emdash 0.16.0 → 0.17.0

package/src/api/handlers/bylines.ts

@@ -1,11 +1,57 @@
 import type { Kysely } from "kysely";
 
-import { BylineRepository, type CreateBylineInput } from "../../database/repositories/byline.js";
-import type { BylineSummary } from "../../database/repositories/types.js";
+import {
+	BylineRepository,
+	type CreateBylineInput,
+	type UpdateBylineInput,
+} from "../../database/repositories/byline.js";
+import { EmDashValidationError, type BylineSummary } from "../../database/repositories/types.js";
 import type { Database } from "../../database/types.js";
 import { getI18nConfig } from "../../i18n/config.js";
 import type { ApiResult } from "../types.js";
 
+// `undefined → null` so a missing field in the create payload matches the
+// repo's stored `null` (BylineRepository normalises with `?? null` on write).
+const norm = (v: string | null | undefined): string | null => v ?? null;
+
+/**
+ * Whether the existing byline row's fixed columns match a fresh-create
+ * payload after null/undefined normalisation. Used by the D1 create-retry
+ * recovery branch.
+ */
+function bylineFixedFieldsMatch(
+	existing: BylineSummary,
+	input: CreateBylineInput,
+	effectiveLocale: string,
+): boolean {
+	return (
+		existing.displayName === input.displayName &&
+		norm(existing.bio) === norm(input.bio) &&
+		norm(existing.avatarMediaId) === norm(input.avatarMediaId) &&
+		norm(existing.websiteUrl) === norm(input.websiteUrl) &&
+		norm(existing.userId) === norm(input.userId) &&
+		existing.isGuest === (input.isGuest ?? false) &&
+		existing.locale === effectiveLocale
+	);
+}
+
+/**
+ * Whether every key in `existing` appears in `input` with the same value.
+ * Allows `input` to contain additional keys (the partial-write recovery
+ * case); rejects on a divergent value or a key the input omits.
+ */
+function existingCustomFieldsAreSubsetOf(
+	existing: Record<string, unknown>,
+	input: Record<string, unknown> | undefined,
+): boolean {
+	if (!input) return Object.keys(existing).length === 0;
+	for (const [slug, value] of Object.entries(existing)) {
+		if (!Object.hasOwn(input, slug)) return false;
+		if (input[slug] !== value) return false;
+	}
+	return true;
+}
+
 /**
  * Reject locales the site doesn't configure. Returns `null` when the locale
  * is fine (omitted, or matches `locales` in the i18n config, or i18n isn't
@@ -135,10 +181,30 @@ export async function handleBylineCreate(
 		}
 
 		// Duplicate guard: same (slug, locale) — matches the DB unique key
-		// added in migration 040. Falls back to the configured defaultLocale
-		// when the caller omits `locale`, mirroring the column DEFAULT.
+		// from migration 040.
 		const existing = await repo.findBySlug(input.slug, { locale: effectiveLocale });
 		if (existing) {
+			// D1 has no transactions, so a crash between the byline insert
+			// and the per-field writes leaves a partial row that's
+			// otherwise unrecoverable. Treat a same-identity retry that
+			// provides customFields as completing the abandoned create.
+			// Recovery requires fixed-column + translation-group +
+			// subset-customFields match; anything else collapses to a
+			// standard duplicate-slug conflict.
+			const expectedTranslationGroup = sourceGroup ?? existing.id;
+			const inputHasFields = !!input.customFields && Object.keys(input.customFields).length > 0;
+			if (
+				inputHasFields &&
+				bylineFixedFieldsMatch(existing, input, effectiveLocale) &&
+				existing.translationGroup === expectedTranslationGroup &&
+				existingCustomFieldsAreSubsetOf(existing.customFields ?? {}, input.customFields)
+			) {
+				const recovered = await repo.update(existing.id, {
+					customFields: input.customFields,
+				});
+				if (recovered) return { success: true, data: recovered };
+			}
+
 			return {
 				success: false,
 				error: {
@@ -152,10 +218,65 @@ export async function handleBylineCreate(
 
 		const byline = await repo.create(input);
 		return { success: true, data: byline };
-	} catch {
+	} catch (error) {
+		// Mirror handleBylineUpdate: surface customFields validation
+		// errors as 400 rather than swallowing them as a generic 500.
+		if (error instanceof EmDashValidationError) {
+			return {
+				success: false,
+				error: { code: "VALIDATION_ERROR", message: error.message },
+			};
+		}
+		console.error("[BYLINE_CREATE_ERROR]", error);
 		return {
 			success: false,
 			error: { code: "BYLINE_CREATE_ERROR", message: "Failed to create byline" },
 		};
 	}
 }
+
+/**
+ * Update an existing byline. Forwards every field on `UpdateBylineInput`
+ * to `BylineRepository.update`, including the Phase 3 `customFields`
+ * map; per-field type validation lives in the repo, which throws
+ * `EmDashValidationError` on unknown slugs, type mismatches, or
+ * `select`-choice misses. This handler translates that into a clean
+ * `VALIDATION_ERROR` (400 via `mapErrorStatus`).
+ *
+ * Returns `NOT_FOUND` when the byline id doesn't resolve. Generic
+ * failures surface as `BYLINE_UPDATE_ERROR` (500) without leaking the
+ * underlying message.
+ */
+export async function handleBylineUpdate(
+	db: Kysely<Database>,
+	id: string,
+	input: UpdateBylineInput,
+): Promise<ApiResult<BylineSummary>> {
+	try {
+		const repo = new BylineRepository(db);
+		const byline = await repo.update(id, input);
+		if (!byline) {
+			return {
+				success: false,
+				error: { code: "NOT_FOUND", message: "Byline not found" },
+			};
+		}
+		return { success: true, data: byline };
+	} catch (error) {
+		// Unknown-key + type-mismatch + select-choice writes throw
+		// EmDashValidationError (Phase 3, see BylineRepository.update).
+		// Map to a clean 400 — the error message names the offending
+		// slug/type, which is safe to surface to the admin client.
+		if (error instanceof EmDashValidationError) {
+			return {
+				success: false,
+				error: { code: "VALIDATION_ERROR", message: error.message },
+			};
+		}
+		console.error("[BYLINE_UPDATE_ERROR]", error);
+		return {
+			success: false,
+			error: { code: "BYLINE_UPDATE_ERROR", message: "Failed to update byline" },
+		};
+	}
+}

package/src/api/handlers/content.ts

@@ -295,6 +295,34 @@ export interface TrashedContentItem {
 	deletedAt: string;
 }
 
+/**
+ * Resolve the columns a content-list search should match against. Always
+ * includes `slug` (a standard column) and adds the `title`/`name` display
+ * fields when the collection actually defines them, mirroring the admin's
+ * item-title resolution (title -> name -> slug). Returning only existing
+ * columns avoids "no such column" errors on collections without them.
+ */
+async function resolveSearchColumns(db: Kysely<Database>, collection: string): Promise<string[]> {
+	const columns = ["slug"];
+	const row = await db
+		.selectFrom("_emdash_collections")
+		.select("id")
+		.where("slug", "=", collection)
+		.executeTakeFirst();
+	if (!row) return columns;
+
+	const fields = await db
+		.selectFrom("_emdash_fields")
+		.select("slug")
+		.where("collection_id", "=", row.id)
+		.execute();
+	const fieldSlugs = new Set(fields.map((f) => f.slug));
+	for (const candidate of ["title", "name"]) {
+		if (fieldSlugs.has(candidate)) columns.push(candidate);
+	}
+	return columns;
+}
+
 /**
  * Create content list handler
  */
@@ -308,14 +336,26 @@ export async function handleContentList(
 		orderBy?: string;
 		order?: "asc" | "desc";
 		locale?: string;
+		q?: string;
 	},
 ): Promise<ApiResult<ContentListResponse>> {
 	try {
 		const repo = new ContentRepository(db);
-		const where: { status?: string; locale?: string } = {};
+		const where: {
+			status?: string;
+			locale?: string;
+			q?: string;
+			searchColumns?: string[];
+		} = {};
 		if (params.status) where.status = params.status;
 		if (params.locale) where.locale = params.locale;
 
+		const q = params.q?.trim();
+		if (q) {
+			where.q = q;
+			where.searchColumns = await resolveSearchColumns(db, collection);
+		}
+
 		const result = await repo.findMany(collection, {
 			cursor: params.cursor,
 			limit: params.limit || 50,
@@ -655,6 +695,7 @@ export async function handleContentUpdate(
 		status?: string;
 		authorId?: string | null;
 		bylines?: ContentBylineInput[];
+		locale?: string;
 		_rev?: string;
 		seo?: ContentSeoInput;
 		publishedAt?: string | null;
@@ -682,7 +723,7 @@ export async function handleContentUpdate(
 		const repo = new ContentRepository(db);
 
 		// Resolve slug → ID if needed
-		const resolvedId = (await resolveId(repo, collection, id)) ?? id;
+		const resolvedId = (await resolveId(repo, collection, id, body.locale)) ?? id;
 
 		// Wrap content + SEO writes in a transaction for atomicity.
 		// The _rev check is inside the transaction so the read-then-write

package/src/api/handlers/media.ts

@@ -27,6 +27,7 @@ export async function handleMediaList(
 		cursor?: string;
 		limit?: number;
 		mimeType?: string | readonly string[];
+		q?: string;
 	},
 ): Promise<ApiResult<MediaListResponse>> {
 	try {
@@ -35,6 +36,7 @@ export async function handleMediaList(
 			cursor: params.cursor,
 			limit: Math.min(params.limit || 50, 100),
 			mimeType: params.mimeType,
+			q: params.q,
 		});
 
 		return {

package/src/api/openapi/document.ts

@@ -257,6 +257,9 @@ const contentPaths = {
 					collection: z.string().meta({ description: "Collection slug" }),
 					id: z.string().meta({ description: "Content ID or slug" }),
 				}),
+				query: z.object({
+					locale: z.string().optional().meta({ description: "Locale filter" }),
+				}),
 			},
 			requestBody: {
 				content: { [JSON_CONTENT]: { schema: contentUpdateBody } },

package/src/api/schemas/byline-fields.ts

@@ -0,0 +1,188 @@
+/**
+ * Zod schemas for the byline-fields admin API (Discussion #1174, Phase 4).
+ *
+ * Reserved-slug + identifier validation runs at the zod layer so the
+ * route returns a clean 400 (`VALIDATION_ERROR` from `parseBody`) rather
+ * than bubbling a registry-level `BylineSchemaError` ("RESERVED_SLUG" /
+ * "INVALID_SLUG"). The registry repeats the same checks for non-HTTP
+ * callers (seeds, scripts) — see `BylineSchemaRegistry.validateSlug`.
+ *
+ * Field types are constrained to the v1 subset declared in
+ * `BYLINE_FIELD_TYPES`. Adding a type to the union there will require a
+ * corresponding update to this enum.
+ */
+
+import { z } from "zod";
+
+import { BYLINE_FIELD_TYPES, RESERVED_BYLINE_FIELD_SLUGS } from "../../schema/types.js";
+
+/**
+ * Slug pattern for byline field definitions — matches the identifier rule
+ * used by `validateIdentifier` (and `slugPattern` in `common.ts`).
+ * Lowercase letters, digits, and underscores; must start with a letter.
+ */
+const bylineFieldSlugPattern = /^[a-z][a-z0-9_]*$/;
+
+/** Hard cap on a slug — mirrors `BylineSchemaRegistry.MAX_SLUG_LENGTH`. */
+const MAX_SLUG_LENGTH = 63;
+/** Hard cap on a label — mirrors `BylineSchemaRegistry.MAX_LABEL_LENGTH`. */
+const MAX_LABEL_LENGTH = 200;
+/** Hard cap on a select field's `options` list. */
+const MAX_SELECT_OPTIONS = 200;
+
+const RESERVED_SET: ReadonlySet<string> = new Set(RESERVED_BYLINE_FIELD_SLUGS);
+
+// Enumerate the v1 byline field types explicitly so zod gets the exact
+// literal union for `z.infer<>`. Mirrors `BYLINE_FIELD_TYPES`; CI's
+// type-checker catches drift via the satisfies/import below.
+const bylineFieldTypeValues = z.enum(["string", "text", "url", "boolean", "select"]);
+// Compile-time guard: a drift here trips the satisfies check.
+type _BylineFieldTypeDriftCheck =
+	(typeof BYLINE_FIELD_TYPES)[number] extends z.infer<typeof bylineFieldTypeValues>
+		? z.infer<typeof bylineFieldTypeValues> extends (typeof BYLINE_FIELD_TYPES)[number]
+			? true
+			: never
+		: never;
+const _bylineFieldTypeDriftCheck: _BylineFieldTypeDriftCheck = true;
+void _bylineFieldTypeDriftCheck;
+
+/**
+ * Validation payload for a byline custom field. v1 only exposes
+ * `options` (used by `select`-type fields). Empty/duplicate options are
+ * rejected at the registry layer; the zod layer only enforces shape and
+ * caps. Future field types may add keys here.
+ */
+const bylineFieldValidationSchema = z
+	.object({
+		options: z
+			.array(z.string().min(1))
+			.min(1, "select options must contain at least one entry")
+			.max(MAX_SELECT_OPTIONS, `select options cannot exceed ${MAX_SELECT_OPTIONS} entries`)
+			.optional(),
+	})
+	.strict()
+	.nullable();
+
+/**
+ * Slug validation chain shared by create + reorder bodies. Centralised so
+ * the reserved-slug message and pattern are identical everywhere.
+ */
+const bylineFieldSlug = z
+	.string()
+	.min(1, "Byline field slug is required")
+	.max(MAX_SLUG_LENGTH, `Byline field slug must be ${MAX_SLUG_LENGTH} characters or less`)
+	.regex(
+		bylineFieldSlugPattern,
+		"Byline field slug must contain only lowercase letters, digits, and underscores, and start with a letter",
+	)
+	.refine((slug) => !RESERVED_SET.has(slug), {
+		// Surface the offending slug in the validation issue path-message
+		// for easier debugging from the admin UI's error toast.
+		message: "Byline field slug is reserved",
+	});
+
+const bylineFieldLabel = z
+	.string()
+	.min(1, "Byline field label is required")
+	.max(MAX_LABEL_LENGTH, `Byline field label must be ${MAX_LABEL_LENGTH} characters or less`);
+
+// ---------------------------------------------------------------------------
+// Request bodies
+// ---------------------------------------------------------------------------
+
+export const bylineFieldCreateBody = z
+	.object({
+		slug: bylineFieldSlug,
+		label: bylineFieldLabel,
+		type: bylineFieldTypeValues,
+		required: z.boolean().optional(),
+		/**
+		 * Whether values are stored per-locale (translatable, default) or
+		 * shared across the translation group. See `BylineFieldDefinition`.
+		 */
+		translatable: z.boolean().optional(),
+		validation: bylineFieldValidationSchema.optional(),
+		sortOrder: z.number().int().min(0).optional(),
+	})
+	.strict()
+	.meta({ id: "BylineFieldCreateBody" });
+
+/**
+ * Update body. `slug` and `type` are intentionally absent — both are
+ * immutable post-create (changing them would invalidate stored values).
+ * `translatable` flips are gated at the registry layer when value rows
+ * exist (`TRANSLATABLE_LOCKED`).
+ */
+export const bylineFieldUpdateBody = z
+	.object({
+		label: bylineFieldLabel.optional(),
+		required: z.boolean().optional(),
+		translatable: z.boolean().optional(),
+		validation: bylineFieldValidationSchema.optional(),
+		sortOrder: z.number().int().min(0).optional(),
+	})
+	.strict()
+	.meta({ id: "BylineFieldUpdateBody" });
+
+export const bylineFieldReorderBody = z
+	.object({
+		/**
+		 * Exact set of currently registered slugs in the desired order.
+		 * The registry rejects any drift (`REORDER_MISMATCH`); the zod
+		 * layer enforces slug shape only. An empty array is permitted —
+		 * `reorderFields([])` is a valid no-op when zero fields are
+		 * registered (registry contract). Rejecting empty here would
+		 * produce a spurious 400 for an admin UI that submits a reorder
+		 * after deleting the last field.
+		 */
+		slugs: z.array(bylineFieldSlug),
+	})
+	.strict()
+	.meta({ id: "BylineFieldReorderBody" });
+
+// ---------------------------------------------------------------------------
+// Response shapes
+// ---------------------------------------------------------------------------
+
+export const bylineFieldDefinitionSchema = z
+	.object({
+		id: z.string(),
+		slug: z.string(),
+		label: z.string(),
+		type: bylineFieldTypeValues,
+		required: z.boolean(),
+		translatable: z.boolean(),
+		validation: z
+			.object({
+				options: z.array(z.string()).optional(),
+			})
+			.nullable(),
+		sortOrder: z.number().int(),
+		createdAt: z.string(),
+		updatedAt: z.string(),
+	})
+	.meta({ id: "BylineFieldDefinition" });
+
+export const bylineFieldListResponseSchema = z
+	.object({
+		items: z.array(bylineFieldDefinitionSchema),
+	})
+	.meta({ id: "BylineFieldListResponse" });
+
+/**
+ * Response shape for `GET /api/admin/byline-fields/[slug]/usage`.
+ *
+ * `translatableValueCount` counts rows in `_emdash_byline_field_values`.
+ * `groupValueCount` counts rows in `_emdash_byline_field_group_values`.
+ * `totalAffectedRows` is the sum — what the destructive-delete confirm
+ * dialog surfaces. Both individual counts are exposed for diagnostic
+ * value (e.g. inconsistency with the field's current `translatable`
+ * flag would show non-zero on the "wrong" side).
+ */
+export const bylineFieldUsageResponseSchema = z
+	.object({
+		translatableValueCount: z.number().int().nonnegative(),
+		groupValueCount: z.number().int().nonnegative(),
+		totalAffectedRows: z.number().int().nonnegative(),
+	})
+	.meta({ id: "BylineFieldUsageResponse" });

package/src/api/schemas/bylines.ts

@@ -12,6 +12,13 @@ export const bylineSummarySchema = z
 		displayName: z.string(),
 		bio: z.string().nullable(),
 		avatarMediaId: z.string().nullable(),
+		/**
+		 * Avatar media storage key + alt, folded in by the media join during
+		 * content byline hydration. Null on the plain byline finders, which
+		 * don't join media.
+		 */
+		avatarStorageKey: z.string().nullish(),
+		avatarAlt: z.string().nullish(),
 		websiteUrl: z.string().nullable(),
 		userId: z.string().nullable(),
 		isGuest: z.boolean(),
@@ -25,6 +32,16 @@ export const bylineSummarySchema = z
 		 * source. Nullable in storage for backwards compatibility.
 		 */
 		translationGroup: z.string().nullable(),
+		/**
+		 * Byline custom-field values (Discussion #1174). Keys are slugs
+		 * registered via the byline-fields admin API; values follow
+		 * `CustomFieldValue` (`string | boolean | null`). Always present
+		 * on hydrated responses — empty `{}` when no fields are
+		 * registered (Phase 3 AC #6). Marked optional in the schema for
+		 * historic-payload compatibility with pre-Phase-3 clients that
+		 * may not send the key on writes; hydration always populates it.
+		 */
+		customFields: z.record(z.string(), z.union([z.string(), z.boolean(), z.null()])).optional(),
 	})
 	.meta({ id: "BylineSummary" });
 
@@ -83,6 +100,19 @@ export const bylineCreateBody = z
 		 * rather than minting a fresh one. Requires `locale`.
 		 */
 		translationOf: z.string().min(1).optional(),
+		/**
+		 * Byline custom-field values (Discussion #1174, Phase 6 — create-flow
+		 * parity with update). Keys are field slugs; values are unknown at
+		 * the API layer because the per-field type contract lives in the
+		 * registry and would require an extra query to enforce here. The
+		 * repository's `coerceFieldValue` validates against the field's
+		 * type and throws `EmDashValidationError` on mismatch — the route
+		 * maps that to a 400 `VALIDATION_ERROR`. Reserved-slug write
+		 * attempts fall out as `EmDashValidationError("Unknown byline
+		 * custom field …")` because no registered field claims a reserved
+		 * slug.
+		 */
+		customFields: z.record(z.string(), z.unknown()).optional(),
 	})
 	.meta({ id: "BylineCreateBody" });
 
@@ -120,6 +150,18 @@ export const bylineUpdateBody = z
 		websiteUrl: httpUrl.nullish(),
 		userId: z.string().nullish(),
 		isGuest: z.boolean().optional(),
+		/**
+		 * Byline custom-field values (Discussion #1174, Phase 3+4). Keys
+		 * are field slugs; values are unknown at the API layer because
+		 * the per-field type contract lives in the registry and would
+		 * require an extra query to enforce here. The repository's
+		 * `coerceFieldValue` validates against the field's type and
+		 * throws `EmDashValidationError` on mismatch — the route maps
+		 * that to a 400 `VALIDATION_ERROR`. Reserved-slug write attempts
+		 * fall out as `EmDashValidationError("Unknown byline custom
+		 * field …")` because no registered field claims a reserved slug.
+		 */
+		customFields: z.record(z.string(), z.unknown()).optional(),
 	})
 	.meta({ id: "BylineUpdateBody" });
 

package/src/api/schemas/content.ts

@@ -24,6 +24,8 @@ export const contentListQuery = cursorPaginationQuery
 		orderBy: z.string().optional(),
 		order: z.enum(["asc", "desc"]).optional(),
 		locale: localeCode.optional(),
+		/** Case-insensitive substring search across the collection's title/name/slug. */
+		q: z.string().trim().min(1).max(200).optional(),
 	})
 	.meta({ id: "ContentListQuery" });
 

package/src/api/schemas/index.ts

@@ -15,3 +15,4 @@ export * from "./users.js";
 export * from "./widgets.js";
 export * from "./redirects.js";
 export * from "./bylines.js";
+export * from "./byline-fields.js";

package/src/api/schemas/media.ts

@@ -21,6 +21,8 @@ const mimeTypeFilter = z
 export const mediaListQuery = cursorPaginationQuery
 	.extend({
 		mimeType: mimeTypeFilter,
+		/** Case-insensitive filename substring search (also matches extensions). */
+		q: z.string().trim().min(1).max(200).optional(),
 	})
 	.meta({ id: "MediaListQuery" });
 

package/src/astro/integration/routes.ts

@@ -457,6 +457,33 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/admin/bylines/[id]/translations.ts"),
 	});
 
+	// Byline custom-field schema routes (Discussion #1174, Phase 4).
+	// Order matters: the static `reorder` route must precede the dynamic
+	// `[slug]` route so Astro's resolver dispatches POST /byline-fields/reorder
+	// to the reorder handler instead of treating "reorder" as a slug. The
+	// `reorder` slug is also reserved at the data layer
+	// (RESERVED_BYLINE_FIELD_SLUGS) so the registry rejects field creation
+	// with that name — defence in depth.
+	injectRoute({
+		pattern: "/_emdash/api/admin/byline-fields",
+		entrypoint: resolveRoute("api/admin/byline-fields/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/admin/byline-fields/reorder",
+		entrypoint: resolveRoute("api/admin/byline-fields/reorder.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/admin/byline-fields/[slug]",
+		entrypoint: resolveRoute("api/admin/byline-fields/[slug].ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/admin/byline-fields/[slug]/usage",
+		entrypoint: resolveRoute("api/admin/byline-fields/[slug]/usage.ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/admin/users/[id]",
 		entrypoint: resolveRoute("api/admin/users/[id]/index.ts"),

package/src/astro/middleware/redirect.ts

@@ -74,7 +74,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		}
 
 		// 1. Exact match (O(1) Map lookup)
-		const exact = cached.exact.get(pathname);
+		let exact = cached.exact.get(pathname);
+		if (!exact && pathname.length > 1) {
+			const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
+			exact = cached.exact.get(alt);
+		}
 		if (exact) {
 			const dest = exact.destination;
 			if (dest.startsWith("//") || dest.startsWith("/\\")) return next();

package/src/astro/routes/api/admin/byline-fields/[slug]/usage.ts

@@ -0,0 +1,36 @@
+/**
+ * Byline field usage counts.
+ *
+ * GET /_emdash/api/admin/byline-fields/{slug}/usage
+ *
+ * Returns `{ translatableValueCount, groupValueCount, totalAffectedRows }`.
+ * Backs the destructive-delete confirm dialog in the admin UI (Phase 5).
+ * Thin wrapper around `handleBylineFieldUsage`.
+ *
+ * Phase 4 of Discussion #1174.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, requireDb, unwrapResult } from "#api/error.js";
+import { handleBylineFieldUsage } from "#api/handlers/byline-fields.js";
+
+export const prerender = false;
+
+// GET requires `schema:read` (Editor+); see byline-fields/index.ts GET
+// for rationale on the read/manage split.
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "schema:read");
+	if (denied) return denied;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const slug = params.slug;
+	if (!slug) return apiError("MISSING_PARAM", "Field slug is required", 400);
+
+	const result = await handleBylineFieldUsage(emdash.db, slug);
+	return unwrapResult(result);
+};