@opensaas/stack-core 0.26.0 → 0.27.1

package/src/config/types.ts

@@ -5,14 +5,7 @@ import type { z } from 'zod'
  * Field configuration types
  */
 export type FieldType =
-  | 'text'
-  | 'integer'
-  | 'checkbox'
-  | 'timestamp'
-  | 'password'
-  | 'select'
-  | 'relationship'
-  | string // Allow custom field types from third-party packages
+  'text' | 'integer' | 'checkbox' | 'timestamp' | 'password' | 'select' | 'relationship' | string // Allow custom field types from third-party packages
 
 /**
  * Field-level hook argument types (exported for user annotations)
@@ -1711,11 +1704,11 @@ export type ListConfig<TTypeInfo extends TypeInfo> = {
 /**
  * List-level UI configuration for the admin interface.
  *
- * Mirrors Keystone's `ui` block on a list. Only the list-view defaults
- * (column selection/order and default sort) are supported today; other
- * Keystone concerns (`label`, `labelField`, `description`) are intentionally
- * deferred as they cover different concerns (navigation text and
- * relationship-picker labels rather than list-view defaults).
+ * Mirrors Keystone's `ui` block on a list. List-view defaults (column
+ * selection/order and default sort) and the label field are supported
+ * today; other Keystone concerns (`label`, `description`) are intentionally
+ * deferred as they cover navigation text rather than list-view or
+ * row-labelling defaults.
  */
 export type ListUIConfig = {
   /**
@@ -1723,6 +1716,20 @@ export type ListUIConfig = {
    * Keystone's `ui.listView`.
    */
   listView?: ListViewUIConfig
+  /**
+   * The field used to represent a row as a single label — in relationship
+   * cells, dropdown options, and page headings. Must reference a declared,
+   * non-relationship field on this list.
+   *
+   * When omitted, resolves via `getLabelFieldName`'s fallback order: `name`
+   * → `title` → `id` (first field that exists on the list).
+   *
+   * @example
+   * ```typescript
+   * ui: { labelField: 'email' }
+   * ```
+   */
+  labelField?: string
 }
 
 /**

package/src/context/index.ts

@@ -6,11 +6,13 @@ import {
   filterReadableFields,
   buildIncludeWithAccessControl,
   mergeIncludeWithAccessControl,
+  stripVirtualFieldsFromInclude,
 } from '../access/index.js'
 import { ValidationError, DatabaseError } from '../hooks/index.js'
 import { getDbKey } from '../lib/case-utils.js'
 import type { PrismaClientLike } from '../access/types.js'
 import { buildInclude, pickFields, isFragment } from '../query/index.js'
+import { getRelationshipOptions } from '../query/relationship-options.js'
 import {
   runWritePipeline,
   createWriteStrategy,
@@ -22,6 +24,14 @@ export type ServerActionProps =
   | { listKey: string; action: 'create'; data: Record<string, unknown> }
   | { listKey: string; action: 'update'; id: string; data: Record<string, unknown> }
   | { listKey: string; action: 'delete'; id: string }
+  | {
+      listKey: string
+      action: 'relationshipOptions'
+      field: string
+      search?: string
+      take?: number
+      selectedIds?: string[]
+    }
 
 /**
  * Tracks which (listName, operation) pairs have already warned about an ignored
@@ -239,11 +249,7 @@ function parsePrismaError(error: unknown, listConfig: ListConfig<any>): Error {
  * PostgreSQL — required for the concurrency-sensitive capacity-gate pattern).
  */
 export type TransactionIsolationLevel =
-  | 'ReadUncommitted'
-  | 'ReadCommitted'
-  | 'RepeatableRead'
-  | 'Serializable'
-  | 'Snapshot'
+  'ReadUncommitted' | 'ReadCommitted' | 'RepeatableRead' | 'Serializable' | 'Snapshot'
 
 /**
  * Options for {@link StackContext.transaction}, forwarded verbatim to the
@@ -421,6 +427,26 @@ export function getContext<
     }
 
     try {
+      if (props.action === 'relationshipOptions') {
+        const fieldConfig = listConfig.fields[props.field] as
+          { type?: string; ref?: string } | undefined
+        if (!fieldConfig || fieldConfig.type !== 'relationship' || !fieldConfig.ref) {
+          return {
+            success: false,
+            error: `Field "${props.field}" on list "${props.listKey}" is not a relationship field`,
+          }
+        }
+
+        const relatedListKey = fieldConfig.ref.split('.')[0]
+        const options = await getRelationshipOptions(context, config, relatedListKey, {
+          search: props.search,
+          take: props.take,
+          selectedIds: props.selectedIds,
+        })
+
+        return { success: true, data: options }
+      }
+
       let result: unknown = null
 
       if (props.action === 'create') {
@@ -673,6 +699,10 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
           context,
         },
         config,
+        0,
+        // Seed the cycle guard with the root list so a relationship cycle back
+        // to it (self-referential or longer) stops re-descending.
+        [listName],
       )
       // MERGE (not replace) a caller-supplied include with the access-controlled
       // include: the caller selects WHICH relations to fetch, access control
@@ -688,6 +718,13 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
         : accessControlledInclude
     }
 
+    // Virtual fields have no database column. Whichever path produced
+    // `include` (fragment, access-controlled merge, or sudo passthrough), a
+    // virtual key must never reach Prisma — it would throw "Unknown field"
+    // (#628). The virtual value is still computed unconditionally below by
+    // `filterReadableFields`, independent of what was requested here.
+    include = stripVirtualFieldsFromInclude(include, listConfig.fields, config)
+
     // Execute query with optimized includes
     // Access Prisma model dynamically - required because model names are generated at runtime
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -796,6 +833,10 @@ function createFindMany<TPrisma extends PrismaClientLike>(
           context,
         },
         config,
+        0,
+        // Seed the cycle guard with the root list so a relationship cycle back
+        // to it (self-referential or longer) stops re-descending.
+        [listName],
       )
       // MERGE (not replace) a caller-supplied include with the access-controlled
       // include: the caller selects WHICH relations to fetch, access control
@@ -811,6 +852,13 @@ function createFindMany<TPrisma extends PrismaClientLike>(
         : accessControlledInclude
     }
 
+    // Virtual fields have no database column. Whichever path produced
+    // `include` (fragment, access-controlled merge, or sudo passthrough), a
+    // virtual key must never reach Prisma — it would throw "Unknown field"
+    // (#628). The virtual value is still computed unconditionally below by
+    // `filterReadableFields`, independent of what was requested here.
+    include = stripVirtualFieldsFromInclude(include, listConfig.fields, config)
+
     // Execute query with optimized includes
     // Access Prisma model dynamically - required because model names are generated at runtime
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -1101,6 +1149,10 @@ function createGet<TPrisma extends PrismaClientLike>(
         context,
       },
       config,
+      0,
+      // Seed the cycle guard with the root list so a relationship cycle back
+      // to it (self-referential or longer) stops re-descending.
+      [listName],
     )
 
     // Try to find the record

package/src/context/write-pipeline.ts

@@ -53,8 +53,7 @@ export type WriteOperation = 'create' | 'update' | 'delete'
  *   any input phases, before-hooks, or the DB call.
  */
 export type TargetResolution =
-  | { status: 'ok'; originalItem: Record<string, unknown> | undefined }
-  | { status: 'denied' }
+  { status: 'ok'; originalItem: Record<string, unknown> | undefined } | { status: 'denied' }
 
 /**
  * Minimal dynamic Prisma model surface used by the write pipeline. Model names

package/src/fields/calendar-day.test.ts

@@ -1,7 +1,9 @@
-import { describe, it, expect, expectTypeOf } from 'vitest'
+import { describe, it, expect, expectTypeOf, vi } from 'vitest'
 import { calendarDay } from './index.js'
 import { generateZodSchema, validateWithZod } from '../validation/schema.js'
+import { getContext } from '../context/index.js'
 import type { FieldConfig } from '../config/types.js'
+import type { OpenSaasConfig } from '../config/types.js'
 
 /**
  * calendarDay is a YYYY-MM-DD string end-to-end (Keystone's CalendarDay
@@ -54,7 +56,7 @@ describe('calendarDay field (YYYY-MM-DD string end-to-end)', () => {
     })
   })
 
-  describe('write validation (string-only)', () => {
+  describe('write validation (YYYY-MM-DD string, or a Date post-resolveInput)', () => {
     const fields: Record<string, FieldConfig> = {
       startsOn: calendarDay({ validation: { isRequired: true } }),
     }
@@ -73,15 +75,18 @@ describe('calendarDay field (YYYY-MM-DD string end-to-end)', () => {
       }
     })
 
-    it('rejects a Date instance at runtime (not a string)', () => {
-      // A typed caller cannot reach here (input type is `string`), but the
-      // validator is string-only as a runtime backstop.
+    it('accepts a Date instance (the shape resolveInput produces from a valid string)', () => {
+      // The write pipeline runs field `resolveInput` BEFORE this schema, and
+      // calendarDay's resolveInput turns a valid YYYY-MM-DD string into a UTC
+      // Date (see #621) so Prisma's `@db.Date` write validator accepts it. So
+      // by the time this schema runs, a successful write reaches it as a
+      // Date, not the original string — the schema must accept both shapes.
       const result = validateWithZod(
-        { startsOn: new Date('2025-01-15') } as unknown as Record<string, unknown>,
+        { startsOn: new Date('2025-01-15T00:00:00.000Z') } as unknown as Record<string, unknown>,
         fields,
         'create',
       )
-      expect(result.success).toBe(false)
+      expect(result.success).toBe(true)
     })
 
     it('zod schema for the field validates the YYYY-MM-DD shape', () => {
@@ -91,6 +96,62 @@ describe('calendarDay field (YYYY-MM-DD string end-to-end)', () => {
     })
   })
 
+  describe('write transform (resolveInput coerces YYYY-MM-DD string to a UTC Date, #621)', () => {
+    // The write pipeline calls fieldConfig.hooks.resolveInput({ resolvedData,
+    // fieldKey, ... }) BEFORE zod validation runs. We exercise that hook
+    // directly with the value shapes a caller (or an upstream list-level
+    // resolveInput) can produce.
+    function writeValue(value: unknown): unknown {
+      const field = calendarDay()
+      const hook = field.hooks?.resolveInput
+      if (!hook) throw new Error('calendarDay must define a resolveInput hook')
+      return (
+        hook as unknown as (args: {
+          resolvedData: Record<string, unknown>
+          fieldKey: string
+        }) => unknown
+      )({ resolvedData: { startsOn: value }, fieldKey: 'startsOn' })
+    }
+
+    it('converts a YYYY-MM-DD string to a UTC-midnight Date', () => {
+      const result = writeValue('2025-01-15') as Date
+      expect(result).toBeInstanceOf(Date)
+      expect(result.toISOString()).toBe('2025-01-15T00:00:00.000Z')
+    })
+
+    it('passes an already-Date value through unchanged', () => {
+      const date = new Date('2025-06-01T00:00:00.000Z')
+      expect(writeValue(date)).toBe(date)
+    })
+
+    it('passes null/undefined through unchanged (so isRequired can still reject a missing value)', () => {
+      expect(writeValue(null)).toBeNull()
+      expect(writeValue(undefined)).toBeUndefined()
+    })
+
+    it('leaves a malformed string untouched so zod still rejects it with a clear message', () => {
+      expect(writeValue('15/01/2025')).toBe('15/01/2025')
+    })
+
+    it('reads resolvedData[fieldKey], not inputData — survives a list-level resolveInput default', () => {
+      // A list-level resolveInput can inject a default for an omitted key
+      // into resolvedData before field resolveInput runs. Reading
+      // resolvedData (not the original inputData) here means that injected
+      // default is what gets coerced, instead of being read as `undefined`
+      // and overwriting the injected default with null.
+      const field = calendarDay()
+      const hook = field.hooks?.resolveInput as unknown as (args: {
+        resolvedData: Record<string, unknown>
+        fieldKey: string
+      }) => unknown
+      const result = hook({
+        resolvedData: { startsOn: '2025-03-20' }, // injected by a list-level hook
+        fieldKey: 'startsOn',
+      }) as Date
+      expect(result.toISOString()).toBe('2025-03-20T00:00:00.000Z')
+    })
+  })
+
   describe('read transform (resolveOutput returns a YYYY-MM-DD string)', () => {
     // The read pipeline calls fieldConfig.hooks.resolveOutput({ value, ... }).
     // We exercise that hook directly with the value shapes Prisma can return.
@@ -137,4 +198,94 @@ describe('calendarDay field (YYYY-MM-DD string end-to-end)', () => {
       expect(hook({ value: '2025-01-15' })).toBe('custom:2025-01-15')
     })
   })
+
+  describe('end-to-end via context.db.*.create/update (#621 repro)', () => {
+    // Prisma 7's client validator rejects a bare YYYY-MM-DD string for a
+    // `@db.Date` column. Assert the value actually forwarded to the Prisma
+    // client is a Date, not the string the caller passed in.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- mock Prisma client
+    let mockPrisma: any
+
+    function buildConfig(): OpenSaasConfig {
+      mockPrisma = {
+        event: {
+          findFirst: vi.fn(),
+          findUnique: vi.fn(),
+          findMany: vi.fn(),
+          create: vi.fn(),
+          update: vi.fn(),
+          delete: vi.fn(),
+          count: vi.fn(),
+        },
+      }
+      return {
+        db: {
+          provider: 'postgresql',
+          prismaClientConstructor: (PrismaClient) => new PrismaClient(),
+        },
+        lists: {
+          Event: {
+            fields: {
+              startsOn: calendarDay({ validation: { isRequired: true } }),
+            },
+            access: {
+              operation: {
+                query: () => true,
+                create: () => true,
+                update: () => true,
+                delete: () => true,
+              },
+            },
+          },
+        },
+      }
+    }
+
+    it('create: a YYYY-MM-DD string reaches Prisma as a UTC-midnight Date', async () => {
+      const config = buildConfig()
+      mockPrisma.event.create.mockResolvedValue({
+        id: '1',
+        startsOn: new Date('2025-01-15T00:00:00.000Z'),
+      })
+      const context = await getContext(config, mockPrisma, null)
+
+      await context.db.event.create({ data: { startsOn: '2025-01-15' } })
+
+      expect(mockPrisma.event.create).toHaveBeenCalledTimes(1)
+      const callArgs = mockPrisma.event.create.mock.calls[0][0]
+      expect(callArgs.data.startsOn).toBeInstanceOf(Date)
+      expect((callArgs.data.startsOn as Date).toISOString()).toBe('2025-01-15T00:00:00.000Z')
+    })
+
+    it('update: a YYYY-MM-DD string reaches Prisma as a UTC-midnight Date', async () => {
+      const config = buildConfig()
+      const existing = { id: '1', startsOn: new Date('2025-01-15T00:00:00.000Z') }
+      mockPrisma.event.findUnique.mockResolvedValue(existing)
+      mockPrisma.event.update.mockResolvedValue({
+        ...existing,
+        startsOn: new Date('2025-02-20T00:00:00.000Z'),
+      })
+      const context = await getContext(config, mockPrisma, null)
+
+      await context.db.event.update({ where: { id: '1' }, data: { startsOn: '2025-02-20' } })
+
+      expect(mockPrisma.event.update).toHaveBeenCalledTimes(1)
+      const callArgs = mockPrisma.event.update.mock.calls[0][0]
+      expect(callArgs.data.startsOn).toBeInstanceOf(Date)
+      expect((callArgs.data.startsOn as Date).toISOString()).toBe('2025-02-20T00:00:00.000Z')
+    })
+
+    it('the read result is still normalised back to a YYYY-MM-DD string', async () => {
+      const config = buildConfig()
+      mockPrisma.event.create.mockResolvedValue({
+        id: '1',
+        startsOn: new Date('2025-01-15T00:00:00.000Z'),
+      })
+      const context = await getContext(config, mockPrisma, null)
+
+      const result = await context.db.event.create({ data: { startsOn: '2025-01-15' } })
+
+      expect(result?.startsOn).toBe('2025-01-15')
+    })
+  })
 })

package/src/fields/index.ts

@@ -523,9 +523,13 @@ export function timestamp<
  * - Stores date values only (no time component)
  * - PostgreSQL/MySQL: Uses native DATE type via @db.Date
  * - SQLite: Uses String representation
- * - **Writes:** accept only a `YYYY-MM-DD` string; a malformed string or a
- *   `Date` is rejected at runtime by validation (a `ValidationError`). Genuine
- *   compile-time rejection at the `context.db` call site is tracked in #599.
+ * - **Writes:** pass a `YYYY-MM-DD` string (the declared type). A
+ *   `resolveInput` hook converts a valid string to a UTC-midnight `Date`
+ *   before validation, since Prisma 7's client validator rejects a bare date
+ *   string for a `@db.Date` column (#621); a `Date` is also accepted
+ *   directly. A malformed string is rejected at runtime by validation (a
+ *   `ValidationError`). Genuine compile-time rejection of a `Date` at the
+ *   `context.db` call site is tracked in #599.
  * - **Reads:** always return a `YYYY-MM-DD` string. Even though the underlying
  *   `@db.Date` column hands Prisma a `Date`, a `resolveOutput` transform
  *   normalises it back to a `YYYY-MM-DD` string so the runtime value matches
@@ -573,6 +577,17 @@ export function calendarDay<
   return {
     type: 'calendarDay',
     ...options,
+    // Writes: the write pipeline runs field resolveInput BEFORE zod
+    // validation (Hook Pipeline: field resolveInput → built-in field rules),
+    // so this is the only point a YYYY-MM-DD string can be turned into
+    // something Prisma's `@db.Date` write validator accepts — Prisma 7
+    // rejects a bare date string there (#621). Convert a valid string to a
+    // UTC-midnight Date; leave anything else (a Date already, null/undefined,
+    // or a malformed string) untouched so the zod schema below still rejects
+    // malformed input with a clear message. Reads resolvedData[fieldKey]
+    // (not raw inputData) so a list-level resolveInput that injects a default
+    // for an omitted key is still coerced instead of being overwritten.
+    //
     // Reads: the underlying @db.Date column hands Prisma a Date (or a TEXT
     // string under the SQLite fallback). Normalise to a YYYY-MM-DD string so the
     // runtime value matches the declared `string` type. UTC components are used
@@ -580,6 +595,15 @@ export function calendarDay<
     // Cast hooks to any since field builders are generic and can't know the
     // specific TFieldKey (same pattern as password()).
     hooks: {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Field builder hooks must be generic
+      resolveInput: ({ resolvedData, fieldKey }: { resolvedData: any; fieldKey: string }) => {
+        const value = resolvedData?.[fieldKey]
+        if (value == null || value instanceof Date) return value
+        if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(value)) {
+          return new Date(`${value}T00:00:00.000Z`)
+        }
+        return value
+      },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Field builder hooks must be generic
       resolveOutput: ({ value }: { value: any }) => formatCalendarDay(value),
       // Merge with user-provided hooks if any
@@ -590,15 +614,19 @@ export function calendarDay<
       const validation = options?.validation
       const isRequired = validation?.isRequired
 
-      // Accept ISO8601 date strings (YYYY-MM-DD)
-      const baseSchema = z.string({
-        message: `${formatFieldName(fieldName)} must be a valid date in ISO8601 format (YYYY-MM-DD)`,
-      })
+      // Accept ISO8601 date strings (YYYY-MM-DD) in the shape a caller passes,
+      // or a `Date` — the shape resolveInput above turns a valid string into
+      // before this schema runs. Malformed strings fall through resolveInput
+      // untouched and still fail the regex here with a clear message.
+      const stringSchema = z
+        .string({
+          message: `${formatFieldName(fieldName)} must be a valid date in ISO8601 format (YYYY-MM-DD)`,
+        })
+        .regex(/^\d{4}-\d{2}-\d{2}$/, {
+          message: `${formatFieldName(fieldName)} must be in YYYY-MM-DD format`,
+        })
 
-      // Validate ISO8601 date format (YYYY-MM-DD)
-      const dateSchema = baseSchema.regex(/^\d{4}-\d{2}-\d{2}$/, {
-        message: `${formatFieldName(fieldName)} must be in YYYY-MM-DD format`,
-      })
+      const dateSchema = z.union([stringSchema, z.date()])
 
       if (isRequired && operation === 'create') {
         return dateSchema

package/src/hooks/index.ts

@@ -386,8 +386,7 @@ export async function executeFieldBeforeTransactionHooks(
  *    so hooks can compensate.
  */
 export type TransactionOutcome =
-  | { status: 'committed'; item: Record<string, unknown> }
-  | { status: 'rolled-back'; error: unknown }
+  { status: 'committed'; item: Record<string, unknown> } | { status: 'rolled-back'; error: unknown }
 
 /**
  * Execute field-level afterTransaction hooks (#590 / ADR-0010).

package/src/index.ts

@@ -43,6 +43,11 @@ export type {
 // Naming utilities (documented public helpers; used for URLs and db keys)
 export { getDbKey, getUrlKey, getListKeyFromUrl } from './lib/case-utils.js'
 
+// Label seam — resolves the field that represents a row as a single label
+// (projection) and reads it off a row (render). Used by the admin UI for
+// relationship cells, dropdown options, and page headings.
+export { getLabelFieldName, getItemLabel } from './config/label.js'
+
 // Validation error surfaced by write operations
 export { ValidationError } from './hooks/index.js'
 
@@ -61,3 +66,9 @@ export type { FieldConfigValidationError } from './validation/field-config.js'
 // root surface — those live on '@opensaas/stack-core/internal'.
 export { defineFragment, runQuery, runQueryOne } from './query/index.js'
 export type { ResultOf, RelationSelector, QueryArgs } from './query/index.js'
+
+// Relationship-options read primitive — bounded, projected fetch for
+// relationship editors. Backs the `relationshipOptions` context.serverAction
+// op; also callable directly wherever a full context is already in hand.
+export { getRelationshipOptions } from './query/relationship-options.js'
+export type { RelationshipOption, RelationshipOptionsArgs } from './query/relationship-options.js'

package/src/query/relationship-options.test.ts

@@ -0,0 +1,157 @@
+import { describe, it, expect, vi } from 'vitest'
+import { getRelationshipOptions } from './relationship-options.js'
+import type { QueryRunnerContext } from './index.js'
+import type { OpenSaasConfig } from '../config/types.js'
+
+function makeDelegate(rows: Array<Record<string, unknown>>) {
+  return {
+    findMany: vi.fn(async (_args?: unknown) => rows),
+    findFirst: vi.fn(async (_args?: unknown) => rows[0] ?? null),
+  }
+}
+
+function makeContext(
+  delegates: Record<string, ReturnType<typeof makeDelegate>>,
+): QueryRunnerContext {
+  return { db: delegates }
+}
+
+const authors = [
+  { id: 'a1', name: 'Ada Lovelace' },
+  { id: 'a2', name: 'Alan Turing' },
+  { id: 'a3', name: 'Grace Hopper' },
+]
+
+function makeConfig(): OpenSaasConfig {
+  return {
+    db: { provider: 'sqlite', url: 'file:./test.db' },
+    lists: {
+      Author: {
+        fields: {
+          name: { type: 'text' },
+        },
+        access: { operation: { query: () => true } },
+      },
+      NumericLabel: {
+        fields: {
+          rank: { type: 'integer' },
+        },
+        ui: { labelField: 'rank' },
+        access: { operation: { query: () => true } },
+      },
+    },
+  } as unknown as OpenSaasConfig
+}
+
+describe('getRelationshipOptions', () => {
+  it('returns { id, label }[] via a scalar-only fragment with no nested include', async () => {
+    const delegate = makeDelegate(authors)
+    const context = makeContext({ author: delegate })
+    const config = makeConfig()
+
+    const result = await getRelationshipOptions(context, config, 'Author', {})
+
+    expect(result).toEqual([
+      { id: 'a1', label: 'Ada Lovelace' },
+      { id: 'a2', label: 'Alan Turing' },
+      { id: 'a3', label: 'Grace Hopper' },
+    ])
+
+    const call = delegate.findMany.mock.calls[0][0] as Record<string, unknown>
+    expect(call.include).toBeUndefined()
+  })
+
+  it('bounds the result by take', async () => {
+    const delegate = makeDelegate(authors.slice(0, 2))
+    const context = makeContext({ author: delegate })
+    const config = makeConfig()
+
+    await getRelationshipOptions(context, config, 'Author', { take: 2 })
+
+    expect(delegate.findMany).toHaveBeenCalledWith(expect.objectContaining({ take: 2 }))
+  })
+
+  it('orders by the label field ascending and filters via contains on a text label field', async () => {
+    const delegate = makeDelegate([authors[0]])
+    const context = makeContext({ author: delegate })
+    const config = makeConfig()
+
+    await getRelationshipOptions(context, config, 'Author', { search: 'Ada' })
+
+    expect(delegate.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { name: { contains: 'Ada' } },
+        orderBy: { name: 'asc' },
+      }),
+    )
+  })
+
+  it('does not filter (first-N) when the label field is not a text field', async () => {
+    const rows = [{ id: 'n1', rank: 1 }]
+    const delegate = makeDelegate(rows)
+    const context = makeContext({ numericLabel: delegate })
+    const config = makeConfig()
+
+    await getRelationshipOptions(context, config, 'NumericLabel', { search: '1' })
+
+    const call = delegate.findMany.mock.calls[0][0] as Record<string, unknown>
+    expect(call.where).toBeUndefined()
+    expect(call.orderBy).toEqual({ rank: 'asc' })
+  })
+
+  it('unions currently-selected ids even when beyond take / not matching search', async () => {
+    // The bounded/search-scoped query only returns a1 (mimicking take:1 + search).
+    const primaryDelegate = makeDelegate([authors[0]])
+    const context = makeContext({ author: primaryDelegate })
+    const config = makeConfig()
+
+    // The selected-ids query (a separate findMany call) resolves a3, which fell
+    // outside the primary window.
+    primaryDelegate.findMany.mockImplementationOnce(async () => [authors[0]])
+    primaryDelegate.findMany.mockImplementationOnce(async () => [authors[2]])
+
+    const result = await getRelationshipOptions(context, config, 'Author', {
+      take: 1,
+      selectedIds: ['a3'],
+    })
+
+    expect(result).toEqual([
+      { id: 'a1', label: 'Ada Lovelace' },
+      { id: 'a3', label: 'Grace Hopper' },
+    ])
+
+    const selectedCall = primaryDelegate.findMany.mock.calls[1][0] as Record<string, unknown>
+    expect(selectedCall.where).toEqual({ id: { in: ['a3'] } })
+  })
+
+  it('does not re-query when the selected id is already within the primary window', async () => {
+    const delegate = makeDelegate([authors[0]])
+    const context = makeContext({ author: delegate })
+    const config = makeConfig()
+
+    await getRelationshipOptions(context, config, 'Author', { selectedIds: ['a1'] })
+
+    expect(delegate.findMany).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns [] when the related list query access is denied (findMany returns [])', async () => {
+    const delegate = makeDelegate([])
+    const context = makeContext({ author: delegate })
+    const config = makeConfig()
+
+    const result = await getRelationshipOptions(context, config, 'Author', {
+      selectedIds: ['a1'],
+    })
+
+    expect(result).toEqual([])
+  })
+
+  it('returns [] when the related list does not exist in config', async () => {
+    const context = makeContext({})
+    const config = makeConfig()
+
+    const result = await getRelationshipOptions(context, config, 'Missing', {})
+
+    expect(result).toEqual([])
+  })
+})