t\t\"Writing publishedAt or createdAt requires content:publish_any permission\",\n\t\t\t403,\n\t\t);\n\t}\n\n\tconst actor = user ? { id: user.id, role: user.role } : undefined;\n\n\t// Auto-set authorId to current user when creating content\n\tconst result = await emdash.handleContentCreate(collection, {\n\t\t...body,\n\t\tauthorId: user?.id,\n\t\tlocale: body.locale,\n\t\ttranslationOf: body.translationOf,\n\t\tactor,\n\t});\n\n\treturn unwrapResult(result, 201);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAa,YAAY;AAEzB,MAAa,MAAgB,OAAO,EAAE,QAAQ,KAAK,aAAa;CAC/D,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,kBACZ,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,eAAe;AAChD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,QAAQ,WAAW,KAAK,iBAAiB;AAC/C,KAAI,aAAa,MAAM,CAAE,QAAO;CAKhC,MAAM,UAAU,cAAc,MAAM,sBAAsB,GACvD,QACA;EAAE,GAAG;EAAO,QAAQ;EAAa;AAIpC,QAAO,aAFQ,MAAM,OAAO,kBAAkB,YAAY,QAAQ,CAEvC;;AAG5B,MAAa,OAAiB,OAAO,EAAE,QAAQ,SAAS,aAAa;CACpE,MAAM,EAAE,QAAQ,SAAS;AACzB,KAAI,CAAC,QAAQ,uBAAuB,CAAC,QAAQ,iBAC5C,QAAO,SAAS,kBAAkB,6BAA6B,IAAI;CAEpE,MAAM,SAAS,YAAY,MAAM,iBAAiB;AAClD,KAAI,OAAQ,QAAO;CACnB,MAAM,aAAa,OAAO;CAC1B,MAAM,OAAO,MAAM,UAAU,SAAS,kBAAkB;AACxD,KAAI,aAAa,KAAK,CAAE,QAAO;AAG/B,KAAI,KAAK,eAAe;EACvB,MAAM,SAAS,MAAM,OAAO,iBAAiB,YAAY,KAAK,cAAc;AAC5E,MAAI,CAAC,OAAO,QACX,QAAO,SACN,OAAO,OAAO,QAAQ,aACtB,OAAO,OAAO,WAAW,gCACzB,eAAe,OAAO,OAAO,KAAK,CAClC;EAGF,MAAM,oBAAoB,iBACzB,MAFoB,OAAO,KAAK,KAAK,YAAY,IAIjD,oBACA,mBACA;AACD,MAAI,kBAAmB,QAAO;;AAK/B,MADwB,KAAK,gBAAgB,UAAa,KAAK,cAAc,WACtD,CAAC,cAAc,MAAM,sBAAsB,CACjE,QAAO,SACN,aACA,4EACA,IACA;CAGF,MAAM,QAAQ,OAAO;EAAE,IAAI,KAAK;EAAI,MAAM,KAAK;EAAM,GAAG;AAWxD,QAAO,aARQ,MAAM,OAAO,oBAAoB,YAAY;EAC3D,GAAG;EACH,UAAU,MAAM;EAChB,QAAQ,KAAK;EACb,eAAe,KAAK;EACpB;EACA,CAAC,EAE0B,IAAI"}