json-rest-api 2.4.0 → 3.0.0

package/plugins/core/bulk-operations-plugin.js

@@ -1,475 +1,93 @@
 import { RestApiValidationError } from '../../lib/rest-api-errors.js'
-import { beginWriteTransaction, commitTransaction, onTransactionFinished, rollbackAfterError, withWriteOutcome } from '../../lib/error-context.js'
-import { rejectRemovedOptions, resolveFormat, resolveReturning } from './lib/querying-writing/response-options.js'
-import { selectWriteInput } from './lib/querying-writing/request-contracts.js'
 
-function validateAtomic (atomic, field = 'atomic') {
-  if (typeof atomic !== 'boolean') {
-    throw new RestApiValidationError(`${field} must be a boolean`, { fields: [field] })
-  }
-}
-
-function validateTransactionMode (atomic, transaction) {
-  if (!atomic && transaction) {
-    throw new RestApiValidationError('A caller transaction requires atomic bulk operations', { fields: ['transaction'] })
-  }
-}
-
-function resolveBulkVersions (params, records, schemaInfo) {
-  if (params.expectedVersion !== undefined) {
-    throw new RestApiValidationError('Bulk writes require expectedVersions aligned with the batch', { fields: ['expectedVersion'] })
-  }
-  const versions = params.expectedVersions
-  if (versions === undefined) return undefined
-  if (!records || !schemaInfo?.versionField || !Array.isArray(versions) || versions.length !== records.length ||
-    Array.from(versions).some(token => typeof token !== 'string' || !token.length || token.length > 128)) {
-    throw new RestApiValidationError('expectedVersions requires a versioned update/delete batch with one non-empty token of at most 128 characters per item', { fields: ['expectedVersions'] })
-  }
-  return versions.slice()
-}
-
-function retainChildCleanup (context, recordContext, bulkIndex) {
-  let copiedErrors = 0
-  let copiedUploads = []
-  const collect = () => {
-    const errors = recordContext.cleanupErrors || []
-    if (errors.length > copiedErrors) {
-      const entries = context.cleanupErrors ||= []
-      for (const entry of errors.slice(copiedErrors)) entries.push({ ...entry, bulkIndex })
-      copiedErrors = errors.length
-    }
-    if (copiedUploads.length) context.fileHandlingUploads = context.fileHandlingUploads.filter(entry => !copiedUploads.includes(entry))
-    copiedUploads = (recordContext.fileHandlingUploads || []).map(entry => ({ ...entry, bulkIndex }))
-    if (copiedUploads.length) (context.fileHandlingUploads ||= []).push(...copiedUploads)
-  }
-  collect()
-  onTransactionFinished(recordContext.transaction, collect)
-}
+const DEFAULT_MAX_BULK_OPERATIONS = 1000
 
+/**
+ * HTTP routes for many-row writes: POST, PATCH and DELETE /<type>/bulk run
+ * postMany, patchMany and deleteMany, one statement per chunk and all or
+ * nothing. Programs call those methods directly; this plugin only exposes them
+ * over HTTP with a request size limit.
+ */
 export const BulkOperationsPlugin = {
   name: 'bulk-operations',
   dependencies: ['rest-api'],
 
-  async install ({ api, log, addHook, addResourceMethod, helpers, pluginOptions }) {
+  async install ({ api, log, addHook, pluginOptions }) {
     const bulkOptions = pluginOptions || {}
-    const {
-      maxBulkOperations = 100,
-      defaultAtomic = true
-    } = bulkOptions
-    const unknown = Object.keys(bulkOptions).filter(name => !['maxBulkOperations', 'defaultAtomic'].includes(name))
+    const { maxBulkOperations = DEFAULT_MAX_BULK_OPERATIONS } = bulkOptions
+    const unknown = Object.keys(bulkOptions).filter(name => name !== 'maxBulkOperations')
     if (unknown.length) {
-      throw new RestApiValidationError(`Unsupported bulk options: ${unknown.join(', ')}. Pass maxBulkOperations and defaultAtomic directly.`, { fields: unknown })
+      throw new RestApiValidationError(`Unsupported bulk options: ${unknown.join(', ')}. Bulk routes are all-or-nothing and take only maxBulkOperations.`, { fields: unknown })
     }
     if (!Number.isSafeInteger(maxBulkOperations) || maxBulkOperations < 1) {
       throw new RestApiValidationError('maxBulkOperations must be a positive safe integer', { fields: ['maxBulkOperations'] })
     }
-    validateAtomic(defaultAtomic, 'defaultAtomic')
-
-    log.info('Installing Bulk Operations plugin', { maxBulkOperations, defaultAtomic })
 
-    // Add bulk methods to each scope
-    addResourceMethod('bulkPost', withWriteOutcome(async ({ scope, vars, params, context }) => {
-      const { atomic = defaultAtomic } = params
-      rejectRemovedOptions(params)
-      const inputKey = selectWriteInput(params)
-      const inputRecords = inputKey === 'document' ? params.document.data : params.data
-      validateAtomic(atomic)
-      validateTransactionMode(atomic, params.transaction)
-      resolveBulkVersions(params)
-      const format = resolveFormat(params.format, vars.format)
-      const returning = resolveReturning(params.returning, vars.returning)
+    log.info('Installing Bulk Operations plugin', { maxBulkOperations })
 
-      // Validate bulk size
-      if (!Array.isArray(inputRecords) || inputRecords.length === 0) {
-        throw new RestApiValidationError('Bulk operations require an array of records', {
+    // The body's data array, checked against the limit before anything runs.
+    const bodyRows = (body, queryString) => {
+      const query = [...new URLSearchParams(queryString).keys()]
+      if (query.length) {
+        throw new RestApiValidationError(`Bulk routes take no query parameters: ${query.join(', ')}`, { fields: query })
+      }
+      const rows = body?.data
+      if (!Array.isArray(rows) || rows.length === 0) {
+        throw new RestApiValidationError('A bulk request body is { data: [...] } with at least one entry', {
           fields: ['data'],
           violations: [{ field: 'data', rule: 'required_array', message: 'Must be a non-empty array' }]
         })
       }
-
-      if (inputRecords.length > maxBulkOperations) {
-        throw new RestApiValidationError(`Bulk operations limited to ${maxBulkOperations} records`, {
+      if (rows.length > maxBulkOperations) {
+        throw new RestApiValidationError(`Bulk requests are limited to ${maxBulkOperations} entries`, {
           fields: ['data'],
-          violations: [{
-            field: 'data',
-            rule: 'max_items',
-            message: `Cannot process more than ${maxBulkOperations} records at once`
-          }]
-        })
-      }
-
-      const results = []
-      const errors = []
-      let transaction = null
-      const ownsTransaction = !params.transaction
-
-      try {
-        // Start transaction if atomic mode
-        if (atomic) {
-          transaction = await beginWriteTransaction(context, params.transaction, helpers.newTransaction)
-        }
-
-        for (const [recordIndex, inputRecord] of inputRecords.entries()) {
-          const recordContext = {
-            ...context,
-            cleanupErrors: undefined,
-            fileHandlingUploads: undefined,
-            bulkOperation: true,
-            bulkIndex: recordIndex
-          }
-          try {
-            // Use the existing post method with transaction
-            const result = await scope.post({
-              ...(inputKey === 'document'
-                ? { document: { ...params.document, data: inputRecord } }
-                : { data: inputRecord }),
-              transaction,
-              format,
-              returning
-            }, recordContext)
-
-            results.push({
-              index: recordIndex,
-              status: 'success',
-              data: format === 'jsonapi' ? result?.data : result
-            })
-          } catch (error) {
-            if (atomic) {
-              throw error
-            } else {
-              // In non-atomic mode, collect errors
-              errors.push({
-                index: recordIndex,
-                status: 'error',
-                error: {
-                  code: error.code || 'UNKNOWN_ERROR',
-                  message: error.message,
-                  details: error.details,
-                  transactionOutcome: error.transactionOutcome
-                }
-              })
-            }
-          } finally { retainChildCleanup(context, recordContext, recordIndex) }
-        }
-
-        // Commit transaction if atomic
-        if (transaction && ownsTransaction) {
-          await commitTransaction(transaction, context)
-        }
-
-        // Build response
-        return {
-          ...(returning === 'none' ? {} : { data: results.map(r => r.data) }),
-          errors: errors.length > 0 ? errors : undefined,
-          meta: {
-            total: inputRecords.length,
-            succeeded: results.length,
-            failed: errors.length,
-            atomic
-          }
-        }
-      } catch (error) {
-        await rollbackAfterError(error, context, ownsTransaction ? transaction : null)
-        throw error
-      }
-    }))
-
-    addResourceMethod('bulkPatch', withWriteOutcome(async ({ scope, vars, params, context }) => {
-      const { operations, atomic = defaultAtomic } = params
-      rejectRemovedOptions(params)
-      validateAtomic(atomic)
-      validateTransactionMode(atomic, params.transaction)
-      const format = resolveFormat(params.format, vars.format)
-      const returning = resolveReturning(params.returning, vars.returning)
-
-      // Validate operations
-      if (!Array.isArray(operations) || operations.length === 0) {
-        throw new RestApiValidationError('Bulk patch requires an array of operations', {
-          fields: ['operations'],
-          violations: [{ field: 'operations', rule: 'required_array', message: 'Must be a non-empty array' }]
+          violations: [{ field: 'data', rule: 'max_items', message: `Cannot process more than ${maxBulkOperations} entries at once` }]
         })
       }
+      return rows
+    }
 
-      if (operations.length > maxBulkOperations) {
-        throw new RestApiValidationError(`Bulk operations limited to ${maxBulkOperations} operations`, {
-          fields: ['operations'],
-          violations: [{
-            field: 'operations',
-            rule: 'max_items',
-            message: `Cannot process more than ${maxBulkOperations} operations at once`
-          }]
-        })
-      }
-
-      const expectedVersions = resolveBulkVersions(params, operations, vars.schemaInfo)
-      const results = []
-      const errors = []
-      let transaction = null
-      const ownsTransaction = !params.transaction
-
-      try {
-        if (atomic) {
-          transaction = await beginWriteTransaction(context, params.transaction, helpers.newTransaction)
-        }
-
-        for (let i = 0; i < operations.length; i++) {
-          const operation = operations[i]
-
-          // Validate operation structure
-          if (!operation || operation.id === undefined || operation.id === null) {
-            errors.push({
-              index: i,
-              status: 'error',
-              error: {
-                code: 'INVALID_OPERATION',
-                message: 'Operation must include id and exactly one of data or document',
-                details: { operation },
-                transactionOutcome: 'none'
-              }
-            })
-            if (atomic) {
-              throw new RestApiValidationError('Invalid operation structure', {
-                fields: [`operations[${i}]`],
-                violations: [{
-                  field: `operations[${i}]`,
-                  rule: 'required_fields',
-                  message: 'Operation must include id and exactly one of data or document'
-                }]
-              })
-            }
-            continue
-          }
-
-          const recordContext = {
-            ...context,
-            cleanupErrors: undefined,
-            fileHandlingUploads: undefined,
-            bulkOperation: true,
-            bulkIndex: i
-          }
-          try {
-            const result = await scope.patch({
-              ...operation,
-              expectedVersion: expectedVersions?.[i],
-              transaction,
-              format,
-              returning
-            }, recordContext)
-
-            results.push({
-              index: i,
-              id: operation.id,
-              status: 'success',
-              data: format === 'jsonapi' ? result?.data : result
-            })
-          } catch (error) {
-            if (atomic) {
-              throw error
-            } else {
-              errors.push({
-                index: i,
-                id: operation.id,
-                status: 'error',
-                error: {
-                  code: error.code || 'UNKNOWN_ERROR',
-                  message: error.message,
-                  details: error.details,
-                  transactionOutcome: error.transactionOutcome
-                }
-              })
-            }
-          } finally { retainChildCleanup(context, recordContext, i) }
-        }
-
-        if (transaction && ownsTransaction) {
-          await commitTransaction(transaction, context)
-        }
-
-        return {
-          ...(returning === 'none' ? {} : { data: results.map(r => r.data) }),
-          errors: errors.length > 0 ? errors : undefined,
-          meta: {
-            total: operations.length,
-            succeeded: results.length,
-            failed: errors.length,
-            atomic
-          }
-        }
-      } catch (error) {
-        await rollbackAfterError(error, context, ownsTransaction ? transaction : null)
-        throw error
-      }
-    }))
-
-    addResourceMethod('bulkDelete', withWriteOutcome(async ({ scope, vars, params, context }) => {
-      const { ids, atomic = defaultAtomic } = params
-      rejectRemovedOptions(params)
-      validateAtomic(atomic)
-      validateTransactionMode(atomic, params.transaction)
-      if (params.format !== undefined) resolveFormat(params.format)
-
-      // Validate IDs
-      if (!Array.isArray(ids) || ids.length === 0) {
-        throw new RestApiValidationError('Bulk delete requires an array of IDs', {
-          fields: ['ids'],
-          violations: [{ field: 'ids', rule: 'required_array', message: 'Must be a non-empty array' }]
-        })
-      }
-
-      if (ids.length > maxBulkOperations) {
-        throw new RestApiValidationError(`Bulk operations limited to ${maxBulkOperations} IDs`, {
-          fields: ['ids'],
-          violations: [{
-            field: 'ids',
-            rule: 'max_items',
-            message: `Cannot process more than ${maxBulkOperations} IDs at once`
-          }]
-        })
-      }
-
-      const expectedVersions = resolveBulkVersions(params, ids, vars.schemaInfo)
-      const results = []
-      const errors = []
-      let transaction = null
-      const ownsTransaction = !params.transaction
-
-      try {
-        if (atomic) {
-          transaction = await beginWriteTransaction(context, params.transaction, helpers.newTransaction)
-        }
-
-        // Process deletes
-        for (let i = 0; i < ids.length; i++) {
-          const id = ids[i]
-
-          const recordContext = {
-            ...context,
-            cleanupErrors: undefined,
-            fileHandlingUploads: undefined,
-            bulkOperation: true,
-            bulkIndex: i
-          }
-          try {
-            await scope.delete({
-              id,
-              expectedVersion: expectedVersions?.[i],
-              transaction
-            }, recordContext)
-
-            results.push({
-              index: i,
-              id,
-              status: 'success'
-            })
-          } catch (error) {
-            if (atomic) {
-              throw error
-            } else {
-              errors.push({
-                index: i,
-                id,
-                status: 'error',
-                error: {
-                  code: error.code || 'UNKNOWN_ERROR',
-                  message: error.message,
-                  details: error.details,
-                  transactionOutcome: error.transactionOutcome
-                }
-              })
-            }
-          } finally { retainChildCleanup(context, recordContext, i) }
-        }
-
-        if (transaction && ownsTransaction) {
-          await commitTransaction(transaction, context)
-        }
-
-        return {
-          meta: {
-            total: ids.length,
-            succeeded: results.length,
-            failed: errors.length,
-            deleted: results.filter(r => r.status === 'success').map(r => r.id),
-            atomic
-          },
-          errors: errors.length > 0 ? errors : undefined
-        }
-      } catch (error) {
-        await rollbackAfterError(error, context, ownsTransaction ? transaction : null)
-        throw error
-      }
-    }))
-
-    // Hook into scope creation to add bulk routes
     addHook('resource:added', 'bulkOperationsRoutes', { beforeFunction: 'registerScopeRoutes' }, async ({ context: { scopeName } }) => {
       const urlPrefix = api.vars.transport?.mountPath || ''
-      const scopePath = `${urlPrefix}/${scopeName}`
-
-      // Create route handlers
-      const createBulkRouteHandler = (method) => {
-        return async ({ context, body, queryString }) => {
-          const query = Object.fromEntries(new URLSearchParams(queryString))
-          rejectRemovedOptions(query)
-          if (query.atomic !== undefined && query.atomic !== 'true' && query.atomic !== 'false') {
-            throw new RestApiValidationError('atomic must be true or false', { fields: ['atomic'] })
-          }
-          // Parse query params for atomic mode override
-          const atomic = query?.atomic !== undefined
-            ? query.atomic === 'true'
-            : defaultAtomic
-
-          let params
-          if (method === 'bulkPost') {
-            // For bulk create, expect array in data field (JSON:API style)
-            params = {
-              document: body,
-              atomic
-            }
-          } else if (method === 'bulkPatch') {
-            // For bulk update, expect operations array
-            const operations = body?.operations || body
-            params = {
-              operations: Array.isArray(operations)
-                ? operations.map(operation => ({ id: operation?.id, document: { data: operation?.data } }))
-                : operations,
-              atomic
-            }
-          } else if (method === 'bulkDelete') {
-            // For bulk delete, expect IDs array
-            params = {
-              ids: body?.data || body?.ids || body,
-              atomic
-            }
-          }
-
-          const result = await api.resources[scopeName][method]({
-            ...params,
-            expectedVersion: body?.expectedVersion,
-            expectedVersions: body?.expectedVersions,
-            format: 'jsonapi',
-            returning: 'full'
-          }, context)
-          return { statusCode: method === 'bulkPost' ? 201 : 200, body: result }
-        }
-      }
+      const path = `${urlPrefix}/${scopeName}/bulk`
+      const resource = () => api.resources[scopeName]
 
-      // Register bulk routes
+      // Body: { data: [resource objects] }; responds 201 { data: [records] }.
       await api.addRoute({
         method: 'POST',
-        path: `${scopePath}/bulk`,
-        handler: createBulkRouteHandler('bulkPost')
+        path,
+        handler: async ({ context, body, queryString }) => {
+          bodyRows(body, queryString)
+          const result = await resource().postMany({ document: body, format: 'jsonapi', returning: 'full' }, context)
+          return { statusCode: 201, body: result }
+        }
       })
 
+      // Body: { data: [resource objects with id] }; responds 200 { data: [records] }.
       await api.addRoute({
         method: 'PATCH',
-        path: `${scopePath}/bulk`,
-        handler: createBulkRouteHandler('bulkPatch')
+        path,
+        handler: async ({ context, body, queryString }) => {
+          bodyRows(body, queryString)
+          const result = await resource().patchMany({ document: body, format: 'jsonapi', returning: 'full' }, context)
+          return { statusCode: 200, body: result }
+        }
       })
 
+      // Body: { data: [{ type, id }] }; responds 200 { data: [the deleted identifiers] }.
       await api.addRoute({
         method: 'DELETE',
-        path: `${scopePath}/bulk`,
-        handler: createBulkRouteHandler('bulkDelete')
+        path,
+        handler: async ({ context, body, queryString }) => {
+          const ids = bodyRows(body, queryString).map((identifier, index) => {
+            if (identifier?.type !== scopeName || identifier.id === undefined || identifier.id === null) {
+              throw new RestApiValidationError(`data[${index}] must be a resource identifier { type: '${scopeName}', id }`, { fields: [`data[${index}]`] })
+            }
+            return identifier.id
+          })
+          const result = await resource().deleteMany({ ids, returning: 'minimal' }, context)
+          return { statusCode: 200, body: result }
+        }
       })
 
       log.debug(`Added bulk operation routes for scope: ${scopeName}`)

package/plugins/core/connectors/lib/transport-http-helpers.js

@@ -23,8 +23,32 @@ export function mergeResponseHeaders (...sources) {
 export function getHttpDiagnosticError (error) {
   // Parser messages and stacks can quote raw input before a resource is known.
   // Keep the original error for hooks/responses, but log only this safe preview.
-  if (error?.type !== 'entity.parse.failed') return error
-  return { name: 'SyntaxError', message: 'Invalid JSON request body', type: 'entity.parse.failed', status: 400 }
+  if (error?.type === 'entity.parse.failed') {
+    return { name: 'SyntaxError', message: 'Invalid JSON request body', type: 'entity.parse.failed', status: 400 }
+  }
+  // A database error repeats the stored values: in the message Knex builds
+  // from the SQL and its bindings, in MySQL's sql and sqlMessage, and in
+  // PostgreSQL's detail. Log only which failure it was.
+  const failure = databaseFailure(error)
+  return failure ? { name: failure.name, code: failure.code } : error
+}
+
+/**
+ * The database driver error behind `error`, which may wrap it as its cause
+ * (a RestApiWriteError does).
+ * @param {unknown} error
+ */
+function databaseFailure (error) {
+  let current = error
+  for (let depth = 0; current && typeof current === 'object' && depth < 10; depth++) {
+    if (!isRestApiError(current)) {
+      const { sqlState, sqlMessage, errno, severity, code } = /** @type {any} */ (current)
+      // mysql2 (and socket) errors, pg errors, and better-sqlite3 or sqlite3 errors.
+      if (typeof sqlState === 'string' || typeof sqlMessage === 'string' || typeof errno === 'number' ||
+        typeof severity === 'string' || /^SQLITE_/.test(String(code ?? ''))) return current
+    }
+    current = /** @type {any} */ (current).cause
+  }
 }
 
 const JSON_API_WRITE_CONTENT_TYPES = [
@@ -115,11 +139,15 @@ export function mapRestApiErrorToHttp (error) {
   // Read hooks can reject with null or undefined.
   error ??= {}
   const statusHint = error.statusCode ?? error.status
+  // Only the library's own errors carry messages meant for clients; a write
+  // error wraps what failed. Other messages, a database's above all, can
+  // repeat SQL and stored values.
+  const origin = isRestApiError(error) && error instanceof RestApiWriteError ? error.cause : error
   let status = 500
   let errors = [{
     status: '500',
     title: 'Internal Server Error',
-    detail: error.message
+    detail: isRestApiError(origin) ? error.message : 'An unexpected error occurred'
   }]
 
   if (error?.validation) {
@@ -172,6 +200,9 @@ export function mapRestApiErrorToHttp (error) {
         ...(error.details ? { source: error.details } : {})
       }]
     }
+  } else if (error.code === 'REST_API_BULK_WRITE_UNSUPPORTED') {
+    status = 422
+    errors = [{ status: '422', code: error.code, title: 'Unsupported Bulk Write', detail: error.message }]
   } else if (error.code === 'REST_API_PRECONDITION_FAILED') {
     status = 412
     errors = [{ status: '412', code: error.code, title: 'Precondition Failed', detail: error.message }]

package/plugins/core/file-handling-plugin.js

@@ -1,6 +1,6 @@
 /** File detection, uploads and cleanup tied to resource writes. */
 
-import { RestApiValidationError } from '../../lib/rest-api-errors.js'
+import { RestApiBulkWriteUnsupportedError, RestApiValidationError } from '../../lib/rest-api-errors.js'
 import { getOperationDiagnosticContext, wrapUnexpectedError } from '../../lib/error-context.js'
 import { createEnhancedLogger } from '../../lib/enhanced-logger.js'
 
@@ -218,11 +218,26 @@ export const FileHandlingPlugin = {
       }
     }
 
-    addHook('beforeProcessing', 'processFiles', {}, async ({ context }) => {
+    addHook('beforeProcessing', 'processFiles', { batch: true }, async ({ context }) => {
       if (!['post', 'put', 'patch'].includes(context.method)) return
       await processFiles(context.scopeName, context.params, context)
     })
 
+    // Uploads belong to one record each; many-row writes refuse rows that set file fields.
+    const refuseFileFields = ({ context, scopeName }) => {
+      const fileFields = getFileFields(scopeName)
+      const set = fileFields.filter(field => context.rawFields?.includes(field.field) ||
+        context.inputRecords.some(record => record?.data?.attributes?.[field.field] !== undefined))
+      if (!set.length) return
+      throw new RestApiBulkWriteUnsupportedError({
+        resourceType: scopeName,
+        operation: context.method,
+        reason: `rows set file fields (${set.map(field => field.field).join(', ')}); upload files with single writes`
+      })
+    }
+    addHook('beforeProcessingPostMany', 'refuse-file-fields-post-many', {}, refuseFileFields)
+    addHook('beforeProcessingPatchMany', 'refuse-file-fields-patch-many', {}, refuseFileFields)
+
     addHook('afterRollback', 'cleanupUploadedFiles', {}, async ({ context }) => {
       await cleanupUploadedFiles(context)
     })

package/plugins/core/lib/anyapi/anyapi-registry.js

@@ -20,7 +20,8 @@ const DEFAULT_CACHE_SIZE = 100
 const EMPTY_RUNTIME = Object.freeze({ schema: {}, searchSchema: {}, callbacks: [] })
 
 // Errors from two servers inserting the same new resource at once.
-const WRITE_CONFLICT_CODES = new Set(['23505', '40001', '40P01', 'ER_DUP_ENTRY', 'ER_LOCK_DEADLOCK', 'SQLITE_BUSY', 'SQLITE_CONSTRAINT_UNIQUE'])
+// ER_CHECKREAD (1020): MariaDB with innodb_snapshot_isolation refuses a row changed since the snapshot.
+const WRITE_CONFLICT_CODES = new Set(['23505', '40001', '40P01', 'ER_DUP_ENTRY', 'ER_LOCK_DEADLOCK', 'ER_CHECKREAD', 'SQLITE_BUSY', 'SQLITE_CONSTRAINT_UNIQUE'])
 const creationRaces = new WeakSet()
 
 const resolveIdProperty = (schema = {}, explicitIdProperty = null) => {
@@ -113,7 +114,7 @@ const rowsSignature = (rows, columns) => JSON.stringify(rows.map(row => columns.
   return value ?? null
 })).sort((left, right) => String(left[0]).localeCompare(String(right[0]))))
 
-const isWriteConflict = error => WRITE_CONFLICT_CODES.has(error?.code) || [1062, 1213].includes(error?.errno)
+const isWriteConflict = error => WRITE_CONFLICT_CODES.has(error?.code) || [1020, 1062, 1213].includes(error?.errno)
 
 /**
  * Canonical resource metadata. One registry can serve every tenant API that

package/plugins/core/lib/anyapi/canonical-link-store.js

@@ -432,7 +432,10 @@ export function createCanonicalLinkStore ({ api, getDescriptor, getScopeStorageA
     resolveId: row => row.relationship === options.relationshipKey && row.left_resource === options.descriptor.resource && normalizeId(row.left_id) === options.leftId ? row.right_id : row.left_id
   })
 
-  const invalidateDeletedLinkTargets = async (scopeName, context) => {
+  // Advances the versions of parents linked to a record about to be deleted.
+  // When there are such parents, `lockRow` first locks the record's row against
+  // link writers, and answers not found when it has gone.
+  const invalidateDeletedLinkTargets = async (scopeName, context, lockRow) => {
     const relationships = []
     for (const [parentType, parent] of Object.entries(api.resources)) {
       if (!parent.vars.schemaInfo?.versionField) continue
@@ -444,7 +447,7 @@ export function createCanonicalLinkStore ({ api, getDescriptor, getScopeStorageA
     }
     if (!relationships.length) return
     assertVersionedRelationshipTransaction(api, relationships[0].inverse, context.transaction)
-    await lockRelationshipTargets(api, context.transaction, [{ type: scopeName, id: context.id }], { exclusive: true })
+    await lockRow()
     const id = normalizeId(context.id)
     for (const { inverse, info } of relationships) {
       const query = buildLinkMutationQuery({ ...info, db: context.transaction, allParents: true }, (query, column) => query.where(column, id))