@bobbykim/manguito-cms-cli 0.11.3 → 0.12.0

package/dist/index.js

@@ -21,6 +21,8 @@ import {
   __toESM,
   buildRelationsMap,
   buildSchemaRegistry,
+  checkRelationInput,
+  checkRequiredInParagraphItems,
   computeVersionModel,
   createFieldKeyMap,
   createFieldKeyMapFromProjection,
@@ -28,6 +30,7 @@ import {
   describeSchemaChange,
   entityKind,
   fillPlaceholders,
+  findMissingReferences,
   findSchemaDeprecations,
   getTableName,
   getTableUniqueName,
@@ -36,12 +39,17 @@ import {
   is,
   isColumnBacked,
   isDriverValueEncoder,
+  isMissing,
+  isPlainObject,
   isSQLWrapper,
   junctionOrderBy,
   loadSchemaFile,
   loadVersionSnapshots,
   oneOrMany,
+  ownParagraphRowIds,
   paragraphItems,
+  paragraphItemsIn,
+  paragraphTypeOf,
   parseRoles,
   parseRoutes,
   parseSchema,
@@ -55,7 +63,7 @@ import {
   validateCrossReferences,
   verifyPassword,
   walkSchemaDirectory
-} from "./chunk-N75KN2YC.js";
+} from "./chunk-EVB2E4A5.js";
 
 // ../../node_modules/.pnpm/postgres-array@2.0.0/node_modules/postgres-array/index.js
 var require_postgres_array = __commonJS({
@@ -5264,9 +5272,10 @@ import { Command } from "commander";
 
 // src/commands/build.ts
 init_esm_shims();
-import { mkdirSync, statSync, existsSync as existsSync3, readdirSync, writeFileSync } from "fs";
+import { mkdirSync, statSync, existsSync as existsSync3, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { resolve as resolve3, join as join7, dirname } from "path";
 import { createRequire } from "module";
+import { fileURLToPath } from "url";
 import { build as viteBuild } from "vite";
 import { build as tsupBuild } from "tsup";
 
@@ -16713,6 +16722,7 @@ function drizzle2(...params) {
 })(drizzle2 || (drizzle2 = {}));
 
 // ../db/dist/index.mjs
+import { createHash } from "crypto";
 import { execSync, spawnSync } from "child_process";
 import crypto2 from "crypto";
 import path from "path";
@@ -16801,6 +16811,256 @@ function createPostgresAdapter(options = {}) {
     }
   };
 }
+var MAX_IDENTIFIER = 63;
+var SUFFIX = "_unique";
+function linkUniqueName(tableName) {
+  const plain = `${tableName}${SUFFIX}`;
+  if (plain.length <= MAX_IDENTIFIER) return plain;
+  const hash = createHash("sha256").update(tableName).digest("hex").slice(0, 8);
+  return `${tableName.slice(0, 47)}_${hash}${SUFFIX}`;
+}
+function linkDedupeSql(table, left, right, hasOrder) {
+  const order = hasOrder ? '(a."order", a.ctid) > (b."order", b.ctid)' : "a.ctid > b.ctid";
+  return `DELETE FROM "${table}" a USING "${table}" b WHERE a."${left}" = b."${left}" AND a."${right}" = b."${right}" AND ${order}`;
+}
+var ADD_LINK_UNIQUE = /ALTER TABLE "([^"]+)" ADD CONSTRAINT "([^"]+)" UNIQUE\("left_id","right_id"\);/g;
+function addLinkDedupe(sql6) {
+  return sql6.replace(
+    ADD_LINK_UNIQUE,
+    (statement, table, name) => [
+      "-- Removes only repeated (left, right) pairs, keeping the lowest order, before adding the constraint.",
+      "DO $$ BEGIN",
+      `IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = '"${table}"'::regclass AND conname = '${name}') THEN`,
+      `LOCK TABLE "${table}" IN SHARE ROW EXCLUSIVE MODE;`,
+      `${linkDedupeSql(table, "left_id", "right_id", true)};`,
+      statement,
+      "END IF;",
+      "END $$;"
+    ].join("\n")
+  );
+}
+async function ensureLinkConstraints(db, registry) {
+  const owners = [
+    ...Object.values(registry.content_types),
+    ...Object.values(registry.taxonomy_types)
+  ];
+  const added = [];
+  for (const owner of owners) {
+    for (const jt of owner.db.junction_tables) {
+      const table = jt.table_name;
+      const name = linkUniqueName(table);
+      const exists2 = await db.execute(
+        sql`SELECT to_regclass(${`"${table}"`}) IS NOT NULL AS found`
+      );
+      if (!exists2.rows[0].found) continue;
+      const constrained = await db.execute(
+        sql`SELECT 1 FROM pg_constraint WHERE conrelid = ${`"${table}"`}::regclass AND conname = ${name}`
+      );
+      if (constrained.rows.length > 0) continue;
+      const orderColumn = await db.execute(
+        sql`SELECT 1 FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = ${table} AND column_name = 'order'`
+      );
+      const deleted = await db.execute(
+        sql.raw(
+          `${linkDedupeSql(table, jt.left_column, jt.right_column, orderColumn.rows.length > 0)} RETURNING 1`
+        )
+      );
+      await db.execute(
+        sql.raw(
+          `ALTER TABLE "${table}" ADD CONSTRAINT "${name}" UNIQUE("${jt.left_column}", "${jt.right_column}")`
+        )
+      );
+      added.push({ table, removed: deleted.rows.length });
+    }
+  }
+  return added;
+}
+var LIMIT = 63;
+var stored = (name) => name.slice(0, LIMIT);
+var SYSTEM_TABLES = ["media", "base_paths", "roles", "users"];
+var SYSTEM_UNIQUES = [
+  { name: "base_paths_name_unique", table: "base_paths" },
+  { name: "base_paths_path_unique", table: "base_paths" },
+  { name: "roles_name_unique", table: "roles" },
+  { name: "roles_hierarchy_level_unique", table: "roles" },
+  { name: "users_email_unique", table: "users" }
+];
+function foreignKeyName(table, column, targetTable, targetColumn) {
+  return `${table}_${column}_${targetTable}_${targetColumn}_fk`;
+}
+function checkConstraintName(column) {
+  return `${column}_check`;
+}
+function primaryKeyName(table) {
+  const name = `${table}_pkey`;
+  return name.length <= LIMIT ? name : `${table.slice(0, LIMIT - "_pkey".length)}_pkey`;
+}
+function rawFieldPath(owner, field) {
+  if (owner.schema_type !== "content-type") return `fields[${field.order}].name`;
+  const t = owner.ui.tabs.findIndex((tab) => tab.fields.includes(field.name));
+  const i = t < 0 ? -1 : owner.ui.tabs[t].fields.indexOf(field.name);
+  return t < 0 ? `fields[${field.order}].name` : `fields[${t}].tab.fields[${i}].name`;
+}
+function declaredColumn(field) {
+  const column = field.db_column?.column_name;
+  return column !== void 0 && column !== field.name ? column : void 0;
+}
+function describeField(field) {
+  const column = declaredColumn(field);
+  return column !== void 0 ? `field "${field.name}" (column "${column}")` : `field "${field.name}"`;
+}
+function renameOf(field) {
+  const column = declaredColumn(field);
+  return column !== void 0 ? `change the column "${column}" of field "${field.name}"` : `rename field "${field.name}"`;
+}
+function shortenOf(field, room) {
+  const column = declaredColumn(field);
+  return column !== void 0 ? `shorten the column "${column}" of field "${field.name}" to at most ${room} characters` : `shorten field "${field.name}" to at most ${room} characters`;
+}
+var commonPrefixLength = (a2, b2) => {
+  let i = 0;
+  while (i < a2.length && i < b2.length && a2[i] === b2[i]) i++;
+  return i;
+};
+function typeTableConstraints(owner) {
+  const table = owner.db.table_name;
+  const names = [];
+  for (const field of owner.fields) {
+    const col = field.db_column;
+    if (field.field_type === "paragraph" || col === null || col.junction) continue;
+    if (col.foreign_key) {
+      const fk = col.foreign_key;
+      names.push({ name: foreignKeyName(table, col.column_name, fk.table, fk.column), kind: "foreign key", field });
+    }
+    if ((col.check_constraint?.length ?? 0) > 0) {
+      names.push({ name: checkConstraintName(col.column_name), kind: "check", field });
+    }
+  }
+  return names;
+}
+function typeTableMessage(owner, a2, b2) {
+  const table = owner.db.table_name;
+  const clash = `Postgres keeps only the first ${LIMIT} characters of a name, which are the same, so the migration would fail with "constraint already exists".`;
+  if (a2.kind === "foreign key" && b2.kind === "foreign key") {
+    const room2 = LIMIT - 1 - table.length;
+    const shared = commonPrefixLength(a2.name.slice(table.length), b2.name.slice(table.length));
+    const maxType = LIMIT - 1 - shared + (owner.name.length - table.length);
+    const fix = room2 < 1 ? `shorten the name of type "${owner.name}" to at most ${maxType} characters: its table name "${table}" leaves no room for a column in the first ${LIMIT} characters` : `${renameOf(a2.field)} or ${renameOf(b2.field)} so that the two differ within their first ${room2} characters, or shorten the name of type "${owner.name}"`;
+    return `The ${describeField(a2.field)} and the ${describeField(b2.field)} of "${owner.name}" get foreign keys "${a2.name}" and "${b2.name}". ${clash} To fix it, ${fix}.`;
+  }
+  if (a2.kind === "check" && b2.kind === "check") {
+    const room2 = LIMIT - "_check".length;
+    return `The ${describeField(a2.field)} and the ${describeField(b2.field)} of "${owner.name}" get check constraints "${a2.name}" and "${b2.name}". ${clash} To fix it, ${renameOf(a2.field)} or ${renameOf(b2.field)} so that the two differ within their first ${room2} characters.`;
+  }
+  const check = a2.kind === "check" ? a2 : b2;
+  const room = LIMIT - 1 - "_check".length;
+  return `The ${a2.kind} "${a2.name}" of the ${describeField(a2.field)} and the ${b2.kind} "${b2.name}" of the ${describeField(b2.field)}, both on "${owner.name}", are the same in their first ${LIMIT} characters. ${clash} To fix it, ${shortenOf(check.field, room)}.`;
+}
+function checkTypeTable(owner) {
+  const errors = [];
+  const first = /* @__PURE__ */ new Map();
+  for (const constraint of typeTableConstraints(owner)) {
+    const earlier = first.get(stored(constraint.name));
+    if (!earlier) {
+      first.set(stored(constraint.name), constraint);
+      continue;
+    }
+    errors.push({
+      file: owner.source_file,
+      code: "CONSTRAINT_NAME_COLLISION",
+      message: typeTableMessage(owner, earlier, constraint),
+      path: rawFieldPath(owner, constraint.field)
+    });
+  }
+  return errors;
+}
+function checkLinkTable(link, left, right, rightTable) {
+  const { owner, field, table } = link;
+  const leftFk = foreignKeyName(table, left, owner.db.table_name, "id");
+  const rightFk = foreignKeyName(table, right, rightTable, "id");
+  const names = [leftFk, rightFk, link.unique];
+  const collides = names.some((n, i) => names.some((m2, j) => i < j && stored(n) === stored(m2)));
+  if (!collides) return null;
+  const base = { file: owner.source_file, code: "CONSTRAINT_NAME_COLLISION", path: rawFieldPath(owner, field) };
+  const truncated = `Postgres keeps only the first ${LIMIT} characters of a name`;
+  if (stored(leftFk) === stored(rightFk)) {
+    const prefix = `junction_${owner.db.table_name}_`.length;
+    const room = LIMIT - 2 - prefix;
+    const fix = room < 1 ? `shorten the name of type "${owner.name}": its link table names already have ${prefix} characters before the field name` : `shorten field "${field.name}" to at most ${room} characters, or the name of type "${owner.name}"`;
+    return {
+      ...base,
+      message: `The link table of field "${field.name}" of "${owner.name}", "${table}", has ${table.length} characters, so its foreign keys "${leftFk}" and "${rightFk}" are the same in their first ${LIMIT} characters. ${truncated}, so the migration would fail with "constraint already exists". To keep the link table within ${LIMIT - 2} characters, ${fix}.`
+    };
+  }
+  return {
+    ...base,
+    message: `The link table of field "${field.name}" of "${owner.name}", "${table}", gets constraints ${names.map((n) => `"${n}"`).join(", ")}, two of which are the same in their first ${LIMIT} characters. ${truncated}, so the migration would fail with "constraint already exists". To fix it, rename field "${field.name}" of type "${owner.name}".`
+  };
+}
+function takenNames(registry, links) {
+  const taken = [];
+  for (const table of SYSTEM_TABLES) {
+    taken.push({ name: table, what: `system table "${table}"` });
+    taken.push({ name: primaryKeyName(table), what: `the primary key of system table "${table}"` });
+  }
+  for (const u of SYSTEM_UNIQUES) taken.push({ name: u.name, what: `a unique constraint of system table "${u.table}"` });
+  const types3 = [
+    ...Object.values(registry.taxonomy_types),
+    ...Object.values(registry.paragraph_types),
+    ...Object.values(registry.content_types)
+  ];
+  for (const t of types3) {
+    taken.push({ name: t.db.table_name, what: `the table of type "${t.name}"` });
+    taken.push({ name: primaryKeyName(t.db.table_name), what: `the primary key of type "${t.name}"` });
+  }
+  for (const l of links) taken.push({ name: l.table, what: `the link table of field "${l.field.name}" of "${l.owner.name}"` });
+  return taken;
+}
+function checkLinkUniques(registry, links) {
+  const first = /* @__PURE__ */ new Map();
+  for (const t of takenNames(registry, links)) {
+    if (!first.has(stored(t.name))) first.set(stored(t.name), t);
+  }
+  const errors = [];
+  for (const link of links) {
+    const key = stored(link.unique);
+    const earlier = first.get(key);
+    if (!earlier) {
+      first.set(key, { name: link.unique, what: `the unique constraint of the link table of field "${link.field.name}" of "${link.owner.name}"` });
+      continue;
+    }
+    const same = earlier.name === link.unique ? `which is also the name of ${earlier.what}` : `which is the same as ${earlier.what}, "${earlier.name}", in its first ${LIMIT} characters. Postgres keeps only the first ${LIMIT} characters of a name`;
+    errors.push({
+      file: link.owner.source_file,
+      code: "CONSTRAINT_NAME_COLLISION",
+      message: `The link table of field "${link.field.name}" of "${link.owner.name}" gets unique constraint "${link.unique}", ${same}. A unique constraint shares its name with its index, and indexes share one namespace with tables, so the migration would fail with "relation already exists". Rename field "${link.field.name}" of type "${link.owner.name}".`,
+      path: rawFieldPath(link.owner, link.field)
+    });
+  }
+  return errors;
+}
+function findConstraintNameCollisions(registry) {
+  const errors = [];
+  const typeTables = [
+    ...Object.values(registry.taxonomy_types),
+    ...Object.values(registry.paragraph_types),
+    ...Object.values(registry.content_types)
+  ];
+  for (const owner of typeTables) errors.push(...checkTypeTable(owner));
+  const links = [];
+  for (const owner of [...Object.values(registry.content_types), ...Object.values(registry.taxonomy_types)]) {
+    for (const jt of owner.db.junction_tables) {
+      const field = owner.fields.find((f) => f.db_column?.junction?.table_name === jt.table_name);
+      if (!field) continue;
+      const link = { owner, field, table: jt.table_name, unique: linkUniqueName(jt.table_name) };
+      links.push(link);
+      const error = checkLinkTable(link, jt.left_column, jt.right_column, jt.right_table);
+      if (error) errors.push(error);
+    }
+  }
+  errors.push(...checkLinkUniques(registry, links));
+  return errors;
+}
 function generateFileHeader() {
   return "import * as s from 'drizzle-orm/pg-core'\nimport { sql } from 'drizzle-orm'";
 }
@@ -16935,7 +17195,7 @@ ${colBlock2}
   const constraints = enumFields.map((f) => {
     const col = f.db_column;
     const values = col.check_constraint.map((v2) => `'${v2}'`).join(", ");
-    const cname = `${col.column_name}_check`;
+    const cname = checkConstraintName(col.column_name);
     return [
       `    ${cname}: s.check(`,
       `      '${cname}',`,
@@ -16997,7 +17257,10 @@ function generateJunctionTables(registry) {
         `      .notNull()`,
         `      .references(() => ${rightVar}.id, { onDelete: 'cascade' }),`,
         ...orderLine ? [orderLine] : [],
-        `  }`,
+        `  },`,
+        `  (table) => ({`,
+        `    pair: s.unique('${linkUniqueName(jt.table_name)}').on(table.${jt.left_column}, table.${jt.right_column}),`,
+        `  })`,
         `)`
       ].join("\n");
       tables.push(def);
@@ -17236,7 +17499,14 @@ async function runGenerate(configPath, outFolder, cwd) {
   } catch {
   }
   const beforeSet = new Set(beforeFiles);
-  return afterFiles.filter((f) => !beforeSet.has(f));
+  const added = afterFiles.filter((f) => !beforeSet.has(f));
+  for (const name of added) {
+    const file = path.join(outFolder, name);
+    const text2 = await fs.readFile(file, "utf8");
+    const rewritten = addLinkDedupe(text2);
+    if (rewritten !== text2) await fs.writeFile(file, rewritten);
+  }
+  return added;
 }
 async function generateMigration(configPath, migrationsFolder) {
   return runGenerate(configPath, migrationsFolder, path.dirname(configPath));
@@ -18670,6 +18940,14 @@ function resolveSchemaConfig(cwd, config2) {
   };
 }
 
+// src/utils/schema-checks.ts
+init_esm_shims();
+function checkRegistry(registry, maxFileSize) {
+  const crossRefErrors = validateCrossReferences(registry, maxFileSize);
+  if (crossRefErrors.length > 0) return crossRefErrors;
+  return findConstraintNameCollisions(registry);
+}
+
 // src/utils/env.ts
 init_esm_shims();
 import { existsSync as existsSync2 } from "fs";
@@ -18757,7 +19035,7 @@ async function runBuild(options, deps) {
     parsedRoles
   );
   printSchemaDeprecations(findSchemaDeprecations(registry));
-  const crossRefErrors = validateCrossReferences(registry, config2.api.media?.max_file_size);
+  const crossRefErrors = checkRegistry(registry, config2.api.media?.max_file_size);
   if (crossRefErrors.length > 0) {
     printValidationErrors(crossRefErrors, "Schema reference errors", "manguito build");
     process.exit(1);
@@ -18791,6 +19069,11 @@ async function runBuild(options, deps) {
     { adminPrefix: config2.admin.prefix, apiPrefix: config2.api.prefix },
     generatedDir
   );
+  writeFileSync(
+    join7(generatedDir, VERSIONS_RECORD),
+    JSON.stringify(installedManguitoVersions(cwd), null, 2) + "\n",
+    "utf8"
+  );
   printSuccess("Codegen complete");
   try {
     await viteBuild({
@@ -18839,11 +19122,76 @@ async function runBuild(options, deps) {
   printSuccess("Server compiled");
   process.stdout.write("\nBuild complete \u2192 dist/\n");
 }
-async function needsRebuild(cwd) {
+var VERSIONS_RECORD = "manguito-versions.json";
+var MANGUITO_PACKAGES = [
+  "@bobbykim/manguito-cms-core",
+  "@bobbykim/manguito-cms-db",
+  "@bobbykim/manguito-cms-api",
+  "@bobbykim/manguito-cms-admin",
+  "@bobbykim/manguito-cms-cli"
+];
+function installedManguitoVersions(cwd) {
+  const cwdRequire = createRequire(join7(cwd, "package.json"));
+  const versions = {};
+  for (const name of MANGUITO_PACKAGES) {
+    try {
+      let dir = dirname(cwdRequire.resolve(name));
+      for (; ; ) {
+        const pkgPath = join7(dir, "package.json");
+        if (existsSync3(pkgPath)) {
+          const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+          if (pkg.name === name && typeof pkg.version === "string") versions[name] = pkg.version;
+          break;
+        }
+        const parent = dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+      }
+    } catch {
+    }
+  }
+  const running = runningCliVersion();
+  if (running !== void 0) versions[RUNNING_CLI_KEY] = running;
+  return versions;
+}
+var RUNNING_CLI_KEY = "running-cli";
+var CLI_PACKAGE = "@bobbykim/manguito-cms-cli";
+function runningCliVersion() {
+  try {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (; ; ) {
+      const pkgPath = join7(dir, "package.json");
+      if (existsSync3(pkgPath)) {
+        const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+        if (pkg.name === CLI_PACKAGE && typeof pkg.version === "string") return pkg.version;
+      }
+      const parent = dirname(dir);
+      if (parent === dir) return void 0;
+      dir = parent;
+    }
+  } catch {
+    return void 0;
+  }
+}
+function recordedVersions(cwd) {
+  try {
+    return JSON.parse(readFileSync2(resolve3(cwd, "dist/generated", VERSIONS_RECORD), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function sameVersions(a2, b2) {
+  const keys = Object.keys(a2);
+  return keys.length === Object.keys(b2).length && keys.every((k) => a2[k] === b2[k]);
+}
+async function needsRebuild(cwd, options = {}) {
+  const installed = options.installed ?? installedManguitoVersions(cwd);
   const sentinel = resolve3(cwd, "dist/generated/schema.ts");
   if (!existsSync3(sentinel)) return true;
+  const recorded = recordedVersions(cwd);
+  if (recorded === null || !sameVersions(recorded, installed)) return true;
   const sentinelMtime = statSync(sentinel).mtimeMs;
-  const schemasDir = resolve3(cwd, "schemas");
+  const schemasDir = options.schemaDir ?? resolve3(cwd, "schemas");
   if (!existsSync3(schemasDir)) return false;
   return walkFiles(schemasDir).some(
     (file) => statSync(file).mtimeMs > sentinelMtime
@@ -21901,7 +22249,7 @@ var ERROR_STATUS_MAP = {
 var errorHandler2 = (err, c) => {
   console.error(err.stack ?? err.message);
   const raw2 = err.code;
-  const deliberate = raw2 !== void 0 && raw2 !== "INTERNAL_ERROR" && raw2 in ERROR_STATUS_MAP;
+  const deliberate = raw2 !== void 0 && raw2 !== "INTERNAL_ERROR" && Object.hasOwn(ERROR_STATUS_MAP, raw2);
   if (!deliberate) {
     return c.json({ ok: false, error: { code: "INTERNAL_ERROR", message: "Internal server error" } }, 500);
   }
@@ -22464,16 +22812,16 @@ function parseFilters(url, validFields, columnFor) {
   }
   return { ok: true, filters };
 }
+function pickProgrammatic(resolved, names) {
+  const out = {};
+  for (const name of names) if (Object.hasOwn(resolved, name)) out[name] = resolved[name];
+  return out;
+}
 function isPublished(item) {
   return item["published"] === true;
 }
 function registerPublicContentRoutes(app, registry, repos, projectors, paths, listRateLimit, resolver, resolverProjectors) {
   const forResolver = resolverProjectors ?? projectors;
-  function pickProgrammatic(resolved, names) {
-    const out = {};
-    for (const name of names) if (name in resolved) out[name] = resolved[name];
-    return out;
-  }
   async function respondItem(row, typeName, programmatic) {
     const data = projectRow(row, typeName, projectors);
     if (!resolver?.hasSchema(typeName)) return data;
@@ -22785,25 +23133,42 @@ function quoteIdent(name) {
 function isRequiredSingleReferenceTo(f, targetType) {
   return f.field_type === "reference" && f.required && relationCardinality(f) === "one" && f.db_column?.foreign_key !== void 0 && f.ui_component.component === "typeahead-select" && f.ui_component.ref === targetType;
 }
+function requiredReferencesTo(owners, targetType) {
+  return owners.flatMap(
+    (owner) => owner.fields.filter((f) => isRequiredSingleReferenceTo(f, targetType)).map((f) => ({ owner, f }))
+  );
+}
 async function findRequiredReferrers(db, registry, targetType, id) {
-  const owners = [
-    ...Object.values(registry.content_types),
-    ...Object.values(registry.taxonomy_types),
-    ...Object.values(registry.paragraph_types)
-  ];
-  const out = [];
-  for (const owner of owners) {
-    for (const f of owner.fields) {
-      if (!isRequiredSingleReferenceTo(f, targetType)) continue;
-      const notSelf = owner.name === targetType ? sql` AND id <> ${id}` : sql``;
-      const r = await db.execute(
-        sql`SELECT count(*)::int AS n FROM ${sql.raw(quoteIdent(owner.db.table_name))} WHERE ${sql.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
-      );
-      const n = r.rows[0].n;
-      if (n > 0) out.push({ type_label: owner.label, field_label: f.label, count: n });
-    }
+  const targetFields = registry.content_types[targetType]?.fields ?? registry.taxonomy_types[targetType]?.fields ?? [];
+  const itemOwners = [...Object.values(registry.content_types), ...Object.values(registry.taxonomy_types)];
+  const itemFields = requiredReferencesTo(itemOwners, targetType);
+  const paragraphFields = requiredReferencesTo(Object.values(registry.paragraph_types), targetType);
+  const ownIds = paragraphFields.length > 0 ? await ownParagraphRowIds(db, registry, targetFields, id) : [];
+  const [itemCounts, paragraphCounts] = await Promise.all([
+    Promise.all(
+      itemFields.map(async ({ owner, f }) => {
+        const notSelf = owner.name === targetType ? sql` AND id <> ${id}` : sql``;
+        const r = await db.execute(
+          sql`SELECT count(*)::int AS n FROM ${sql.raw(quoteIdent(owner.db.table_name))} WHERE ${sql.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
+        );
+        return { owner, f, n: r.rows[0].n, own: 0 };
+      })
+    ),
+    Promise.all(
+      paragraphFields.map(async ({ owner, f }) => {
+        const r = await db.execute(
+          sql`SELECT count(*)::int AS n, count(*) FILTER (WHERE id = ANY(${sql.param(ownIds)}::uuid[]))::int AS own FROM ${sql.raw(quoteIdent(owner.db.table_name))} WHERE ${sql.raw(quoteIdent(f.db_column.column_name))} = ${id}`
+        );
+        const { n, own } = r.rows[0];
+        return { owner, f, n, own };
+      })
+    )
+  ]);
+  const others = [];
+  for (const { owner, f, n, own } of [...itemCounts, ...paragraphCounts]) {
+    if (n - own > 0) others.push({ type_label: owner.label, field_label: f.label, count: n - own });
   }
-  return out;
+  return { others, fromOwnParagraphs: paragraphCounts.some((c) => c.own > 0) };
 }
 function inUseMessage(referrers) {
   const total = referrers.reduce((sum, r) => sum + r.count, 0);
@@ -22828,7 +23193,7 @@ function topLevelMediaDelta(mediaFields, before, after) {
   for (const f of mediaFields) {
     const key = f.db_column?.column_name;
     if (key === void 0 || key === "") continue;
-    if (after !== null && !(key in after)) continue;
+    if (after !== null && !Object.hasOwn(after, key)) continue;
     const oldId = before ? extractMediaId(before[key]) : null;
     const newId = after ? extractMediaId(after[key]) : null;
     if (newId === oldId) continue;
@@ -22851,127 +23216,6 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
   if (netAdd.length > 0) await mediaRepo.incrementReferenceCount(netAdd);
   if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
 }
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isUuid(v2) {
-  return typeof v2 === "string" && UUID_RE.test(v2);
-}
-function isPlainObject(v2) {
-  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
-}
-function checkRelationInput(fields, body, registry, path5 = "") {
-  const errors = [];
-  for (const field of fields) {
-    if (!(field.name in body)) continue;
-    const cardinality = relationCardinality(field);
-    if (cardinality === null) continue;
-    const value = body[field.name];
-    const name = `${path5}${field.name}`;
-    if (field.field_type === "reference") {
-      const ok = cardinality === "one" ? value === null || isUuid(value) : Array.isArray(value) && value.every(isUuid);
-      if (!ok) {
-        errors.push({
-          field: name,
-          message: cardinality === "one" ? `${name} holds one item: send a UUID string or null.` : `${name} holds a list: send an array of UUID strings.`
-        });
-      }
-      continue;
-    }
-    const items = cardinality === "one" ? value === null ? [] : isPlainObject(value) ? [value] : void 0 : Array.isArray(value) && value.every(isPlainObject) ? value : void 0;
-    if (items === void 0) {
-      errors.push({
-        field: name,
-        message: cardinality === "one" ? `${name} holds one item: send an object or null.` : `${name} holds a list: send an array of objects.`
-      });
-      continue;
-    }
-    const pType = paragraphTypeOf(field, registry);
-    if (!pType) continue;
-    items.forEach((item, i) => {
-      const prefix = cardinality === "one" ? `${name}.` : `${name}[${i}].`;
-      errors.push(...checkRelationInput(pType.fields, item, registry, prefix));
-    });
-  }
-  return errors;
-}
-function paragraphTypeOf(field, registry) {
-  const comp = field.ui_component;
-  return comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
-}
-function paragraphItemsIn(fields, body, registry, path5) {
-  const out = [];
-  for (const field of fields) {
-    if (field.field_type !== "paragraph" || !(field.name in body)) continue;
-    const pType = paragraphTypeOf(field, registry);
-    if (!pType) continue;
-    const value = body[field.name];
-    const name = `${path5}${field.name}`;
-    if (relationCardinality(field) === "one") {
-      if (isPlainObject(value)) out.push({ item: value, fields: pType.fields, prefix: `${name}.` });
-    } else if (Array.isArray(value)) {
-      value.forEach((item, i) => {
-        if (isPlainObject(item)) out.push({ item, fields: pType.fields, prefix: `${name}[${i}].` });
-      });
-    }
-  }
-  return out;
-}
-function isMissing(value) {
-  if (value === null || value === void 0) return true;
-  if (typeof value === "string" && value.trim() === "") return true;
-  if (Array.isArray(value) && value.length === 0) return true;
-  return false;
-}
-function checkRequiredInParagraphItems(fields, body, registry, path5 = "") {
-  const errors = [];
-  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path5)) {
-    for (const f of itemFields) {
-      if (!f.required || f.removed === true || !f.db_column || f.db_column.junction) continue;
-      if (isMissing(item[f.name])) {
-        errors.push({ field: `${prefix}${f.name}`, message: `${prefix}${f.name} is required.` });
-      }
-    }
-    errors.push(...checkRequiredInParagraphItems(itemFields, item, registry, prefix));
-  }
-  return errors;
-}
-function quoteIdent2(name) {
-  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
-  return `"${name}"`;
-}
-function collectReferences(fields, body, registry, path5, out) {
-  for (const f of fields) {
-    if (!(f.name in body) || !f.db_column) continue;
-    const table = f.db_column.junction ? f.db_column.junction.right_table : f.db_column.foreign_key?.table;
-    if (!table) continue;
-    const value = body[f.name];
-    const name = `${path5}${f.name}`;
-    if (typeof value === "string") {
-      out.push({ table, id: value, field: name });
-    } else if (Array.isArray(value)) {
-      value.forEach((v2, i) => {
-        if (typeof v2 === "string") out.push({ table, id: v2, field: `${name}[${i}]` });
-      });
-    }
-  }
-  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path5)) {
-    collectReferences(itemFields, item, registry, prefix, out);
-  }
-}
-async function findMissingReferences(db, fields, body, registry) {
-  const uses = [];
-  collectReferences(fields, body, registry, "", uses);
-  if (uses.length === 0) return [];
-  const lookups = [...new Set(uses.map((u) => u.table))].map(async (table) => {
-    const ids = [...new Set(uses.filter((u) => u.table === table && isUuid(u.id)).map((u) => u.id.toLowerCase()))];
-    if (ids.length === 0) return [table, /* @__PURE__ */ new Set()];
-    const result = await db.execute(
-      sql`SELECT id FROM ${sql.raw(quoteIdent2(table))} WHERE id IN (${sql.join(ids.map((id) => sql`${id}`), sql`, `)})`
-    );
-    return [table, new Set(result.rows.map((r) => String(r.id).toLowerCase()))];
-  });
-  const found = new Map(await Promise.all(lookups));
-  return uses.filter((u) => !found.get(u.table).has(u.id.toLowerCase())).map((u) => ({ field: u.field, message: `${u.field} refers to an item that does not exist.` }));
-}
 var VARCHAR_DEFAULT_LIMIT = 255;
 var INTEGER_MIN = -2147483648;
 var INTEGER_MAX = 2147483647;
@@ -22982,7 +23226,7 @@ var EMPTY_MEANS_NULL = /* @__PURE__ */ new Set(["date", "integer", "float", "enu
 function emptyValuesToNull(fields, body, registry) {
   const out = { ...body };
   for (const f of fields) {
-    if (!(f.name in out)) continue;
+    if (!Object.hasOwn(out, f.name)) continue;
     const value = out[f.name];
     if (value === "" && EMPTY_MEANS_NULL.has(f.field_type)) {
       out[f.name] = null;
@@ -23087,7 +23331,7 @@ function rangeError(name, value, min, max) {
 function checkFieldValues(fields, body, registry, path5 = "") {
   const errors = [];
   for (const f of fields) {
-    if (!(f.name in body) || f.removed === true) continue;
+    if (!Object.hasOwn(body, f.name) || f.removed === true) continue;
     const name = `${path5}${f.name}`;
     const message = valueError(f, body[f.name], name);
     if (message) errors.push({ field: name, message });
@@ -23097,20 +23341,18 @@ function checkFieldValues(fields, body, registry, path5 = "") {
   }
   return errors;
 }
-function quoteIdent3(name) {
+function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
 async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   const result = await db.execute(
-    sql`SELECT * FROM ${sql.raw(quoteIdent3(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    sql`SELECT * FROM ${sql.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC, id ASC`
   );
   const rows = result.rows;
   for (const nf of pType.fields) {
     if (nf.db_column !== null) continue;
-    const comp = nf.ui_component;
-    if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-    const nType = registry.paragraph_types[comp.ref];
+    const nType = paragraphTypeOf(nf, registry);
     if (!nType) continue;
     for (const row of rows) {
       row[nf.name] = oneOrMany(
@@ -23122,35 +23364,36 @@ async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   return rows;
 }
 async function loadRelationsForEdit(db, registry, fields, id, row) {
-  for (const f of fields) {
-    if (f.db_column === null) {
-      const comp = f.ui_component;
-      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-      const pType = registry.paragraph_types[comp.ref];
-      if (!pType) continue;
-      row[f.name] = oneOrMany(relationCardinality(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name));
-    } else if (f.db_column.junction) {
-      const j = f.db_column.junction;
-      const r = await db.execute(
-        sql`SELECT ${sql.raw(quoteIdent3(j.right_column))} FROM ${sql.raw(quoteIdent3(j.table_name))} WHERE ${sql.raw(quoteIdent3(j.left_column))} = ${id}${junctionOrderBy(j)}`
-      );
-      row[f.name] = r.rows.map((linked) => linked[j.right_column]);
-    }
-  }
+  const loaded = await Promise.all(
+    fields.map(async (f) => {
+      if (f.db_column === null) {
+        const pType = paragraphTypeOf(f, registry);
+        if (!pType) return null;
+        return [f.name, oneOrMany(relationCardinality(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name))];
+      }
+      if (f.db_column.junction) {
+        const j = f.db_column.junction;
+        const r = await db.execute(
+          sql`SELECT ${sql.raw(quoteIdent2(j.right_column))} FROM ${sql.raw(quoteIdent2(j.table_name))} WHERE ${sql.raw(quoteIdent2(j.left_column))} = ${id}${junctionOrderBy(j)}`
+        );
+        return [f.name, [...new Set(r.rows.map((linked) => linked[j.right_column]))]];
+      }
+      return null;
+    })
+  );
+  for (const entry of loaded) if (entry) row[entry[0]] = entry[1];
 }
 async function valuesForPublishCheck(db, registry, requiredFields, id, storedLabels, body) {
-  const stored = { ...storedLabels };
-  if (db) await loadRelationsForEdit(db, registry, requiredFields.filter((f) => !(f.name in body)), id, stored);
-  return { ...stored, ...body };
+  const stored2 = { ...storedLabels };
+  if (db) await loadRelationsForEdit(db, registry, requiredFields.filter((f) => !Object.hasOwn(body, f.name)), id, stored2);
+  return { ...stored2, ...body };
 }
 async function persistRelationFields(db, registry, fields, body, itemId, ownerTable) {
   const deltas = [];
   for (const f of fields) {
-    if (!(f.name in body)) continue;
+    if (!Object.hasOwn(body, f.name)) continue;
     if (f.db_column === null) {
-      const comp = f.ui_component;
-      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-      const pType = registry.paragraph_types[comp.ref];
+      const pType = paragraphTypeOf(f, registry);
       if (!pType) continue;
       deltas.push(await persistParagraphField(db, itemId, ownerTable, f.name, pType, paragraphItems(f, body[f.name]), registry));
     } else if (f.db_column.junction) {
@@ -23161,6 +23404,46 @@ async function persistRelationFields(db, registry, fields, body, itemId, ownerTa
   }
   return deltas;
 }
+async function deleteOwnParagraphs(db, registry, fields, itemId) {
+  const deltas = [];
+  for (const f of fields) {
+    const pType = paragraphTypeOf(f, registry);
+    if (!pType) continue;
+    deltas.push(await deleteParagraphField(db, itemId, f.name, pType, registry));
+  }
+  return deltas;
+}
+function releasedFromParagraphsOnly(paragraphDeltas, topLevel) {
+  const stillHeld = new Set(topLevel.removed);
+  return { added: [], removed: mergeMediaDeltas(...paragraphDeltas).removed.filter((mediaId) => !stillHeld.has(mediaId)) };
+}
+async function deleteItemCascade(db, registry, mediaRepo, target) {
+  const { typeName, fields, mediaFields, repo, id, row } = target;
+  const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : { others: [], fromOwnParagraphs: false };
+  if (referrers.others.length > 0) return { ok: false, message: inUseMessage(referrers.others) };
+  const topLevel = topLevelMediaDelta(mediaFields, row, null);
+  if (!db || !referrers.fromOwnParagraphs) {
+    try {
+      await repo.delete(id);
+    } catch (err) {
+      if (isForeignKeyViolation(err)) return { ok: false, message: IN_USE_RACE_MESSAGE };
+      throw err;
+    }
+    const paragraphDeltas2 = db ? await deleteOwnParagraphs(db, registry, fields, id) : [];
+    await applyMediaReferenceDelta(mergeMediaDeltas(topLevel, ...paragraphDeltas2), mediaRepo);
+    return { ok: true };
+  }
+  const paragraphDeltas = await deleteOwnParagraphs(db, registry, fields, id);
+  try {
+    await repo.delete(id);
+  } catch (err) {
+    await applyMediaReferenceDelta(releasedFromParagraphsOnly(paragraphDeltas, topLevel), mediaRepo);
+    if (isForeignKeyViolation(err)) return { ok: false, message: IN_USE_RACE_MESSAGE };
+    throw err;
+  }
+  await applyMediaReferenceDelta(mergeMediaDeltas(topLevel, ...paragraphDeltas), mediaRepo);
+  return { ok: true };
+}
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
     sql`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
@@ -23270,7 +23553,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
     const mediaFields = contentType.fields.filter(
       (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
     );
-    const paragraphFieldDefs = contentType.fields.filter((f) => f.db_column === null);
     const searchableColumns = [
       ...contentType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
       ...contentType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
@@ -23420,7 +23702,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
       for (const f of columnBackedFields) {
         const key = f.db_column.column_name;
-        if (!(key in storageBody)) continue;
+        if (!Object.hasOwn(storageBody, key)) continue;
         columnData[key] = storageBody[key];
       }
       if (db) {
@@ -23462,7 +23744,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        if (!contentType.only_one && "slug" in body) {
+        if (!contentType.only_one && Object.hasOwn(body, "slug")) {
           const slug = body["slug"];
           if (typeof slug !== "string" || slug.trim() === "") {
             return c.json(
@@ -23532,11 +23814,11 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
       const patchColumnBackedFields = contentType.fields.filter(isColumnBacked);
       const patchData = {};
-      if (!contentType.only_one && "slug" in body) patchData["slug"] = body["slug"];
-      if ("published" in body) patchData["published"] = body["published"];
+      if (!contentType.only_one && Object.hasOwn(body, "slug")) patchData["slug"] = body["slug"];
+      if (Object.hasOwn(body, "published")) patchData["published"] = body["published"];
       for (const f of patchColumnBackedFields) {
         const key = f.db_column.column_name;
-        if (!(key in storageBody)) continue;
+        if (!Object.hasOwn(storageBody, key)) continue;
         patchData[key] = storageBody[key];
       }
       const updated = await repo.update(id, patchData);
@@ -23586,31 +23868,17 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
-        if (referrers.length > 0) {
-          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
-        }
-        try {
-          await repo.delete(id);
-        } catch (err) {
-          if (isForeignKeyViolation(err)) {
-            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
-          }
-          throw err;
-        }
-        const mediaDeltas = [
-          topLevelMediaDelta(mediaFields, item, null)
-        ];
-        if (db) {
-          for (const f of paragraphFieldDefs) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
-          }
+        const outcome = await deleteItemCascade(db, registry, mediaRepo, {
+          typeName,
+          fields: contentType.fields,
+          mediaFields,
+          repo,
+          id,
+          row: item
+        });
+        if (!outcome.ok) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: outcome.message } }, 409);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         return c.json({ ok: true });
       }
     );
@@ -23631,7 +23899,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
     const mediaFields = taxonomyType.fields.filter(
       (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
     );
-    const paragraphFieldDefs = taxonomyType.fields.filter((f) => f.db_column === null);
     const searchableColumns = [
       ...taxonomyType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
       ...taxonomyType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
@@ -23717,7 +23984,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         };
         for (const f of taxColumnBackedFields) {
           const key = f.db_column.column_name;
-          if (!(key in storageBody)) continue;
+          if (!Object.hasOwn(storageBody, key)) continue;
           taxColumnData[key] = storageBody[key];
         }
         const item = await repo.create(taxColumnData);
@@ -23769,10 +24036,10 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         }
         const taxPatchColumnBackedFields = taxonomyType.fields.filter(isColumnBacked);
         const taxPatchData = {};
-        if ("published" in body) taxPatchData["published"] = body["published"];
+        if (Object.hasOwn(body, "published")) taxPatchData["published"] = body["published"];
         for (const f of taxPatchColumnBackedFields) {
           const key = f.db_column.column_name;
-          if (!(key in storageBody)) continue;
+          if (!Object.hasOwn(storageBody, key)) continue;
           taxPatchData[key] = storageBody[key];
         }
         const updated = await repo.update(id, taxPatchData);
@@ -23805,31 +24072,17 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
-        if (referrers.length > 0) {
-          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
-        }
-        try {
-          await repo.delete(id);
-        } catch (err) {
-          if (isForeignKeyViolation(err)) {
-            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
-          }
-          throw err;
-        }
-        const mediaDeltas = [
-          topLevelMediaDelta(mediaFields, item, null)
-        ];
-        if (db) {
-          for (const f of paragraphFieldDefs) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
-          }
+        const outcome = await deleteItemCascade(db, registry, mediaRepo, {
+          typeName,
+          fields: taxonomyType.fields,
+          mediaFields,
+          repo,
+          id,
+          row: item
+        });
+        if (!outcome.ok) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: outcome.message } }, 409);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         return c.json({ ok: true });
       }
     );
@@ -24774,7 +25027,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 var API_VERSION = (() => {
   try {
-    return "0.9.2";
+    return "0.9.4";
   } catch {
     return "0.0.0";
   }
@@ -24883,7 +25136,7 @@ function codeError(code, message) {
   err.code = code;
   return err;
 }
-function quoteIdent4(name) {
+function quoteIdent3(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Unsafe SQL identifier: ${name}`);
   }
@@ -24934,7 +25187,7 @@ function whereFragment(conds) {
 function createDrizzleContentRepository(db, tableName, options = {}) {
   const { relations = {}, publishedRelations = false, sortableColumns } = options;
   function tableRaw() {
-    return sql.raw(quoteIdent4(tableName));
+    return sql.raw(quoteIdent3(tableName));
   }
   async function resolveRows(rows, include, cache) {
     if (rows.length === 0) return rows;
@@ -24977,7 +25230,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       const offset = (page - 1) * per_page;
       const conds = buildConditions(published_only, filters, search);
       const where = whereFragment(conds);
-      const sortCol = sql.raw(quoteIdent4(sort_by));
+      const sortCol = sql.raw(quoteIdent3(sort_by));
       const sortDir = sql.raw(sort_order === "desc" ? "DESC" : "ASC");
       const countResult = await db.execute(
         sql`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
@@ -25031,7 +25284,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v2]) => v2 !== void 0);
-      const colsSql = sql.join(entries.map(([k]) => sql.raw(quoteIdent4(k))), sql`, `);
+      const colsSql = sql.join(entries.map(([k]) => sql.raw(quoteIdent3(k))), sql`, `);
       const valsSql = sql.join(entries.map(([, v2]) => sql`${v2}`), sql`, `);
       const result = await db.execute(
         sql`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
@@ -25048,7 +25301,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         return this.findOne(id);
       }
       const setClauses = sql.join(
-        entries.map(([k, v2]) => sql`${sql.raw(quoteIdent4(k))} = ${v2}`),
+        entries.map(([k, v2]) => sql`${sql.raw(quoteIdent3(k))} = ${v2}`),
         sql`, `
       );
       const result = await db.execute(
@@ -25457,7 +25710,7 @@ function createCmsApp(options) {
       handler: null,
       error: null
     }));
-    const ready = import("./handler-MFF32JB4-NUVEJZXC.js").then(({ createGraphQLHandler }) => {
+    const ready = import("./handler-5OTVPIAF-JVSJWO2S.js").then(({ createGraphQLHandler }) => {
       gqlPasses.forEach((pass, i) => {
         const mount = mounts[i];
         try {
@@ -25743,6 +25996,7 @@ async function runDev(options, deps) {
   const { registry, versionModel } = loaded.value;
   await generateDrizzleConfig(config2, manguitoDir);
   await writeFile9(join11(manguitoDir, "schema.ts"), generateSchemaFile(registry), "utf8");
+  await addLinkConstraints(db.getDb(), registry);
   await runDevMigration(drizzleConfigPath);
   printSuccess(needsSeed ? "Schema tables created" : "Schema tables up to date");
   if (needsSeed) {
@@ -25938,6 +26192,13 @@ async function onSchemaFileChange(args) {
   await generateRoutes2(registry, manguitoDir);
   await generateForms(registry, join11(manguitoDir, "forms"));
   await generateNav(registry, manguitoDir);
+  try {
+    await addLinkConstraints(db.getDb(), registry);
+  } catch (err) {
+    process.stderr.write(`\u26A0 Adding link constraints failed: ${err instanceof Error ? err.message : String(err)}
+`);
+    return;
+  }
   try {
     await runDevMigration(drizzleConfigPath);
   } catch (err) {
@@ -25962,11 +26223,17 @@ async function onSchemaFileChange(args) {
   updateFetch((req) => newAdapter.app.fetch(req));
   printSuccess("Schema updated");
 }
+async function addLinkConstraints(database, registry) {
+  const results = await ensureLinkConstraints(database, registry);
+  for (const { table, removed } of results) {
+    if (removed > 0) printSuccess(`Removed ${removed} duplicate links from ${table}`);
+  }
+}
 function loadValidatedSchema(cwd, config2) {
   const parsed = parseAllSchemas(cwd, config2);
   if (!parsed.ok) return parsed;
   const registry = parsed.value;
-  const crossRefErrors = validateCrossReferences(registry, config2.api.media?.max_file_size);
+  const crossRefErrors = checkRegistry(registry, config2.api.media?.max_file_size);
   if (crossRefErrors.length > 0) return { ok: false, errors: crossRefErrors };
   const versions = loadProjectVersionModel(resolveSchemaConfig(cwd, config2), registry);
   if (!versions.ok) return { ok: false, errors: versions.errors };
@@ -26152,7 +26419,7 @@ function buildDeps(options, cwd) {
   loadEnvFile(options.env);
   return {
     buildRunner: async () => runBuild(options.env ? { env: options.env } : {}, { cwd }),
-    needsRebuild: () => needsRebuild(cwd),
+    needsRebuild: (schemaDir) => needsRebuild(cwd, { schemaDir }),
     db: createPostgresAdapter(),
     migrationsFolder: resolve8(cwd, "./migrations"),
     configPath: resolve8(cwd, "dist/generated/drizzle.config.ts"),
@@ -26220,7 +26487,7 @@ async function runMigrate(options, deps) {
     printGuidedError("DB_URL not set or database unreachable");
     process.exit(1);
   }
-  if (await deps.needsRebuild()) {
+  if (await deps.needsRebuild(resolve8(cwd, config2.schema.base_path))) {
     try {
       await deps.buildRunner();
     } catch (err) {
@@ -26406,7 +26673,7 @@ async function runValidate(options, deps) {
   if (allErrors.length === 0 && parsedRoles !== null && parsedRoutesDef !== null) {
     const registry = buildSchemaRegistry(parsedSchemas, parsedRoutesDef, parsedRoles);
     printSchemaDeprecations(findSchemaDeprecations(registry));
-    const crossRefErrors = validateCrossReferences(registry, config2.api.media?.max_file_size);
+    const crossRefErrors = checkRegistry(registry, config2.api.media?.max_file_size);
     allErrors.push(...crossRefErrors);
     if (crossRefErrors.length === 0) {
       const versions = loadProjectVersionModel(resolveSchemaConfig(cwd, config2), registry);
@@ -26722,7 +26989,7 @@ function loadWorkingRegistry(cwd, config2, command) {
     process.exit(1);
   }
   const registry = buildSchemaRegistry(parsedSchemas, parsedRoutes, parsedRoles);
-  const crossRefErrors = validateCrossReferences(registry, config2.api.media?.max_file_size);
+  const crossRefErrors = checkRegistry(registry, config2.api.media?.max_file_size);
   if (crossRefErrors.length > 0) {
     printValidationErrors(crossRefErrors, "Schema reference errors", command);
     process.exit(1);