emdash 0.40.1 → 0.41.0

package/src/api/handlers/validate-references.ts

@@ -0,0 +1,146 @@
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+import { requestCached } from "../../request-cache.js";
+import type { ApiResult } from "../types.js";
+
+export interface ReferenceFieldConstraints {
+	/** Field slug — how the entry API addresses the selection. */
+	slug: string;
+	/** Relation slug the field binds to. */
+	relation: string;
+	/** Relation id, for the reads that address the link table directly. */
+	relationId: string | null;
+	/** Which end of the relation the field's own collection sits on. */
+	relationSide: "parent" | "child";
+	/** How many entries this side of the relation may hold. `null` is unlimited. */
+	maxSelected: number | null;
+	/** How many this field's selection may hand each entry it selects. */
+	maxOpposite: number | null;
+	required: boolean;
+}
+
+function validationError(message: string): ApiResult<never> {
+	return { success: false, error: { code: "VALIDATION_ERROR", message } };
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null;
+}
+
+/**
+ * Every reference field on a collection that is bound to a relation, by field
+ * slug — the key the entry API takes a selection under.
+ */
+export function referenceFieldConstraints(
+	db: Kysely<Database>,
+	collection: string,
+): Promise<Map<string, ReferenceFieldConstraints>> {
+	return requestCached(`reference-field-constraints:${collection}`, async () => {
+		const fields = await db
+			.selectFrom("_emdash_fields")
+			.innerJoin("_emdash_collections", "_emdash_collections.id", "_emdash_fields.collection_id")
+			.select(["_emdash_fields.slug", "_emdash_fields.required", "_emdash_fields.validation"])
+			.where("_emdash_collections.slug", "=", collection)
+			.where("_emdash_fields.type", "=", "reference")
+			.execute();
+
+		// Cardinality lives on the relation, not the field: with both ends of a
+		// relation bindable, two fields carrying their own limits could disagree
+		// about one edge set. The field contributes only which end it views.
+		const relations = await db
+			.selectFrom("_emdash_relations")
+			.select(["id", "slug", "max_children_per_parent", "max_parents_per_child"])
+			.execute();
+		const limits = new Map(relations.map((r) => [r.slug, r]));
+
+		const constraints = new Map<string, ReferenceFieldConstraints>();
+		for (const field of fields) {
+			if (!field.validation) continue;
+
+			let parsed: unknown;
+			try {
+				parsed = JSON.parse(field.validation);
+			} catch {
+				continue;
+			}
+			if (!isRecord(parsed) || typeof parsed.relation !== "string") continue;
+
+			const relation = limits.get(parsed.relation);
+			const relationSide = parsed.relationSide === "child" ? "child" : "parent";
+			const onChildSide = relationSide === "child";
+
+			constraints.set(field.slug, {
+				slug: field.slug,
+				relation: parsed.relation,
+				relationId: relation?.id ?? null,
+				relationSide,
+				maxSelected: onChildSide
+					? (relation?.max_parents_per_child ?? null)
+					: (relation?.max_children_per_parent ?? null),
+				maxOpposite: onChildSide
+					? (relation?.max_children_per_parent ?? null)
+					: (relation?.max_parents_per_child ?? null),
+				required: field.required === 1,
+			});
+		}
+		return constraints;
+	});
+}
+
+/**
+ * The field viewing one end of a relation, for the relation-scoped routes, which
+ * address a relation rather than a field. At most one field binds each
+ * (relation, side), so this is unambiguous.
+ */
+export function constraintsForRelationSide(
+	constraints: Map<string, ReferenceFieldConstraints>,
+	relation: string,
+	side: "parent" | "child",
+): ReferenceFieldConstraints | undefined {
+	for (const field of constraints.values()) {
+		if (field.relation === relation && field.relationSide === side) return field;
+	}
+	return undefined;
+}
+
+export function validateReferenceSelection(
+	constraints: ReferenceFieldConstraints,
+	childIds: string[],
+): ApiResult<true> {
+	const max = constraints.maxSelected;
+	if (max !== null && childIds.length > max) {
+		return validationError(
+			max === 1
+				? `Field '${constraints.slug}' accepts a single reference, received ${childIds.length}.`
+				: `Field '${constraints.slug}' accepts at most ${max} references, received ${childIds.length}.`,
+		);
+	}
+	if (constraints.required && childIds.length === 0) {
+		return validationError(
+			`Field '${constraints.slug}' is required and must reference at least one entry.`,
+		);
+	}
+	return { success: true, data: true };
+}
+
+export async function validateRequiredReferencesPresent(
+	db: Kysely<Database>,
+	collection: string,
+	references: Record<string, string[]> | undefined,
+	translationOf: string | undefined,
+): Promise<ApiResult<true>> {
+	// References belong to a translation group, so a new locale row inherits
+	// the source group's existing edges when its payload omits them.
+	if (translationOf) return { success: true, data: true };
+
+	const constraints = await referenceFieldConstraints(db, collection);
+	for (const field of constraints.values()) {
+		if (!field.required) continue;
+		if (references && Object.hasOwn(references, field.slug)) continue;
+		return validationError(
+			`Field '${field.slug}' is required and must reference at least one entry.`,
+		);
+	}
+	return { success: true, data: true };
+}

package/src/api/schemas/content.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { SQL_BATCH_SIZE } from "../../utils/chunks.js";
 import { bylineSummarySchema, bylineCreditSchema, contentBylineInputSchema } from "./bylines.js";
 import { cursorPaginationQuery, httpUrl, localeCode } from "./common.js";
+import { referenceChildrenResponseSchema } from "./relations.js";
 
 // ---------------------------------------------------------------------------
 // Content: Input schemas
@@ -209,6 +210,10 @@ export const contentCreateBody = z
 			description:
 				"Taxonomy term assignments as { taxonomyName: [termSlug, ...] }, resolved in the entry's locale.",
 		}),
+		references: z.record(z.string(), z.array(z.string()).max(1000)).optional().meta({
+			description:
+				"Reference selections as { fieldSlug: [entryId, ...] }, in display order. Written as content-reference links in the same transaction as the entry. A field bound to the child end of its relation selects the entries pointing at this one, which carry no order.",
+		}),
 		publishedAt: contentDateOverride,
 		createdAt: contentDateOverride,
 		migrateBlocks: z.boolean().optional(),
@@ -234,6 +239,10 @@ export const contentUpdateBody = z
 			description:
 				"Replace taxonomy assignments as { taxonomyName: [termSlug, ...] }. Only named taxonomies are touched; pass an empty array to clear a taxonomy.",
 		}),
+		references: z.record(z.string(), z.array(z.string()).max(1000)).optional().meta({
+			description:
+				"Reference selections as { fieldSlug: [entryId, ...] }, in display order. Written as content-reference links in the same transaction as the entry. A field bound to the child end of its relation selects the entries pointing at this one, which carry no order.",
+		}),
 		publishedAt: contentDateOverride,
 		migrateBlocks: z.boolean().optional(),
 		replaceBlocks: z.boolean().optional(),
@@ -374,6 +383,10 @@ export const contentItemSchema = z
 		locale: z.string().nullable(),
 		translationGroup: z.string().nullable(),
 		seo: contentSeoSchema.optional(),
+		// First page of each reference field's selection, keyed by field slug. Only
+		// present when the editor GET path opts into hydration
+		// (`referenceOptions`); omitted otherwise, so it's optional here.
+		references: z.record(z.string(), referenceChildrenResponseSchema).optional(),
 	})
 	.meta({ id: "ContentItem" });
 

package/src/api/schemas/relations.ts

@@ -1,7 +1,5 @@
 import { z } from "zod";
 
-import { localeCode } from "./common.js";
-
 const slugPattern = /^[a-z][a-z0-9_]*$/;
 const collectionSlug = z
 	.string()
@@ -9,95 +7,107 @@ const collectionSlug = z
 	.max(63)
 	.regex(slugPattern, "Invalid collection slug format");
 
+/** NULL means unlimited on that side. */
+const roleLimit = z.number().int().positive().nullable().optional();
+const roleLabelSingular = z.string().min(1).max(200).nullable().optional();
+
 export const createRelationBody = z
 	.object({
-		name: z
+		slug: z
 			.string()
 			.min(1)
 			.max(63)
-			.regex(slugPattern, "Name must be lowercase alphanumeric with underscores"),
-		parentCollection: collectionSlug.optional(),
-		childCollection: collectionSlug.optional(),
+			.regex(slugPattern, "Slug must be lowercase alphanumeric with underscores"),
+		parentCollection: collectionSlug,
+		childCollection: collectionSlug,
 		parentLabel: z.string().min(1).max(200),
+		parentLabelSingular: roleLabelSingular,
 		childLabel: z.string().min(1).max(200),
-		locale: localeCode.optional(),
-		translationOf: z.string().min(1).optional(),
+		childLabelSingular: roleLabelSingular,
+		maxChildrenPerParent: roleLimit,
+		maxParentsPerChild: roleLimit,
 	})
-	// A translation inherits its structural fields (name, parentCollection,
-	// childCollection) from the source relation, so the handler ignores any
-	// collections supplied alongside `translationOf`. Require them only when
-	// minting a base relation, so callers aren't forced to pass discarded values.
-	.refine(
-		(body) =>
-			body.translationOf !== undefined ||
-			(body.parentCollection !== undefined && body.childCollection !== undefined),
-		{ message: "parentCollection and childCollection are required unless translationOf is set" },
-	)
 	.meta({ id: "CreateRelationBody" });
 
+export const relationListQuery = z
+	.object({
+		collection: collectionSlug.optional().meta({
+			description: "Only relations with this collection on one end",
+		}),
+	})
+	.meta({ id: "RelationListQuery" });
+
 export const updateRelationBody = z
 	.object({
 		parentLabel: z.string().min(1).max(200).optional(),
+		parentLabelSingular: roleLabelSingular,
 		childLabel: z.string().min(1).max(200).optional(),
+		childLabelSingular: roleLabelSingular,
+		maxChildrenPerParent: roleLimit,
+		maxParentsPerChild: roleLimit,
 	})
 	// Reject empty payloads: an update touching no field is a client mistake, not
 	// a successful no-op. Without this, `{}` validates and the handler returns 200
 	// with the unchanged row, so a typo'd payload looks like it landed.
-	.refine((body) => body.parentLabel !== undefined || body.childLabel !== undefined, {
-		message: "At least one of parentLabel or childLabel is required",
+	.refine((body) => Object.values(body).some((value) => value !== undefined), {
+		message: "At least one field is required",
 	})
 	.meta({ id: "UpdateRelationBody" });
 
-export const setReferenceChildrenBody = z
-	.object({ childIds: z.array(z.string().min(1)).max(1000) })
-	.meta({ id: "SetReferenceChildrenBody" });
-
 export const relationDefSchema = z
 	.object({
 		id: z.string(),
-		name: z.string(),
+		slug: z.string(),
 		parentCollection: z.string(),
 		childCollection: z.string(),
 		parentLabel: z.string(),
+		parentLabelSingular: z.string().nullable(),
 		childLabel: z.string(),
-		locale: z.string(),
-		translationGroup: z.string(),
+		childLabelSingular: z.string().nullable(),
+		maxChildrenPerParent: z.number().int().nullable(),
+		maxParentsPerChild: z.number().int().nullable(),
 	})
 	.meta({ id: "RelationDef" });
 
+/** A relation plus what deleting it would take: the fields that view it and
+ * how many links it holds. */
+export const relationWithUsageSchema = relationDefSchema
+	.extend({
+		boundFields: z.array(
+			z.object({
+				collectionSlug: z.string(),
+				fieldSlug: z.string(),
+				side: z.enum(["parent", "child"]),
+			}),
+		),
+		linkCount: z.number().int(),
+	})
+	.meta({ id: "RelationWithUsage" });
+
 export const relationListResponseSchema = z
-	.object({ relations: z.array(relationDefSchema) })
+	.object({ relations: z.array(relationWithUsageSchema) })
 	.meta({ id: "RelationListResponse" });
 
 export const relationResponseSchema = z
-	.object({ relation: relationDefSchema })
+	.object({ relation: relationWithUsageSchema })
 	.meta({ id: "RelationResponse" });
 
-export const relationTranslationsSchema = z
-	.object({
-		translationGroup: z.string(),
-		translations: z.array(
-			z.object({
-				id: z.string(),
-				name: z.string(),
-				locale: z.string(),
-				parentLabel: z.string(),
-				childLabel: z.string(),
-			}),
-		),
-	})
-	.meta({ id: "RelationTranslations" });
-
 export const entryRefSchema = z
 	.object({
 		id: z.string(),
 		slug: z.string().nullable(),
 		collection: z.string(),
+		// Display label sourced from the entry's `title`, then `name`, field —
+		// `null` when neither is set. Mirrors the runtime `EntryRef`.
+		title: z.string().nullable(),
 		// The actual locale of the resolved variant. When no variant matches the
 		// requesting entry's locale, the ref falls back to another locale's row;
 		// this field makes that substitution explicit instead of silently
 		// presenting a wrong-locale entry under the requested context.
 		locale: z.string().nullable(),
+		// The translation group the ref resolved from — the locale-stable identity
+		// of the referenced entry, which `id` is not.
+		translationGroup: z.string().nullable(),
 		sortOrder: z.number().int().optional(),
 	})
 	.meta({ id: "ReferenceEntryRef" });

package/src/api/schemas/schema.ts

@@ -108,6 +108,20 @@ const fieldValidation = z
 			.min(1, "allowedMimeTypes must not be empty — omit the field to allow all types")
 			.max(64, "allowedMimeTypes may contain at most 64 entries")
 			.optional(),
+		// Reference fields: the picker targets a collection and may allow more
+		// than one entry. Without these keys Zod strips them and the create
+		// handler rejects the field for a missing target collection.
+		targetCollection: z.string().min(1).optional(),
+		multiple: z.boolean().optional(),
+		// Reference fields: bind to an existing relation instead of creating one,
+		// and say which of its ends this collection sits on.
+		relation: z
+			.string()
+			.min(1)
+			.max(63)
+			.regex(slugPattern, "Invalid relation slug format")
+			.optional(),
+		relationSide: z.enum(["parent", "child"]).optional(),
 		allowedTypes: z.array(z.string().min(1).max(63).regex(slugPattern)).optional(),
 		retiredTypes: z.array(z.string().min(1).max(63).regex(slugPattern)).optional(),
 	})

package/src/astro/integration/routes.ts

@@ -218,22 +218,13 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/translations.ts"),
 	});
 
-	// Content relation routes
-	injectRoute({
-		pattern: "/_emdash/api/relations",
-		entrypoint: resolveRoute("api/relations/index.ts"),
-	});
-
-	injectRoute({
-		pattern: "/_emdash/api/relations/[id]",
-		entrypoint: resolveRoute("api/relations/[id]/index.ts"),
-	});
-
+	// Scheduled publishing routes
 	injectRoute({
-		pattern: "/_emdash/api/relations/[id]/translations",
-		entrypoint: resolveRoute("api/relations/[id]/translations.ts"),
+		pattern: "/_emdash/api/content/[collection]/[id]/schedule",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/schedule.ts"),
 	});
 
+	// Reference field edge routes (children = parent side, parents = backlinks)
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/[id]/references/[relation]/children",
 		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/children.ts"),
@@ -244,12 +235,6 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/references/[relation]/parents.ts"),
 	});
 
-	// Scheduled publishing routes
-	injectRoute({
-		pattern: "/_emdash/api/content/[collection]/[id]/schedule",
-		entrypoint: resolveRoute("api/content/[collection]/[id]/schedule.ts"),
-	});
-
 	// Revision management routes (for restore, etc.)
 	injectRoute({
 		pattern: "/_emdash/api/revisions/[revisionId]",
@@ -574,6 +559,17 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/terms/[taxonomy].ts"),
 	});
 
+	// Relation definition routes (reference field relations)
+	injectRoute({
+		pattern: "/_emdash/api/relations",
+		entrypoint: resolveRoute("api/relations/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/relations/[id]",
+		entrypoint: resolveRoute("api/relations/[id]/index.ts"),
+	});
+
 	// Plugin management routes (under /admin to avoid conflict with plugin API routes)
 	injectRoute({
 		pattern: "/_emdash/api/admin/plugins",

package/src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts

@@ -1,19 +1,22 @@
 /**
- * Content-entry reference children endpoint (parent side)
+ * Content-entry reference children endpoint (parent side), read-only.
  *
- * GET  /_emdash/api/content/:collection/:id/references/:relation/children
- * POST /_emdash/api/content/:collection/:id/references/:relation/children
+ * GET /_emdash/api/content/:collection/:id/references/:relation/children
+ *
+ * A selection is written with the entry that holds it, through the `references`
+ * key of the content create and update bodies. Writing edges here instead would
+ * put them live on a collection that keeps drafts, past staging, discard and
+ * publication.
  */
 
 import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
-import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
+import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleReferenceChildrenGet, handleReferenceChildrenSet } from "#api/handlers/relations.js";
-import { isParseError, parseBody, parseQuery } from "#api/parse.js";
-import { cursorPaginationQuery, setReferenceChildrenBody } from "#api/schemas.js";
-import { ContentRepository } from "#db/repositories/content.js";
+import { handleReferenceChildrenGet } from "#api/handlers/relations.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { cursorPaginationQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
@@ -47,49 +50,3 @@ export const GET: APIRoute = async ({ params, request, locals }) => {
 		return handleError(error, "Failed to get references", "REFERENCES_GET_ERROR");
 	}
 };
-
-export const POST: APIRoute = async ({ params, request, locals }) => {
-	const { emdash, user } = locals;
-	const { collection, id, relation } = params;
-
-	if (!collection || !id || !relation) {
-		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
-	}
-
-	const dbErr = requireDb(emdash?.db);
-	if (dbErr) return dbErr;
-	// Gate on the base edit capability BEFORE the existence lookup. Resolving the
-	// entry first would let a user with no edit permission distinguish real ids
-	// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy
-	// edge POST, which checks `content:edit_own` before fetching the entry.
-	const denied = requirePerm(user, "content:edit_own");
-	if (denied) return denied;
-
-	// Resolve the parent entry to gate on its author (ownership-aware write).
-	const parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);
-	if (!parent) return apiError("NOT_FOUND", "Content not found", 404);
-
-	const editDenied = requireOwnerPerm(
-		user,
-		parent.authorId ?? "",
-		"content:edit_own",
-		"content:edit_any",
-	);
-	if (editDenied) return editDenied;
-
-	try {
-		const body = await parseBody(request, setReferenceChildrenBody);
-		if (isParseError(body)) return body;
-
-		const result = await handleReferenceChildrenSet(
-			emdash.db,
-			collection,
-			id,
-			relation,
-			body.childIds,
-		);
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to set references", "REFERENCES_SET_ERROR");
-	}
-};

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -28,7 +28,9 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	const id = params.id!;
 	const locale = url.searchParams.get("locale") || undefined;
 
-	const result = await emdash.handleContentGet(collection, id, locale);
+	const result = await emdash.handleContentGet(collection, id, locale, {
+		includeDrafts: hasPermission(user, "content:read_drafts"),
+	});
 
 	// Hide non-published items from users without content:read_drafts. Return
 	// 404 (not 403) so subscribers can't enumerate draft IDs by status code.

package/src/astro/routes/api/oauth/device/authorize.ts

@@ -1,8 +1,10 @@
 /**
+ * GET  /_emdash/api/oauth/device/authorize?user_code=XXXX-XXXX
  * POST /_emdash/api/oauth/device/authorize
  *
- * User submits the user code after logging in via the browser.
- * This endpoint requires authentication (the user must be logged in).
+ * GET returns the scopes a pending user code requested, for display before
+ * approval. POST approves or denies the code after the user logs in via the
+ * browser. Both require authentication (the user must be logged in).
  */
 
 /// <reference types="emdash/locals" />
@@ -11,16 +13,43 @@ import type { APIRoute } from "astro";
 import { z } from "zod";
 
 import { apiError, handleError, unwrapResult } from "#api/error.js";
-import { handleDeviceAuthorize } from "#api/handlers/device-flow.js";
-import { isParseError, parseBody } from "#api/parse.js";
+import { handleDeviceAuthorize, handleDeviceCodeLookup } from "#api/handlers/device-flow.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 
 export const prerender = false;
 
+const lookupSchema = z.object({
+	user_code: z.string().min(1),
+});
+
 const authorizeSchema = z.object({
 	user_code: z.string().min(1),
 	action: z.enum(["approve", "deny"]).optional(),
 });
 
+export const GET: APIRoute = async ({ url, locals }) => {
+	const { emdash } = locals;
+	const { user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!user) {
+		return apiError("NOT_AUTHENTICATED", "Authentication required", 401);
+	}
+
+	try {
+		const query = parseQuery(url, lookupSchema);
+		if (isParseError(query)) return query;
+
+		const result = await handleDeviceCodeLookup(emdash.db, user.role, query);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to look up device code", "DEVICE_CODE_LOOKUP_ERROR");
+	}
+};
+
 export const POST: APIRoute = async ({ request, locals }) => {
 	const { emdash } = locals;
 	const { user } = locals;

package/src/astro/routes/api/relations/index.ts

@@ -1,7 +1,7 @@
 /**
  * Relation definitions endpoint
  *
- * GET  /_emdash/api/relations[?locale=xx] - List relation definitions
+ * GET  /_emdash/api/relations[?collection=xx] - List relation definitions
  * POST /_emdash/api/relations              - Create a relation definition
  */
 
@@ -11,7 +11,7 @@ import { requirePerm } from "#api/authorize.js";
 import { handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleRelationCreate, handleRelationList } from "#api/handlers/relations.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
-import { createRelationBody, localeFilterQuery } from "#api/schemas.js";
+import { createRelationBody, relationListQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
@@ -24,11 +24,11 @@ export const GET: APIRoute = async ({ request, locals }) => {
 	const denied = requirePerm(user, "schema:read");
 	if (denied) return denied;
 
-	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	const query = parseQuery(new URL(request.url), relationListQuery);
 	if (isParseError(query)) return query;
 
 	try {
-		const result = await handleRelationList(emdash.db, { locale: query.locale });
+		const result = await handleRelationList(emdash.db, { collection: query.collection });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to list relations", "RELATION_LIST_ERROR");

package/src/astro/routes/api/schema/collections/[slug]/fields/[fieldSlug].ts

@@ -54,7 +54,7 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	return unwrapResult(result);
 };
 
-export const DELETE: APIRoute = async ({ params, locals }) => {
+export const DELETE: APIRoute = async ({ params, url, locals }) => {
 	const { emdash, user } = locals;
 	const collectionSlug = params.slug!;
 	const fieldSlug = params.fieldSlug!;
@@ -65,6 +65,10 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "schema:manage");
 	if (denied) return denied;
 
-	const result = await handleSchemaFieldDelete(emdash.db, collectionSlug, fieldSlug);
+	// DELETE carries no body, so the cascade opt-in rides on the query string,
+	// matching `?force=true` on collection delete.
+	const result = await handleSchemaFieldDelete(emdash.db, collectionSlug, fieldSlug, {
+		deleteRelation: url.searchParams.get("deleteRelation") === "true",
+	});
 	return unwrapResult(result);
 };

package/src/astro/types.ts

@@ -197,6 +197,8 @@ export interface EmDashManifest {
 	 * browse or install flows.
 	 */
 	marketplace?: boolean;
+	/** Whether a sandbox runner is enabled for installing and running sandboxed plugins. */
+	sandboxEnabled?: boolean;
 	/**
 	 * Decentralized plugin registry configuration.
 	 *
@@ -304,6 +306,7 @@ export interface EmDashHandlers {
 		collection: string,
 		id: string,
 		locale?: string,
+		referenceOptions?: { includeDrafts: boolean },
 	) => Promise<
 		HandlerResponse<{
 			item: {
@@ -326,6 +329,7 @@ export interface EmDashHandlers {
 			locale?: string;
 			translationOf?: string;
 			taxonomies?: Record<string, string[]>;
+			references?: Record<string, string[]>;
 			createdAt?: string | null;
 			publishedAt?: string | null;
 			migrateBlocks?: boolean;
@@ -352,6 +356,7 @@ export interface EmDashHandlers {
 				noIndex?: boolean;
 			};
 			taxonomies?: Record<string, string[]>;
+			references?: Record<string, string[]>;
 			publishedAt?: string | null;
 			_rev?: string;
 			migrateBlocks?: boolean;