emdash 0.28.1 → 0.30.0

package/src/astro/routes/api/admin/bylines/[id]/translations.ts

@@ -15,7 +15,7 @@
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
-import { handleError, requireDb, unwrapResult } from "#api/error.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleBylineCreate, handleBylineTranslations } from "#api/handlers/bylines.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { bylineTranslationCreateBody } from "#api/schemas.js";
@@ -65,10 +65,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 		const repo = new BylineRepository(emdash.db);
 		const source = await repo.findById(id);
 		if (!source) {
-			return new Response(
-				JSON.stringify({ error: { code: "NOT_FOUND", message: "Byline not found" } }),
-				{ status: 404, headers: { "Content-Type": "application/json" } },
-			);
+			return apiError("NOT_FOUND", "Byline not found", 404);
 		}
 
 		const result = await handleBylineCreate(emdash.db, {

package/src/astro/routes/api/admin/comments/[id]/status.ts

@@ -14,7 +14,6 @@ import { commentStatusBody } from "#api/schemas.js";
 import { getSiteBaseUrl } from "#api/site-url.js";
 import { lookupContentAuthor, sendCommentNotification } from "#comments/notifications.js";
 import { moderateComment, type CommentHookRunner } from "#comments/service.js";
-import type { CommentStatus } from "#db/repositories/comment.js";
 import type { ModerationDecision } from "#plugins/types.js";
 
 export const prerender = false;
@@ -37,7 +36,7 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 		const body = await parseBody(request, commentStatusBody);
 		if (isParseError(body)) return body;
 
-		const newStatus = body.status as CommentStatus;
+		const newStatus = body.status;
 
 		// Build hook runner for the service
 		const hookRunner: CommentHookRunner = {

package/src/astro/routes/api/admin/comments/index.ts

@@ -11,7 +11,6 @@ import { handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleCommentInbox } from "#api/handlers/comments.js";
 import { isParseError, parseQuery } from "#api/parse.js";
 import { commentListQuery } from "#api/schemas.js";
-import type { CommentStatus } from "#db/repositories/comment.js";
 
 export const prerender = false;
 
@@ -32,7 +31,7 @@ export const GET: APIRoute = async ({ url, locals }) => {
 		if (isParseError(query)) return query;
 
 		const result = await handleCommentInbox(emdash.db, {
-			status: query.status as CommentStatus | undefined,
+			status: query.status,
 			collection: query.collection,
 			search: query.search,
 			limit: query.limit,

package/src/astro/routes/api/admin/media-usage/repair.ts

@@ -0,0 +1,24 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import { handleMediaUsageRepair } from "#api/handlers/media-usage.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { mediaUsageRepairBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+
+	const body = await parseBody(request, mediaUsageRepairBody);
+	if (isParseError(body)) return body;
+
+	const result = await handleMediaUsageRepair(emdash.db, body);
+	return unwrapResult(result);
+};

package/src/astro/routes/api/admin/plugins/[id]/index.ts

@@ -34,6 +34,12 @@ export const GET: APIRoute = async ({ params, locals }) => {
 		id,
 		emdash.config.marketplace,
 	);
+	if (result.success) {
+		const tools = await emdash.getPluginMcpTools(id);
+		result.data.item.mcpTools = tools.map(
+			({ inputSchema: _, outputSchema: __, pluginId: ___, ...tool }) => tool,
+		);
+	}
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/[id]/mcp.ts

@@ -0,0 +1,42 @@
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess } from "#api/error.js";
+import { parseBody } from "#api/parse.js";
+import { PluginStateRepository } from "#plugins/state.js";
+
+export const prerender = false;
+
+const bodySchema = z.object({ enabled: z.boolean() });
+
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+	if (!params.id) return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+
+	const parsed = await parseBody(request, bodySchema);
+	if (parsed instanceof Response) return parsed;
+	const tools = await emdash.getPluginMcpTools(params.id);
+	if (parsed.enabled && tools.length === 0) {
+		return apiError("NO_MCP_TOOLS", "Plugin does not declare MCP tools", 400);
+	}
+	const stateRepo = new PluginStateRepository(emdash.db);
+	const existing = await stateRepo.get(params.id);
+	const configuredVersion =
+		emdash.configuredPlugins.find((plugin) => plugin.id === params.id)?.version ??
+		emdash.sandboxedPluginEntries.find((plugin) => plugin.id === params.id)?.version;
+	const version = existing?.version ?? configuredVersion;
+	if (!version) return apiError("NOT_FOUND", "Plugin not found", 404);
+	const consent = parsed.enabled ? emdash.serializePluginMcpConsent(tools, params.id) : null;
+	const item = await stateRepo.upsert(params.id, version, existing?.status ?? "active", {
+		mcpToolsEnabled: parsed.enabled,
+		mcpToolsConsent: consent,
+	});
+	return apiSuccess({
+		enabled: item.mcpToolsEnabled,
+		tools: tools.map(({ inputSchema: _, outputSchema: __, ...tool }) => tool),
+	});
+};

package/src/astro/routes/api/admin/plugins/[id]/settings.ts

@@ -0,0 +1,80 @@
+/**
+ * Plugin settings endpoint (auto-generated settings UI)
+ *
+ * GET /_emdash/api/admin/plugins/:id/settings - Get schema + current values (secrets masked)
+ * PUT /_emdash/api/admin/plugins/:id/settings - Update values
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError } from "#api/error.js";
+import {
+	getPluginSettingsSchema,
+	handlePluginSettingsGet,
+	handlePluginSettingsUpdate,
+} from "#api/handlers/plugin-settings.js";
+import { unwrapResult } from "#api/index.js";
+import { isParseError, parseBody } from "#api/parse.js";
+
+export const prerender = false;
+
+const updateBody = z.object({
+	values: z.record(z.string(), z.unknown()),
+});
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+	}
+
+	const schema =
+		getPluginSettingsSchema(emdash.configuredPlugins, emdash.sandboxedPluginEntries, id) ??
+		emdash.getRuntimePluginSettingsSchema(id);
+	if (schema === null) {
+		return apiError("NOT_FOUND", `Plugin not found: ${id}`, 404);
+	}
+
+	const result = await handlePluginSettingsGet(emdash.db, id, schema);
+	return unwrapResult(result);
+};
+
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+	}
+
+	const schema =
+		getPluginSettingsSchema(emdash.configuredPlugins, emdash.sandboxedPluginEntries, id) ??
+		emdash.getRuntimePluginSettingsSchema(id);
+	if (schema === null) {
+		return apiError("NOT_FOUND", `Plugin not found: ${id}`, 404);
+	}
+
+	const body = await parseBody(request, updateBody);
+	if (isParseError(body)) return body;
+
+	const result = await handlePluginSettingsUpdate(emdash.db, id, schema, body.values);
+	return unwrapResult(result);
+};

package/src/astro/routes/api/admin/plugins/[id]/update.ts

@@ -18,6 +18,7 @@ const updateBodySchema = z.object({
 	version: z.string().min(1).optional(),
 	confirmCapabilityChanges: z.boolean().optional(),
 	confirmRouteVisibilityChanges: z.boolean().optional(),
+	confirmMcpTools: z.boolean().optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -48,6 +49,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			version: body.version,
 			confirmCapabilityChanges: body.confirmCapabilityChanges,
 			confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+			confirmMcpTools: body.confirmMcpTools,
 			sandboxBypassed: emdash.isSandboxBypassed(),
 		},
 	);

package/src/astro/routes/api/admin/plugins/index.ts

@@ -27,7 +27,16 @@ export const GET: APIRoute = async ({ locals }) => {
 		emdash.configuredPlugins,
 		emdash.sandboxedPluginEntries,
 		emdash.config.marketplace,
+		(pluginId) => emdash.getRuntimePluginSettingsSchema(pluginId),
 	);
+	if (result.success) {
+		const tools = await emdash.getPluginMcpTools();
+		for (const item of result.data.items) {
+			item.mcpTools = tools
+				.filter((tool) => tool.pluginId === item.id)
+				.map(({ inputSchema: _, outputSchema: __, pluginId: ___, ...tool }) => tool);
+		}
+	}
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/admin/plugins/marketplace/[id]/install.ts

@@ -16,6 +16,7 @@ export const prerender = false;
 
 const installBodySchema = z.object({
 	version: z.string().min(1).optional(),
+	confirmMcpTools: z.boolean().optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -54,6 +55,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 				configuredPluginIds,
 				siteOrigin,
 				sandboxBypassed: emdash.isSandboxBypassed(),
+				confirmMcpTools: body.confirmMcpTools,
 			},
 		);
 

package/src/astro/routes/api/admin/plugins/registry/[id]/update.ts

@@ -36,6 +36,7 @@ const updateBodySchema = z.object({
 	 * version newly exposes a public (unauthenticated) route.
 	 */
 	confirmRouteVisibilityChanges: z.boolean().optional(),
+	confirmMcpTools: z.boolean().optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -67,6 +68,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 				version: body.version,
 				confirmCapabilityChanges: body.confirmCapabilityChanges,
 				confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+				confirmMcpTools: body.confirmMcpTools,
 				hostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),
 			},
 		);

package/src/astro/routes/api/admin/plugins/registry/install.ts

@@ -57,6 +57,7 @@ const installBodySchema = z.object({
 	 * dialog and the install POST.
 	 */
 	acknowledgedDeclaredAccess: z.unknown().optional(),
+	acknowledgedMcpTools: z.unknown().optional(),
 });
 
 export const POST: APIRoute = async ({ request, locals }) => {
@@ -93,6 +94,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 				slug: body.slug,
 				version: body.version,
 				acknowledgedDeclaredAccess: body.acknowledgedDeclaredAccess,
+				acknowledgedMcpTools: body.acknowledgedMcpTools,
 			},
 			{
 				configuredPluginIds: reservedPluginIds,

package/src/astro/routes/api/admin/plugins/updates.ts

@@ -15,7 +15,7 @@
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
-import { apiError } from "#api/error.js";
+import { apiError, apiSuccess } from "#api/error.js";
 import { handleMarketplaceUpdateCheck, handleRegistryUpdateCheck } from "#api/index.js";
 
 export const prerender = false;
@@ -59,7 +59,5 @@ export const GET: APIRoute = async ({ locals }) => {
 	if (marketplace?.success) items.push(...marketplace.data.items);
 	if (registry?.success) items.push(...registry.data.items);
 
-	// Match the rest of the admin API envelope (`{ data: ... }`) so the
-	// admin client's `parseApiResponse` unwraps `body.data`.
-	return Response.json({ data: { items } });
+	return apiSuccess({ items });
 };

package/src/astro/routes/api/auth/mode.ts

@@ -11,6 +11,7 @@
 
 import type { APIRoute } from "astro";
 
+import { apiSuccess } from "#api/error.js";
 import { getAuthMode } from "#auth/mode.js";
 
 export const prerender = false;
@@ -40,18 +41,9 @@ export const GET: APIRoute = async ({ locals }) => {
 		label: p.label,
 	}));
 
-	return Response.json(
-		{
-			data: {
-				authMode: authMode.type === "external" ? authMode.providerType : "passkey",
-				signupEnabled,
-				providers,
-			},
-		},
-		{
-			headers: {
-				"Cache-Control": "private, no-store",
-			},
-		},
-	);
+	return apiSuccess({
+		authMode: authMode.type === "external" ? authMode.providerType : "passkey",
+		signupEnabled,
+		providers,
+	});
 };

package/src/astro/routes/api/auth/oauth/[provider]/callback.ts

@@ -115,11 +115,17 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 	}
 
 	try {
-		// Get OAuth providers from environment
-		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- locals.runtime is injected by the Cloudflare adapter at runtime; not declared on App.Locals since the adapter is optional
-		const runtimeLocals = locals as unknown as { runtime?: { env?: Record<string, unknown> } };
-		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env is typed as ImportMetaEnv but we need Record<string, unknown> for getOAuthConfig
-		const env = runtimeLocals.runtime?.env ?? (import.meta.env as Record<string, unknown>);
+		// Get OAuth providers from environment. Astro 6 removed
+		// `Astro.locals.runtime.env` (accessing it throws rather than
+		// returning undefined, so optional-chaining doesn't help) -- read
+		// Cloudflare bindings via the emdash virtual module instead, which
+		// re-exports `cloudflare:workers`' `env` under that adapter and
+		// falls back to `import.meta.env` on Node (#1736).
+		// @ts-ignore - virtual module, generated by the Astro integration
+		const { env: cfEnv } = (await import("virtual:emdash/env")) as {
+			env?: Record<string, unknown>;
+		};
+		const env = cfEnv ?? import.meta.env;
 		const providers = getOAuthConfig(env);
 
 		if (!providers[provider]) {
@@ -217,6 +223,16 @@ export const GET: APIRoute = async ({ params, request, locals, session, redirect
 				case "signup_not_allowed":
 					message = "Self-signup is not allowed for your email. Please contact an administrator.";
 					break;
+				case "invite_invalid":
+					message = "This invite link is invalid or has expired. Please ask for a new one.";
+					break;
+				case "invite_email_mismatch":
+					message = "This invite was sent to a different email address than your account.";
+					break;
+				case "invite_email_unverified":
+					message =
+						"Your account's email is not verified by the provider. Please verify it and try again.";
+					break;
 				case "user_not_found":
 					message = "Your account was not found. It may have been deleted.";
 					break;

package/src/astro/routes/api/auth/oauth/[provider].ts

@@ -17,6 +17,9 @@ type ProviderName = "github" | "google";
 
 const VALID_PROVIDERS = new Set<string>(["github", "google"]);
 
+/** Invite tokens are base64url; clamp shape and length before persisting to state. */
+const INVITE_TOKEN_REGEX = /^[A-Za-z0-9_-]{1,256}$/;
+
 function isValidProvider(provider: string): provider is ProviderName {
 	return VALID_PROVIDERS.has(provider);
 }
@@ -93,12 +96,17 @@ export const GET: APIRoute = async ({ params, request, locals, redirect }) => {
 	try {
 		const url = new URL(request.url);
 
-		// Get OAuth providers from environment
-		// Access via locals.runtime for Cloudflare, or import.meta.env for Node
-		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- locals.runtime is injected by the Cloudflare adapter at runtime; not declared on App.Locals since the adapter is optional
-		const runtimeLocals = locals as unknown as { runtime?: { env?: Record<string, unknown> } };
-		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- import.meta.env is typed as ImportMetaEnv but we need Record<string, unknown> for getOAuthConfig
-		const env = runtimeLocals.runtime?.env ?? (import.meta.env as Record<string, unknown>);
+		// Get OAuth providers from environment. Astro 6 removed
+		// `Astro.locals.runtime.env` (accessing it throws rather than
+		// returning undefined, so optional-chaining doesn't help) -- read
+		// Cloudflare bindings via the emdash virtual module instead, which
+		// re-exports `cloudflare:workers`' `env` under that adapter and
+		// falls back to `import.meta.env` on Node (#1736).
+		// @ts-ignore - virtual module, generated by the Astro integration
+		const { env: cfEnv } = (await import("virtual:emdash/env")) as {
+			env?: Record<string, unknown>;
+		};
+		const env = cfEnv ?? import.meta.env;
 		const providers = getOAuthConfig(env);
 
 		if (!providers[provider]) {
@@ -114,7 +122,16 @@ export const GET: APIRoute = async ({ params, request, locals, redirect }) => {
 
 		const stateStore = createOAuthStateStore(emdash.db);
 
-		const { url: authUrl } = await createAuthorizationUrl(config, provider, stateStore);
+		// When the flow starts from an invite link, carry the invite token so the
+		// callback can complete the invite for a matching, verified email. Validate
+		// its shape/length first: this endpoint is unauthenticated, so we avoid
+		// persisting arbitrary or oversized values into the short-lived state store.
+		const rawInvite = url.searchParams.get("invite");
+		const inviteToken = rawInvite && INVITE_TOKEN_REGEX.test(rawInvite) ? rawInvite : undefined;
+
+		const { url: authUrl } = await createAuthorizationUrl(config, provider, stateStore, {
+			inviteToken,
+		});
 
 		return redirect(authUrl);
 	} catch (error) {

package/src/astro/routes/api/comments/[collection]/[contentId]/index.ts

@@ -14,6 +14,7 @@ import { createCommentBody } from "#api/schemas.js";
 import { getSiteBaseUrl } from "#api/site-url.js";
 import { sendCommentNotification } from "#comments/notifications.js";
 import { createComment, type CommentHookRunner } from "#comments/service.js";
+import { getTurnstileSecretKey, verifyTurnstileToken } from "#comments/turnstile.js";
 import { resolveSecretsCached } from "#config/secrets.js";
 import { CommentRepository } from "#db/repositories/comment.js";
 import { validateIdentifier } from "#db/validate.js";
@@ -163,6 +164,18 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			return apiError("RATE_LIMITED", "Too many comments. Please try again later.", 429);
 		}
 
+		// Anti-spam: Turnstile — enforced only when the operator configured a
+		// secret key. Runs after the free checks (honeypot, rate limit) so
+		// obvious spam never triggers a siteverify subrequest. Fails closed:
+		// missing token, failed verification, and siteverify errors all reject.
+		const turnstileSecretKey = getTurnstileSecretKey();
+		if (turnstileSecretKey) {
+			const verified = await verifyTurnstileToken(body.turnstileToken, turnstileSecretKey, meta.ip);
+			if (!verified) {
+				return apiError("TURNSTILE_FAILED", "CAPTCHA verification failed", 403);
+			}
+		}
+
 		// Build collection settings
 		const collectionSettings: CollectionCommentSettings = {
 			commentsEnabled: collectionRow.comments_enabled === 1,

package/src/astro/routes/api/content/[collection]/[id]/compare.ts

@@ -13,15 +13,14 @@ export const prerender = false;
 
 export const GET: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
+	if (!emdash?.handleContentCompare) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
 	const denied = requirePerm(user, "content:read_drafts");
 	if (denied) return denied;
 	const collection = params.collection!;
 	const id = params.id!;
 
-	if (!emdash?.handleContentCompare) {
-		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
-	}
-
 	const result = await emdash.handleContentCompare(collection, id);
 
 	return unwrapResult(result);

package/src/astro/routes/api/content/[collection]/[id]/duplicate.ts

@@ -16,12 +16,11 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 	const collection = params.collection!;
 	const id = params.id!;
 
-	const denied = requirePerm(user, "content:create");
-	if (denied) return denied;
-
 	if (!emdash?.handleContentDuplicate || !emdash?.handleContentGet) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	const denied = requirePerm(user, "content:create");
+	if (denied) return denied;
 
 	// Fetch item to check ownership — duplicating requires read access to the source
 	const existing = await emdash.handleContentGet(collection, id);

package/src/astro/routes/api/content/[collection]/[id]/permanent.ts

@@ -16,12 +16,11 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 	const collection = params.collection!;
 	const id = params.id!;
 
-	const denied = requirePerm(user, "content:delete_permanent");
-	if (denied) return denied;
-
 	if (!emdash?.handleContentPermanentDelete) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	const denied = requirePerm(user, "content:delete_permanent");
+	if (denied) return denied;
 
 	const result = await emdash.handleContentPermanentDelete(collection, id);
 

package/src/astro/routes/api/content/[collection]/[id]/preview-url.ts

@@ -33,15 +33,14 @@ const DURATION_PATTERN = /^(\d+)([smhdw])$/;
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
 	const denied = requirePerm(user, "content:read_drafts");
 	if (denied) return denied;
 	const collection = params.collection!;
 	const id = params.id!;
 
-	if (!emdash?.db) {
-		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
-	}
-
 	// Resolve the preview secret. Env override wins; otherwise a stable
 	// site-specific value is read from (or generated into) the options table.
 	// The resolver always returns a usable secret, so this path can no

package/src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts

@@ -0,0 +1,95 @@
+/**
+ * Content-entry reference children endpoint (parent side)
+ *
+ * GET  /_emdash/api/content/:collection/:id/references/:relation/children
+ * POST /_emdash/api/content/:collection/:id/references/:relation/children
+ */
+
+import { hasPermission } from "@emdash-cms/auth";
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleReferenceChildrenGet, handleReferenceChildrenSet } from "#api/handlers/relations.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { cursorPaginationQuery, setReferenceChildrenBody } from "#api/schemas.js";
+import { ContentRepository } from "#db/repositories/content.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { collection, id, relation } = params;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+
+	if (!collection || !id || !relation) {
+		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
+	}
+
+	const query = parseQuery(new URL(request.url), cursorPaginationQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const result = await handleReferenceChildrenGet(
+			emdash.db,
+			collection,
+			id,
+			relation,
+			{ limit: query.limit, cursor: query.cursor },
+			hasPermission(user, "content:read_drafts"),
+		);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to get references", "REFERENCES_GET_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { collection, id, relation } = params;
+
+	if (!collection || !id || !relation) {
+		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+	// Gate on the base edit capability BEFORE the existence lookup. Resolving the
+	// entry first would let a user with no edit permission distinguish real ids
+	// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy
+	// edge POST, which checks `content:edit_own` before fetching the entry.
+	const denied = requirePerm(user, "content:edit_own");
+	if (denied) return denied;
+
+	// Resolve the parent entry to gate on its author (ownership-aware write).
+	const parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);
+	if (!parent) return apiError("NOT_FOUND", "Content not found", 404);
+
+	const editDenied = requireOwnerPerm(
+		user,
+		parent.authorId ?? "",
+		"content:edit_own",
+		"content:edit_any",
+	);
+	if (editDenied) return editDenied;
+
+	try {
+		const body = await parseBody(request, setReferenceChildrenBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleReferenceChildrenSet(
+			emdash.db,
+			collection,
+			id,
+			relation,
+			body.childIds,
+		);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to set references", "REFERENCES_SET_ERROR");
+	}
+};