@bobbykim/manguito-cms-cli 0.10.1 → 0.11.0

package/dist/{chunk-X7D2QPPO.js → chunk-WTZBHFCV.js}

@@ -9270,7 +9270,7 @@ var require_bcryptjs = __commonJS({
   }
 });
 
-// ../api/dist/chunk-IHEIX6P4.mjs
+// ../api/dist/chunk-GUZZQZSN.mjs
 init_esm_shims();
 import crypto from "crypto";
 
@@ -25795,7 +25795,8 @@ var fieldTypeRegistry = {
         left_column: "left_id",
         right_column: "right_id",
         right_table: targetTableName,
-        order_column: false
+        // Every list keeps the order the editor gave it (#57).
+        order_column: true
       }
     } : {
       // FK column on the owning table. An optional reference is cleared when
@@ -26617,7 +26618,7 @@ function describeSchemaChange(input) {
   return { from: from?.version ?? null, to: to.version, types, identical };
 }
 
-// ../api/dist/chunk-IHEIX6P4.mjs
+// ../api/dist/chunk-GUZZQZSN.mjs
 function isColumnBacked2(field) {
   const col = field.db_column;
   if (col === null) return false;
@@ -26845,10 +26846,28 @@ async function persistJunctionField(db, itemId, junction, relatedIds) {
   const tbl = sql.raw(quoteIdent(junction.table_name));
   const left = sql.raw(quoteIdent(junction.left_column));
   const right = sql.raw(quoteIdent(junction.right_column));
+  const seen = /* @__PURE__ */ new Set();
+  const ids = relatedIds.filter((id) => {
+    const key = id.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
   await db.execute(sql`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
-  for (const rid of relatedIds) {
-    await db.execute(sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
-  }
+  if (ids.length === 0) return;
+  const rows = sql.join(
+    ids.map(
+      (rid, position) => junction.order_column ? sql`(${itemId}, ${rid}, ${position})` : sql`(${itemId}, ${rid})`
+    ),
+    sql`, `
+  );
+  await db.execute(
+    junction.order_column ? sql`INSERT INTO ${tbl} (${left}, ${right}, "order") VALUES ${rows}` : sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES ${rows}`
+  );
+}
+function junctionOrderBy(junction) {
+  const right = sql.raw(quoteIdent(junction.right_column));
+  return junction.order_column ? sql` ORDER BY "order" ASC, ${right} ASC` : sql` ORDER BY ${right} ASC`;
 }
 function oneOrMany(cardinality, list) {
   return cardinality === "one" ? list[0] ?? null : list;
@@ -26950,9 +26969,8 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
   } else if (rel.type === "junction") {
     const parentIds = batch.map((r) => r["id"]);
     const inList = sql.join(parentIds.map((id) => sql`${id}`), sql`, `);
-    const orderBy = rel.order_column ? sql` ORDER BY "order" ASC` : sql``;
     const junctionResult = await db.execute(
-      sql`SELECT * FROM ${sql.raw(quoteIdent(rel.junction_table))} WHERE ${sql.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
+      sql`SELECT * FROM ${sql.raw(quoteIdent(rel.junction_table))} WHERE ${sql.raw(quoteIdent(rel.left_column))} IN (${inList})${junctionOrderBy(rel)}`
     );
     const jRows = junctionResult.rows;
     const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
@@ -27011,7 +27029,7 @@ async function resolveRelationBareIds(db, rows, fieldName, rel) {
     const parentIds = rows.map((r) => r["id"]);
     const inList = sql.join(parentIds.map((id) => sql`${id}`), sql`, `);
     const result = await db.execute(
-      sql`SELECT ${sql.raw(quoteIdent(rel.left_column))} AS left_id, ${sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${sql.raw(quoteIdent(rel.junction_table))} WHERE ${sql.raw(quoteIdent(rel.left_column))} IN (${inList})`
+      sql`SELECT ${sql.raw(quoteIdent(rel.left_column))} AS left_id, ${sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${sql.raw(quoteIdent(rel.junction_table))} WHERE ${sql.raw(quoteIdent(rel.left_column))} IN (${inList})${junctionOrderBy(rel)}`
     );
     const byLeft = groupBy(result.rows, "left_id");
     for (const row of rows) {
@@ -27071,6 +27089,7 @@ export {
   persistParagraphField,
   deleteParagraphField,
   persistJunctionField,
+  junctionOrderBy,
   oneOrMany,
   paragraphItems,
   buildRelationsMap,

package/dist/{handler-VEOWJRAL-OU66YS5U.js → handler-MFF32JB4-MEMKPHHQ.js}

@@ -12,7 +12,7 @@ import {
   isColumnBacked,
   relationCardinality,
   resolveRelationField
-} from "./chunk-X7D2QPPO.js";
+} from "./chunk-WTZBHFCV.js";
 
 // ../../node_modules/.pnpm/@whatwg-node+fetch@0.10.13/node_modules/@whatwg-node/fetch/dist/shouldSkipPonyfill.js
 var require_shouldSkipPonyfill = __commonJS({
@@ -10787,10 +10787,10 @@ var require_parser = __commonJS({
   }
 });
 
-// ../api/dist/handler-VEOWJRAL.mjs
+// ../api/dist/handler-MFF32JB4.mjs
 init_esm_shims();
 
-// ../api/dist/chunk-Y5SWT7PO.mjs
+// ../api/dist/chunk-ITOSMGDT.mjs
 init_esm_shims();
 
 // ../../node_modules/.pnpm/graphql-yoga@5.21.2_graphql@16.14.2/node_modules/graphql-yoga/esm/index.js
@@ -30123,7 +30123,7 @@ function createYoga(options) {
   });
 }
 
-// ../api/dist/chunk-Y5SWT7PO.mjs
+// ../api/dist/chunk-ITOSMGDT.mjs
 var import_dataloader = __toESM(require_dataloader(), 1);
 
 // ../../node_modules/.pnpm/@escape.tech+graphql-armor@3.2.0_@envelop+core@5.5.1_@escape.tech+graphql-armor-types@0.7.0/node_modules/@escape.tech/graphql-armor/dist/graphql-armor.esm.js
@@ -30881,7 +30881,7 @@ var EnvelopArmor = class {
   }
 };
 
-// ../api/dist/chunk-Y5SWT7PO.mjs
+// ../api/dist/chunk-ITOSMGDT.mjs
 var DateTimeScalar = new GraphQLScalarType({
   name: "DateTime",
   description: "ISO-8601 date-time string",

package/dist/index.js

@@ -37,6 +37,7 @@ import {
   isColumnBacked,
   isDriverValueEncoder,
   isSQLWrapper,
+  junctionOrderBy,
   loadSchemaFile,
   loadVersionSnapshots,
   oneOrMany,
@@ -54,7 +55,7 @@ import {
   validateCrossReferences,
   verifyPassword,
   walkSchemaDirectory
-} from "./chunk-X7D2QPPO.js";
+} from "./chunk-WTZBHFCV.js";
 
 // ../../node_modules/.pnpm/postgres-array@2.0.0/node_modules/postgres-array/index.js
 var require_postgres_array = __commonJS({
@@ -22848,8 +22849,7 @@ function checkRelationInput(fields, body, registry, path5 = "") {
       });
       continue;
     }
-    const comp = field.ui_component;
-    const pType = comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
+    const pType = paragraphTypeOf(field, registry);
     if (!pType) continue;
     items.forEach((item, i) => {
       const prefix = cardinality === "one" ? `${name}.` : `${name}[${i}].`;
@@ -22858,12 +22858,15 @@ function checkRelationInput(fields, body, registry, path5 = "") {
   }
   return errors;
 }
+function paragraphTypeOf(field, registry) {
+  const comp = field.ui_component;
+  return comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
+}
 function paragraphItemsIn(fields, body, registry, path5) {
   const out = [];
   for (const field of fields) {
     if (field.field_type !== "paragraph" || !(field.name in body)) continue;
-    const comp = field.ui_component;
-    const pType = comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
+    const pType = paragraphTypeOf(field, registry);
     if (!pType) continue;
     const value = body[field.name];
     const name = `${path5}${field.name}`;
@@ -22934,6 +22937,131 @@ async function findMissingReferences(db, fields, body, registry) {
   const found = new Map(await Promise.all(lookups));
   return uses.filter((u) => !found.get(u.table).has(u.id.toLowerCase())).map((u) => ({ field: u.field, message: `${u.field} refers to an item that does not exist.` }));
 }
+var VARCHAR_DEFAULT_LIMIT = 255;
+var INTEGER_MIN = -2147483648;
+var INTEGER_MAX = 2147483647;
+var DECIMAL_LIMIT = 1e6;
+var ISO_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
+var DECIMAL_STRING = /^-?\d+(?:\.\d+)?$/;
+var EMPTY_MEANS_NULL = /* @__PURE__ */ new Set(["date", "integer", "float", "enum"]);
+function emptyValuesToNull(fields, body, registry) {
+  const out = { ...body };
+  for (const f of fields) {
+    if (!(f.name in out)) continue;
+    const value = out[f.name];
+    if (value === "" && EMPTY_MEANS_NULL.has(f.field_type)) {
+      out[f.name] = null;
+      continue;
+    }
+    if (f.field_type !== "paragraph") continue;
+    const pType = paragraphTypeOf(f, registry);
+    if (!pType) continue;
+    if (isPlainObject(value)) out[f.name] = emptyValuesToNull(pType.fields, value, registry);
+    else if (Array.isArray(value)) {
+      out[f.name] = value.map((item) => isPlainObject(item) ? emptyValuesToNull(pType.fields, item, registry) : item);
+    }
+  }
+  return out;
+}
+var compiled = /* @__PURE__ */ new Map();
+function patternOf(source) {
+  if (!compiled.has(source)) {
+    let re;
+    try {
+      re = new RegExp(source);
+    } catch {
+      re = null;
+    }
+    compiled.set(source, re);
+  }
+  return compiled.get(source) ?? null;
+}
+function isRealDate(value) {
+  const m2 = ISO_TIMESTAMP.exec(value);
+  if (!m2) return false;
+  const [y, mo, d2, h = 0, mi2 = 0, sec = 0] = m2.slice(1).map((part) => part === void 0 ? void 0 : Number(part));
+  if (y === void 0 || mo === void 0 || d2 === void 0 || y < 1) return false;
+  const date2 = new Date(Date.UTC(y, mo - 1, d2));
+  date2.setUTCFullYear(y);
+  return date2.getUTCMonth() === mo - 1 && date2.getUTCDate() === d2 && h <= 23 && mi2 <= 59 && sec <= 59;
+}
+function valueError(f, value, name) {
+  const v2 = f.validation;
+  if (Array.isArray(value) && (f.field_type === "paragraph" || f.field_type === "reference")) {
+    if (v2.max_items !== void 0 && value.length > v2.max_items) {
+      return `${name} can hold at most ${v2.max_items} items.`;
+    }
+    return null;
+  }
+  const col = f.db_column;
+  if (!col || col.junction || col.column_type === "uuid") return null;
+  if (value === null || value === void 0) {
+    if (col.nullable) return null;
+    return f.required ? `${name} is required.` : `${name} cannot be empty.`;
+  }
+  switch (f.field_type) {
+    case "text/plain": {
+      if (typeof value !== "string") return `${name} must be text.`;
+      if (value.includes("\0")) return `${name} contains a character that cannot be stored (U+0000).`;
+      const limit = v2.limit ?? VARCHAR_DEFAULT_LIMIT;
+      if ([...value].length > limit) return `${name} can be at most ${limit} characters.`;
+      const pattern = v2.pattern === void 0 ? null : patternOf(v2.pattern);
+      if (value !== "" && pattern && !pattern.test(value)) return `${name} is not in the correct format.`;
+      return null;
+    }
+    case "text/rich":
+      if (typeof value !== "string") return `${name} must be text.`;
+      return value.includes("\0") ? `${name} contains a character that cannot be stored (U+0000).` : null;
+    case "integer":
+      if (typeof value !== "number" || !Number.isInteger(value)) return `${name} must be a whole number.`;
+      if (value < INTEGER_MIN || value > INTEGER_MAX) {
+        return `${name} must be between ${INTEGER_MIN} and ${INTEGER_MAX}.`;
+      }
+      return rangeError(name, value, v2.min, v2.max);
+    case "float": {
+      const n = typeof value === "number" ? value : typeof value === "string" && DECIMAL_STRING.test(value) ? Number(value) : NaN;
+      if (!Number.isFinite(n)) return `${name} must be a number.`;
+      if (roundedSize(typeof value === "string" ? value : String(n)) >= DECIMAL_LIMIT) {
+        return `${name} must be less than ${DECIMAL_LIMIT} in size.`;
+      }
+      return rangeError(name, n, v2.min, v2.max);
+    }
+    case "boolean":
+      return typeof value === "boolean" ? null : `${name} must be true or false.`;
+    case "date":
+      return typeof value === "string" && isRealDate(value) ? null : `${name} must be a date, such as 2026-10-11 or 2026-10-11T09:30:00Z.`;
+    case "enum": {
+      const allowed = v2.allowed_values ?? [];
+      return typeof value === "string" && allowed.includes(value) ? null : `${name} must be one of: ${allowed.join(", ")}.`;
+    }
+    default:
+      return null;
+  }
+}
+function roundedSize(text2) {
+  if (text2.includes("e")) return Math.abs(Number(text2));
+  const [int = "0", frac = ""] = text2.replace("-", "").split(".");
+  const kept = Number(`${int}.${frac.slice(0, 4) || "0"}`);
+  return frac.length > 4 && frac.charAt(4) >= "5" ? kept + 1e-4 : kept;
+}
+function rangeError(name, value, min, max) {
+  if (min !== void 0 && value < min) return `${name} must be at least ${min}.`;
+  if (max !== void 0 && value > max) return `${name} must be at most ${max}.`;
+  return null;
+}
+function checkFieldValues(fields, body, registry, path5 = "") {
+  const errors = [];
+  for (const f of fields) {
+    if (!(f.name in body) || f.removed === true) continue;
+    const name = `${path5}${f.name}`;
+    const message = valueError(f, body[f.name], name);
+    if (message) errors.push({ field: name, message });
+  }
+  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path5)) {
+    errors.push(...checkFieldValues(itemFields, item, registry, prefix));
+  }
+  return errors;
+}
 function quoteIdent3(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
@@ -22969,7 +23097,7 @@ async function loadRelationsForEdit(db, registry, fields, id, row) {
     } else if (f.db_column.junction) {
       const j = f.db_column.junction;
       const r = await db.execute(
-        sql`SELECT ${sql.raw(quoteIdent3(j.right_column))} FROM ${sql.raw(quoteIdent3(j.table_name))} WHERE ${sql.raw(quoteIdent3(j.left_column))} = ${id}`
+        sql`SELECT ${sql.raw(quoteIdent3(j.right_column))} FROM ${sql.raw(quoteIdent3(j.table_name))} WHERE ${sql.raw(quoteIdent3(j.left_column))} = ${id}${junctionOrderBy(j)}`
       );
       row[f.name] = r.rows.map((linked) => linked[j.right_column]);
     }
@@ -23012,6 +23140,8 @@ async function relationInputError(c, fields, body, registry, db) {
   const refuse = (message, details) => c.json({ ok: false, error: { code: "VALIDATION_ERROR", message, details } }, 422);
   const shape = checkRelationInput(fields, body, registry);
   if (shape.length > 0) return refuse("Relation fields have the wrong shape", shape);
+  const values = checkFieldValues(fields, body, registry);
+  if (values.length > 0) return refuse("Some values are not valid", values);
   const required = checkRequiredInParagraphItems(fields, body, registry);
   if (required.length > 0) return refuse("Required fields are missing", required);
   if (db) {
@@ -23162,7 +23292,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       `/admin/api/${basePath}`,
       requirePermission("content:create"),
       async (c) => {
-        const body = await c.req.json();
+        const body = emptyValuesToNull(contentType.fields, await c.req.json(), registry);
         if (contentType.only_one) {
           const existing = await repo.findMany({ page: 1, per_page: 1 });
           if (existing.meta.total > 0) {
@@ -23289,7 +23419,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       requirePermission("content:edit"),
       async (c) => {
         const id = c.req.param("id");
-        const body = await c.req.json();
+        const body = emptyValuesToNull(contentType.fields, await c.req.json(), registry);
         const existing = await repo.findOne(id);
         if (!existing) {
           return c.json(
@@ -23396,7 +23526,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         `/admin/api/${basePath}`,
         requirePermission("content:edit"),
         async (c) => {
-          const body = await c.req.json();
+          const body = emptyValuesToNull(contentType.fields, await c.req.json(), registry);
           const existingResult = await repo.findMany({ page: 1, per_page: 1 });
           const existing = existingResult.data[0];
           if (!existing) {
@@ -23523,7 +23653,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       `/admin/api/taxonomy/${typeName}`,
       requirePermission("content:create"),
       async (c) => {
-        const body = await c.req.json();
+        const body = emptyValuesToNull(taxonomyType.fields, await c.req.json(), registry);
         const inputError = await relationInputError(c, taxonomyType.fields, body, registry, db);
         if (inputError) return inputError;
         const storageBody = fieldKeys.toStorage(body);
@@ -23571,7 +23701,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       requirePermission("content:edit"),
       async (c) => {
         const id = c.req.param("id");
-        const body = await c.req.json();
+        const body = emptyValuesToNull(taxonomyType.fields, await c.req.json(), registry);
         const storageBody = fieldKeys.toStorage(body);
         const existing = await repo.findOne(id);
         if (!existing) {
@@ -24609,7 +24739,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 var API_VERSION = (() => {
   try {
-    return "0.8.4";
+    return "0.9.0";
   } catch {
     return "0.0.0";
   }
@@ -25292,7 +25422,7 @@ function createCmsApp(options) {
       handler: null,
       error: null
     }));
-    const ready = import("./handler-VEOWJRAL-OU66YS5U.js").then(({ createGraphQLHandler }) => {
+    const ready = import("./handler-MFF32JB4-MEMKPHHQ.js").then(({ createGraphQLHandler }) => {
       gqlPasses.forEach((pass, i) => {
         const mount = mounts[i];
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobbykim/manguito-cms-cli",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "license": "MIT",
   "author": "Bobby Kim <bobby.sihun.kim@gmail.com>",
   "homepage": "https://github.com/bobbykim89/manguito-cms",
@@ -29,10 +29,10 @@
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vite": "^8.1.3",
-    "@bobbykim/manguito-cms-admin": "0.5.3",
-    "@bobbykim/manguito-cms-api": "0.8.4",
-    "@bobbykim/manguito-cms-db": "0.1.9",
-    "@bobbykim/manguito-cms-core": "0.9.0"
+    "@bobbykim/manguito-cms-admin": "0.5.4",
+    "@bobbykim/manguito-cms-api": "0.9.0",
+    "@bobbykim/manguito-cms-core": "0.10.0",
+    "@bobbykim/manguito-cms-db": "0.1.10"
   },
   "devDependencies": {
     "@types/node": "^25.9.5",