emdash 0.40.1 → 0.42.0

package/src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts

@@ -1,19 +1,22 @@
 /**
- * Content-entry reference children endpoint (parent side)
+ * Content-entry reference children endpoint (parent side), read-only.
  *
- * GET  /_emdash/api/content/:collection/:id/references/:relation/children
- * POST /_emdash/api/content/:collection/:id/references/:relation/children
+ * GET /_emdash/api/content/:collection/:id/references/:relation/children
+ *
+ * A selection is written with the entry that holds it, through the `references`
+ * key of the content create and update bodies. Writing edges here instead would
+ * put them live on a collection that keeps drafts, past staging, discard and
+ * publication.
  */
 
 import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
-import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
+import { requirePerm } from "#api/authorize.js";
 import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleReferenceChildrenGet, handleReferenceChildrenSet } from "#api/handlers/relations.js";
-import { isParseError, parseBody, parseQuery } from "#api/parse.js";
-import { cursorPaginationQuery, setReferenceChildrenBody } from "#api/schemas.js";
-import { ContentRepository } from "#db/repositories/content.js";
+import { handleReferenceChildrenGet } from "#api/handlers/relations.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { cursorPaginationQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
@@ -47,49 +50,3 @@ export const GET: APIRoute = async ({ params, request, locals }) => {
 		return handleError(error, "Failed to get references", "REFERENCES_GET_ERROR");
 	}
 };
-
-export const POST: APIRoute = async ({ params, request, locals }) => {
-	const { emdash, user } = locals;
-	const { collection, id, relation } = params;
-
-	if (!collection || !id || !relation) {
-		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
-	}
-
-	const dbErr = requireDb(emdash?.db);
-	if (dbErr) return dbErr;
-	// Gate on the base edit capability BEFORE the existence lookup. Resolving the
-	// entry first would let a user with no edit permission distinguish real ids
-	// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy
-	// edge POST, which checks `content:edit_own` before fetching the entry.
-	const denied = requirePerm(user, "content:edit_own");
-	if (denied) return denied;
-
-	// Resolve the parent entry to gate on its author (ownership-aware write).
-	const parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);
-	if (!parent) return apiError("NOT_FOUND", "Content not found", 404);
-
-	const editDenied = requireOwnerPerm(
-		user,
-		parent.authorId ?? "",
-		"content:edit_own",
-		"content:edit_any",
-	);
-	if (editDenied) return editDenied;
-
-	try {
-		const body = await parseBody(request, setReferenceChildrenBody);
-		if (isParseError(body)) return body;
-
-		const result = await handleReferenceChildrenSet(
-			emdash.db,
-			collection,
-			id,
-			relation,
-			body.childIds,
-		);
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to set references", "REFERENCES_SET_ERROR");
-	}
-};

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -28,7 +28,9 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	const id = params.id!;
 	const locale = url.searchParams.get("locale") || undefined;
 
-	const result = await emdash.handleContentGet(collection, id, locale);
+	const result = await emdash.handleContentGet(collection, id, locale, {
+		includeDrafts: hasPermission(user, "content:read_drafts"),
+	});
 
 	// Hide non-published items from users without content:read_drafts. Return
 	// 404 (not 403) so subscribers can't enumerate draft IDs by status code.

package/src/astro/routes/api/import/wordpress/execute.ts

@@ -18,11 +18,13 @@ import {
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { wxrChunkCursor, wxrChunkState, wxrImportConfig } from "#api/schemas.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 import { resolveImportByline } from "#import/utils.js";
 import {
 	attachPostTaxonomies,
 	isWxrTaxonomyConflictError,
+	loadTaxonomyPlanFromDb,
 	mirrorTermsToLocales,
 	preImportWxrTaxonomies,
 	setPostTermAssignmentsReplacing,
@@ -35,6 +37,30 @@ import { sanitizeSlug } from "./analyze.js";
 
 export const prerender = false;
 
+/** Posts processed per Worker invocation in chunked WXR imports. */
+const WXR_CONTENT_CHUNK_SIZE = 30;
+
+/** Phase/cursor payload for chunked WXR imports. */
+interface WxrChunkCursor {
+	offset: number;
+	source: string;
+	taxonomiesReady: true;
+}
+
+/** Cross-chunk state carried by the client. */
+interface WxrChunkState {
+	translationGroups: Record<string, string>;
+}
+
+/** Chunked response shape mirrors the wordpress-plugin execute endpoint. */
+interface WxrChunkResponse {
+	success: boolean;
+	result: ImportResult;
+	done: boolean;
+	cursor?: WxrChunkCursor;
+	chunk?: WxrChunkState;
+}
+
 export interface ImportConfig {
 	/** Map WordPress post types to EmDash collections */
 	postTypeMappings: Record<
@@ -109,11 +135,61 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			return apiError("VALIDATION_ERROR", "No config provided", 400);
 		}
 
-		const config: ImportConfig = JSON.parse(configJson);
+		const parsedConfig = parseJsonField(configJson, "config");
+		if ("response" in parsedConfig) return parsedConfig.response;
+		const configResult = wxrImportConfig.safeParse(parsedConfig.value);
+		if (!configResult.success) {
+			return apiError("VALIDATION_ERROR", "Invalid import config", 400);
+		}
+		const config: ImportConfig = configResult.data;
+
+		const phaseEntry = formData.get("phase");
+		if (
+			phaseEntry !== null &&
+			phaseEntry !== "taxonomy" &&
+			phaseEntry !== "content" &&
+			phaseEntry !== "finalize"
+		) {
+			return apiError("VALIDATION_ERROR", "Invalid import phase", 400);
+		}
+		const phase = phaseEntry;
+
+		const cursorEntry = formData.get("cursor");
+		let cursor: WxrChunkCursor | undefined;
+		if (typeof cursorEntry === "string" && cursorEntry.length > 0) {
+			const parsedCursor = parseJsonField(cursorEntry, "cursor");
+			if ("response" in parsedCursor) return parsedCursor.response;
+			const cursorResult = wxrChunkCursor.safeParse(parsedCursor.value);
+			if (!cursorResult.success) {
+				return apiError("VALIDATION_ERROR", "Invalid import cursor", 400);
+			}
+			cursor = cursorResult.data;
+		}
+
+		const chunkEntry = formData.get("chunk");
+		let incomingChunk: WxrChunkState | undefined;
+		if (typeof chunkEntry === "string" && chunkEntry.length > 0) {
+			const parsedChunk = parseJsonField(chunkEntry, "chunk");
+			if ("response" in parsedChunk) return parsedChunk.response;
+			const chunkResult = wxrChunkState.safeParse(parsedChunk.value);
+			if (!chunkResult.success) {
+				return apiError("VALIDATION_ERROR", "Invalid import chunk state", 400);
+			}
+			incomingChunk = chunkResult.data;
+		}
 
 		// Parse WXR
 		const text = await file.text();
 		const wxr = await parseWxrString(text);
+		const source = await importFingerprint(text, configJson);
+
+		if (cursor && cursor.source !== source) {
+			return apiError(
+				"WXR_IMPORT_SOURCE_CHANGED",
+				"The WXR file or import configuration changed after this import started",
+				409,
+			);
+		}
 
 		// Build attachment ID -> URL map for featured images
 		const attachmentMap = new Map<string, string>();
@@ -130,6 +206,81 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			authorDisplayNames.set(author.login, author.displayName || author.login);
 		}
 
+		if (phase === "content") {
+			if (!cursor?.taxonomiesReady) {
+				return apiError("VALIDATION_ERROR", "Taxonomy preparation is not complete", 400);
+			}
+			const chunkResponse = await runContentChunk(
+				wxr,
+				config,
+				emdash,
+				emdashManifest,
+				attachmentMap,
+				authorDisplayNames,
+				cursor,
+				incomingChunk,
+				source,
+			);
+			if (chunkResponse instanceof Response) return chunkResponse;
+			return apiSuccess(chunkResponse);
+		}
+
+		if (phase === "taxonomy") {
+			if (cursor || incomingChunk) {
+				return apiError("VALIDATION_ERROR", "Taxonomy preparation cannot be resumed", 400);
+			}
+			let taxonomyPlan: TaxonomyImportPlan;
+			try {
+				taxonomyPlan = await prepareTaxonomies(wxr, emdash, config.locale);
+			} catch (error) {
+				if (isWxrTaxonomyConflictError(error)) {
+					console.error("[WXR_IMPORT_TAXONOMY_CONFLICT]", error);
+					return apiError("WXR_IMPORT_TAXONOMY_CONFLICT", error.publicMessage, 409);
+				}
+				throw error;
+			}
+			const result = emptyImportResult();
+			result.taxonomies = {
+				termsCreated: taxonomyPlan.termsCreated,
+				termsReused: taxonomyPlan.termsReused,
+				assignments: 0,
+				missingTaxonomies: taxonomyPlan.missingTaxonomies,
+			};
+			return apiSuccess({
+				success: true,
+				result,
+				done: true,
+				cursor: { offset: 0, source, taxonomiesReady: true as const },
+				chunk: { translationGroups: {} },
+			});
+		}
+
+		if (phase === "finalize") {
+			if (!cursor || cursor.offset !== wxr.posts.length) {
+				return apiError("VALIDATION_ERROR", "Content import is not complete", 400);
+			}
+			const result = emptyImportResult();
+			if (config.importSections !== false) {
+				const sectionsResult = await importReusableBlocksAsSections(wxr.posts, emdash.db);
+				result.sections = {
+					created: sectionsResult.sectionsCreated,
+					skipped: sectionsResult.sectionsSkipped,
+				};
+				result.errors.push(...sectionsResult.errors);
+				result.success = result.errors.length === 0;
+			}
+			return apiSuccess({ success: result.success, result, done: true });
+		}
+
+		if (wxr.posts.length > WXR_CONTENT_CHUNK_SIZE) {
+			return apiError(
+				"WXR_IMPORT_TOO_LARGE",
+				`This WXR contains ${wxr.posts.length} posts, which exceeds the ${WXR_CONTENT_CHUNK_SIZE}-post limit for a single import request. ` +
+					`Run the import in chunked mode or split the file into smaller exports.`,
+				413,
+			);
+		}
+
 		// Pre-create taxonomy terms (categories, tags, custom taxonomies) so
 		// per-post assignments can resolve to existing rows. Done before any
 		// content insert because WXR exports list terms at the top of the
@@ -205,6 +356,105 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	}
 };
 
+function parseJsonField(
+	value: string,
+	fieldName: string,
+): { value: unknown } | { response: Response } {
+	try {
+		return { value: JSON.parse(value) };
+	} catch {
+		return { response: apiError("VALIDATION_ERROR", `Invalid JSON in ${fieldName}`, 400) };
+	}
+}
+
+async function importFingerprint(text: string, configJson: string): Promise<string> {
+	const bytes = new TextEncoder().encode(`${configJson}\u0000${text}`);
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function emptyImportResult(): ImportResult {
+	return {
+		success: true,
+		imported: 0,
+		skipped: 0,
+		errors: [],
+		byCollection: {},
+	};
+}
+
+/** Import a bounded WXR post chunk using taxonomy rows prepared in the prior phase. */
+async function runContentChunk(
+	wxr: Awaited<ReturnType<typeof parseWxrString>>,
+	config: ImportConfig,
+	emdash: EmDashHandlers,
+	manifest: EmDashManifest,
+	attachmentMap: Map<string, string>,
+	authorDisplayNames: Map<string, string>,
+	cursor: WxrChunkCursor | undefined,
+	incomingChunk: WxrChunkState | undefined,
+	source: string,
+): Promise<WxrChunkResponse | Response> {
+	const offset = cursor?.offset ?? 0;
+	if (offset > wxr.posts.length || (offset > 0 && offset % WXR_CONTENT_CHUNK_SIZE !== 0)) {
+		return apiError("VALIDATION_ERROR", "Invalid import cursor offset", 400);
+	}
+	const posts = wxr.posts.slice(offset, offset + WXR_CONTENT_CHUNK_SIZE);
+	const taxonomyPlan = await loadTaxonomyPlanFromDb(emdash.db);
+
+	// Seed translation-group state from earlier chunks so a translation that
+	// appears on chunk N can link to its sibling imported on chunk N-1.
+	const translationGroupMap = new Map<string, string>(
+		Object.entries(incomingChunk?.translationGroups ?? {}),
+	);
+
+	const result = await importContent(
+		posts,
+		config,
+		emdash,
+		manifest,
+		attachmentMap,
+		config.locale,
+		authorDisplayNames,
+		taxonomyPlan,
+		translationGroupMap,
+	);
+
+	const nextOffset = offset + posts.length;
+	const done = nextOffset >= wxr.posts.length;
+
+	return {
+		success: result.errors.length === 0,
+		result,
+		done,
+		cursor: { offset: nextOffset, source, taxonomiesReady: true },
+		chunk: { translationGroups: Object.fromEntries(translationGroupMap) },
+	};
+}
+
+async function prepareTaxonomies(
+	wxr: Awaited<ReturnType<typeof parseWxrString>>,
+	emdash: EmDashHandlers,
+	locale: string | undefined,
+): Promise<TaxonomyImportPlan> {
+	const taxonomyPlan = await preImportWxrTaxonomies(
+		emdash.db,
+		wxr.posts,
+		wxr.categories,
+		wxr.tags,
+		wxr.terms,
+		locale,
+	);
+	const postLocales = new Set<string>();
+	for (const post of wxr.posts) {
+		if (post.locale) postLocales.add(post.locale);
+	}
+	if (postLocales.size > 0) {
+		await mirrorTermsToLocales(emdash.db, taxonomyPlan, postLocales, locale);
+	}
+	return taxonomyPlan;
+}
+
 export async function importContent(
 	posts: WxrPost[],
 	config: ImportConfig,
@@ -214,6 +464,7 @@ export async function importContent(
 	locale: string | undefined,
 	authorDisplayNames: Map<string, string> | undefined,
 	taxonomyPlan: TaxonomyImportPlan,
+	translationGroupMap = new Map<string, string>(),
 ): Promise<ImportResult> {
 	const result: ImportResult = {
 		success: true,
@@ -234,11 +485,6 @@ export async function importContent(
 	const bylineRepo = new BylineRepository(emdash.db);
 	const bylineCache = new Map<string, string>();
 
-	// Source-side translation group ID -> the EmDash ID of the first post we
-	// imported for that group. Subsequent translations are linked via
-	// `translationOf` so they share a `translation_group` on the EmDash side.
-	const translationGroupMap = new Map<string, string>();
-
 	for (const post of posts) {
 		const postType = post.postType || "post";
 		const mapping = config.postTypeMappings[postType];

package/src/astro/routes/api/import/wordpress/prepare.ts

@@ -55,8 +55,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const body = await parseBody(request, wpPrepareBody);
 		if (isParseError(body)) return body;
 
-		// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Zod schema output narrowed to PrepareRequest
-		const result = await prepareImport(emdash.db, body as PrepareRequest);
+		const result = await prepareImport(emdash.db, body);
 
 		// Invalidate the URL pattern cache when prepare adds new collections so
 		// public routing picks up their patterns immediately. The manifest

package/src/astro/routes/api/oauth/device/authorize.ts

@@ -1,8 +1,10 @@
 /**
+ * GET  /_emdash/api/oauth/device/authorize?user_code=XXXX-XXXX
  * POST /_emdash/api/oauth/device/authorize
  *
- * User submits the user code after logging in via the browser.
- * This endpoint requires authentication (the user must be logged in).
+ * GET returns the scopes a pending user code requested, for display before
+ * approval. POST approves or denies the code after the user logs in via the
+ * browser. Both require authentication (the user must be logged in).
  */
 
 /// <reference types="emdash/locals" />
@@ -11,16 +13,43 @@ import type { APIRoute } from "astro";
 import { z } from "zod";
 
 import { apiError, handleError, unwrapResult } from "#api/error.js";
-import { handleDeviceAuthorize } from "#api/handlers/device-flow.js";
-import { isParseError, parseBody } from "#api/parse.js";
+import { handleDeviceAuthorize, handleDeviceCodeLookup } from "#api/handlers/device-flow.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 
 export const prerender = false;
 
+const lookupSchema = z.object({
+	user_code: z.string().min(1),
+});
+
 const authorizeSchema = z.object({
 	user_code: z.string().min(1),
 	action: z.enum(["approve", "deny"]).optional(),
 });
 
+export const GET: APIRoute = async ({ url, locals }) => {
+	const { emdash } = locals;
+	const { user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!user) {
+		return apiError("NOT_AUTHENTICATED", "Authentication required", 401);
+	}
+
+	try {
+		const query = parseQuery(url, lookupSchema);
+		if (isParseError(query)) return query;
+
+		const result = await handleDeviceCodeLookup(emdash.db, user.role, query);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to look up device code", "DEVICE_CODE_LOOKUP_ERROR");
+	}
+};
+
 export const POST: APIRoute = async ({ request, locals }) => {
 	const { emdash } = locals;
 	const { user } = locals;

package/src/astro/routes/api/oauth/register.ts

@@ -4,12 +4,16 @@
  * RFC 7591 Dynamic Client Registration. Public, unauthenticated.
  * MCP clients (e.g. Claude Code) call this to register themselves
  * before starting the OAuth authorization flow.
+ *
+ * Rate limited: 10 registrations per minute per IP.
  */
 
 import type { APIRoute } from "astro";
 
 import { apiError, handleError } from "#api/error.js";
 import { handleOAuthClientCreate } from "#api/handlers/oauth-clients.js";
+import { checkRateLimit, getClientIp } from "#auth/rate-limit.js";
+import { getTrustedProxyHeaders } from "#auth/trusted-proxy.js";
 
 export const prerender = false;
 
@@ -36,10 +40,14 @@ const SUPPORTED_GRANT_TYPES = new Set([
 ]);
 const SUPPORTED_RESPONSE_TYPES = new Set(["code"]);
 
-function registrationError(description: string, status = 400): Response {
+function registrationError(
+	description: string,
+	status = 400,
+	error = "invalid_client_metadata",
+): Response {
 	return Response.json(
 		{
-			error: "invalid_client_metadata",
+			error,
 			error_description: description,
 		},
 		{ status, headers: OAUTH_REGISTRATION_HEADERS },
@@ -141,6 +149,18 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			return scopes;
 		}
 
+		const ip = getClientIp(request, getTrustedProxyHeaders(emdash.config));
+		const rateLimit = await checkRateLimit(emdash.db, ip, "oauth/register", 10, 60);
+		if (!rateLimit.allowed) {
+			const response = registrationError(
+				"Too many registration requests. Please try again later.",
+				429,
+				"temporarily_unavailable",
+			);
+			response.headers.set("Retry-After", "60");
+			return response;
+		}
+
 		const clientId = crypto.randomUUID();
 		const clientName =
 			typeof body.client_name === "string" && body.client_name

package/src/astro/routes/api/relations/index.ts

@@ -1,7 +1,7 @@
 /**
  * Relation definitions endpoint
  *
- * GET  /_emdash/api/relations[?locale=xx] - List relation definitions
+ * GET  /_emdash/api/relations[?collection=xx] - List relation definitions
  * POST /_emdash/api/relations              - Create a relation definition
  */
 
@@ -11,7 +11,7 @@ import { requirePerm } from "#api/authorize.js";
 import { handleError, requireDb, unwrapResult } from "#api/error.js";
 import { handleRelationCreate, handleRelationList } from "#api/handlers/relations.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
-import { createRelationBody, localeFilterQuery } from "#api/schemas.js";
+import { createRelationBody, relationListQuery } from "#api/schemas.js";
 
 export const prerender = false;
 
@@ -24,11 +24,11 @@ export const GET: APIRoute = async ({ request, locals }) => {
 	const denied = requirePerm(user, "schema:read");
 	if (denied) return denied;
 
-	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	const query = parseQuery(new URL(request.url), relationListQuery);
 	if (isParseError(query)) return query;
 
 	try {
-		const result = await handleRelationList(emdash.db, { locale: query.locale });
+		const result = await handleRelationList(emdash.db, { collection: query.collection });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to list relations", "RELATION_LIST_ERROR");

package/src/astro/routes/api/revisions/[revisionId]/restore.ts

@@ -2,18 +2,25 @@
  * Restore revision endpoint - injected by EmDash integration
  *
  * POST /_emdash/api/revisions/{revisionId}/restore - Restore revision
+ *
+ * Optional JSON body: { overrideLock?: boolean }
  */
 
 import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { revisionRestoreBody } from "#api/schemas.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, locals }) => {
+export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	const revisionId = params.revisionId!;
+	const body = await parseOptionalBody(request, revisionRestoreBody, {});
+	if (isParseError(body)) return body;
 
 	if (!emdash?.handleRevisionRestore || !emdash?.handleRevisionGet || !emdash?.handleContentGet) {
 		return apiError("NOT_CONFIGURED", "EmDash not configured", 500);
@@ -52,6 +59,15 @@ export const POST: APIRoute = async ({ params, locals }) => {
 	const denied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
 	if (denied) return denied;
 
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, entryId, user!.id, {
+		override: body.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleRevisionRestore(revisionId, user!.id);
 
 	return unwrapResult(result);

package/src/astro/routes/api/schema/collections/[slug]/fields/[fieldSlug].ts

@@ -54,7 +54,7 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	return unwrapResult(result);
 };
 
-export const DELETE: APIRoute = async ({ params, locals }) => {
+export const DELETE: APIRoute = async ({ params, url, locals }) => {
 	const { emdash, user } = locals;
 	const collectionSlug = params.slug!;
 	const fieldSlug = params.fieldSlug!;
@@ -65,6 +65,10 @@ export const DELETE: APIRoute = async ({ params, locals }) => {
 	const denied = requirePerm(user, "schema:manage");
 	if (denied) return denied;
 
-	const result = await handleSchemaFieldDelete(emdash.db, collectionSlug, fieldSlug);
+	// DELETE carries no body, so the cascade opt-in rides on the query string,
+	// matching `?force=true` on collection delete.
+	const result = await handleSchemaFieldDelete(emdash.db, collectionSlug, fieldSlug, {
+		deleteRelation: url.searchParams.get("deleteRelation") === "true",
+	});
 	return unwrapResult(result);
 };

package/src/astro/routes/api/setup/admin-verify.ts

@@ -8,7 +8,7 @@ import type { APIRoute } from "astro";
 
 export const prerender = false;
 
-import { Role, secureCompare } from "@emdash-cms/auth";
+import { secureCompare } from "@emdash-cms/auth";
 import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
 import { verifyRegistrationResponse, registerPasskey } from "@emdash-cms/auth/passkey";
 
@@ -16,6 +16,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { getPublicOrigin } from "#api/public-url.js";
 import { setupAdminVerifyBody } from "#api/schemas.js";
+import { createFirstAdmin } from "#api/setup-complete.js";
 import { getConfiguredAllowedOrigins, validateAllowedOrigins } from "#auth/allowed-origins.js";
 import { createChallengeStore } from "#auth/challenge-store.js";
 import { getPasskeyConfig } from "#auth/passkey-config.js";
@@ -103,13 +104,13 @@ export const POST: APIRoute = async ({ cookies, request, locals }) => {
 			challengeStore,
 		);
 
-		// Create the admin user
-		const user = await adapter.createUser({
+		const user = await createFirstAdmin(emdash.db, {
 			email: setupState.email,
 			name: setupState.name ?? null,
-			role: Role.ADMIN,
-			emailVerified: false, // No email verification for first user
 		});
+		if (!user) {
+			return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		}
 
 		// Register the passkey
 		await registerPasskey(adapter, user.id, verified, "Setup passkey");