fix(core): separate revision author from entry owner and pass actor to content hooks (#2881)

[emdashbot]

What does this PR do?

Fixes content change attribution so revisions, entry ownership, and hook payloads no longer conflate the acting user.

• The REST content routes and MCP content_update now pass the authenticated actor separately from the entry owner. revisions.author_id is set from the actor when the client does not supply one, so admin saves stop recording NULL authors.
• authorId on content_update changes only ec_{collection}.author_id; the MCP no longer silently reassigns entry ownership on every edit.
• content:beforeSave and content:afterSave hooks now receive event.actor with the acting user's id and role.
• actor is treated as draft-only metadata, so authenticated draft saves that only supply actor metadata do not bump the content version or invalidate public caches.
• Adds regression test at packages/core/tests/integration/content/attribution-2881.test.ts.

Closes #2881.

A candidate change the reporter confirmed against their own site via the preview build:

npm i https://pkg.pr.new/emdash@bot/fix-2881

_{Opened automatically by emdashbot as a draft. A maintainer must review before merge.}

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main.
• I have added and reviewed the user-facing changeset (if this PR changes a published package)
• New features link to an approved Discussion: https://github.com/emdash-cms/emdash/discussions/...
• I have included screenshots below if this PR changes the UI

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: emdashbot + Kimi K2.7 Code

Screenshots / test output

[changeset-bot]

🦋 Changeset detected

Latest commit: 29b53ff

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 18 packages

Name	Type
emdash	Patch
@emdash-cms/plugin-audit-log	Patch
@emdash-cms/cloudflare	Patch
@emdash-cms/sandbox-workerd	Patch
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/admin	Patch
@emdash-cms/auth	Patch
@emdash-cms/blocks	Patch
create-emdash	Patch
@emdash-cms/gutenberg-to-portable-text	Patch
@emdash-cms/x402	Patch
@emdash-cms/auth-atproto	Patch
@emdash-cms/release-service	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://bot-fix-2881.try.emdashcms.com, https://bot-fix-2881-emdash-playground.emdash-cms.workers.dev (commit 29b53ff)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://9e9a3e71.try.emdashcms.com, https://9e9a3e71-emdash-playground.emdash-cms.workers.dev	29b53ff	2026-09-11T11:36:13.374Z	Visit the dashboard ↗
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://4f75872e.try.emdashcms.com, https://4f75872e-emdash-playground.emdash-cms.workers.dev	2b62632	2026-09-10T17:21:51.896Z	Visit the dashboard ↗

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@3057

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@3057

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@3057

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@3057

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@3057

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@3057

emdash

npm i https://pkg.pr.new/emdash@3057

create-emdash

npm i https://pkg.pr.new/create-emdash@3057

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@3057

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@3057

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@3057

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@3057

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@3057

@emdash-cms/registry-moderation

npm i https://pkg.pr.new/@emdash-cms/registry-moderation@3057

@emdash-cms/registry-verification

npm i https://pkg.pr.new/@emdash-cms/registry-verification@3057

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@3057

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@3057

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@3057

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@3057

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@3057

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@3057

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@3057

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@3057

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@3057

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@3057

commit: 29b53ff

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat: make the reference field type merge-ready #2799 (5 shared files)
• feat: reference field type (storage-less edges + admin UI) #1928 (5 shared files)
• feat(core): built-in SMTP email transport for generic SMTP credentials #2156 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	docs	29b53ff	Sep 11 2026, 11:35 AM