@bobbykim/manguito-cms-api 0.6.0 → 0.8.0

package/dist/index.js

@@ -38,7 +38,7 @@ function isColumnBacked(field) {
   if (col.junction) return false;
   return true;
 }
-function buildFieldKeyMap(pairs, allLabels, droppedKeys) {
+function buildFieldKeyMap(pairs, allLabels, droppedColumns, droppedLabels) {
   const labelToColumn = /* @__PURE__ */ new Map();
   const columnToLabel = /* @__PURE__ */ new Map();
   for (const { label, column } of pairs) {
@@ -46,7 +46,7 @@ function buildFieldKeyMap(pairs, allLabels, droppedKeys) {
     columnToLabel.set(column, label);
   }
   for (const { label, ownColumn } of allLabels) {
-    if (ownColumn === label) continue;
+    if (ownColumn !== void 0) continue;
     const columnOwner = columnToLabel.get(label);
     if (columnOwner !== void 0 && columnOwner !== label) {
       throw new Error(
@@ -55,23 +55,33 @@ function buildFieldKeyMap(pairs, allLabels, droppedKeys) {
     }
   }
   for (const label of labelToColumn.keys()) {
-    if (droppedKeys.has(label)) labelToColumn.delete(label);
+    if (droppedLabels.has(label)) labelToColumn.delete(label);
   }
   for (const column of columnToLabel.keys()) {
-    if (droppedKeys.has(column)) columnToLabel.delete(column);
+    if (droppedColumns.has(column)) columnToLabel.delete(column);
   }
   const diverges = [...labelToColumn].some(([label, column]) => label !== column);
-  function remap(input, lookup) {
+  function remap(input, lookup, dropped, droppedIfUnmapped) {
     const out = {};
     for (const key of Object.keys(input)) {
-      if (droppedKeys.has(key)) continue;
-      out[lookup.get(key) ?? key] = input[key];
+      const mapped = lookup.get(key);
+      if (mapped !== void 0) {
+        out[mapped] = input[key];
+        continue;
+      }
+      if (dropped.has(key) || droppedIfUnmapped?.has(key)) continue;
+      out[key] = input[key];
     }
     return out;
   }
   return {
-    toStorage: (input) => remap(input, labelToColumn),
-    toLabels: (row) => remap(row, columnToLabel),
+    // toStorage reads LABEL-keyed input: a live label maps and writes
+    // regardless of either drop set; an unmapped key is refused if it is
+    // EITHER the tombstone's own name (droppedLabels) or a raw, unexposed
+    // column (droppedColumns) — see remap's comment.
+    // toLabels reads COLUMN-keyed input, so it consults only droppedColumns.
+    toStorage: (input) => remap(input, labelToColumn, droppedLabels, droppedColumns),
+    toLabels: (row) => remap(row, columnToLabel, droppedColumns),
     columnFor: (label) => labelToColumn.get(label),
     labelFor: (column) => columnToLabel.get(column),
     labels: [...labelToColumn.keys()],
@@ -79,14 +89,15 @@ function buildFieldKeyMap(pairs, allLabels, droppedKeys) {
   };
 }
 function createFieldKeyMap(fields) {
-  const droppedKeys = /* @__PURE__ */ new Set();
+  const droppedColumns = /* @__PURE__ */ new Set();
+  const droppedLabels = /* @__PURE__ */ new Set();
   const pairs = [];
   for (const f of fields) {
     if (!isColumnBacked(f)) continue;
     pairs.push({ label: f.name, column: f.db_column.column_name });
     if (f.removed === true) {
-      droppedKeys.add(f.name);
-      droppedKeys.add(f.db_column.column_name);
+      droppedLabels.add(f.name);
+      droppedColumns.add(f.db_column.column_name);
     }
   }
   return buildFieldKeyMap(
@@ -97,30 +108,33 @@ function createFieldKeyMap(fields) {
       // forbids present-and-undefined.
       ...isColumnBacked(f) && { ownColumn: f.db_column.column_name }
     })),
-    droppedKeys
+    droppedColumns,
+    droppedLabels
   );
 }
 function createFieldKeyMapFromProjection(projectionType, allFields) {
   const pairs = projectionType.fields.map((f) => ({ label: f.exposed_as, column: f.column_name }));
-  const projected = new Set(pairs.map((p) => p.label));
-  const dropped = /* @__PURE__ */ new Set();
+  const projectedColumns = new Set(pairs.map((p) => p.column));
+  const projectedLabels = new Set(pairs.map((p) => p.label));
+  const droppedColumns = /* @__PURE__ */ new Set();
+  const droppedLabels = /* @__PURE__ */ new Set();
   for (const f of allFields) {
     if (!isColumnBacked(f)) continue;
-    dropped.add(f.name);
-    dropped.add(f.db_column.column_name);
+    if (!projectedColumns.has(f.db_column.column_name)) droppedColumns.add(f.db_column.column_name);
+    if (!projectedLabels.has(f.name)) droppedLabels.add(f.name);
   }
-  for (const p of pairs) dropped.delete(p.column);
-  for (const label of projected) dropped.delete(label);
   return buildFieldKeyMap(
     pairs,
     allFields.map((f) => ({
       label: f.name,
-      // See buildFieldKeyMap's collision check: this is what lets it tell a
-      // version exposing a field's own column under a new label (fine) from a
-      // label that reuses another field's column (not fine).
+      // See buildFieldKeyMap's collision check: `ownColumn` marks every
+      // column-backed field so the check skips it entirely — only a
+      // paragraph/junction/programmatic label (no column of its own) can
+      // still collide.
       ...isColumnBacked(f) && { ownColumn: f.db_column.column_name }
     })),
-    dropped
+    droppedColumns,
+    droppedLabels
   );
 }
 var init_field_keys = __esm({
@@ -130,7 +144,7 @@ var init_field_keys = __esm({
 });
 
 // src/relations.ts
-function quoteIdent(name) {
+function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
@@ -142,10 +156,10 @@ function paragraphMediaFieldNames(pType) {
 async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
   const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
   if (mediaColumns.length === 0) return [];
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  const cols = import_drizzle_orm2.sql.join(mediaColumns.map((c) => import_drizzle_orm2.sql.raw(quoteIdent(c))), import_drizzle_orm2.sql`, `);
+  const tbl = import_drizzle_orm3.sql.raw(quoteIdent2(pType.db.table_name));
+  const cols = import_drizzle_orm3.sql.join(mediaColumns.map((c) => import_drizzle_orm3.sql.raw(quoteIdent2(c))), import_drizzle_orm3.sql`, `);
   const result = await db.execute(
-    import_drizzle_orm2.sql`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
+    import_drizzle_orm3.sql`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
   );
   const ids = [];
   for (const row of result.rows) {
@@ -164,14 +178,14 @@ function nestedParagraphFields(pType, registry) {
     const comp = f.ui_component;
     if (comp.component !== "paragraph-embed" || !comp.ref) continue;
     const nType = registry.paragraph_types[comp.ref];
-    if (nType) out.push({ fieldName: f.name, nType });
+    if (nType) out.push({ fieldName: f.name, nType, field: f });
   }
   return out;
 }
 async function fetchParagraphRowIds(db, pType, itemId, fieldName) {
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  const tbl = import_drizzle_orm3.sql.raw(quoteIdent2(pType.db.table_name));
   const result = await db.execute(
-    import_drizzle_orm2.sql`SELECT id FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
+    import_drizzle_orm3.sql`SELECT id FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
   );
   return result.rows.map((r) => r["id"]).filter((id) => typeof id === "string");
 }
@@ -187,8 +201,8 @@ async function persistParagraphField(db, itemId, parentType, fieldName, pType, i
       }
     }
   }
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  const tbl = import_drizzle_orm3.sql.raw(quoteIdent2(pType.db.table_name));
+  await db.execute(import_drizzle_orm3.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
   const mediaFieldNames = paragraphMediaFieldNames(pType);
   const added = [];
   for (let i = 0; i < items.length; i++) {
@@ -207,15 +221,15 @@ async function persistParagraphField(db, itemId, parentType, fieldName, pType, i
       if (!pf.db_column || pf.db_column.junction) continue;
       data[pf.db_column.column_name] = pItem[pf.name] ?? null;
     }
-    const cols = import_drizzle_orm2.sql.join(Object.keys(data).map((k) => import_drizzle_orm2.sql.raw(quoteIdent(k))), import_drizzle_orm2.sql`, `);
-    const vals = import_drizzle_orm2.sql.join(Object.values(data).map((v) => import_drizzle_orm2.sql`${v}`), import_drizzle_orm2.sql`, `);
-    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
+    const cols = import_drizzle_orm3.sql.join(Object.keys(data).map((k) => import_drizzle_orm3.sql.raw(quoteIdent2(k))), import_drizzle_orm3.sql`, `);
+    const vals = import_drizzle_orm3.sql.join(Object.values(data).map((v) => import_drizzle_orm3.sql`${v}`), import_drizzle_orm3.sql`, `);
+    await db.execute(import_drizzle_orm3.sql`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
     for (const name of mediaFieldNames) {
       const val = pItem[name];
       if (typeof val === "string" && val !== "") added.push(val);
     }
     for (const n of nested) {
-      const nestedItems = Array.isArray(pItem[n.fieldName]) ? pItem[n.fieldName] : [];
+      const nestedItems = paragraphItems(n.field, pItem[n.fieldName]);
       const d = await persistParagraphField(
         db,
         rowId,
@@ -243,19 +257,28 @@ async function deleteParagraphField(db, itemId, fieldName, pType, registry) {
       }
     }
   }
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  const tbl = import_drizzle_orm3.sql.raw(quoteIdent2(pType.db.table_name));
+  await db.execute(import_drizzle_orm3.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
   return { added: [], removed };
 }
 async function persistJunctionField(db, itemId, junction, relatedIds) {
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(junction.table_name));
-  const left = import_drizzle_orm2.sql.raw(quoteIdent(junction.left_column));
-  const right = import_drizzle_orm2.sql.raw(quoteIdent(junction.right_column));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
+  const tbl = import_drizzle_orm3.sql.raw(quoteIdent2(junction.table_name));
+  const left = import_drizzle_orm3.sql.raw(quoteIdent2(junction.left_column));
+  const right = import_drizzle_orm3.sql.raw(quoteIdent2(junction.right_column));
+  await db.execute(import_drizzle_orm3.sql`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
   for (const rid of relatedIds) {
-    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
+    await db.execute(import_drizzle_orm3.sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
   }
 }
+function oneOrMany(cardinality, list) {
+  return cardinality === "one" ? list[0] ?? null : list;
+}
+function paragraphItems(field, value) {
+  if ((0, import_manguito_cms_core2.relationCardinality)(field) === "one") {
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? [value] : [];
+  }
+  return Array.isArray(value) ? value : [];
+}
 function buildRelationsMap(fields, registry) {
   const relations = {};
   for (const field of fields) {
@@ -266,7 +289,11 @@ function buildRelationsMap(fields, registry) {
       const ref = field.ui_component.ref;
       const pType = ref ? registry.paragraph_types[ref] : void 0;
       if (!pType) continue;
-      relations[field.name] = { type: "paragraph", table: pType.db.table_name };
+      relations[field.name] = {
+        type: "paragraph",
+        table: pType.db.table_name,
+        cardinality: (0, import_manguito_cms_core2.relationCardinality)(field) ?? "many"
+      };
     } else if (field.field_type === "reference") {
       if (!field.db_column) continue;
       if (field.db_column.junction) {
@@ -299,9 +326,8 @@ function groupBy(items, key) {
   }
   return result;
 }
-function needsFkResolution(row, fkColumn, fieldName) {
-  if (fkColumn !== fieldName && !(fkColumn in row)) return false;
-  const current = row[fieldName];
+function needsFkResolution(row, fkColumn) {
+  const current = row[fkColumn];
   return !(typeof current === "object" && current !== null);
 }
 async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOnly = false) {
@@ -309,33 +335,29 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
   const batch = [...new Set(rows)];
   if (rel.type === "paragraph") {
     const parentIds = batch.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const inList = import_drizzle_orm3.sql.join(parentIds.map((id) => import_drizzle_orm3.sql`${id}`), import_drizzle_orm3.sql`, `);
     const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
+      import_drizzle_orm3.sql`SELECT * FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
     );
     const byParent = groupBy(result.rows, "parent_id");
     for (const row of batch) {
-      row[fieldName] = byParent[row["id"]] ?? [];
+      row[fieldName] = oneOrMany(rel.cardinality, byParent[row["id"]] ?? []);
     }
   } else if (rel.type === "reference") {
-    const dropFk = rel.fk_column !== fieldName;
-    const pending = batch.filter((r) => needsFkResolution(r, rel.fk_column, fieldName));
+    const pending = batch.filter((r) => needsFkResolution(r, rel.fk_column));
     if (pending.length === 0) return;
     const fkValues = pending.map((r) => r[rel.fk_column]).filter(Boolean);
     if (fkValues.length === 0) {
-      for (const row of pending) {
-        row[fieldName] = null;
-        if (dropFk) delete row[rel.fk_column];
-      }
+      for (const row of pending) row[rel.fk_column] = null;
       return;
     }
     const unique = [...new Set(fkValues)];
     const uncached = unique.filter((id) => !cache.has(`${rel.table}:${id}`));
     if (uncached.length > 0) {
-      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const publishedCond = publishedOnly ? import_drizzle_orm2.sql` AND published = true` : import_drizzle_orm2.sql``;
+      const inList = import_drizzle_orm3.sql.join(uncached.map((id) => import_drizzle_orm3.sql`${id}`), import_drizzle_orm3.sql`, `);
+      const publishedCond = publishedOnly ? import_drizzle_orm3.sql` AND published = true` : import_drizzle_orm3.sql``;
       const result = await db.execute(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${inList})${publishedCond}`
+        import_drizzle_orm3.sql`SELECT * FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.table))} WHERE id IN (${inList})${publishedCond}`
       );
       for (const item of result.rows) {
         cache.set(`${rel.table}:${item["id"]}`, item);
@@ -343,24 +365,23 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
     }
     for (const row of pending) {
       const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
-      if (dropFk) delete row[rel.fk_column];
+      row[rel.fk_column] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
     }
   } else if (rel.type === "junction") {
     const parentIds = batch.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const orderBy = rel.order_column ? import_drizzle_orm2.sql` ORDER BY "order" ASC` : import_drizzle_orm2.sql``;
+    const inList = import_drizzle_orm3.sql.join(parentIds.map((id) => import_drizzle_orm3.sql`${id}`), import_drizzle_orm3.sql`, `);
+    const orderBy = rel.order_column ? import_drizzle_orm3.sql` ORDER BY "order" ASC` : import_drizzle_orm3.sql``;
     const junctionResult = await db.execute(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
+      import_drizzle_orm3.sql`SELECT * FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.junction_table))} WHERE ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.left_column))} IN (${inList})${orderBy}`
     );
     const jRows = junctionResult.rows;
     const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
     const uncached = rightIds.filter((id) => !cache.has(`${rel.table}:${id}`));
     if (uncached.length > 0) {
-      const rightInList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const publishedCond = publishedOnly ? import_drizzle_orm2.sql` AND published = true` : import_drizzle_orm2.sql``;
+      const rightInList = import_drizzle_orm3.sql.join(uncached.map((id) => import_drizzle_orm3.sql`${id}`), import_drizzle_orm3.sql`, `);
+      const publishedCond = publishedOnly ? import_drizzle_orm3.sql` AND published = true` : import_drizzle_orm3.sql``;
       const entitiesResult = await db.execute(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})${publishedCond}`
+        import_drizzle_orm3.sql`SELECT * FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.table))} WHERE id IN (${rightInList})${publishedCond}`
       );
       for (const item of entitiesResult.rows) {
         cache.set(`${rel.table}:${item["id"]}`, item);
@@ -372,30 +393,25 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
       row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
     }
   } else if (rel.type === "media") {
-    const dropFk = rel.fk_column !== fieldName;
-    const pending = batch.filter((r) => needsFkResolution(r, rel.fk_column, fieldName));
+    const pending = batch.filter((r) => needsFkResolution(r, rel.fk_column));
     if (pending.length === 0) return;
     const fkValues = pending.map((r) => r[rel.fk_column]).filter(Boolean);
     if (fkValues.length === 0) {
-      for (const row of pending) {
-        row[fieldName] = null;
-        if (dropFk) delete row[rel.fk_column];
-      }
+      for (const row of pending) row[rel.fk_column] = null;
       return;
     }
     const unique = [...new Set(fkValues)];
     const uncached = unique.filter((id) => !cache.has(`media:${id}`));
     if (uncached.length > 0) {
-      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const result = await db.execute(import_drizzle_orm2.sql`SELECT * FROM "media" WHERE id IN (${inList})`);
+      const inList = import_drizzle_orm3.sql.join(uncached.map((id) => import_drizzle_orm3.sql`${id}`), import_drizzle_orm3.sql`, `);
+      const result = await db.execute(import_drizzle_orm3.sql`SELECT * FROM "media" WHERE id IN (${inList})`);
       for (const item of result.rows) {
         cache.set(`media:${item["id"]}`, item);
       }
     }
     for (const row of pending) {
       const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
-      if (dropFk) delete row[rel.fk_column];
+      row[rel.fk_column] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
     }
   }
 }
@@ -403,19 +419,19 @@ async function resolveRelationBareIds(db, rows, fieldName, rel) {
   if (rows.length === 0) return;
   if (rel.type === "paragraph") {
     const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const inList = import_drizzle_orm3.sql.join(parentIds.map((id) => import_drizzle_orm3.sql`${id}`), import_drizzle_orm3.sql`, `);
     const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT id, parent_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
+      import_drizzle_orm3.sql`SELECT id, parent_id FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
     );
     const byParent = groupBy(result.rows, "parent_id");
     for (const row of rows) {
-      row[fieldName] = (byParent[row["id"]] ?? []).map((r) => r["id"]);
+      row[fieldName] = oneOrMany(rel.cardinality, (byParent[row["id"]] ?? []).map((r) => r["id"]));
     }
   } else if (rel.type === "junction") {
     const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const inList = import_drizzle_orm3.sql.join(parentIds.map((id) => import_drizzle_orm3.sql`${id}`), import_drizzle_orm3.sql`, `);
     const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} AS left_id, ${import_drizzle_orm2.sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})`
+      import_drizzle_orm3.sql`SELECT ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.left_column))} AS left_id, ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.right_column))} AS right_id FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.junction_table))} WHERE ${import_drizzle_orm3.sql.raw(quoteIdent2(rel.left_column))} IN (${inList})`
     );
     const byLeft = groupBy(result.rows, "left_id");
     for (const row of rows) {
@@ -423,12 +439,13 @@ async function resolveRelationBareIds(db, rows, fieldName, rel) {
     }
   }
 }
-var import_node_crypto, import_drizzle_orm2;
+var import_node_crypto, import_drizzle_orm3, import_manguito_cms_core2;
 var init_relations = __esm({
   "src/relations.ts"() {
     "use strict";
     import_node_crypto = __toESM(require("crypto"));
-    import_drizzle_orm2 = require("drizzle-orm");
+    import_drizzle_orm3 = require("drizzle-orm");
+    import_manguito_cms_core2 = require("@bobbykim/manguito-cms-core");
   }
 });
 
@@ -677,29 +694,22 @@ function scalarFieldResolver(field, fallback) {
 function relationFieldResolver(typeName, schemaFieldName) {
   return (parent, _args, ctx) => ctx.loaders.load(typeName, schemaFieldName, parent);
 }
-function programmaticFieldResolver(typeName, schemaFieldName, mediaFields = [], fieldKeys) {
+function programmaticFieldResolver(typeName, schemaFieldName, mediaFieldNames = [], fieldKeys) {
   return async (parent, _args, ctx) => {
     let p = ctx.programmaticMemo.get(parent);
     if (!p) {
-      p = resolveProgrammaticRow(typeName, parent, ctx, mediaFields, fieldKeys);
+      p = resolveProgrammaticRow(typeName, parent, ctx, mediaFieldNames, fieldKeys);
       ctx.programmaticMemo.set(parent, p);
     }
     return (await p)[schemaFieldName];
   };
 }
-async function resolveProgrammaticRow(typeName, parent, ctx, mediaFields, fieldKeys) {
+async function resolveProgrammaticRow(typeName, parent, ctx, mediaFieldNames, fieldKeys) {
   const toLabels = (row) => fieldKeys ? fieldKeys.toLabels(row) : row;
-  if (mediaFields.length === 0) return ctx.resolver.resolveItem(typeName, toLabels(parent));
+  if (mediaFieldNames.length === 0) return ctx.resolver.resolveItem(typeName, toLabels(parent));
   const enriched = { ...parent };
-  await Promise.all(mediaFields.map((m) => ctx.loaders.load(typeName, m.name, enriched)));
-  return ctx.resolver.resolveItem(typeName, relabelMedia(toLabels(enriched), enriched, mediaFields));
-}
-function relabelMedia(record, enriched, mediaFields) {
-  for (const { name, exposedAs } of mediaFields) {
-    if (!(name in enriched)) continue;
-    record[exposedAs] = enriched[name];
-  }
-  return record;
+  await Promise.all(mediaFieldNames.map((name) => ctx.loaders.load(typeName, name, enriched)));
+  return ctx.resolver.resolveItem(typeName, toLabels(enriched));
 }
 function collectionResolver(typeName, nameMap, fieldKeys) {
   return async (_root, args, ctx) => {
@@ -757,7 +767,7 @@ var init_resolvers = __esm({
 });
 
 // src/graphql/schema.ts
-function buildGraphQLSchema(registry, fieldKeyMaps = {}, view) {
+function buildGraphQLSchema(registry, fieldKeyMaps = {}, view, programmaticKeyMaps = fieldKeyMaps) {
   const objectTypes = /* @__PURE__ */ new Map();
   const enumTypes = /* @__PURE__ */ new Map();
   for (const [name, enumType] of Object.entries(registry.enum_types)) {
@@ -797,7 +807,8 @@ function buildGraphQLSchema(registry, fieldKeyMaps = {}, view) {
 `
         );
       }
-      return new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(target ?? MEDIA));
+      const t = target ?? MEDIA;
+      return (0, import_manguito_cms_core6.relationCardinality)(field) === "one" ? t : new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(t));
     }
     if (field.field_type === "reference") {
       const ref = field.ui_component.component === "typeahead-select" ? field.ui_component.ref : void 0;
@@ -806,8 +817,7 @@ function buildGraphQLSchema(registry, fieldKeyMaps = {}, view) {
         process.stderr.write(`\u26A0 reference field '${field.name}' targets unknown type '${ref}'; exposing as Media
 `);
       }
-      const rel = field.ui_component.component === "typeahead-select" ? field.ui_component.rel : void 0;
-      const isMany = rel === "many-to-many" || rel === "one-to-many";
+      const isMany = (0, import_manguito_cms_core6.relationCardinality)(field) === "many";
       const t = target ?? MEDIA;
       return isMany ? new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(t)) : t;
     }
@@ -821,9 +831,9 @@ function buildGraphQLSchema(registry, fieldKeyMaps = {}, view) {
   }
   function buildObjectType(machineName, type) {
     const visible = viewFieldsFor(machineName, type);
-    const mediaFields = visible.filter(
-      (v) => v.field.field_type === "image" || v.field.field_type === "video" || v.field.field_type === "file"
-    ).map((v) => ({ name: v.field.name, exposedAs: v.exposedAs }));
+    const mediaFieldNames = type.fields.filter(
+      (f) => f.removed !== true && (f.field_type === "image" || f.field_type === "video" || f.field_type === "file")
+    ).map((f) => f.name);
     return new import_graphql5.GraphQLObjectType({
       name: graphqlTypeName(machineName),
       fields: () => {
@@ -843,7 +853,7 @@ function buildGraphQLSchema(registry, fieldKeyMaps = {}, view) {
           const outType = outputTypeForField(field, vf.required);
           let resolve;
           if (field.field_type === "programmatic") {
-            resolve = programmaticFieldResolver(machineName, field.name, mediaFields, fieldKeyMaps[machineName]);
+            resolve = programmaticFieldResolver(machineName, field.name, mediaFieldNames, programmaticKeyMaps[machineName]);
           } else if (field.field_type === "reference" || field.field_type === "paragraph" || field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
             resolve = relationFieldResolver(machineName, field.name);
           } else {
@@ -888,7 +898,10 @@ function buildGraphQLSchema(registry, fieldKeyMaps = {}, view) {
   for (const [name, ct] of Object.entries(registry.content_types)) {
     const objType = objectTypes.get(name);
     const visible = viewFieldsFor(name, ct);
-    const nameMap = buildFieldNameMap(visible.map((v) => v.exposedAs));
+    const nameMap = buildFieldNameMap([
+      ...visible.map((v) => v.exposedAs),
+      ...ct.system_fields.map((s) => s.name)
+    ]);
     if (ct.only_one) {
       queryFields[singleQueryName(name)] = { type: objType, resolve: singletonResolver(name) };
       continue;
@@ -946,11 +959,12 @@ function buildGraphQLSchema(registry, fieldKeyMaps = {}, view) {
     query: new import_graphql5.GraphQLObjectType({ name: "Query", fields: queryFields })
   });
 }
-var import_graphql5, PAGE_META, MEDIA;
+var import_graphql5, import_manguito_cms_core6, PAGE_META, MEDIA;
 var init_schema = __esm({
   "src/graphql/schema.ts"() {
     "use strict";
     import_graphql5 = require("graphql");
+    import_manguito_cms_core6 = require("@bobbykim/manguito-cms-core");
     init_scalars();
     init_type_mapping();
     init_naming();
@@ -1076,7 +1090,8 @@ function createRelationLoaders(db, registry) {
         async (parents) => {
           const rows = parents;
           await resolveRelationField(db, rows, fieldName, rel, cache, true);
-          return rows.map((r) => r[fieldName]);
+          const resultKey = rel.type === "reference" || rel.type === "media" ? rel.fk_column : fieldName;
+          return rows.map((r) => r[resultKey]);
         },
         // Batch within a tick; do not memoize by parent identity (rows are mutated
         // and may recur across nesting levels).
@@ -1161,7 +1176,7 @@ function createGraphQLHandler(registry, repos, fieldKeyMaps, resolver, db, optio
       currentVersion: versioning.currentVersion
     });
   }
-  const schema = buildGraphQLSchema(registry, fieldKeyMaps, view);
+  const schema = buildGraphQLSchema(registry, fieldKeyMaps, view, versioning.currentFieldKeyMaps ?? fieldKeyMaps);
   const { plugins } = buildArmorPlugin({
     maxDepth: options.maxDepth,
     maxComplexity: options.maxComplexity
@@ -1240,7 +1255,7 @@ function createVersionedPaths(prefix, version) {
 
 // src/app.ts
 var import_hono = require("hono");
-var import_drizzle_orm10 = require("drizzle-orm");
+var import_drizzle_orm11 = require("drizzle-orm");
 
 // src/middleware/cors.ts
 function createCorsMiddleware(corsConfig) {
@@ -1334,16 +1349,20 @@ var ERROR_STATUS_MAP = {
   UNSUPPORTED_MIME_TYPE: 415,
   STORAGE_ERROR: 502,
   MEDIA_IN_USE: 409,
+  ITEM_IN_USE: 409,
   PRESIGNED_URL_EXPIRED: 410,
   RATE_LIMITED: 429,
   INTERNAL_ERROR: 500
 };
 var errorHandler = (err, c) => {
   console.error(err.stack ?? err.message);
-  const apiErr = err;
-  const code = apiErr.code ?? "INTERNAL_ERROR";
-  const status = ERROR_STATUS_MAP[code] ?? 500;
-  return c.json({ ok: false, error: { code, message: err.message } }, status);
+  const raw = err.code;
+  const deliberate = raw !== void 0 && raw !== "INTERNAL_ERROR" && raw in ERROR_STATUS_MAP;
+  if (!deliberate) {
+    return c.json({ ok: false, error: { code: "INTERNAL_ERROR", message: "Internal server error" } }, 500);
+  }
+  const status = ERROR_STATUS_MAP[raw] ?? 500;
+  return c.json({ ok: false, error: { code: raw, message: err.message } }, status);
 };
 
 // src/middleware/auth.ts
@@ -1817,18 +1836,21 @@ function createProgrammaticResolver(resolvers, options) {
 }
 
 // src/projector.ts
+init_field_keys();
 function isPlainRow(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof Date);
 }
 var MEDIA_FIELD_TYPES = /* @__PURE__ */ new Set(["image", "video", "file"]);
-function nestedTargets(fields) {
+function nestedTargets(fields, map) {
   const out = [];
   for (const f of fields) {
     if (MEDIA_FIELD_TYPES.has(f.field_type)) continue;
     if (f.field_type !== "paragraph" && f.field_type !== "reference") continue;
     const ref = f.ui_component.ref;
     if (!ref) continue;
-    out.push({ label: f.name, target: ref });
+    const label = isColumnBacked(f) ? map.labelFor(f.db_column.column_name) : f.name;
+    if (label === void 0) continue;
+    out.push({ label, target: ref });
   }
   return out;
 }
@@ -1846,7 +1868,7 @@ function buildProjectors(registry, fieldKeyMaps, fallbacks) {
       const typeFallbacks = fallbacks?.[typeName];
       projectors[typeName] = {
         map,
-        nested: nestedTargets(type.fields),
+        nested: nestedTargets(type.fields, map),
         // Spread rather than assign: with exactOptionalPropertyTypes, an optional
         // property may be ABSENT but not present-and-undefined.
         ...typeFallbacks !== void 0 && { fallbacks: typeFallbacks }
@@ -1933,7 +1955,28 @@ function parseFilters(url, validFields, columnFor) {
 function isPublished(item) {
   return item["published"] === true;
 }
-function registerPublicContentRoutes(app, registry, repos, projectors, paths, listRateLimit, resolver) {
+function registerPublicContentRoutes(app, registry, repos, projectors, paths, listRateLimit, resolver, resolverProjectors) {
+  const forResolver = resolverProjectors ?? projectors;
+  function pickProgrammatic(resolved, names) {
+    const out = {};
+    for (const name of names) if (name in resolved) out[name] = resolved[name];
+    return out;
+  }
+  async function respondItem(row, typeName, programmatic) {
+    const data = projectRow(row, typeName, projectors);
+    if (!resolver?.hasSchema(typeName)) return data;
+    const resolved = await resolver.resolveItem(typeName, projectRow(row, typeName, forResolver));
+    return { ...data, ...pickProgrammatic(resolved, programmatic) };
+  }
+  async function respondList(rows, typeName, programmatic) {
+    const data = rows.map((row) => projectRow(row, typeName, projectors));
+    if (!resolver?.hasSchema(typeName)) return data;
+    const resolved = await resolver.resolveList(
+      typeName,
+      rows.map((row) => projectRow(row, typeName, forResolver))
+    );
+    return data.map((d, i) => ({ ...d, ...pickProgrammatic(resolved[i], programmatic) }));
+  }
   function registerListRoute(path, handler) {
     if (listRateLimit) {
       app.get(path, listRateLimit, handler);
@@ -1957,18 +2000,29 @@ function registerPublicContentRoutes(app, registry, repos, projectors, paths, li
     return c.json({ ok: true, data });
   });
   for (const [typeName, contentType] of Object.entries(registry.content_types)) {
+    let translateInclude2 = function(requested) {
+      const include = [];
+      for (const field of requested) {
+        const registryName = includeNames.get(field);
+        if (registryName === void 0) return { ok: false, field };
+        include.push(registryName);
+      }
+      return { ok: true, include };
+    };
+    var translateInclude = translateInclude2;
     const basePath = contentType.default_base_path;
     const repo = repos[typeName];
     if (!repo) continue;
     const fieldKeys = projectors[typeName].map;
-    const relationFieldNames = /* @__PURE__ */ new Set();
+    const programmatic = contentType.fields.filter((f) => f.field_type === "programmatic").map((f) => f.name);
+    const includeNames = /* @__PURE__ */ new Map();
     for (const f of contentType.fields) {
       if (!RELATION_FIELD_TYPES.has(f.field_type)) continue;
       if (isColumnBacked(f)) {
         const label = fieldKeys.labelFor(f.db_column.column_name);
-        if (label !== void 0) relationFieldNames.add(label);
+        if (label !== void 0) includeNames.set(label, f.name);
       } else {
-        relationFieldNames.add(f.name);
+        includeNames.set(f.name, f.name);
       }
     }
     const filterableFieldNames = /* @__PURE__ */ new Set([
@@ -1987,8 +2041,11 @@ function registerPublicContentRoutes(app, registry, repos, projectors, paths, li
             404
           );
         }
-        let data = projectRow(result.data[0], typeName, projectors);
-        if (resolver?.hasSchema(typeName)) data = await resolver.resolveItem(typeName, data);
+        const data = await respondItem(
+          result.data[0],
+          typeName,
+          programmatic
+        );
         return c.json({ ok: true, data });
       });
     } else {
@@ -2045,21 +2102,20 @@ function registerPublicContentRoutes(app, registry, repos, projectors, paths, li
             400
           );
         }
-        const include = parseInclude(c.req.query("include"));
-        for (const field of include) {
-          if (!relationFieldNames.has(field)) {
-            return c.json(
-              {
-                ok: false,
-                error: {
-                  code: "INVALID_INCLUDE_FIELD",
-                  message: `'${field}' is not a valid relation field`
-                }
-              },
-              400
-            );
-          }
+        const translated = translateInclude2(parseInclude(c.req.query("include")));
+        if (!translated.ok) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "INVALID_INCLUDE_FIELD",
+                message: `'${translated.field}' is not a valid relation field`
+              }
+            },
+            400
+          );
         }
+        const include = translated.include;
         const sortColumn = fieldKeys.labels.includes(sortBy) ? fieldKeys.columnFor(sortBy) : sortBy;
         const result = await repo.findMany({
           published_only: true,
@@ -2070,29 +2126,25 @@ function registerPublicContentRoutes(app, registry, repos, projectors, paths, li
           filters: filtersResult.filters,
           include
         });
-        const labeled = result.data.map(
-          (row) => projectRow(row, typeName, projectors)
-        );
-        const data = resolver?.hasSchema(typeName) ? await resolver.resolveList(typeName, labeled) : labeled;
+        const data = await respondList(result.data, typeName, programmatic);
         return c.json({ ...result, data });
       });
       app.get(paths.item(basePath), async (c) => {
         const slug = c.req.param("slug");
-        const include = parseInclude(c.req.query("include"));
-        for (const field of include) {
-          if (!relationFieldNames.has(field)) {
-            return c.json(
-              {
-                ok: false,
-                error: {
-                  code: "INVALID_INCLUDE_FIELD",
-                  message: `'${field}' is not a valid relation field`
-                }
-              },
-              400
-            );
-          }
+        const translated = translateInclude2(parseInclude(c.req.query("include")));
+        if (!translated.ok) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "INVALID_INCLUDE_FIELD",
+                message: `'${translated.field}' is not a valid relation field`
+              }
+            },
+            400
+          );
         }
+        const include = translated.include;
         const item = await repo.findBySlug(slug, include);
         if (!item || !isPublished(item)) {
           return c.json(
@@ -2103,15 +2155,15 @@ function registerPublicContentRoutes(app, registry, repos, projectors, paths, li
             404
           );
         }
-        let data = projectRow(item, typeName, projectors);
-        if (resolver?.hasSchema(typeName)) data = await resolver.resolveItem(typeName, data);
+        const data = await respondItem(item, typeName, programmatic);
         return c.json({ ok: true, data });
       });
     }
   }
-  for (const [typeName] of Object.entries(registry.taxonomy_types)) {
+  for (const [typeName, taxonomyType] of Object.entries(registry.taxonomy_types)) {
     const repo = repos[typeName];
     if (!repo) continue;
+    const programmatic = taxonomyType.fields.filter((f) => f.field_type === "programmatic").map((f) => f.name);
     registerListRoute(paths.taxonomyCollection(typeName), async (c) => {
       const pagination = parsePagination(c.req.query("page"), c.req.query("per_page"));
       if (!pagination.ok) {
@@ -2131,10 +2183,7 @@ function registerPublicContentRoutes(app, registry, repos, projectors, paths, li
         page: pagination.page,
         per_page: pagination.per_page
       });
-      const labeled = result.data.map(
-        (row) => projectRow(row, typeName, projectors)
-      );
-      const data = resolver?.hasSchema(typeName) ? await resolver.resolveList(typeName, labeled) : labeled;
+      const data = await respondList(result.data, typeName, programmatic);
       return c.json({ ...result, data });
     });
     app.get(paths.taxonomyItem(typeName), async (c) => {
@@ -2149,8 +2198,7 @@ function registerPublicContentRoutes(app, registry, repos, projectors, paths, li
           404
         );
       }
-      let data = projectRow(item, typeName, projectors);
-      if (resolver?.hasSchema(typeName)) data = await resolver.resolveItem(typeName, data);
+      const data = await respondItem(item, typeName, programmatic);
       return c.json({ ok: true, data });
     });
   }
@@ -2222,7 +2270,55 @@ function registerPublicMediaRoutes(app, mediaRepo, paths, listRateLimit) {
 }
 
 // src/routes/admin/content.ts
-var import_drizzle_orm3 = require("drizzle-orm");
+var import_drizzle_orm4 = require("drizzle-orm");
+
+// src/references-in-use.ts
+var import_drizzle_orm2 = require("drizzle-orm");
+var import_manguito_cms_core = require("@bobbykim/manguito-cms-core");
+function quoteIdent(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+function isRequiredSingleReferenceTo(f, targetType) {
+  return f.field_type === "reference" && f.required && (0, import_manguito_cms_core.relationCardinality)(f) === "one" && f.db_column?.foreign_key !== void 0 && f.ui_component.component === "typeahead-select" && f.ui_component.ref === targetType;
+}
+async function findRequiredReferrers(db, registry, targetType, id) {
+  const owners = [
+    ...Object.values(registry.content_types),
+    ...Object.values(registry.taxonomy_types),
+    ...Object.values(registry.paragraph_types)
+  ];
+  const out = [];
+  for (const owner of owners) {
+    for (const f of owner.fields) {
+      if (!isRequiredSingleReferenceTo(f, targetType)) continue;
+      const notSelf = owner.name === targetType ? import_drizzle_orm2.sql` AND id <> ${id}` : import_drizzle_orm2.sql``;
+      const r = await db.execute(
+        import_drizzle_orm2.sql`SELECT count(*)::int AS n FROM ${import_drizzle_orm2.sql.raw(quoteIdent(owner.db.table_name))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
+      );
+      const n = r.rows[0].n;
+      if (n > 0) out.push({ type_label: owner.label, field_label: f.label, count: n });
+    }
+  }
+  return out;
+}
+function inUseMessage(referrers) {
+  const total = referrers.reduce((sum, r) => sum + r.count, 0);
+  const where = referrers.map((r) => `${r.count} in ${r.type_label} (${r.field_label})`).join(", ");
+  return `This item is still used by ${total} item${total === 1 ? "" : "s"}: ${where}. Remove it from those first.`;
+}
+var IN_USE_RACE_MESSAGE = "This item is still in use. Remove it from the items that use it first.";
+function isForeignKeyViolation(err) {
+  let e = err;
+  for (let depth = 0; depth < 3 && typeof e === "object" && e !== null; depth++) {
+    if (e.code === "23503") return true;
+    e = e.cause;
+  }
+  return false;
+}
+
+// src/routes/admin/content.ts
+var import_manguito_cms_core4 = require("@bobbykim/manguito-cms-core");
 
 // src/media-references.ts
 function extractMediaId(value) {
@@ -2260,14 +2356,62 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
 
 // src/routes/admin/content.ts
 init_relations();
+
+// src/relation-input.ts
+var import_manguito_cms_core3 = require("@bobbykim/manguito-cms-core");
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(v) {
+  return typeof v === "string" && UUID_RE.test(v);
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function checkRelationInput(fields, body, registry, path = "") {
+  const errors = [];
+  for (const field of fields) {
+    if (!(field.name in body)) continue;
+    const cardinality = (0, import_manguito_cms_core3.relationCardinality)(field);
+    if (cardinality === null) continue;
+    const value = body[field.name];
+    const name = `${path}${field.name}`;
+    if (field.field_type === "reference") {
+      const ok = cardinality === "one" ? value === null || isUuid(value) : Array.isArray(value) && value.every(isUuid);
+      if (!ok) {
+        errors.push({
+          field: name,
+          message: cardinality === "one" ? `${name} holds one item: send a UUID string or null.` : `${name} holds a list: send an array of UUID strings.`
+        });
+      }
+      continue;
+    }
+    const items = cardinality === "one" ? value === null ? [] : isPlainObject(value) ? [value] : void 0 : Array.isArray(value) && value.every(isPlainObject) ? value : void 0;
+    if (items === void 0) {
+      errors.push({
+        field: name,
+        message: cardinality === "one" ? `${name} holds one item: send an object or null.` : `${name} holds a list: send an array of objects.`
+      });
+      continue;
+    }
+    const comp = field.ui_component;
+    const pType = comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
+    if (!pType) continue;
+    items.forEach((item, i) => {
+      const prefix = cardinality === "one" ? `${name}.` : `${name}[${i}].`;
+      errors.push(...checkRelationInput(pType.fields, item, registry, prefix));
+    });
+  }
+  return errors;
+}
+
+// src/routes/admin/content.ts
 init_field_keys();
-function quoteIdent2(name) {
+function quoteIdent3(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
 async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   const result = await db.execute(
-    import_drizzle_orm3.sql`SELECT * FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    import_drizzle_orm4.sql`SELECT * FROM ${import_drizzle_orm4.sql.raw(quoteIdent3(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
   );
   const rows = result.rows;
   for (const nf of pType.fields) {
@@ -2277,14 +2421,17 @@ async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
     const nType = registry.paragraph_types[comp.ref];
     if (!nType) continue;
     for (const row of rows) {
-      row[nf.name] = await loadParagraphRows(db, registry, nType, row["id"], nf.name);
+      row[nf.name] = oneOrMany(
+        (0, import_manguito_cms_core4.relationCardinality)(nf) ?? "many",
+        await loadParagraphRows(db, registry, nType, row["id"], nf.name)
+      );
     }
   }
   return rows;
 }
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
-    import_drizzle_orm3.sql`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
+    import_drizzle_orm4.sql`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
   );
   return r.rows[0]?.id ?? null;
 }
@@ -2298,6 +2445,14 @@ function isEmpty(value) {
 function checkRequiredFields(fields, data) {
   return fields.filter((f) => f.required && isEmpty(data[f.name])).map((f) => ({ field: f.name, message: `${f.label} is required` }));
 }
+function relationShapeError(c, fields, body, registry) {
+  const details = checkRelationInput(fields, body, registry);
+  if (details.length === 0) return null;
+  return c.json(
+    { ok: false, error: { code: "VALIDATION_ERROR", message: "Relation fields have the wrong shape", details } },
+    422
+  );
+}
 function parseListQuery(url, schemaFieldNames, relationFieldNames, columnFor) {
   const searchParams = new URL(url).searchParams;
   const pagination = parsePagination(
@@ -2439,11 +2594,11 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
               if (comp.component !== "paragraph-embed" || !comp.ref) continue;
               const pType = registry.paragraph_types[comp.ref];
               if (!pType) continue;
-              row[f.name] = await loadParagraphRows(db, registry, pType, id, f.name);
+              row[f.name] = oneOrMany((0, import_manguito_cms_core4.relationCardinality)(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name));
             } else if (f.db_column.junction) {
               const j = f.db_column.junction;
               const r = await db.execute(
-                import_drizzle_orm3.sql`SELECT ${import_drizzle_orm3.sql.raw(quoteIdent2(j.right_column))} FROM ${import_drizzle_orm3.sql.raw(quoteIdent2(j.table_name))} WHERE ${import_drizzle_orm3.sql.raw(quoteIdent2(j.left_column))} = ${id}`
+                import_drizzle_orm4.sql`SELECT ${import_drizzle_orm4.sql.raw(quoteIdent3(j.right_column))} FROM ${import_drizzle_orm4.sql.raw(quoteIdent3(j.table_name))} WHERE ${import_drizzle_orm4.sql.raw(quoteIdent3(j.left_column))} = ${id}`
               );
               row[f.name] = r.rows.map(
                 (row2) => row2[j.right_column]
@@ -2519,6 +2674,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
     );
     const writeNewItem = async (c, body) => {
+      const shapeError = relationShapeError(c, contentType.fields, body, registry);
+      if (shapeError) return shapeError;
       const storageBody = fieldKeys.toStorage(body);
       const fieldErrors = checkRequiredFields(requiredFields, body);
       if (fieldErrors.length > 0) {
@@ -2582,7 +2739,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           if (comp.component !== "paragraph-embed" || !comp.ref) continue;
           const pType = registry.paragraph_types[comp.ref];
           if (!pType) continue;
-          const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+          const items = paragraphItems(f, body[f.name]);
           mediaDeltas.push(await persistParagraphField(db, itemId, contentType.db.table_name, f.name, pType, items, registry));
         }
         for (const f of junctionFields) {
@@ -2653,6 +2810,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
     );
     const writeExistingItem = async (c, id, existing, body) => {
+      const shapeError = relationShapeError(c, contentType.fields, body, registry);
+      if (shapeError) return shapeError;
       const storageBody = fieldKeys.toStorage(body);
       if (body["published"] === true) {
         const publishDeny = await requirePermission("content:edit")(c, async () => {
@@ -2699,14 +2858,16 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       ];
       if (db) {
         for (const f of patchParagraphFields) {
+          if (!(f.name in body)) continue;
           const comp = f.ui_component;
           if (comp.component !== "paragraph-embed" || !comp.ref) continue;
           const pType = registry.paragraph_types[comp.ref];
           if (!pType) continue;
-          const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+          const items = paragraphItems(f, body[f.name]);
           mediaDeltas.push(await persistParagraphField(db, id, contentType.db.table_name, f.name, pType, items, registry));
         }
         for (const f of patchJunctionFields) {
+          if (!(f.name in body)) continue;
           const junction = f.db_column.junction;
           const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
           await persistJunctionField(db, id, junction, relatedIds);
@@ -2746,6 +2907,18 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
+        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
+        if (referrers.length > 0) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
+        }
+        try {
+          await repo.delete(id);
+        } catch (err) {
+          if (isForeignKeyViolation(err)) {
+            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
+          }
+          throw err;
+        }
         const mediaDeltas = [
           topLevelMediaDelta(mediaFields, item, null)
         ];
@@ -2759,7 +2932,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
-        await repo.delete(id);
         return c.json({ ok: true });
       }
     );
@@ -2837,6 +3009,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       requirePermission("content:create"),
       async (c) => {
         const body = await c.req.json();
+        const shapeError = relationShapeError(c, taxonomyType.fields, body, registry);
+        if (shapeError) return shapeError;
         const storageBody = fieldKeys.toStorage(body);
         const fieldErrors = checkRequiredFields(requiredFields, body);
         if (fieldErrors.length > 0) {
@@ -2876,7 +3050,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             if (comp.component !== "paragraph-embed" || !comp.ref) continue;
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
-            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            const items = paragraphItems(f, body[f.name]);
             mediaDeltas.push(await persistParagraphField(db, taxItemId, taxonomyType.db.table_name, f.name, pType, items, registry));
           }
         }
@@ -2899,6 +3073,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
+        const shapeError = relationShapeError(c, taxonomyType.fields, body, registry);
+        if (shapeError) return shapeError;
         if (body["published"] === true) {
           const publishDeny = await requirePermission("content:edit")(c, async () => {
           });
@@ -2940,11 +3116,12 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         ];
         if (db) {
           for (const f of taxPatchParagraphFields) {
+            if (!(f.name in body)) continue;
             const comp = f.ui_component;
             if (comp.component !== "paragraph-embed" || !comp.ref) continue;
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
-            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            const items = paragraphItems(f, body[f.name]);
             mediaDeltas.push(await persistParagraphField(db, id, taxonomyType.db.table_name, f.name, pType, items, registry));
           }
         }
@@ -2965,6 +3142,18 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
+        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
+        if (referrers.length > 0) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
+        }
+        try {
+          await repo.delete(id);
+        } catch (err) {
+          if (isForeignKeyViolation(err)) {
+            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
+          }
+          throw err;
+        }
         const mediaDeltas = [
           topLevelMediaDelta(mediaFields, item, null)
         ];
@@ -2978,7 +3167,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
-        await repo.delete(id);
         return c.json({ ok: true });
       }
     );
@@ -3440,10 +3628,10 @@ function registerAdminMediaRoutes(app, mediaRepo, storage, requirePermission, ma
 
 // src/routes/admin/auth.ts
 var import_cookie3 = require("hono/cookie");
-var import_drizzle_orm4 = require("drizzle-orm");
+var import_drizzle_orm5 = require("drizzle-orm");
 
 // src/auth/password.ts
-var import_manguito_cms_core = require("@bobbykim/manguito-cms-core");
+var import_manguito_cms_core5 = require("@bobbykim/manguito-cms-core");
 
 // src/routes/admin/auth.ts
 var loginAttempts = /* @__PURE__ */ new Map();
@@ -3506,20 +3694,20 @@ function registerAuthRoutes(app, db) {
       );
     }
     const userResult = await db.execute(
-      import_drizzle_orm4.sql`SELECT id, email, password_hash, role_id, token_version
+      import_drizzle_orm5.sql`SELECT id, email, password_hash, role_id, token_version
           FROM users WHERE email = ${email} LIMIT 1`
     );
     const user = userResult.rows[0];
     if (!user) {
-      await (0, import_manguito_cms_core.verifyPassword)(password, DUMMY_PASSWORD_HASH);
+      await (0, import_manguito_cms_core5.verifyPassword)(password, DUMMY_PASSWORD_HASH);
       return c.json(invalidCredentials, 401);
     }
-    const passwordValid = await (0, import_manguito_cms_core.verifyPassword)(password, user.password_hash);
+    const passwordValid = await (0, import_manguito_cms_core5.verifyPassword)(password, user.password_hash);
     if (!passwordValid) {
       return c.json(invalidCredentials, 401);
     }
     const roleResult = await db.execute(
-      import_drizzle_orm4.sql`SELECT r.name AS name, u.must_change_password
+      import_drizzle_orm5.sql`SELECT r.name AS name, u.must_change_password
           FROM roles r
           JOIN users u ON u.role_id = r.id
           WHERE r.id = ${user.role_id} AND u.id = ${user.id}
@@ -3579,7 +3767,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const rowResult = await db.execute(
-      import_drizzle_orm4.sql`SELECT u.token_version, r.name AS role
+      import_drizzle_orm5.sql`SELECT u.token_version, r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${payload.user_id}
@@ -3603,7 +3791,7 @@ function registerAuthRoutes(app, db) {
   app.post("/admin/api/auth/logout", authMiddleware, async (c) => {
     const user = c.get("user");
     await db.execute(
-      import_drizzle_orm4.sql`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
+      import_drizzle_orm5.sql`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
     );
     clearAuthCookie(c, "auth_token");
     clearAuthCookie(c, "refresh_token", "/admin/api/auth");
@@ -3612,7 +3800,7 @@ function registerAuthRoutes(app, db) {
 }
 
 // src/routes/admin/users.ts
-var import_drizzle_orm5 = require("drizzle-orm");
+var import_drizzle_orm6 = require("drizzle-orm");
 var import_node_crypto2 = require("crypto");
 function getActingUser(c) {
   return c.get("user");
@@ -3647,18 +3835,18 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       );
     }
     const hashResult = await db.execute(
-      import_drizzle_orm5.sql`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      import_drizzle_orm6.sql`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const hashRow = hashResult.rows[0];
-    if (!hashRow || !await (0, import_manguito_cms_core.verifyPassword)(currentPassword, hashRow.password_hash)) {
+    if (!hashRow || !await (0, import_manguito_cms_core5.verifyPassword)(currentPassword, hashRow.password_hash)) {
       return c.json(
         { ok: false, error: { code: "INVALID_CREDENTIALS", message: "Invalid credentials." } },
         401
       );
     }
-    const newHash = await (0, import_manguito_cms_core.hashPassword)(newPassword);
+    const newHash = await (0, import_manguito_cms_core5.hashPassword)(newPassword);
     await db.execute(
-      import_drizzle_orm5.sql`UPDATE users
+      import_drizzle_orm6.sql`UPDATE users
           SET password_hash       = ${newHash},
               must_change_password = false,
               token_version        = token_version + 1,
@@ -3669,7 +3857,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   });
   app.get("/admin/api/users", requirePermission("users:read"), async (c) => {
     const result = await db.execute(
-      import_drizzle_orm5.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      import_drizzle_orm6.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -3680,7 +3868,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   app.get("/admin/api/users/:id", requirePermission("users:read"), async (c) => {
     const id = c.req.param("id");
     const result = await db.execute(
-      import_drizzle_orm5.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      import_drizzle_orm6.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -3725,7 +3913,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const roleResult = await db.execute(
-        import_drizzle_orm5.sql`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
+        import_drizzle_orm6.sql`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
       );
       const roleRow = roleResult.rows[0];
       if (!roleRow) {
@@ -3738,9 +3926,9 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const tempPassword = generateTempPassword();
-      const passwordHash = await (0, import_manguito_cms_core.hashPassword)(tempPassword);
+      const passwordHash = await (0, import_manguito_cms_core5.hashPassword)(tempPassword);
       const insertResult = await db.execute(
-        import_drizzle_orm5.sql`INSERT INTO users
+        import_drizzle_orm6.sql`INSERT INTO users
               (id, email, password_hash, role_id, must_change_password, token_version,
                created_at, updated_at)
             VALUES
@@ -3795,7 +3983,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        import_drizzle_orm5.sql`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm6.sql`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -3809,7 +3997,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       let changeRole = false;
       if (typeof body.role === "string" && body.role) {
         const roleResult = await db.execute(
-          import_drizzle_orm5.sql`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
+          import_drizzle_orm6.sql`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
         );
         const roleRow = roleResult.rows[0];
         if (!roleRow) {
@@ -3829,7 +4017,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       }
       if (changeRole) {
         await db.execute(
-          import_drizzle_orm5.sql`UPDATE users
+          import_drizzle_orm6.sql`UPDATE users
               SET email         = ${newEmail},
                   role_id       = ${newRoleId},
                   token_version = token_version + 1,
@@ -3838,7 +4026,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       } else {
         await db.execute(
-          import_drizzle_orm5.sql`UPDATE users
+          import_drizzle_orm6.sql`UPDATE users
               SET email      = ${newEmail},
                   role_id    = ${newRoleId},
                   updated_at = NOW()
@@ -3846,7 +4034,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const updatedResult = await db.execute(
-        import_drizzle_orm5.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+        import_drizzle_orm6.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                    u.created_at, u.updated_at
             FROM users u
             JOIN roles r ON r.id = u.role_id
@@ -3883,7 +4071,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const result = await db.execute(
-        import_drizzle_orm5.sql`DELETE FROM users WHERE id = ${id} RETURNING id`
+        import_drizzle_orm6.sql`DELETE FROM users WHERE id = ${id} RETURNING id`
       );
       if (result.rows.length === 0) {
         return c.json(
@@ -3914,7 +4102,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        import_drizzle_orm5.sql`SELECT id FROM users WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm6.sql`SELECT id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -3924,9 +4112,9 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const tempPassword = generateTempPassword();
-      const passwordHash = await (0, import_manguito_cms_core.hashPassword)(tempPassword);
+      const passwordHash = await (0, import_manguito_cms_core5.hashPassword)(tempPassword);
       await db.execute(
-        import_drizzle_orm5.sql`UPDATE users
+        import_drizzle_orm6.sql`UPDATE users
             SET password_hash        = ${passwordHash},
                 must_change_password = true,
                 token_version        = token_version + 1,
@@ -3939,10 +4127,10 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 
 // src/routes/admin/config.ts
-var import_drizzle_orm6 = require("drizzle-orm");
+var import_drizzle_orm7 = require("drizzle-orm");
 var API_VERSION = (() => {
   try {
-    return "0.6.0";
+    return "0.8.0";
   } catch {
     return "0.0.0";
   }
@@ -3961,7 +4149,7 @@ function registerConfigRoute(app, config, registry, db) {
       permissions: r.permissions
     }));
     const userResult = await db.execute(
-      import_drizzle_orm6.sql`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      import_drizzle_orm7.sql`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const userRow = userResult.rows[0];
     return c.json({
@@ -3987,7 +4175,7 @@ function registerConfigRoute(app, config, registry, db) {
 }
 
 // src/routes/admin/schema.ts
-var import_drizzle_orm7 = require("drizzle-orm");
+var import_drizzle_orm8 = require("drizzle-orm");
 function liveFields(fields) {
   return fields.filter((f) => f.removed !== true);
 }
@@ -4027,7 +4215,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.content_types).map(async (ct) => {
         const result = await db.execute(
-          import_drizzle_orm7.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm7.sql.raw(`"${ct.db.table_name}"`)}`
+          import_drizzle_orm8.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm8.sql.raw(`"${ct.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: ct.name, label: ct.label, only_one: ct.only_one, count };
@@ -4039,7 +4227,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.taxonomy_types).map(async (tt) => {
         const result = await db.execute(
-          import_drizzle_orm7.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm7.sql.raw(`"${tt.db.table_name}"`)}`
+          import_drizzle_orm8.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm8.sql.raw(`"${tt.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: tt.name, label: tt.label, count };
@@ -4051,7 +4239,7 @@ function registerSchemaRoute(app, registry, db) {
 
 // src/repositories/content.ts
 var import_node_crypto3 = __toESM(require("crypto"));
-var import_drizzle_orm8 = require("drizzle-orm");
+var import_drizzle_orm9 = require("drizzle-orm");
 init_relations();
 var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
 function codeError(code, message) {
@@ -4059,7 +4247,7 @@ function codeError(code, message) {
   err.code = code;
   return err;
 }
-function quoteIdent3(name) {
+function quoteIdent4(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Unsafe SQL identifier: ${name}`);
   }
@@ -4074,43 +4262,43 @@ function quoteField(name) {
 function buildConditions(published_only, filters, search) {
   const conds = [];
   if (published_only) {
-    conds.push(import_drizzle_orm8.sql`published = true`);
+    conds.push(import_drizzle_orm9.sql`published = true`);
   }
   if (search && search.term.trim() !== "" && search.columns.length > 0) {
     const pattern = `%${search.term.trim()}%`;
-    const orConds = search.columns.map((col) => import_drizzle_orm8.sql`${import_drizzle_orm8.sql.raw(quoteField(col))} ILIKE ${pattern}`);
-    conds.push(import_drizzle_orm8.sql`(${import_drizzle_orm8.sql.join(orConds, import_drizzle_orm8.sql` OR `)})`);
+    const orConds = search.columns.map((col) => import_drizzle_orm9.sql`${import_drizzle_orm9.sql.raw(quoteField(col))} ILIKE ${pattern}`);
+    conds.push(import_drizzle_orm9.sql`(${import_drizzle_orm9.sql.join(orConds, import_drizzle_orm9.sql` OR `)})`);
   }
   if (filters) {
     for (const [field, value] of Object.entries(filters)) {
-      const col = import_drizzle_orm8.sql.raw(quoteField(field));
+      const col = import_drizzle_orm9.sql.raw(quoteField(field));
       if (Array.isArray(value)) {
         if (value.length === 0) continue;
-        const inList = import_drizzle_orm8.sql.join(
-          value.map((v) => import_drizzle_orm8.sql`${v}`),
-          import_drizzle_orm8.sql`, `
+        const inList = import_drizzle_orm9.sql.join(
+          value.map((v) => import_drizzle_orm9.sql`${v}`),
+          import_drizzle_orm9.sql`, `
         );
-        conds.push(import_drizzle_orm8.sql`${col} IN (${inList})`);
+        conds.push(import_drizzle_orm9.sql`${col} IN (${inList})`);
       } else if (typeof value === "object" && value !== null) {
         const op = value;
-        if (op.gt !== void 0) conds.push(import_drizzle_orm8.sql`${col} > ${op.gt}`);
-        if (op.gte !== void 0) conds.push(import_drizzle_orm8.sql`${col} >= ${op.gte}`);
-        if (op.lt !== void 0) conds.push(import_drizzle_orm8.sql`${col} < ${op.lt}`);
-        if (op.lte !== void 0) conds.push(import_drizzle_orm8.sql`${col} <= ${op.lte}`);
+        if (op.gt !== void 0) conds.push(import_drizzle_orm9.sql`${col} > ${op.gt}`);
+        if (op.gte !== void 0) conds.push(import_drizzle_orm9.sql`${col} >= ${op.gte}`);
+        if (op.lt !== void 0) conds.push(import_drizzle_orm9.sql`${col} < ${op.lt}`);
+        if (op.lte !== void 0) conds.push(import_drizzle_orm9.sql`${col} <= ${op.lte}`);
       } else {
-        conds.push(import_drizzle_orm8.sql`${col} = ${value}`);
+        conds.push(import_drizzle_orm9.sql`${col} = ${value}`);
       }
     }
   }
   return conds;
 }
 function whereFragment(conds) {
-  return conds.length > 0 ? import_drizzle_orm8.sql` WHERE ${import_drizzle_orm8.sql.join(conds, import_drizzle_orm8.sql` AND `)}` : import_drizzle_orm8.sql``;
+  return conds.length > 0 ? import_drizzle_orm9.sql` WHERE ${import_drizzle_orm9.sql.join(conds, import_drizzle_orm9.sql` AND `)}` : import_drizzle_orm9.sql``;
 }
 function createDrizzleContentRepository(db, tableName, options = {}) {
   const { relations = {}, publishedRelations = false, sortableColumns } = options;
   function tableRaw() {
-    return import_drizzle_orm8.sql.raw(quoteIdent3(tableName));
+    return import_drizzle_orm9.sql.raw(quoteIdent4(tableName));
   }
   async function resolveRows(rows, include, cache) {
     if (rows.length === 0) return rows;
@@ -4153,14 +4341,14 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       const offset = (page - 1) * per_page;
       const conds = buildConditions(published_only, filters, search);
       const where = whereFragment(conds);
-      const sortCol = import_drizzle_orm8.sql.raw(quoteIdent3(sort_by));
-      const sortDir = import_drizzle_orm8.sql.raw(sort_order === "desc" ? "DESC" : "ASC");
+      const sortCol = import_drizzle_orm9.sql.raw(quoteIdent4(sort_by));
+      const sortDir = import_drizzle_orm9.sql.raw(sort_order === "desc" ? "DESC" : "ASC");
       const countResult = await db.execute(
-        import_drizzle_orm8.sql`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
+        import_drizzle_orm9.sql`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
       );
       const total = Number(countResult.rows[0]?.["total"] ?? 0);
       const dataResult = await db.execute(
-        import_drizzle_orm8.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
+        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
       );
       const rows = dataResult.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -4181,7 +4369,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findOne(id, include = []) {
       const result = await db.execute(
-        import_drizzle_orm8.sql`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -4191,7 +4379,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findBySlug(slug, include = []) {
       const result = await db.execute(
-        import_drizzle_orm8.sql`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
+        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -4207,10 +4395,10 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = import_drizzle_orm8.sql.join(entries.map(([k]) => import_drizzle_orm8.sql.raw(quoteIdent3(k))), import_drizzle_orm8.sql`, `);
-      const valsSql = import_drizzle_orm8.sql.join(entries.map(([, v]) => import_drizzle_orm8.sql`${v}`), import_drizzle_orm8.sql`, `);
+      const colsSql = import_drizzle_orm9.sql.join(entries.map(([k]) => import_drizzle_orm9.sql.raw(quoteIdent4(k))), import_drizzle_orm9.sql`, `);
+      const valsSql = import_drizzle_orm9.sql.join(entries.map(([, v]) => import_drizzle_orm9.sql`${v}`), import_drizzle_orm9.sql`, `);
       const result = await db.execute(
-        import_drizzle_orm8.sql`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        import_drizzle_orm9.sql`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -4223,25 +4411,25 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       if (entries.length === 0) {
         return this.findOne(id);
       }
-      const setClauses = import_drizzle_orm8.sql.join(
-        entries.map(([k, v]) => import_drizzle_orm8.sql`${import_drizzle_orm8.sql.raw(quoteIdent3(k))} = ${v}`),
-        import_drizzle_orm8.sql`, `
+      const setClauses = import_drizzle_orm9.sql.join(
+        entries.map(([k, v]) => import_drizzle_orm9.sql`${import_drizzle_orm9.sql.raw(quoteIdent4(k))} = ${v}`),
+        import_drizzle_orm9.sql`, `
       );
       const result = await db.execute(
-        import_drizzle_orm8.sql`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        import_drizzle_orm9.sql`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(import_drizzle_orm8.sql`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
+      await db.execute(import_drizzle_orm9.sql`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
     },
     async findAll(opts = {}) {
       const { include = [], published_only } = opts;
       const conds = buildConditions(published_only, void 0, void 0);
       const where = whereFragment(conds);
       const result = await db.execute(
-        import_drizzle_orm8.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
+        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
       );
       const rows = result.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -4256,23 +4444,23 @@ init_relations();
 
 // src/repositories/media.ts
 var import_node_crypto4 = __toESM(require("crypto"));
-var import_drizzle_orm9 = require("drizzle-orm");
+var import_drizzle_orm10 = require("drizzle-orm");
 function createMediaRepository(db) {
-  const TABLE = import_drizzle_orm9.sql.raw('"media"');
+  const TABLE = import_drizzle_orm10.sql.raw('"media"');
   return {
     async findMany(opts = {}) {
       const { page = 1, per_page = 10, type, orphaned } = opts;
       const offset = (page - 1) * per_page;
       const conds = [];
-      if (type) conds.push(import_drizzle_orm9.sql`type = ${type}`);
-      if (orphaned) conds.push(import_drizzle_orm9.sql`reference_count = 0`);
-      const where = conds.length > 0 ? import_drizzle_orm9.sql` WHERE ${import_drizzle_orm9.sql.join(conds, import_drizzle_orm9.sql` AND `)}` : import_drizzle_orm9.sql``;
-      const countResult = await db.execute(import_drizzle_orm9.sql`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
+      if (type) conds.push(import_drizzle_orm10.sql`type = ${type}`);
+      if (orphaned) conds.push(import_drizzle_orm10.sql`reference_count = 0`);
+      const where = conds.length > 0 ? import_drizzle_orm10.sql` WHERE ${import_drizzle_orm10.sql.join(conds, import_drizzle_orm10.sql` AND `)}` : import_drizzle_orm10.sql``;
+      const countResult = await db.execute(import_drizzle_orm10.sql`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
       const total = Number(
         countResult.rows[0]?.["total"] ?? 0
       );
       const dataResult = await db.execute(
-        import_drizzle_orm9.sql`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
+        import_drizzle_orm10.sql`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
       );
       const total_pages = Math.ceil(total / per_page);
       return {
@@ -4290,7 +4478,7 @@ function createMediaRepository(db) {
     },
     async findOne(id) {
       const result = await db.execute(
-        import_drizzle_orm9.sql`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm10.sql`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
@@ -4304,10 +4492,10 @@ function createMediaRepository(db) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = import_drizzle_orm9.sql.join(entries.map(([k]) => import_drizzle_orm9.sql.raw(`"${k}"`)), import_drizzle_orm9.sql`, `);
-      const valsSql = import_drizzle_orm9.sql.join(entries.map(([, v]) => import_drizzle_orm9.sql`${v}`), import_drizzle_orm9.sql`, `);
+      const colsSql = import_drizzle_orm10.sql.join(entries.map(([k]) => import_drizzle_orm10.sql.raw(`"${k}"`)), import_drizzle_orm10.sql`, `);
+      const valsSql = import_drizzle_orm10.sql.join(entries.map(([, v]) => import_drizzle_orm10.sql`${v}`), import_drizzle_orm10.sql`, `);
       const result = await db.execute(
-        import_drizzle_orm9.sql`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        import_drizzle_orm10.sql`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -4317,31 +4505,31 @@ function createMediaRepository(db) {
         ([k, v]) => k !== "id" && v !== void 0
       );
       if (entries.length === 0) return this.findOne(id);
-      const setClauses = import_drizzle_orm9.sql.join(
-        entries.map(([k, v]) => import_drizzle_orm9.sql`${import_drizzle_orm9.sql.raw(`"${k}"`)} = ${v}`),
-        import_drizzle_orm9.sql`, `
+      const setClauses = import_drizzle_orm10.sql.join(
+        entries.map(([k, v]) => import_drizzle_orm10.sql`${import_drizzle_orm10.sql.raw(`"${k}"`)} = ${v}`),
+        import_drizzle_orm10.sql`, `
       );
       const result = await db.execute(
-        import_drizzle_orm9.sql`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        import_drizzle_orm10.sql`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(import_drizzle_orm9.sql`DELETE FROM ${TABLE} WHERE id = ${id}`);
+      await db.execute(import_drizzle_orm10.sql`DELETE FROM ${TABLE} WHERE id = ${id}`);
     },
     async incrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = import_drizzle_orm9.sql.join(ids.map((id) => import_drizzle_orm9.sql`${id}`), import_drizzle_orm9.sql`, `);
+      const inList = import_drizzle_orm10.sql.join(ids.map((id) => import_drizzle_orm10.sql`${id}`), import_drizzle_orm10.sql`, `);
       await db.execute(
-        import_drizzle_orm9.sql`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
+        import_drizzle_orm10.sql`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
       );
     },
     async decrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = import_drizzle_orm9.sql.join(ids.map((id) => import_drizzle_orm9.sql`${id}`), import_drizzle_orm9.sql`, `);
+      const inList = import_drizzle_orm10.sql.join(ids.map((id) => import_drizzle_orm10.sql`${id}`), import_drizzle_orm10.sql`, `);
       await db.execute(
-        import_drizzle_orm9.sql`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
+        import_drizzle_orm10.sql`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
       );
     }
   };
@@ -4478,7 +4666,7 @@ function createCmsApp(options) {
   const requirePermission = createPermissionMiddleware(rolesRegistry);
   const getUserRole = async (userId) => {
     const result = await db.execute(
-      import_drizzle_orm10.sql`SELECT r.name AS role
+      import_drizzle_orm11.sql`SELECT r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${userId}
@@ -4606,7 +4794,7 @@ function createCmsApp(options) {
         app.use(path, attachDeprecationHeaders);
       }
     }
-    registerPublicContentRoutes(app, registry, surface.repos, surface.projectors, surface.paths, listRateLimit, programmaticResolver);
+    registerPublicContentRoutes(app, registry, surface.repos, surface.projectors, surface.paths, listRateLimit, programmaticResolver, projectors);
   }
   if (options.versions !== void 0) {
     app.all(`${prefix}/:version/*`, async (c, next) => {
@@ -4672,7 +4860,8 @@ function createCmsApp(options) {
               endpoint: mount.path,
               currentVersion: model.current,
               ...projection !== void 0 && { projection },
-              ...currentProjection !== void 0 && { currentProjection }
+              ...currentProjection !== void 0 && { currentProjection },
+              currentFieldKeyMaps: fieldKeyMaps
             }
           );
         } catch (err) {