@bobbykim/manguito-cms-cli 0.11.2 → 0.11.4

package/dist/{chunk-WTZBHFCV.js → chunk-44VXH5BN.js}

@@ -9270,7 +9270,7 @@ var require_bcryptjs = __commonJS({
   }
 });
 
-// ../api/dist/chunk-GUZZQZSN.mjs
+// ../api/dist/chunk-IFE2L4VM.mjs
 init_esm_shims();
 import crypto from "crypto";
 
@@ -25308,6 +25308,7 @@ function validateCrossReferences(registry2, globalMaxFileSize) {
   errors.push(...checkFieldRefs(registry2));
   errors.push(...checkCircularParagraphRefs(registry2));
   errors.push(...checkParagraphRelations(registry2));
+  errors.push(...checkTableNameCollisions(registry2));
   if (globalMaxFileSize !== void 0) {
     errors.push(...checkMaxSizeLimit(registry2, globalMaxFileSize));
   }
@@ -25328,6 +25329,58 @@ function checkParagraphRelations(registry2) {
   }
   return errors;
 }
+var POSTGRES_IDENTIFIER_LIMIT = 63;
+function rawFieldPath(owner, field) {
+  if (owner.schema_type !== "content-type") return `fields[${field.order}].name`;
+  const t = owner.ui.tabs.findIndex((tab) => tab.fields.includes(field.name));
+  const i = t < 0 ? -1 : owner.ui.tabs[t].fields.indexOf(field.name);
+  return t < 0 ? `fields[${field.order}].name` : `fields[${t}].tab.fields[${i}].name`;
+}
+function checkTableNameCollisions(registry2) {
+  const uses = [];
+  for (const p of Object.values(registry2.paragraph_types)) {
+    uses.push({ table: p.db.table_name, file: p.source_file, what: `type "${p.name}"`, shorten: `shorten the name of type "${p.name}"` });
+  }
+  for (const owner of [...Object.values(registry2.content_types), ...Object.values(registry2.taxonomy_types)]) {
+    uses.push({
+      table: owner.db.table_name,
+      file: owner.source_file,
+      what: `type "${owner.name}"`,
+      shorten: `shorten the name of type "${owner.name}"`
+    });
+    for (const jt of owner.db.junction_tables) {
+      const field = owner.fields.find((f) => f.db_column?.junction?.table_name === jt.table_name);
+      if (!field) continue;
+      const prefix = `junction_${owner.db.table_name}_`.length;
+      const room = POSTGRES_IDENTIFIER_LIMIT - prefix;
+      uses.push({
+        table: jt.table_name,
+        file: owner.source_file,
+        what: `field "${field.name}" of "${owner.name}"`,
+        shorten: room < 1 ? `shorten the name of type "${owner.name}": its link table names already have ${prefix} characters before the field name` : `shorten field "${field.name}" to at most ${room} characters, or the name of type "${owner.name}"`,
+        path: rawFieldPath(owner, field)
+      });
+    }
+  }
+  const errors = [];
+  const first = /* @__PURE__ */ new Map();
+  for (const use of uses) {
+    const stored = use.table.slice(0, POSTGRES_IDENTIFIER_LIMIT);
+    const earlier = first.get(stored);
+    if (!earlier) {
+      first.set(stored, use);
+      continue;
+    }
+    const tooLong = use.table.length > POSTGRES_IDENTIFIER_LIMIT ? use : earlier;
+    errors.push({
+      file: use.file,
+      code: "TABLE_NAME_COLLISION",
+      message: earlier.table === use.table ? `The ${use.what} would store its data in table "${use.table}", the same table as the ${earlier.what}. Rename one of the two so their tables differ.` : `The ${use.what} and the ${earlier.what} would get tables "${use.table}" and "${earlier.table}". Postgres keeps only the first ${POSTGRES_IDENTIFIER_LIMIT} characters of a name, which are the same, so they would be one table. To keep "${tooLong.table}" within ${POSTGRES_IDENTIFIER_LIMIT} characters, ${tooLong.shorten}.`,
+      ...use.path !== void 0 && { path: use.path }
+    });
+  }
+  return errors;
+}
 function checkDuplicateSchemaNames(allSchemas) {
   const errors = [];
   const seen = /* @__PURE__ */ new Map();
@@ -25904,7 +25957,17 @@ function checkDuplicateColumns(fields, sourceFile, schemaName) {
   for (const f of fields) {
     if (!hasStorageColumn(f)) continue;
     const column = f.column ?? f.name;
-    const first = owner.get(column);
+    const stored = column.slice(0, 63);
+    const firstUse = owner.get(stored);
+    if (firstUse !== void 0 && firstUse.column !== column) {
+      errors.push({
+        file: sourceFile,
+        code: "DUPLICATE_COLUMN",
+        message: `Fields "${firstUse.field}" and "${f.name}" in schema "${schemaName}" resolve to columns "${firstUse.column}" and "${column}". Postgres keeps only the first 63 characters of a column name, which are the same, so they would be one column. Shorten one of the field names to at most 63 characters.`
+      });
+      continue;
+    }
+    const first = firstUse?.field;
     if (first !== void 0) {
       errors.push({
         file: sourceFile,
@@ -25913,7 +25976,7 @@ function checkDuplicateColumns(fields, sourceFile, schemaName) {
       });
       continue;
     }
-    owner.set(column, f.name);
+    owner.set(stored, { field: f.name, column });
   }
   return errors;
 }
@@ -26618,7 +26681,7 @@ function describeSchemaChange(input) {
   return { from: from?.version ?? null, to: to.version, types, identical };
 }
 
-// ../api/dist/chunk-GUZZQZSN.mjs
+// ../api/dist/chunk-IFE2L4VM.mjs
 function isColumnBacked2(field) {
   const col = field.db_column;
   if (col === null) return false;
@@ -26725,10 +26788,131 @@ function createFieldKeyMapFromProjection(projectionType, allFields) {
     droppedLabels
   );
 }
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(v) {
+  return typeof v === "string" && UUID_RE.test(v);
+}
+function isPlainObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function checkRelationInput(fields, body, registry2, path4 = "") {
+  const errors = [];
+  for (const field of fields) {
+    if (!Object.hasOwn(body, field.name)) continue;
+    const cardinality = relationCardinality(field);
+    if (cardinality === null) continue;
+    const value = body[field.name];
+    const name = `${path4}${field.name}`;
+    if (field.field_type === "reference") {
+      const ok = cardinality === "one" ? value === null || isUuid(value) : Array.isArray(value) && value.every(isUuid);
+      if (!ok) {
+        errors.push({
+          field: name,
+          message: cardinality === "one" ? `${name} holds one item: send a UUID string or null.` : `${name} holds a list: send an array of UUID strings.`
+        });
+      }
+      continue;
+    }
+    const items = cardinality === "one" ? value === null ? [] : isPlainObject2(value) ? [value] : void 0 : Array.isArray(value) && value.every(isPlainObject2) ? value : void 0;
+    if (items === void 0) {
+      errors.push({
+        field: name,
+        message: cardinality === "one" ? `${name} holds one item: send an object or null.` : `${name} holds a list: send an array of objects.`
+      });
+      continue;
+    }
+    const pType = paragraphTypeOf(field, registry2);
+    if (!pType) continue;
+    items.forEach((item, i) => {
+      const prefix = cardinality === "one" ? `${name}.` : `${name}[${i}].`;
+      errors.push(...checkRelationInput(pType.fields, item, registry2, prefix));
+    });
+  }
+  return errors;
+}
+function paragraphTypeOf(field, registry2) {
+  const comp = field.ui_component;
+  return comp.component === "paragraph-embed" ? registry2.paragraph_types[comp.ref] : void 0;
+}
+function paragraphItemsIn(fields, body, registry2, path4) {
+  const out = [];
+  for (const field of fields) {
+    if (field.field_type !== "paragraph" || !Object.hasOwn(body, field.name)) continue;
+    const pType = paragraphTypeOf(field, registry2);
+    if (!pType) continue;
+    const value = body[field.name];
+    const name = `${path4}${field.name}`;
+    if (relationCardinality(field) === "one") {
+      if (isPlainObject2(value)) out.push({ item: value, fields: pType.fields, prefix: `${name}.` });
+    } else if (Array.isArray(value)) {
+      value.forEach((item, i) => {
+        if (isPlainObject2(item)) out.push({ item, fields: pType.fields, prefix: `${name}[${i}].` });
+      });
+    }
+  }
+  return out;
+}
+function isMissing(value) {
+  if (value === null || value === void 0) return true;
+  if (typeof value === "string" && value.trim() === "") return true;
+  if (Array.isArray(value) && value.length === 0) return true;
+  return false;
+}
+function checkRequiredInParagraphItems(fields, body, registry2, path4 = "") {
+  const errors = [];
+  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry2, path4)) {
+    for (const f of itemFields) {
+      if (!f.required || f.removed === true || !f.db_column || f.db_column.junction) continue;
+      if (isMissing(item[f.name])) {
+        errors.push({ field: `${prefix}${f.name}`, message: `${prefix}${f.name} is required.` });
+      }
+    }
+    errors.push(...checkRequiredInParagraphItems(itemFields, item, registry2, prefix));
+  }
+  return errors;
+}
 function quoteIdent(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
+function collectReferences(fields, body, registry2, path4, out) {
+  for (const f of fields) {
+    if (!Object.hasOwn(body, f.name) || !f.db_column) continue;
+    const table = f.db_column.junction ? f.db_column.junction.right_table : f.db_column.foreign_key?.table;
+    if (!table) continue;
+    const value = body[f.name];
+    const name = `${path4}${f.name}`;
+    if (typeof value === "string") {
+      out.push({ table, id: value, field: name });
+    } else if (Array.isArray(value)) {
+      value.forEach((v, i) => {
+        if (typeof v === "string") out.push({ table, id: v, field: `${name}[${i}]` });
+      });
+    }
+  }
+  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry2, path4)) {
+    collectReferences(itemFields, item, registry2, prefix, out);
+  }
+}
+async function findMissingReferences(db, fields, body, registry2) {
+  const uses = [];
+  collectReferences(fields, body, registry2, "", uses);
+  if (uses.length === 0) return [];
+  const lookups = [...new Set(uses.map((u) => u.table))].map(async (table) => {
+    const ids = [...new Set(uses.filter((u) => u.table === table && isUuid(u.id)).map((u) => u.id.toLowerCase()))];
+    if (ids.length === 0) return [table, /* @__PURE__ */ new Set()];
+    const result = await db.execute(
+      sql`SELECT id FROM ${sql.raw(quoteIdent(table))} WHERE id IN (${sql.join(ids.map((id) => sql`${id}`), sql`, `)})`
+    );
+    return [table, new Set(result.rows.map((r) => String(r.id).toLowerCase()))];
+  });
+  const found = new Map(await Promise.all(lookups));
+  return uses.filter((u) => !found.get(u.table).has(u.id.toLowerCase())).map((u) => ({ field: u.field, message: `${u.field} refers to an item that does not exist.` }));
+}
+function quoteIdent2(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
 function paragraphMediaFieldNames(pType) {
   return new Set(
     pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name)
@@ -26737,8 +26921,8 @@ function paragraphMediaFieldNames(pType) {
 async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
   const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
   if (mediaColumns.length === 0) return [];
-  const tbl = sql.raw(quoteIdent(pType.db.table_name));
-  const cols = sql.join(mediaColumns.map((c) => sql.raw(quoteIdent(c))), sql`, `);
+  const tbl = sql.raw(quoteIdent2(pType.db.table_name));
+  const cols = sql.join(mediaColumns.map((c) => sql.raw(quoteIdent2(c))), sql`, `);
   const result = await db.execute(
     sql`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
   );
@@ -26756,20 +26940,37 @@ function nestedParagraphFields(pType, registry2) {
   const out = [];
   for (const f of pType.fields) {
     if (f.db_column !== null) continue;
-    const comp = f.ui_component;
-    if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-    const nType = registry2.paragraph_types[comp.ref];
+    const nType = paragraphTypeOf(f, registry2);
     if (nType) out.push({ fieldName: f.name, nType, field: f });
   }
   return out;
 }
 async function fetchParagraphRowIds(db, pType, itemId, fieldName) {
-  const tbl = sql.raw(quoteIdent(pType.db.table_name));
+  const tbl = sql.raw(quoteIdent2(pType.db.table_name));
   const result = await db.execute(
     sql`SELECT id FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
   );
   return result.rows.map((r) => r["id"]).filter((id) => typeof id === "string");
 }
+async function ownParagraphRowIds(db, registry2, fields, itemId) {
+  const ids = [];
+  for (const f of fields) {
+    const pType = paragraphTypeOf(f, registry2);
+    if (!pType) continue;
+    const rowIds = await fetchParagraphRowIds(db, pType, itemId, f.name);
+    ids.push(...rowIds);
+    if (rowIds.length === 0) continue;
+    for (const n of nestedParagraphFields(pType, registry2)) {
+      const result = await db.execute(
+        sql`SELECT id FROM ${sql.raw(quoteIdent2(n.nType.db.table_name))} WHERE parent_id = ANY(${sql.param(rowIds)}::uuid[]) AND parent_field = ${n.fieldName}`
+      );
+      for (const r of result.rows) {
+        if (typeof r["id"] === "string") ids.push(r["id"]);
+      }
+    }
+  }
+  return ids;
+}
 async function persistParagraphField(db, itemId, parentType, fieldName, pType, items, registry2) {
   const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
   const nested = nestedParagraphFields(pType, registry2);
@@ -26782,7 +26983,7 @@ async function persistParagraphField(db, itemId, parentType, fieldName, pType, i
       }
     }
   }
-  const tbl = sql.raw(quoteIdent(pType.db.table_name));
+  const tbl = sql.raw(quoteIdent2(pType.db.table_name));
   await db.execute(sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
   const mediaFieldNames = paragraphMediaFieldNames(pType);
   const added = [];
@@ -26802,7 +27003,7 @@ async function persistParagraphField(db, itemId, parentType, fieldName, pType, i
       if (!pf.db_column || pf.db_column.junction) continue;
       data[pf.db_column.column_name] = pItem[pf.name] ?? null;
     }
-    const cols = sql.join(Object.keys(data).map((k) => sql.raw(quoteIdent(k))), sql`, `);
+    const cols = sql.join(Object.keys(data).map((k) => sql.raw(quoteIdent2(k))), sql`, `);
     const vals = sql.join(Object.values(data).map((v) => sql`${v}`), sql`, `);
     await db.execute(sql`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
     for (const name of mediaFieldNames) {
@@ -26838,14 +27039,14 @@ async function deleteParagraphField(db, itemId, fieldName, pType, registry2) {
       }
     }
   }
-  const tbl = sql.raw(quoteIdent(pType.db.table_name));
+  const tbl = sql.raw(quoteIdent2(pType.db.table_name));
   await db.execute(sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
   return { added: [], removed };
 }
 async function persistJunctionField(db, itemId, junction, relatedIds) {
-  const tbl = sql.raw(quoteIdent(junction.table_name));
-  const left = sql.raw(quoteIdent(junction.left_column));
-  const right = sql.raw(quoteIdent(junction.right_column));
+  const tbl = sql.raw(quoteIdent2(junction.table_name));
+  const left = sql.raw(quoteIdent2(junction.left_column));
+  const right = sql.raw(quoteIdent2(junction.right_column));
   const seen = /* @__PURE__ */ new Set();
   const ids = relatedIds.filter((id) => {
     const key = id.toLowerCase();
@@ -26866,9 +27067,18 @@ async function persistJunctionField(db, itemId, junction, relatedIds) {
   );
 }
 function junctionOrderBy(junction) {
-  const right = sql.raw(quoteIdent(junction.right_column));
+  const right = sql.raw(quoteIdent2(junction.right_column));
   return junction.order_column ? sql` ORDER BY "order" ASC, ${right} ASC` : sql` ORDER BY ${right} ASC`;
 }
+function firstOfEach(items, key) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    const k = key(item);
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+}
 function oneOrMany(cardinality, list) {
   return cardinality === "one" ? list[0] ?? null : list;
 }
@@ -26936,7 +27146,7 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
     const parentIds = batch.map((r) => r["id"]);
     const inList = sql.join(parentIds.map((id) => sql`${id}`), sql`, `);
     const result = await db.execute(
-      sql`SELECT * FROM ${sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
+      sql`SELECT * FROM ${sql.raw(quoteIdent2(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC, id ASC`
     );
     const byParent = groupBy(result.rows, "parent_id");
     for (const row of batch) {
@@ -26956,7 +27166,7 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
       const inList = sql.join(uncached.map((id) => sql`${id}`), sql`, `);
       const publishedCond = publishedOnly ? sql` AND published = true` : sql``;
       const result = await db.execute(
-        sql`SELECT * FROM ${sql.raw(quoteIdent(rel.table))} WHERE id IN (${inList})${publishedCond}`
+        sql`SELECT * FROM ${sql.raw(quoteIdent2(rel.table))} WHERE id IN (${inList})${publishedCond}`
       );
       for (const item of result.rows) {
         cache.set(`${rel.table}:${item["id"]}`, item);
@@ -26970,7 +27180,7 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
     const parentIds = batch.map((r) => r["id"]);
     const inList = sql.join(parentIds.map((id) => sql`${id}`), sql`, `);
     const junctionResult = await db.execute(
-      sql`SELECT * FROM ${sql.raw(quoteIdent(rel.junction_table))} WHERE ${sql.raw(quoteIdent(rel.left_column))} IN (${inList})${junctionOrderBy(rel)}`
+      sql`SELECT * FROM ${sql.raw(quoteIdent2(rel.junction_table))} WHERE ${sql.raw(quoteIdent2(rel.left_column))} IN (${inList})${junctionOrderBy(rel)}`
     );
     const jRows = junctionResult.rows;
     const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
@@ -26979,7 +27189,7 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
       const rightInList = sql.join(uncached.map((id) => sql`${id}`), sql`, `);
       const publishedCond = publishedOnly ? sql` AND published = true` : sql``;
       const entitiesResult = await db.execute(
-        sql`SELECT * FROM ${sql.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})${publishedCond}`
+        sql`SELECT * FROM ${sql.raw(quoteIdent2(rel.table))} WHERE id IN (${rightInList})${publishedCond}`
       );
       for (const item of entitiesResult.rows) {
         cache.set(`${rel.table}:${item["id"]}`, item);
@@ -26987,7 +27197,7 @@ async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOn
     }
     const byLeft = groupBy(jRows, rel.left_column);
     for (const row of batch) {
-      const jEntries = byLeft[row["id"]] ?? [];
+      const jEntries = firstOfEach(byLeft[row["id"]] ?? [], (jr) => jr[rel.right_column]);
       row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
     }
   } else if (rel.type === "media") {
@@ -27019,7 +27229,7 @@ async function resolveRelationBareIds(db, rows, fieldName, rel) {
     const parentIds = rows.map((r) => r["id"]);
     const inList = sql.join(parentIds.map((id) => sql`${id}`), sql`, `);
     const result = await db.execute(
-      sql`SELECT id, parent_id FROM ${sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC`
+      sql`SELECT id, parent_id FROM ${sql.raw(quoteIdent2(rel.table))} WHERE parent_id IN (${inList}) AND parent_field = ${fieldName} ORDER BY "order" ASC, id ASC`
     );
     const byParent = groupBy(result.rows, "parent_id");
     for (const row of rows) {
@@ -27029,11 +27239,11 @@ async function resolveRelationBareIds(db, rows, fieldName, rel) {
     const parentIds = rows.map((r) => r["id"]);
     const inList = sql.join(parentIds.map((id) => sql`${id}`), sql`, `);
     const result = await db.execute(
-      sql`SELECT ${sql.raw(quoteIdent(rel.left_column))} AS left_id, ${sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${sql.raw(quoteIdent(rel.junction_table))} WHERE ${sql.raw(quoteIdent(rel.left_column))} IN (${inList})${junctionOrderBy(rel)}`
+      sql`SELECT ${sql.raw(quoteIdent2(rel.left_column))} AS left_id, ${sql.raw(quoteIdent2(rel.right_column))} AS right_id FROM ${sql.raw(quoteIdent2(rel.junction_table))} WHERE ${sql.raw(quoteIdent2(rel.left_column))} IN (${inList})${junctionOrderBy(rel)}`
     );
     const byLeft = groupBy(result.rows, "left_id");
     for (const row of rows) {
-      row[fieldName] = (byLeft[row["id"]] ?? []).map((r) => r["right_id"]);
+      row[fieldName] = firstOfEach(byLeft[row["id"]] ?? [], (r) => r["right_id"]).map((r) => r["right_id"]);
     }
   }
 }
@@ -27086,6 +27296,14 @@ export {
   isColumnBacked2 as isColumnBacked,
   createFieldKeyMap,
   createFieldKeyMapFromProjection,
+  isPlainObject2 as isPlainObject,
+  checkRelationInput,
+  paragraphTypeOf,
+  paragraphItemsIn,
+  isMissing,
+  checkRequiredInParagraphItems,
+  findMissingReferences,
+  ownParagraphRowIds,
   persistParagraphField,
   deleteParagraphField,
   persistJunctionField,

package/dist/{handler-MFF32JB4-MEMKPHHQ.js → handler-N5IMQJBP-USVWSLZP.js}

@@ -12,7 +12,7 @@ import {
   isColumnBacked,
   relationCardinality,
   resolveRelationField
-} from "./chunk-WTZBHFCV.js";
+} from "./chunk-44VXH5BN.js";
 
 // ../../node_modules/.pnpm/@whatwg-node+fetch@0.10.13/node_modules/@whatwg-node/fetch/dist/shouldSkipPonyfill.js
 var require_shouldSkipPonyfill = __commonJS({
@@ -10787,10 +10787,10 @@ var require_parser = __commonJS({
   }
 });
 
-// ../api/dist/handler-MFF32JB4.mjs
+// ../api/dist/handler-N5IMQJBP.mjs
 init_esm_shims();
 
-// ../api/dist/chunk-ITOSMGDT.mjs
+// ../api/dist/chunk-IMDC3NGM.mjs
 init_esm_shims();
 
 // ../../node_modules/.pnpm/graphql-yoga@5.21.2_graphql@16.14.2/node_modules/graphql-yoga/esm/index.js
@@ -30123,7 +30123,7 @@ function createYoga(options) {
   });
 }
 
-// ../api/dist/chunk-ITOSMGDT.mjs
+// ../api/dist/chunk-IMDC3NGM.mjs
 var import_dataloader = __toESM(require_dataloader(), 1);
 
 // ../../node_modules/.pnpm/@escape.tech+graphql-armor@3.2.0_@envelop+core@5.5.1_@escape.tech+graphql-armor-types@0.7.0/node_modules/@escape.tech/graphql-armor/dist/graphql-armor.esm.js
@@ -30881,7 +30881,7 @@ var EnvelopArmor = class {
   }
 };
 
-// ../api/dist/chunk-ITOSMGDT.mjs
+// ../api/dist/chunk-IMDC3NGM.mjs
 var DateTimeScalar = new GraphQLScalarType({
   name: "DateTime",
   description: "ISO-8601 date-time string",

package/dist/index.js

@@ -21,6 +21,8 @@ import {
   __toESM,
   buildRelationsMap,
   buildSchemaRegistry,
+  checkRelationInput,
+  checkRequiredInParagraphItems,
   computeVersionModel,
   createFieldKeyMap,
   createFieldKeyMapFromProjection,
@@ -28,6 +30,7 @@ import {
   describeSchemaChange,
   entityKind,
   fillPlaceholders,
+  findMissingReferences,
   findSchemaDeprecations,
   getTableName,
   getTableUniqueName,
@@ -36,12 +39,17 @@ import {
   is,
   isColumnBacked,
   isDriverValueEncoder,
+  isMissing,
+  isPlainObject,
   isSQLWrapper,
   junctionOrderBy,
   loadSchemaFile,
   loadVersionSnapshots,
   oneOrMany,
+  ownParagraphRowIds,
   paragraphItems,
+  paragraphItemsIn,
+  paragraphTypeOf,
   parseRoles,
   parseRoutes,
   parseSchema,
@@ -55,7 +63,7 @@ import {
   validateCrossReferences,
   verifyPassword,
   walkSchemaDirectory
-} from "./chunk-WTZBHFCV.js";
+} from "./chunk-44VXH5BN.js";
 
 // ../../node_modules/.pnpm/postgres-array@2.0.0/node_modules/postgres-array/index.js
 var require_postgres_array = __commonJS({
@@ -21901,7 +21909,7 @@ var ERROR_STATUS_MAP = {
 var errorHandler2 = (err, c) => {
   console.error(err.stack ?? err.message);
   const raw2 = err.code;
-  const deliberate = raw2 !== void 0 && raw2 !== "INTERNAL_ERROR" && raw2 in ERROR_STATUS_MAP;
+  const deliberate = raw2 !== void 0 && raw2 !== "INTERNAL_ERROR" && Object.hasOwn(ERROR_STATUS_MAP, raw2);
   if (!deliberate) {
     return c.json({ ok: false, error: { code: "INTERNAL_ERROR", message: "Internal server error" } }, 500);
   }
@@ -22464,16 +22472,16 @@ function parseFilters(url, validFields, columnFor) {
   }
   return { ok: true, filters };
 }
+function pickProgrammatic(resolved, names) {
+  const out = {};
+  for (const name of names) if (Object.hasOwn(resolved, name)) out[name] = resolved[name];
+  return out;
+}
 function isPublished(item) {
   return item["published"] === true;
 }
 function registerPublicContentRoutes(app, registry, repos, projectors, paths, listRateLimit, resolver, resolverProjectors) {
   const forResolver = resolverProjectors ?? projectors;
-  function pickProgrammatic(resolved, names) {
-    const out = {};
-    for (const name of names) if (name in resolved) out[name] = resolved[name];
-    return out;
-  }
   async function respondItem(row, typeName, programmatic) {
     const data = projectRow(row, typeName, projectors);
     if (!resolver?.hasSchema(typeName)) return data;
@@ -22785,25 +22793,42 @@ function quoteIdent(name) {
 function isRequiredSingleReferenceTo(f, targetType) {
   return f.field_type === "reference" && f.required && relationCardinality(f) === "one" && f.db_column?.foreign_key !== void 0 && f.ui_component.component === "typeahead-select" && f.ui_component.ref === targetType;
 }
+function requiredReferencesTo(owners, targetType) {
+  return owners.flatMap(
+    (owner) => owner.fields.filter((f) => isRequiredSingleReferenceTo(f, targetType)).map((f) => ({ owner, f }))
+  );
+}
 async function findRequiredReferrers(db, registry, targetType, id) {
-  const owners = [
-    ...Object.values(registry.content_types),
-    ...Object.values(registry.taxonomy_types),
-    ...Object.values(registry.paragraph_types)
-  ];
-  const out = [];
-  for (const owner of owners) {
-    for (const f of owner.fields) {
-      if (!isRequiredSingleReferenceTo(f, targetType)) continue;
-      const notSelf = owner.name === targetType ? sql` AND id <> ${id}` : sql``;
-      const r = await db.execute(
-        sql`SELECT count(*)::int AS n FROM ${sql.raw(quoteIdent(owner.db.table_name))} WHERE ${sql.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
-      );
-      const n = r.rows[0].n;
-      if (n > 0) out.push({ type_label: owner.label, field_label: f.label, count: n });
-    }
+  const targetFields = registry.content_types[targetType]?.fields ?? registry.taxonomy_types[targetType]?.fields ?? [];
+  const itemOwners = [...Object.values(registry.content_types), ...Object.values(registry.taxonomy_types)];
+  const itemFields = requiredReferencesTo(itemOwners, targetType);
+  const paragraphFields = requiredReferencesTo(Object.values(registry.paragraph_types), targetType);
+  const ownIds = paragraphFields.length > 0 ? await ownParagraphRowIds(db, registry, targetFields, id) : [];
+  const [itemCounts, paragraphCounts] = await Promise.all([
+    Promise.all(
+      itemFields.map(async ({ owner, f }) => {
+        const notSelf = owner.name === targetType ? sql` AND id <> ${id}` : sql``;
+        const r = await db.execute(
+          sql`SELECT count(*)::int AS n FROM ${sql.raw(quoteIdent(owner.db.table_name))} WHERE ${sql.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
+        );
+        return { owner, f, n: r.rows[0].n, own: 0 };
+      })
+    ),
+    Promise.all(
+      paragraphFields.map(async ({ owner, f }) => {
+        const r = await db.execute(
+          sql`SELECT count(*)::int AS n, count(*) FILTER (WHERE id = ANY(${sql.param(ownIds)}::uuid[]))::int AS own FROM ${sql.raw(quoteIdent(owner.db.table_name))} WHERE ${sql.raw(quoteIdent(f.db_column.column_name))} = ${id}`
+        );
+        const { n, own } = r.rows[0];
+        return { owner, f, n, own };
+      })
+    )
+  ]);
+  const others = [];
+  for (const { owner, f, n, own } of [...itemCounts, ...paragraphCounts]) {
+    if (n - own > 0) others.push({ type_label: owner.label, field_label: f.label, count: n - own });
   }
-  return out;
+  return { others, fromOwnParagraphs: paragraphCounts.some((c) => c.own > 0) };
 }
 function inUseMessage(referrers) {
   const total = referrers.reduce((sum, r) => sum + r.count, 0);
@@ -22828,7 +22853,7 @@ function topLevelMediaDelta(mediaFields, before, after) {
   for (const f of mediaFields) {
     const key = f.db_column?.column_name;
     if (key === void 0 || key === "") continue;
-    if (after !== null && !(key in after)) continue;
+    if (after !== null && !Object.hasOwn(after, key)) continue;
     const oldId = before ? extractMediaId(before[key]) : null;
     const newId = after ? extractMediaId(after[key]) : null;
     if (newId === oldId) continue;
@@ -22851,127 +22876,6 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
   if (netAdd.length > 0) await mediaRepo.incrementReferenceCount(netAdd);
   if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
 }
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isUuid(v2) {
-  return typeof v2 === "string" && UUID_RE.test(v2);
-}
-function isPlainObject(v2) {
-  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
-}
-function checkRelationInput(fields, body, registry, path5 = "") {
-  const errors = [];
-  for (const field of fields) {
-    if (!(field.name in body)) continue;
-    const cardinality = relationCardinality(field);
-    if (cardinality === null) continue;
-    const value = body[field.name];
-    const name = `${path5}${field.name}`;
-    if (field.field_type === "reference") {
-      const ok = cardinality === "one" ? value === null || isUuid(value) : Array.isArray(value) && value.every(isUuid);
-      if (!ok) {
-        errors.push({
-          field: name,
-          message: cardinality === "one" ? `${name} holds one item: send a UUID string or null.` : `${name} holds a list: send an array of UUID strings.`
-        });
-      }
-      continue;
-    }
-    const items = cardinality === "one" ? value === null ? [] : isPlainObject(value) ? [value] : void 0 : Array.isArray(value) && value.every(isPlainObject) ? value : void 0;
-    if (items === void 0) {
-      errors.push({
-        field: name,
-        message: cardinality === "one" ? `${name} holds one item: send an object or null.` : `${name} holds a list: send an array of objects.`
-      });
-      continue;
-    }
-    const pType = paragraphTypeOf(field, registry);
-    if (!pType) continue;
-    items.forEach((item, i) => {
-      const prefix = cardinality === "one" ? `${name}.` : `${name}[${i}].`;
-      errors.push(...checkRelationInput(pType.fields, item, registry, prefix));
-    });
-  }
-  return errors;
-}
-function paragraphTypeOf(field, registry) {
-  const comp = field.ui_component;
-  return comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
-}
-function paragraphItemsIn(fields, body, registry, path5) {
-  const out = [];
-  for (const field of fields) {
-    if (field.field_type !== "paragraph" || !(field.name in body)) continue;
-    const pType = paragraphTypeOf(field, registry);
-    if (!pType) continue;
-    const value = body[field.name];
-    const name = `${path5}${field.name}`;
-    if (relationCardinality(field) === "one") {
-      if (isPlainObject(value)) out.push({ item: value, fields: pType.fields, prefix: `${name}.` });
-    } else if (Array.isArray(value)) {
-      value.forEach((item, i) => {
-        if (isPlainObject(item)) out.push({ item, fields: pType.fields, prefix: `${name}[${i}].` });
-      });
-    }
-  }
-  return out;
-}
-function isMissing(value) {
-  if (value === null || value === void 0) return true;
-  if (typeof value === "string" && value.trim() === "") return true;
-  if (Array.isArray(value) && value.length === 0) return true;
-  return false;
-}
-function checkRequiredInParagraphItems(fields, body, registry, path5 = "") {
-  const errors = [];
-  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path5)) {
-    for (const f of itemFields) {
-      if (!f.required || f.removed === true || !f.db_column || f.db_column.junction) continue;
-      if (isMissing(item[f.name])) {
-        errors.push({ field: `${prefix}${f.name}`, message: `${prefix}${f.name} is required.` });
-      }
-    }
-    errors.push(...checkRequiredInParagraphItems(itemFields, item, registry, prefix));
-  }
-  return errors;
-}
-function quoteIdent2(name) {
-  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
-  return `"${name}"`;
-}
-function collectReferences(fields, body, registry, path5, out) {
-  for (const f of fields) {
-    if (!(f.name in body) || !f.db_column) continue;
-    const table = f.db_column.junction ? f.db_column.junction.right_table : f.db_column.foreign_key?.table;
-    if (!table) continue;
-    const value = body[f.name];
-    const name = `${path5}${f.name}`;
-    if (typeof value === "string") {
-      out.push({ table, id: value, field: name });
-    } else if (Array.isArray(value)) {
-      value.forEach((v2, i) => {
-        if (typeof v2 === "string") out.push({ table, id: v2, field: `${name}[${i}]` });
-      });
-    }
-  }
-  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path5)) {
-    collectReferences(itemFields, item, registry, prefix, out);
-  }
-}
-async function findMissingReferences(db, fields, body, registry) {
-  const uses = [];
-  collectReferences(fields, body, registry, "", uses);
-  if (uses.length === 0) return [];
-  const lookups = [...new Set(uses.map((u) => u.table))].map(async (table) => {
-    const ids = [...new Set(uses.filter((u) => u.table === table && isUuid(u.id)).map((u) => u.id.toLowerCase()))];
-    if (ids.length === 0) return [table, /* @__PURE__ */ new Set()];
-    const result = await db.execute(
-      sql`SELECT id FROM ${sql.raw(quoteIdent2(table))} WHERE id IN (${sql.join(ids.map((id) => sql`${id}`), sql`, `)})`
-    );
-    return [table, new Set(result.rows.map((r) => String(r.id).toLowerCase()))];
-  });
-  const found = new Map(await Promise.all(lookups));
-  return uses.filter((u) => !found.get(u.table).has(u.id.toLowerCase())).map((u) => ({ field: u.field, message: `${u.field} refers to an item that does not exist.` }));
-}
 var VARCHAR_DEFAULT_LIMIT = 255;
 var INTEGER_MIN = -2147483648;
 var INTEGER_MAX = 2147483647;
@@ -22982,7 +22886,7 @@ var EMPTY_MEANS_NULL = /* @__PURE__ */ new Set(["date", "integer", "float", "enu
 function emptyValuesToNull(fields, body, registry) {
   const out = { ...body };
   for (const f of fields) {
-    if (!(f.name in out)) continue;
+    if (!Object.hasOwn(out, f.name)) continue;
     const value = out[f.name];
     if (value === "" && EMPTY_MEANS_NULL.has(f.field_type)) {
       out[f.name] = null;
@@ -23087,7 +22991,7 @@ function rangeError(name, value, min, max) {
 function checkFieldValues(fields, body, registry, path5 = "") {
   const errors = [];
   for (const f of fields) {
-    if (!(f.name in body) || f.removed === true) continue;
+    if (!Object.hasOwn(body, f.name) || f.removed === true) continue;
     const name = `${path5}${f.name}`;
     const message = valueError(f, body[f.name], name);
     if (message) errors.push({ field: name, message });
@@ -23097,20 +23001,18 @@ function checkFieldValues(fields, body, registry, path5 = "") {
   }
   return errors;
 }
-function quoteIdent3(name) {
+function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
 async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   const result = await db.execute(
-    sql`SELECT * FROM ${sql.raw(quoteIdent3(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    sql`SELECT * FROM ${sql.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC, id ASC`
   );
   const rows = result.rows;
   for (const nf of pType.fields) {
     if (nf.db_column !== null) continue;
-    const comp = nf.ui_component;
-    if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-    const nType = registry.paragraph_types[comp.ref];
+    const nType = paragraphTypeOf(nf, registry);
     if (!nType) continue;
     for (const row of rows) {
       row[nf.name] = oneOrMany(
@@ -23122,35 +23024,36 @@ async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   return rows;
 }
 async function loadRelationsForEdit(db, registry, fields, id, row) {
-  for (const f of fields) {
-    if (f.db_column === null) {
-      const comp = f.ui_component;
-      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-      const pType = registry.paragraph_types[comp.ref];
-      if (!pType) continue;
-      row[f.name] = oneOrMany(relationCardinality(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name));
-    } else if (f.db_column.junction) {
-      const j = f.db_column.junction;
-      const r = await db.execute(
-        sql`SELECT ${sql.raw(quoteIdent3(j.right_column))} FROM ${sql.raw(quoteIdent3(j.table_name))} WHERE ${sql.raw(quoteIdent3(j.left_column))} = ${id}${junctionOrderBy(j)}`
-      );
-      row[f.name] = r.rows.map((linked) => linked[j.right_column]);
-    }
-  }
+  const loaded = await Promise.all(
+    fields.map(async (f) => {
+      if (f.db_column === null) {
+        const pType = paragraphTypeOf(f, registry);
+        if (!pType) return null;
+        return [f.name, oneOrMany(relationCardinality(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name))];
+      }
+      if (f.db_column.junction) {
+        const j = f.db_column.junction;
+        const r = await db.execute(
+          sql`SELECT ${sql.raw(quoteIdent2(j.right_column))} FROM ${sql.raw(quoteIdent2(j.table_name))} WHERE ${sql.raw(quoteIdent2(j.left_column))} = ${id}${junctionOrderBy(j)}`
+        );
+        return [f.name, [...new Set(r.rows.map((linked) => linked[j.right_column]))]];
+      }
+      return null;
+    })
+  );
+  for (const entry of loaded) if (entry) row[entry[0]] = entry[1];
 }
 async function valuesForPublishCheck(db, registry, requiredFields, id, storedLabels, body) {
   const stored = { ...storedLabels };
-  if (db) await loadRelationsForEdit(db, registry, requiredFields.filter((f) => !(f.name in body)), id, stored);
+  if (db) await loadRelationsForEdit(db, registry, requiredFields.filter((f) => !Object.hasOwn(body, f.name)), id, stored);
   return { ...stored, ...body };
 }
 async function persistRelationFields(db, registry, fields, body, itemId, ownerTable) {
   const deltas = [];
   for (const f of fields) {
-    if (!(f.name in body)) continue;
+    if (!Object.hasOwn(body, f.name)) continue;
     if (f.db_column === null) {
-      const comp = f.ui_component;
-      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-      const pType = registry.paragraph_types[comp.ref];
+      const pType = paragraphTypeOf(f, registry);
       if (!pType) continue;
       deltas.push(await persistParagraphField(db, itemId, ownerTable, f.name, pType, paragraphItems(f, body[f.name]), registry));
     } else if (f.db_column.junction) {
@@ -23161,6 +23064,46 @@ async function persistRelationFields(db, registry, fields, body, itemId, ownerTa
   }
   return deltas;
 }
+async function deleteOwnParagraphs(db, registry, fields, itemId) {
+  const deltas = [];
+  for (const f of fields) {
+    const pType = paragraphTypeOf(f, registry);
+    if (!pType) continue;
+    deltas.push(await deleteParagraphField(db, itemId, f.name, pType, registry));
+  }
+  return deltas;
+}
+function releasedFromParagraphsOnly(paragraphDeltas, topLevel) {
+  const stillHeld = new Set(topLevel.removed);
+  return { added: [], removed: mergeMediaDeltas(...paragraphDeltas).removed.filter((mediaId) => !stillHeld.has(mediaId)) };
+}
+async function deleteItemCascade(db, registry, mediaRepo, target) {
+  const { typeName, fields, mediaFields, repo, id, row } = target;
+  const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : { others: [], fromOwnParagraphs: false };
+  if (referrers.others.length > 0) return { ok: false, message: inUseMessage(referrers.others) };
+  const topLevel = topLevelMediaDelta(mediaFields, row, null);
+  if (!db || !referrers.fromOwnParagraphs) {
+    try {
+      await repo.delete(id);
+    } catch (err) {
+      if (isForeignKeyViolation(err)) return { ok: false, message: IN_USE_RACE_MESSAGE };
+      throw err;
+    }
+    const paragraphDeltas2 = db ? await deleteOwnParagraphs(db, registry, fields, id) : [];
+    await applyMediaReferenceDelta(mergeMediaDeltas(topLevel, ...paragraphDeltas2), mediaRepo);
+    return { ok: true };
+  }
+  const paragraphDeltas = await deleteOwnParagraphs(db, registry, fields, id);
+  try {
+    await repo.delete(id);
+  } catch (err) {
+    await applyMediaReferenceDelta(releasedFromParagraphsOnly(paragraphDeltas, topLevel), mediaRepo);
+    if (isForeignKeyViolation(err)) return { ok: false, message: IN_USE_RACE_MESSAGE };
+    throw err;
+  }
+  await applyMediaReferenceDelta(mergeMediaDeltas(topLevel, ...paragraphDeltas), mediaRepo);
+  return { ok: true };
+}
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
     sql`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
@@ -23270,7 +23213,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
     const mediaFields = contentType.fields.filter(
       (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
     );
-    const paragraphFieldDefs = contentType.fields.filter((f) => f.db_column === null);
     const searchableColumns = [
       ...contentType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
       ...contentType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
@@ -23420,7 +23362,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
       for (const f of columnBackedFields) {
         const key = f.db_column.column_name;
-        if (!(key in storageBody)) continue;
+        if (!Object.hasOwn(storageBody, key)) continue;
         columnData[key] = storageBody[key];
       }
       if (db) {
@@ -23462,7 +23404,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        if (!contentType.only_one && "slug" in body) {
+        if (!contentType.only_one && Object.hasOwn(body, "slug")) {
           const slug = body["slug"];
           if (typeof slug !== "string" || slug.trim() === "") {
             return c.json(
@@ -23532,11 +23474,11 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
       const patchColumnBackedFields = contentType.fields.filter(isColumnBacked);
       const patchData = {};
-      if (!contentType.only_one && "slug" in body) patchData["slug"] = body["slug"];
-      if ("published" in body) patchData["published"] = body["published"];
+      if (!contentType.only_one && Object.hasOwn(body, "slug")) patchData["slug"] = body["slug"];
+      if (Object.hasOwn(body, "published")) patchData["published"] = body["published"];
       for (const f of patchColumnBackedFields) {
         const key = f.db_column.column_name;
-        if (!(key in storageBody)) continue;
+        if (!Object.hasOwn(storageBody, key)) continue;
         patchData[key] = storageBody[key];
       }
       const updated = await repo.update(id, patchData);
@@ -23586,31 +23528,17 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
-        if (referrers.length > 0) {
-          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
-        }
-        try {
-          await repo.delete(id);
-        } catch (err) {
-          if (isForeignKeyViolation(err)) {
-            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
-          }
-          throw err;
-        }
-        const mediaDeltas = [
-          topLevelMediaDelta(mediaFields, item, null)
-        ];
-        if (db) {
-          for (const f of paragraphFieldDefs) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
-          }
+        const outcome = await deleteItemCascade(db, registry, mediaRepo, {
+          typeName,
+          fields: contentType.fields,
+          mediaFields,
+          repo,
+          id,
+          row: item
+        });
+        if (!outcome.ok) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: outcome.message } }, 409);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         return c.json({ ok: true });
       }
     );
@@ -23631,7 +23559,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
     const mediaFields = taxonomyType.fields.filter(
       (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
     );
-    const paragraphFieldDefs = taxonomyType.fields.filter((f) => f.db_column === null);
     const searchableColumns = [
       ...taxonomyType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
       ...taxonomyType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
@@ -23717,7 +23644,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         };
         for (const f of taxColumnBackedFields) {
           const key = f.db_column.column_name;
-          if (!(key in storageBody)) continue;
+          if (!Object.hasOwn(storageBody, key)) continue;
           taxColumnData[key] = storageBody[key];
         }
         const item = await repo.create(taxColumnData);
@@ -23769,10 +23696,10 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         }
         const taxPatchColumnBackedFields = taxonomyType.fields.filter(isColumnBacked);
         const taxPatchData = {};
-        if ("published" in body) taxPatchData["published"] = body["published"];
+        if (Object.hasOwn(body, "published")) taxPatchData["published"] = body["published"];
         for (const f of taxPatchColumnBackedFields) {
           const key = f.db_column.column_name;
-          if (!(key in storageBody)) continue;
+          if (!Object.hasOwn(storageBody, key)) continue;
           taxPatchData[key] = storageBody[key];
         }
         const updated = await repo.update(id, taxPatchData);
@@ -23805,31 +23732,17 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
-        if (referrers.length > 0) {
-          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
-        }
-        try {
-          await repo.delete(id);
-        } catch (err) {
-          if (isForeignKeyViolation(err)) {
-            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
-          }
-          throw err;
-        }
-        const mediaDeltas = [
-          topLevelMediaDelta(mediaFields, item, null)
-        ];
-        if (db) {
-          for (const f of paragraphFieldDefs) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
-          }
+        const outcome = await deleteItemCascade(db, registry, mediaRepo, {
+          typeName,
+          fields: taxonomyType.fields,
+          mediaFields,
+          repo,
+          id,
+          row: item
+        });
+        if (!outcome.ok) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: outcome.message } }, 409);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         return c.json({ ok: true });
       }
     );
@@ -24774,7 +24687,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 var API_VERSION = (() => {
   try {
-    return "0.9.1";
+    return "0.9.3";
   } catch {
     return "0.0.0";
   }
@@ -24883,7 +24796,7 @@ function codeError(code, message) {
   err.code = code;
   return err;
 }
-function quoteIdent4(name) {
+function quoteIdent3(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Unsafe SQL identifier: ${name}`);
   }
@@ -24934,7 +24847,7 @@ function whereFragment(conds) {
 function createDrizzleContentRepository(db, tableName, options = {}) {
   const { relations = {}, publishedRelations = false, sortableColumns } = options;
   function tableRaw() {
-    return sql.raw(quoteIdent4(tableName));
+    return sql.raw(quoteIdent3(tableName));
   }
   async function resolveRows(rows, include, cache) {
     if (rows.length === 0) return rows;
@@ -24977,7 +24890,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       const offset = (page - 1) * per_page;
       const conds = buildConditions(published_only, filters, search);
       const where = whereFragment(conds);
-      const sortCol = sql.raw(quoteIdent4(sort_by));
+      const sortCol = sql.raw(quoteIdent3(sort_by));
       const sortDir = sql.raw(sort_order === "desc" ? "DESC" : "ASC");
       const countResult = await db.execute(
         sql`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
@@ -25031,7 +24944,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v2]) => v2 !== void 0);
-      const colsSql = sql.join(entries.map(([k]) => sql.raw(quoteIdent4(k))), sql`, `);
+      const colsSql = sql.join(entries.map(([k]) => sql.raw(quoteIdent3(k))), sql`, `);
       const valsSql = sql.join(entries.map(([, v2]) => sql`${v2}`), sql`, `);
       const result = await db.execute(
         sql`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
@@ -25048,7 +24961,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         return this.findOne(id);
       }
       const setClauses = sql.join(
-        entries.map(([k, v2]) => sql`${sql.raw(quoteIdent4(k))} = ${v2}`),
+        entries.map(([k, v2]) => sql`${sql.raw(quoteIdent3(k))} = ${v2}`),
         sql`, `
       );
       const result = await db.execute(
@@ -25457,7 +25370,7 @@ function createCmsApp(options) {
       handler: null,
       error: null
     }));
-    const ready = import("./handler-MFF32JB4-MEMKPHHQ.js").then(({ createGraphQLHandler }) => {
+    const ready = import("./handler-N5IMQJBP-USVWSLZP.js").then(({ createGraphQLHandler }) => {
       gqlPasses.forEach((pass, i) => {
         const mount = mounts[i];
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobbykim/manguito-cms-cli",
-  "version": "0.11.2",
+  "version": "0.11.4",
   "license": "MIT",
   "author": "Bobby Kim <bobby.sihun.kim@gmail.com>",
   "homepage": "https://github.com/bobbykim89/manguito-cms",
@@ -29,10 +29,10 @@
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vite": "^8.1.3",
-    "@bobbykim/manguito-cms-admin": "0.6.0",
-    "@bobbykim/manguito-cms-db": "0.2.0",
-    "@bobbykim/manguito-cms-core": "0.10.0",
-    "@bobbykim/manguito-cms-api": "0.9.1"
+    "@bobbykim/manguito-cms-admin": "0.6.2",
+    "@bobbykim/manguito-cms-api": "0.9.3",
+    "@bobbykim/manguito-cms-db": "0.2.1",
+    "@bobbykim/manguito-cms-core": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.5",