emdash 0.40.0 → 0.41.0

package/src/api/schemas/relations.ts

@@ -1,7 +1,5 @@
 import { z } from "zod";
 
-import { localeCode } from "./common.js";
-
 const slugPattern = /^[a-z][a-z0-9_]*$/;
 const collectionSlug = z
 	.string()
@@ -9,95 +7,107 @@ const collectionSlug = z
 	.max(63)
 	.regex(slugPattern, "Invalid collection slug format");
 
+/** NULL means unlimited on that side. */
+const roleLimit = z.number().int().positive().nullable().optional();
+const roleLabelSingular = z.string().min(1).max(200).nullable().optional();
+
 export const createRelationBody = z
 	.object({
-		name: z
+		slug: z
 			.string()
 			.min(1)
 			.max(63)
-			.regex(slugPattern, "Name must be lowercase alphanumeric with underscores"),
-		parentCollection: collectionSlug.optional(),
-		childCollection: collectionSlug.optional(),
+			.regex(slugPattern, "Slug must be lowercase alphanumeric with underscores"),
+		parentCollection: collectionSlug,
+		childCollection: collectionSlug,
 		parentLabel: z.string().min(1).max(200),
+		parentLabelSingular: roleLabelSingular,
 		childLabel: z.string().min(1).max(200),
-		locale: localeCode.optional(),
-		translationOf: z.string().min(1).optional(),
+		childLabelSingular: roleLabelSingular,
+		maxChildrenPerParent: roleLimit,
+		maxParentsPerChild: roleLimit,
 	})
-	// A translation inherits its structural fields (name, parentCollection,
-	// childCollection) from the source relation, so the handler ignores any
-	// collections supplied alongside `translationOf`. Require them only when
-	// minting a base relation, so callers aren't forced to pass discarded values.
-	.refine(
-		(body) =>
-			body.translationOf !== undefined ||
-			(body.parentCollection !== undefined && body.childCollection !== undefined),
-		{ message: "parentCollection and childCollection are required unless translationOf is set" },
-	)
 	.meta({ id: "CreateRelationBody" });
 
+export const relationListQuery = z
+	.object({
+		collection: collectionSlug.optional().meta({
+			description: "Only relations with this collection on one end",
+		}),
+	})
+	.meta({ id: "RelationListQuery" });
+
 export const updateRelationBody = z
 	.object({
 		parentLabel: z.string().min(1).max(200).optional(),
+		parentLabelSingular: roleLabelSingular,
 		childLabel: z.string().min(1).max(200).optional(),
+		childLabelSingular: roleLabelSingular,
+		maxChildrenPerParent: roleLimit,
+		maxParentsPerChild: roleLimit,
 	})
 	// Reject empty payloads: an update touching no field is a client mistake, not
 	// a successful no-op. Without this, `{}` validates and the handler returns 200
 	// with the unchanged row, so a typo'd payload looks like it landed.
-	.refine((body) => body.parentLabel !== undefined || body.childLabel !== undefined, {
-		message: "At least one of parentLabel or childLabel is required",
+	.refine((body) => Object.values(body).some((value) => value !== undefined), {
+		message: "At least one field is required",
 	})
 	.meta({ id: "UpdateRelationBody" });
 
-export const setReferenceChildrenBody = z
-	.object({ childIds: z.array(z.string().min(1)).max(1000) })
-	.meta({ id: "SetReferenceChildrenBody" });
-
 export const relationDefSchema = z
 	.object({
 		id: z.string(),
-		name: z.string(),
+		slug: z.string(),
 		parentCollection: z.string(),
 		childCollection: z.string(),
 		parentLabel: z.string(),
+		parentLabelSingular: z.string().nullable(),
 		childLabel: z.string(),
-		locale: z.string(),
-		translationGroup: z.string(),
+		childLabelSingular: z.string().nullable(),
+		maxChildrenPerParent: z.number().int().nullable(),
+		maxParentsPerChild: z.number().int().nullable(),
 	})
 	.meta({ id: "RelationDef" });
 
+/** A relation plus what deleting it would take: the fields that view it and
+ * how many links it holds. */
+export const relationWithUsageSchema = relationDefSchema
+	.extend({
+		boundFields: z.array(
+			z.object({
+				collectionSlug: z.string(),
+				fieldSlug: z.string(),
+				side: z.enum(["parent", "child"]),
+			}),
+		),
+		linkCount: z.number().int(),
+	})
+	.meta({ id: "RelationWithUsage" });
+
 export const relationListResponseSchema = z
-	.object({ relations: z.array(relationDefSchema) })
+	.object({ relations: z.array(relationWithUsageSchema) })
 	.meta({ id: "RelationListResponse" });
 
 export const relationResponseSchema = z
-	.object({ relation: relationDefSchema })
+	.object({ relation: relationWithUsageSchema })
 	.meta({ id: "RelationResponse" });
 
-export const relationTranslationsSchema = z
-	.object({
-		translationGroup: z.string(),
-		translations: z.array(
-			z.object({
-				id: z.string(),
-				name: z.string(),
-				locale: z.string(),
-				parentLabel: z.string(),
-				childLabel: z.string(),
-			}),
-		),
-	})
-	.meta({ id: "RelationTranslations" });
-
 export const entryRefSchema = z
 	.object({
 		id: z.string(),
 		slug: z.string().nullable(),
 		collection: z.string(),
+		// Display label sourced from the entry's `title`, then `name`, field —
+		// `null` when neither is set. Mirrors the runtime `EntryRef`.
+		title: z.string().nullable(),
 		// The actual locale of the resolved variant. When no variant matches the
 		// requesting entry's locale, the ref falls back to another locale's row;
 		// this field makes that substitution explicit instead of silently
 		// presenting a wrong-locale entry under the requested context.
 		locale: z.string().nullable(),
+		// The translation group the ref resolved from — the locale-stable identity
+		// of the referenced entry, which `id` is not.
+		translationGroup: z.string().nullable(),
 		sortOrder: z.number().int().optional(),
 	})
 	.meta({ id: "ReferenceEntryRef" });

package/src/api/schemas/schema.ts

@@ -108,6 +108,20 @@ const fieldValidation = z
 			.min(1, "allowedMimeTypes must not be empty — omit the field to allow all types")
 			.max(64, "allowedMimeTypes may contain at most 64 entries")
 			.optional(),
+		// Reference fields: the picker targets a collection and may allow more
+		// than one entry. Without these keys Zod strips them and the create
+		// handler rejects the field for a missing target collection.
+		targetCollection: z.string().min(1).optional(),
+		multiple: z.boolean().optional(),
+		// Reference fields: bind to an existing relation instead of creating one,
+		// and say which of its ends this collection sits on.
+		relation: z
+			.string()
+			.min(1)
+			.max(63)
+			.regex(slugPattern, "Invalid relation slug format")
+			.optional(),
+		relationSide: z.enum(["parent", "child"]).optional(),
 		allowedTypes: z.array(z.string().min(1).max(63).regex(slugPattern)).optional(),
 		retiredTypes: z.array(z.string().min(1).max(63).regex(slugPattern)).optional(),
 	})

package/src/astro/integration/routes.ts

@@ -218,22 +218,13 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/translations.ts"),
 	});
 
-	// Content relation routes
-	injectRoute({
-		pattern: "/_emdash/api/relations",
-		entrypoint: resolveRoute("api/relations/index.ts"),
-	});
-
-	injectRoute({
-		pattern: "/_emdash/api/relations/[id]",
-		entrypoint: resolveRoute("api/relations/[id]/index.ts"),
-	});
-
+	// Scheduled publishing routes
 	injectRoute({
-		pattern: "/_emdash/api/relations/[id]/translations",
-		entrypoint: resolveRoute("api/relations/[id]/translations.ts"),
+		pattern: "/_emdash/api/content/[collection]/[id]/schedule",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/schedule.ts"),
 	});
 
+	// Reference field edge routes (children = parent side, parents = backlinks)
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/[id]/references/[relation]/children",
 		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/children.ts"),
@@ -244,12 +235,6 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/parents.ts"),
 	});
 
-	// Scheduled publishing routes
-	injectRoute({
-		pattern: "/_emdash/api/content/[collection]/[id]/schedule",
-		entrypoint: resolveRoute("api/content/[collection]/[id]/schedule.ts"),
-	});
-
 	// Revision management routes (for restore, etc.)
 	injectRoute({
 		pattern: "/_emdash/api/revisions/[revisionId]",
@@ -574,6 +559,17 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/terms/[taxonomy].ts"),
 	});
 
+	// Relation definition routes (reference field relations)
+	injectRoute({
+		pattern: "/_emdash/api/relations",
+		entrypoint: resolveRoute("api/relations/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/relations/[id]",
+		entrypoint: resolveRoute("api/relations/[id]/index.ts"),
+	});
+
 	// Plugin management routes (under /admin to avoid conflict with plugin API routes)
 	injectRoute({
 		pattern: "/_emdash/api/admin/plugins",

package/src/astro/integration/vite-config.ts

@@ -631,14 +631,20 @@ export function createViteConfig(
 			// When using dist, pre-bundle to avoid re-optimization on first hydration.
 			// lowlight pulls in a CommonJS highlight.js entry, so the inline Portable
 			// Text editor requires these to be pre-bundled with ESM interop in dev.
+			// Bare ids would not resolve on pnpm sites, which have no top-level copy.
 			include: useSource
-				? ["@astrojs/react/client.js", "lowlight", "highlight.js", "highlight.js/lib/core"]
+				? [
+						"@astrojs/react/client.js",
+						"emdash > lowlight",
+						"emdash > highlight.js",
+						"emdash > highlight.js/lib/core",
+					]
 				: [
 						"@emdash-cms/admin",
 						"@astrojs/react/client.js",
-						"lowlight",
-						"highlight.js",
-						"highlight.js/lib/core",
+						"emdash > lowlight",
+						"emdash > highlight.js",
+						"emdash > highlight.js/lib/core",
 					],
 			exclude: cloudflare ? ["virtual:emdash"] : [...NODE_NATIVE_EXTERNALS, "virtual:emdash"],
 		},

package/src/astro/middleware.ts

@@ -947,6 +947,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					handleMediaGet: runtime.handleMediaGet.bind(runtime),
 					handleMediaUpload: runtime.handleMediaUpload.bind(runtime),
 					handleMediaCreate: runtime.handleMediaCreate.bind(runtime),
+					handleMediaRegisterUpload: runtime.handleMediaRegisterUpload.bind(runtime),
 					handleMediaUpdate: runtime.handleMediaUpdate.bind(runtime),
 					...(runtime.handleMediaReplaceMetadata
 						? {

package/src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts

@@ -1,19 +1,22 @@
 /**
- * Content-entry reference children endpoint (parent side)
+ * Content-entry reference children endpoint (parent side), read-only.
  *
- * GET  /_emdash/api/content/:collection/:id/references/:relation/children
- * POST /_emdash/api/content/:collection/:id/references/:relation/children
+ * GET /_emdash/api/content/:collection/:id/references/:relation/children
+ *
+ * A selection is written with the entry that holds it, through the `references`
+ * key of the content create and update bodies. Writing edges here instead would
+ * put them live on a collection that keeps drafts, past staging, discard and
+ * publication.
  */
 
 import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
-import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
+import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleReferenceChildrenGet, handleReferenceChildrenSet } from "#api/handlers/relations.js";
-import { isParseError, parseBody, parseQuery } from "#api/parse.js";
-import { cursorPaginationQuery, setReferenceChildrenBody } from "#api/schemas.js";
-import { ContentRepository } from "#db/repositories/content.js";
+import { handleReferenceChildrenGet } from "#api/handlers/relations.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { cursorPaginationQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
@@ -47,49 +50,3 @@ export const GET: APIRoute = async ({ params, request, locals }) => {
 		return handleError(error, "Failed to get references", "REFERENCES_GET_ERROR");
 	}
 };
-
-export const POST: APIRoute = async ({ params, request, locals }) => {
-	const { emdash, user } = locals;
-	const { collection, id, relation } = params;
-
-	if (!collection || !id || !relation) {
-		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
-	}
-
-	const dbErr = requireDb(emdash?.db);
-	if (dbErr) return dbErr;
-	// Gate on the base edit capability BEFORE the existence lookup. Resolving the
-	// entry first would let a user with no edit permission distinguish real ids
-	// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy
-	// edge POST, which checks `content:edit_own` before fetching the entry.
-	const denied = requirePerm(user, "content:edit_own");
-	if (denied) return denied;
-
-	// Resolve the parent entry to gate on its author (ownership-aware write).
-	const parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);
-	if (!parent) return apiError("NOT_FOUND", "Content not found", 404);
-
-	const editDenied = requireOwnerPerm(
-		user,
-		parent.authorId ?? "",
-		"content:edit_own",
-		"content:edit_any",
-	);
-	if (editDenied) return editDenied;
-
-	try {
-		const body = await parseBody(request, setReferenceChildrenBody);
-		if (isParseError(body)) return body;
-
-		const result = await handleReferenceChildrenSet(
-			emdash.db,
-			collection,
-			id,
-			relation,
-			body.childIds,
-		);
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to set references", "REFERENCES_SET_ERROR");
-	}
-};

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -28,7 +28,9 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	const id = params.id!;
 	const locale = url.searchParams.get("locale") || undefined;
 
-	const result = await emdash.handleContentGet(collection, id, locale);
+	const result = await emdash.handleContentGet(collection, id, locale, {
+		includeDrafts: hasPermission(user, "content:read_drafts"),
+	});
 
 	// Hide non-published items from users without content:read_drafts. Return
 	// 404 (not 403) so subscribers can't enumerate draft IDs by status code.

package/src/astro/routes/api/oauth/device/authorize.ts

@@ -1,8 +1,10 @@
 /**
+ * GET  /_emdash/api/oauth/device/authorize?user_code=XXXX-XXXX
  * POST /_emdash/api/oauth/device/authorize
  *
- * User submits the user code after logging in via the browser.
- * This endpoint requires authentication (the user must be logged in).
+ * GET returns the scopes a pending user code requested, for display before
+ * approval. POST approves or denies the code after the user logs in via the
+ * browser. Both require authentication (the user must be logged in).
  */
 
 /// <reference types="emdash/locals" />
@@ -11,16 +13,43 @@ import type { APIRoute } from "astro";
 import { z } from "zod";
 
 import { apiError, handleError, unwrapResult } from "#api/error.js";
-import { handleDeviceAuthorize } from "#api/handlers/device-flow.js";
-import { isParseError, parseBody } from "#api/parse.js";
+import { handleDeviceAuthorize, handleDeviceCodeLookup } from "#api/handlers/device-flow.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 
 export const prerender = false;
 
+const lookupSchema = z.object({
+	user_code: z.string().min(1),
+});
+
 const authorizeSchema = z.object({
 	user_code: z.string().min(1),
 	action: z.enum(["approve", "deny"]).optional(),
 });
 
+export const GET: APIRoute = async ({ url, locals }) => {
+	const { emdash } = locals;
+	const { user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!user) {
+		return apiError("NOT_AUTHENTICATED", "Authentication required", 401);
+	}
+
+	try {
+		const query = parseQuery(url, lookupSchema);
+		if (isParseError(query)) return query;
+
+		const result = await handleDeviceCodeLookup(emdash.db, user.role, query);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to look up device code", "DEVICE_CODE_LOOKUP_ERROR");
+	}
+};
+
 export const POST: APIRoute = async ({ request, locals }) => {
 	const { emdash } = locals;
 	const { user } = locals;

package/src/astro/routes/api/relations/index.ts

@@ -1,7 +1,7 @@
 /**
  * Relation definitions endpoint
  *
- * GET  /_emdash/api/relations[?locale=xx] - List relation definitions
+ * GET  /_emdash/api/relations[?collection=xx] - List relation definitions
  * POST /_emdash/api/relations              - Create a relation definition
  */
 
@@ -11,7 +11,7 @@ import { requirePerm } from "#api/authorize.js";
 import { handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleRelationCreate, handleRelationList } from "#api/handlers/relations.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
-import { createRelationBody, localeFilterQuery } from "#api/schemas.js";
+import { createRelationBody, relationListQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
@@ -24,11 +24,11 @@ export const GET: APIRoute = async ({ request, locals }) => {
 	const denied = requirePerm(user, "schema:read");
 	if (denied) return denied;
 
-	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	const query = parseQuery(new URL(request.url), relationListQuery);
 	if (isParseError(query)) return query;
 
 	try {
-		const result = await handleRelationList(emdash.db, { locale: query.locale });
+		const result = await handleRelationList(emdash.db, { collection: query.collection });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to list relations", "RELATION_LIST_ERROR");

package/src/astro/routes/api/schema/collections/[slug]/fields/[fieldSlug].ts

@@ -54,7 +54,7 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	return unwrapResult(result);
 };
 
-export const DELETE: APIRoute = async ({ params, locals }) => {
+export const DELETE: APIRoute = async ({ params, url, locals }) => {
 	const { emdash, user } = locals;
 	const collectionSlug = params.slug!;
 	const fieldSlug = params.fieldSlug!;
@@ -65,6 +65,10 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "schema:manage");
 	if (denied) return denied;
 
-	const result = await handleSchemaFieldDelete(emdash.db, collectionSlug, fieldSlug);
+	// DELETE carries no body, so the cascade opt-in rides on the query string,
+	// matching `?force=true` on collection delete.
+	const result = await handleSchemaFieldDelete(emdash.db, collectionSlug, fieldSlug, {
+		deleteRelation: url.searchParams.get("deleteRelation") === "true",
+	});
 	return unwrapResult(result);
 };

package/src/astro/routes/api/setup/index.ts

@@ -10,14 +10,25 @@ export const prerender = false;
 
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
-import { getPublicOrigin } from "#api/public-url.js";
+import { getConfiguredOrigin } from "#api/public-url.js";
 import { setupBody } from "#api/schemas.js";
 import { getAuthMode } from "#auth/mode.js";
 import { OptionsRepository } from "#db/repositories/options.js";
-import { applySeed } from "#seed/apply.js";
+import { applySeedWithinBudget, type SeedApplyBudget } from "#seed/apply.js";
 import { loadSeed } from "#seed/load.js";
 import { validateSeed } from "#seed/validate.js";
 
+/**
+ * What one setup request may spend on the seed before the rest continues in
+ * the next request. Cloudflare Workers Free allows 1,000 calls to D1, KV and R2
+ * and 50 external fetches per request. A `$media` download takes at least three
+ * fetches (two DNS-over-HTTPS lookups in `ssrfSafeFetch`, then the file) and
+ * three more per redirect. The margin covers a redirect per download, the entry
+ * that crosses the budget with its images, the phases after content and the
+ * object-cache writes at the end.
+ */
+const SEED_BUDGET_PER_REQUEST: SeedApplyBudget = { queries: 500, mediaDownloads: 5 };
+
 export const POST: APIRoute = async ({ request, url, locals }) => {
 	const { emdash } = locals;
 
@@ -40,6 +51,19 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 			// Options table doesn't exist yet — first-ever setup, allow it
 		}
 
+		const configuredSiteUrl = getConfiguredOrigin(emdash.config);
+		const loopbackHost =
+			url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+		const siteUrl =
+			configuredSiteUrl ?? (import.meta.env.DEV && loopbackHost ? url.origin : undefined);
+		if (!siteUrl) {
+			return apiError(
+				"SITE_URL_REQUIRED",
+				"Set siteUrl or EMDASH_SITE_URL before running production setup",
+				500,
+			);
+		}
+
 		// Parse request body
 		const body = await parseBody(request, setupBody);
 		if (isParseError(body)) return body;
@@ -60,16 +84,22 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 			return apiError("INVALID_SEED", `Invalid seed file: ${validation.errors.join(", ")}`, 400);
 		}
 
-		let result;
+		let seeded;
 		try {
-			result = await applySeed(emdash.db, seed, {
-				includeContent: body.includeContent,
-				onConflict: "skip",
-				storage: emdash.storage ?? undefined,
-			});
+			seeded = await applySeedWithinBudget(
+				emdash.db,
+				seed,
+				{
+					includeContent: body.includeContent,
+					onConflict: "skip",
+					storage: emdash.storage ?? undefined,
+				},
+				SEED_BUDGET_PER_REQUEST,
+			);
 		} catch (error) {
 			return handleError(error, "Failed to apply seed", "SEED_ERROR");
 		}
+		const { result, complete: seedComplete, progress: seedProgress } = seeded;
 
 		// Store setup state
 		// In external auth mode, mark setup complete immediately (first user to login becomes admin)
@@ -85,35 +115,48 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 			// observe an empty value and race to write. A spoofed Host header
 			// on a later call during the wizard window must not be able to
 			// replace the first value.
-			const siteUrl = getPublicOrigin(url, emdash.config);
 			await options.setIfAbsent("emdash:site_url", siteUrl);
 
-			if (useExternalAuth) {
-				// External auth mode: mark setup complete now
-				// First user to log in via external provider will become admin
-				await options.set("emdash:setup_complete", true);
-				await options.set("emdash:site_title", body.title);
-				if (body.tagline) {
-					await options.set("emdash:site_tagline", body.tagline);
+			if (seedComplete) {
+				if (useExternalAuth) {
+					// External auth mode: mark setup complete now
+					// First user to log in via external provider will become admin
+					await options.set("emdash:setup_complete", true);
+					await options.set("emdash:site_title", body.title);
+					if (body.tagline) {
+						await options.set("emdash:site_tagline", body.tagline);
+					}
+				} else {
+					// Passkey/provider mode: store state for next step (admin creation)
+					await options.set("emdash:setup_state", {
+						step: "site_complete",
+						title: body.title,
+						tagline: body.tagline,
+					});
 				}
-			} else {
-				// Passkey/provider mode: store state for next step (admin creation)
-				await options.set("emdash:setup_state", {
-					step: "site_complete",
-					title: body.title,
-					tagline: body.tagline,
-				});
 			}
 		} catch (error) {
 			console.error("Failed to save setup state:", error);
 			// Non-fatal - continue anyway
 		}
 
+		if (!seedComplete) {
+			// The wizard posts again; items already created are skipped.
+			return apiSuccess({
+				success: true,
+				setupComplete: false,
+				seedComplete: false,
+				seedProgress,
+				result,
+			});
+		}
+
 		// Return success with result
 		return apiSuccess({
 			success: true,
 			// In external auth mode, setup is complete - redirect to admin
 			setupComplete: useExternalAuth,
+			seedComplete: true,
 			result,
 		});
 	} catch (error) {

package/src/astro/routes/api/snapshot.ts

@@ -91,7 +91,8 @@ export const GET: APIRoute = async ({ request, locals, url, session }) => {
 	}
 
 	try {
-		const includeDrafts = url.searchParams.get("drafts") === "true";
+		// A preview signature covers published content only.
+		const includeDrafts = !authorized && url.searchParams.get("drafts") === "true";
 		const snapshot = await generateSnapshot(emdash.db, {
 			includeDrafts,
 			origin: getPublicOrigin(url, emdash.config),

package/src/astro/types.ts

@@ -197,6 +197,8 @@ export interface EmDashManifest {
 	 * browse or install flows.
 	 */
 	marketplace?: boolean;
+	/** Whether a sandbox runner is enabled for installing and running sandboxed plugins. */
+	sandboxEnabled?: boolean;
 	/**
 	 * Decentralized plugin registry configuration.
 	 *
@@ -304,6 +306,7 @@ export interface EmDashHandlers {
 		collection: string,
 		id: string,
 		locale?: string,
+		referenceOptions?: { includeDrafts: boolean },
 	) => Promise<
 		HandlerResponse<{
 			item: {
@@ -326,6 +329,7 @@ export interface EmDashHandlers {
 			locale?: string;
 			translationOf?: string;
 			taxonomies?: Record<string, string[]>;
+			references?: Record<string, string[]>;
 			createdAt?: string | null;
 			publishedAt?: string | null;
 			migrateBlocks?: boolean;
@@ -352,6 +356,7 @@ export interface EmDashHandlers {
 				noIndex?: boolean;
 			};
 			taxonomies?: Record<string, string[]>;
+			references?: Record<string, string[]>;
 			publishedAt?: string | null;
 			_rev?: string;
 			migrateBlocks?: boolean;
@@ -466,6 +471,11 @@ export interface EmDashHandlers {
 		folderId?: string | null;
 	}) => Promise<HandlerResponse>;
 
+	handleMediaRegisterUpload: (input: {
+		storageKey: string;
+		authorId?: string;
+	}) => Promise<HandlerResponse>;
+
 	handleMediaUpdate: (
 		id: string,
 		input: {