@bobbykim/manguito-cms-api 0.1.0

package/dist/index.mjs

@@ -0,0 +1,3189 @@
+// src/app.ts
+import { Hono } from "hono";
+import { sql as sql10 } from "drizzle-orm";
+
+// src/middleware/cors.ts
+function createCorsMiddleware(corsConfig) {
+  const allowList = Array.isArray(corsConfig.origin) ? corsConfig.origin : [corsConfig.origin];
+  const wildcard = allowList.includes("*");
+  const methods = corsConfig.methods?.join(",") ?? "GET,POST,PATCH,DELETE,OPTIONS";
+  return async function corsMiddleware(c, next) {
+    if (corsConfig.enabled === false) {
+      return next();
+    }
+    const requestOrigin = c.req.header("origin");
+    if (wildcard) {
+      c.res.headers.set("Access-Control-Allow-Origin", "*");
+    } else if (requestOrigin && allowList.includes(requestOrigin)) {
+      c.res.headers.set("Access-Control-Allow-Origin", requestOrigin);
+      c.res.headers.set("Vary", "Origin");
+      if (corsConfig.credentials === true) {
+        c.res.headers.set("Access-Control-Allow-Credentials", "true");
+      }
+    }
+    c.res.headers.set("Access-Control-Allow-Methods", methods);
+    c.res.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    if (c.req.method === "OPTIONS") {
+      return c.newResponse(null, 204);
+    }
+    return next();
+  };
+}
+
+// src/middleware/security-headers.ts
+function createSecurityHeadersMiddleware(options = {}) {
+  const connectSrc = ["'self'", ...options.connectSrc ?? []].join(" ");
+  const csp = [
+    "default-src 'self'",
+    "img-src 'self' data: https:",
+    "media-src 'self' https:",
+    "style-src 'self' 'unsafe-inline'",
+    "script-src 'self'",
+    "font-src 'self' data:",
+    `connect-src ${connectSrc}`,
+    "frame-ancestors 'none'",
+    "base-uri 'self'",
+    "form-action 'self'"
+  ].join("; ");
+  return async function securityHeaders(c, next) {
+    await next();
+    c.res.headers.set("X-Content-Type-Options", "nosniff");
+    c.res.headers.set("X-Frame-Options", "DENY");
+    c.res.headers.set("Referrer-Policy", "no-referrer");
+    c.res.headers.set("Content-Security-Policy", csp);
+  };
+}
+
+// src/middleware/error.ts
+var ERROR_STATUS_MAP = {
+  NOT_FOUND: 404,
+  SLUG_NOT_FOUND: 404,
+  METHOD_NOT_ALLOWED: 405,
+  VALIDATION_ERROR: 422,
+  INVALID_SLUG_FORMAT: 422,
+  SLUG_CONFLICT: 409,
+  PUBLISH_VALIDATION_ERROR: 422,
+  SINGLETON_ALREADY_EXISTS: 409,
+  UNAUTHORIZED: 401,
+  TOKEN_EXPIRED: 401,
+  TOKEN_INVALID: 401,
+  INSUFFICIENT_PERMISSION: 403,
+  INSUFFICIENT_PRIVILEGE: 403,
+  INVALID_FILTER_FIELD: 400,
+  INVALID_FILTER_OPERATOR: 400,
+  INVALID_SORT_FIELD: 400,
+  INVALID_PAGINATION: 400,
+  INVALID_INCLUDE_FIELD: 400,
+  UNSUPPORTED_MIME_TYPE: 415,
+  STORAGE_ERROR: 502,
+  MEDIA_IN_USE: 409,
+  PRESIGNED_URL_EXPIRED: 410,
+  RATE_LIMITED: 429,
+  INTERNAL_ERROR: 500
+};
+var errorHandler = (err, c) => {
+  console.error(err.stack ?? err.message);
+  const apiErr = err;
+  const code = apiErr.code ?? "INTERNAL_ERROR";
+  const status = ERROR_STATUS_MAP[code] ?? 500;
+  return c.json({ ok: false, error: { code, message: err.message } }, status);
+};
+
+// src/middleware/auth.ts
+import { getCookie } from "hono/cookie";
+import { sql } from "drizzle-orm";
+
+// src/auth/jwt.ts
+import { sign, verify as jwtVerify } from "hono/jwt";
+import { setCookie, deleteCookie } from "hono/cookie";
+var AUTH_TOKEN_TTL = 2 * 60 * 60;
+var REFRESH_TOKEN_TTL = 7 * 24 * 60 * 60;
+var PROACTIVE_REFRESH_THRESHOLD = 30 * 60;
+async function signToken(payload, expiresInSeconds) {
+  const secret = process.env["AUTH_SECRET"];
+  if (!secret) throw new Error("AUTH_SECRET environment variable is not set");
+  const fullPayload = {
+    ...payload,
+    expires_at: Math.floor(Date.now() / 1e3) + expiresInSeconds
+  };
+  return sign(fullPayload, secret);
+}
+async function verifyToken(token) {
+  const secret = process.env["AUTH_SECRET"];
+  if (!secret) throw new Error("AUTH_SECRET environment variable is not set");
+  let raw;
+  try {
+    raw = await jwtVerify(token, secret, "HS256");
+  } catch {
+    throw Object.assign(new Error("Token signature is invalid"), {
+      code: "TOKEN_INVALID"
+    });
+  }
+  const payload = raw;
+  if (payload.expires_at < Math.floor(Date.now() / 1e3)) {
+    throw Object.assign(new Error("Token has expired"), {
+      code: "TOKEN_EXPIRED"
+    });
+  }
+  return payload;
+}
+function setAuthCookie(c, name, token, options) {
+  setCookie(c, name, token, {
+    ...options,
+    httpOnly: true,
+    secure: true,
+    sameSite: "Strict"
+  });
+}
+function clearAuthCookie(c, name, path) {
+  deleteCookie(c, name, path !== void 0 ? { path } : void 0);
+}
+
+// src/middleware/auth.ts
+function createAuthMiddleware(db) {
+  return async (c, next) => {
+    const token = getCookie(c, "auth_token");
+    if (!token) {
+      return c.json(
+        { ok: false, error: { code: "UNAUTHORIZED", message: "Authentication required" } },
+        401
+      );
+    }
+    let payload;
+    try {
+      payload = await verifyToken(token);
+    } catch (err) {
+      const code = err.code;
+      if (code === "TOKEN_EXPIRED") {
+        return c.json(
+          { ok: false, error: { code: "TOKEN_EXPIRED", message: "Token has expired" } },
+          401
+        );
+      }
+      return c.json(
+        { ok: false, error: { code: "TOKEN_INVALID", message: "Token signature is invalid" } },
+        401
+      );
+    }
+    const result = await db.execute(
+      sql`SELECT token_version, must_change_password FROM users WHERE id = ${payload.user_id} LIMIT 1`
+    );
+    const row = result.rows[0];
+    if (!row) {
+      return c.json(
+        { ok: false, error: { code: "TOKEN_INVALID", message: "Token signature is invalid" } },
+        401
+      );
+    }
+    if (payload.token_version !== row.token_version) {
+      return c.json(
+        { ok: false, error: { code: "TOKEN_INVALID", message: "Token has been invalidated" } },
+        401
+      );
+    }
+    c.set("user", {
+      id: payload.user_id,
+      role: payload.role,
+      must_change_password: row.must_change_password
+    });
+    const now = Math.floor(Date.now() / 1e3);
+    if (payload.expires_at < now + PROACTIVE_REFRESH_THRESHOLD) {
+      const newToken = await signToken(
+        {
+          user_id: payload.user_id,
+          role: payload.role,
+          token_version: payload.token_version
+        },
+        AUTH_TOKEN_TTL
+      );
+      setAuthCookie(c, "auth_token", newToken, {});
+    }
+    await next();
+  };
+}
+
+// src/middleware/must-change-password.ts
+var mustChangePasswordCheck = async (c, next) => {
+  const user = c.get("user");
+  if (user?.must_change_password === true && c.req.path !== "/admin/api/users/change-password") {
+    return c.json(
+      {
+        ok: false,
+        error: {
+          code: "PASSWORD_CHANGE_REQUIRED",
+          message: "You must change your password before continuing."
+        }
+      },
+      403
+    );
+  }
+  await next();
+};
+
+// src/middleware/permission.ts
+function createPermissionMiddleware(registry) {
+  return function requirePermission(permission) {
+    return async (c, next) => {
+      const user = c.get("user");
+      const role = user ? registry[user.role] : void 0;
+      if (!role || !role.permissions.includes(permission)) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INSUFFICIENT_PERMISSION", message: "Insufficient permission" }
+          },
+          403
+        );
+      }
+      await next();
+    };
+  };
+}
+
+// src/middleware/hierarchy.ts
+function createHierarchyMiddleware(registry, getUserRole) {
+  return function requireHierarchy() {
+    return async (c, next) => {
+      const user = c.get("user");
+      const actingRole = user ? registry[user.role] : void 0;
+      if (!actingRole) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INSUFFICIENT_PRIVILEGE", message: "Insufficient privilege" }
+          },
+          403
+        );
+      }
+      const method = c.req.method;
+      const targetId = c.req.param("id");
+      let targetRoleName = null;
+      if (method === "POST" && !targetId) {
+        let body = {};
+        try {
+          body = await c.req.json();
+        } catch {
+        }
+        targetRoleName = typeof body.role === "string" ? body.role : null;
+        if (!targetRoleName) {
+          return c.json(
+            {
+              ok: false,
+              error: { code: "INVALID_ROLE", message: "Request body must include a valid role" }
+            },
+            400
+          );
+        }
+      } else if (method === "PATCH" && targetId) {
+        let bodyRole;
+        try {
+          const body = await c.req.json();
+          if (typeof body.role === "string") bodyRole = body.role;
+        } catch {
+        }
+        targetRoleName = bodyRole ?? await getUserRole(targetId);
+      } else if (targetId) {
+        targetRoleName = await getUserRole(targetId);
+      }
+      if (targetRoleName === null) {
+        return next();
+      }
+      const targetRole = registry[targetRoleName];
+      if (!targetRole) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INVALID_ROLE", message: `Role "${targetRoleName}" is not valid` }
+          },
+          400
+        );
+      }
+      if (actingRole.hierarchy_level >= targetRole.hierarchy_level) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INSUFFICIENT_PRIVILEGE", message: "Insufficient privilege" }
+          },
+          403
+        );
+      }
+      await next();
+    };
+  };
+}
+
+// src/middleware/rate-limit.ts
+var DEFAULT_WINDOW_MS = 6e4;
+var DEFAULT_MAX_PER_IP = 30;
+var DEFAULT_MAX_GLOBAL = 500;
+function createRateLimitMiddleware(options) {
+  const { windowMs, maxPerIp, maxGlobal } = options;
+  const ipRequests = /* @__PURE__ */ new Map();
+  const globalRequests = [];
+  return async function rateLimitMiddleware(c, next) {
+    const authToken = c.req.raw.headers.get("cookie")?.split(";").map((s) => s.trim()).find((s) => s.startsWith("auth_token="));
+    if (authToken) {
+      return next();
+    }
+    const now = Date.now();
+    const cutoff = now - windowMs;
+    let gi = 0;
+    while (gi < globalRequests.length && globalRequests[gi] < cutoff) gi++;
+    globalRequests.splice(0, gi);
+    const forwarded = c.req.header("x-forwarded-for");
+    const ip = forwarded ? forwarded.split(",")[0].trim() : c.env?.incoming?.socket?.remoteAddress ?? "unknown";
+    const ipTimes = ipRequests.get(ip) ?? [];
+    let ii = 0;
+    while (ii < ipTimes.length && ipTimes[ii] < cutoff) ii++;
+    ipTimes.splice(0, ii);
+    ipRequests.set(ip, ipTimes);
+    const retryAfterFromGlobal = globalRequests.length > 0 ? Math.ceil((globalRequests[0] + windowMs - now) / 1e3) : 0;
+    const retryAfterFromIp = ipTimes.length > 0 ? Math.ceil((ipTimes[0] + windowMs - now) / 1e3) : 0;
+    if (globalRequests.length >= maxGlobal) {
+      const retryAfter = Math.max(retryAfterFromGlobal, 1);
+      const reset = Math.floor((now + retryAfter * 1e3) / 1e3);
+      return c.json(
+        { ok: false, error: { code: "RATE_LIMITED", message: `Too many requests. Please retry after ${retryAfter} seconds.` } },
+        429,
+        {
+          "Retry-After": String(retryAfter),
+          "X-RateLimit-Limit": String(maxGlobal),
+          "X-RateLimit-Remaining": "0",
+          "X-RateLimit-Reset": String(reset)
+        }
+      );
+    }
+    if (ipTimes.length >= maxPerIp) {
+      const retryAfter = Math.max(retryAfterFromIp, 1);
+      const reset = Math.floor((now + retryAfter * 1e3) / 1e3);
+      return c.json(
+        { ok: false, error: { code: "RATE_LIMITED", message: `Too many requests. Please retry after ${retryAfter} seconds.` } },
+        429,
+        {
+          "Retry-After": String(retryAfter),
+          "X-RateLimit-Limit": String(maxPerIp),
+          "X-RateLimit-Remaining": "0",
+          "X-RateLimit-Reset": String(reset)
+        }
+      );
+    }
+    globalRequests.push(now);
+    ipTimes.push(now);
+    return next();
+  };
+}
+function resolveListRateLimit(rateLimit) {
+  const findAll = rateLimit?.findAll;
+  if (findAll === "*") {
+    return void 0;
+  }
+  return createRateLimitMiddleware({
+    windowMs: findAll?.windowMs ?? DEFAULT_WINDOW_MS,
+    maxPerIp: findAll?.maxPerIp ?? DEFAULT_MAX_PER_IP,
+    maxGlobal: findAll?.maxGlobal ?? DEFAULT_MAX_GLOBAL
+  });
+}
+
+// src/auth/registry.ts
+var SYSTEM_ROLES = ["admin", "manager", "editor", "writer", "viewer"];
+function validateRoles(roles) {
+  if (roles.length === 0) {
+    throw new Error(
+      "Fatal: roles registry failed to build \u2014 roles array is empty. Run `manguito validate` to check your roles schema."
+    );
+  }
+  const nameSet = new Set(roles.map((r) => r.name));
+  for (const systemRole of SYSTEM_ROLES) {
+    if (!nameSet.has(systemRole)) {
+      throw new Error(
+        `Fatal: roles registry failed to build \u2014 missing system role "${systemRole}". Run \`manguito validate\` to check your roles schema.`
+      );
+    }
+  }
+  const levelsSeen = /* @__PURE__ */ new Map();
+  for (const role of roles) {
+    const existing = levelsSeen.get(role.hierarchy_level);
+    if (existing !== void 0) {
+      throw new Error(
+        `Fatal: roles registry failed to build \u2014 duplicate hierarchy_level ${role.hierarchy_level} on roles "${existing}" and "${role.name}". Run \`manguito validate\` to check your roles schema.`
+      );
+    }
+    levelsSeen.set(role.hierarchy_level, role.name);
+  }
+  const namesSeen = /* @__PURE__ */ new Set();
+  for (const role of roles) {
+    if (namesSeen.has(role.name)) {
+      throw new Error(
+        `Fatal: roles registry failed to build \u2014 duplicate role name "${role.name}". Run \`manguito validate\` to check your roles schema.`
+      );
+    }
+    namesSeen.add(role.name);
+  }
+}
+function buildRolesRegistry(roles) {
+  validateRoles(roles);
+  return Object.fromEntries(roles.map((r) => [r.name, r]));
+}
+
+// src/routes/query-params.ts
+var SORTABLE_FIELDS = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
+var RELATION_FIELD_TYPES = /* @__PURE__ */ new Set([
+  "paragraph",
+  "reference",
+  "image",
+  "video",
+  "file"
+]);
+function parsePagination(pageStr, perPageStr) {
+  const page = pageStr !== void 0 ? Number(pageStr) : 1;
+  const per_page = perPageStr !== void 0 ? Number(perPageStr) : 10;
+  if (!Number.isInteger(page) || page < 1) return { ok: false };
+  if (!Number.isInteger(per_page) || per_page < 1 || per_page > 100) return { ok: false };
+  return { ok: true, page, per_page };
+}
+function parseInclude(includeParam) {
+  if (!includeParam) return [];
+  return includeParam.split(",").map((s) => s.trim()).filter(Boolean);
+}
+function parseFilters(url, validFields) {
+  const { searchParams } = new URL(url);
+  const filters = {};
+  for (const [key, value] of searchParams.entries()) {
+    const simpleMatch = /^filter\[([^\]]+)\]$/.exec(key);
+    const opMatch = /^filter\[([^\]]+)\]\[([^\]]+)\]$/.exec(key);
+    if (simpleMatch) {
+      const field = simpleMatch[1];
+      if (!validFields.has(field)) return { ok: false, invalidField: field };
+      const existing = filters[field];
+      if (existing !== void 0) {
+        filters[field] = Array.isArray(existing) ? [...existing, value] : [existing, value];
+      } else {
+        filters[field] = value;
+      }
+    } else if (opMatch) {
+      const field = opMatch[1];
+      const operator = opMatch[2];
+      if (!validFields.has(field)) return { ok: false, invalidField: field };
+      if (!["gt", "gte", "lt", "lte"].includes(operator)) continue;
+      const existing = filters[field] ?? {};
+      filters[field] = { ...existing, [operator]: value };
+    }
+  }
+  return { ok: true, filters };
+}
+
+// src/routes/content.ts
+function isPublished(item) {
+  return item["published"] === true;
+}
+function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
+  function registerListRoute(path, handler) {
+    if (listRateLimit) {
+      app.get(path, listRateLimit, handler);
+    } else {
+      app.get(path, handler);
+    }
+  }
+  registerListRoute("/api/content", (c) => {
+    const data = Object.values(registry.content_types).map((ct) => ({
+      name: ct.name,
+      label: ct.label,
+      only_one: ct.only_one
+    }));
+    return c.json({ ok: true, data });
+  });
+  registerListRoute("/api/taxonomy", (c) => {
+    const data = Object.values(registry.taxonomy_types).map((tt) => ({
+      name: tt.name,
+      label: tt.label
+    }));
+    return c.json({ ok: true, data });
+  });
+  for (const [typeName, contentType] of Object.entries(registry.content_types)) {
+    const basePath = contentType.default_base_path;
+    const repo = repos[typeName];
+    if (!repo) continue;
+    const schemaFieldNames = /* @__PURE__ */ new Set([
+      ...contentType.fields.map((f) => f.name),
+      ...contentType.system_fields.map((f) => f.name)
+    ]);
+    const relationFieldNames = new Set(
+      contentType.fields.filter((f) => RELATION_FIELD_TYPES.has(f.field_type)).map((f) => f.name)
+    );
+    if (contentType.only_one) {
+      app.get(`/api/${basePath}`, async (c) => {
+        const result = await repo.findMany({ published_only: true, page: 1, per_page: 1 });
+        if (result.data.length === 0) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Not found" } },
+            404
+          );
+        }
+        return c.json({ ok: true, data: result.data[0] });
+      });
+    } else {
+      registerListRoute(`/api/${basePath}`, async (c) => {
+        const pagination = parsePagination(c.req.query("page"), c.req.query("per_page"));
+        if (!pagination.ok) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "INVALID_PAGINATION",
+                message: "page must be \u2265 1 and per_page must be between 1 and 100"
+              }
+            },
+            400
+          );
+        }
+        const sortBy = c.req.query("sort_by") ?? "created_at";
+        if (!SORTABLE_FIELDS.has(sortBy)) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "INVALID_SORT_FIELD",
+                message: `'${sortBy}' is not sortable. Allowed: title, created_at, updated_at`
+              }
+            },
+            400
+          );
+        }
+        const sortOrder = c.req.query("sort_order") ?? "asc";
+        if (sortOrder !== "asc" && sortOrder !== "desc") {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "INVALID_SORT_FIELD",
+                message: `sort_order must be 'asc' or 'desc'`
+              }
+            },
+            400
+          );
+        }
+        const filtersResult = parseFilters(c.req.url, schemaFieldNames);
+        if (!filtersResult.ok) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "INVALID_FILTER_FIELD",
+                message: `Filter field '${filtersResult.invalidField}' does not exist on this content type`
+              }
+            },
+            400
+          );
+        }
+        const include = parseInclude(c.req.query("include"));
+        for (const field of include) {
+          if (!relationFieldNames.has(field)) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "INVALID_INCLUDE_FIELD",
+                  message: `'${field}' is not a valid relation field`
+                }
+              },
+              400
+            );
+          }
+        }
+        const result = await repo.findMany({
+          published_only: true,
+          page: pagination.page,
+          per_page: pagination.per_page,
+          sort_by: sortBy,
+          sort_order: sortOrder,
+          filters: filtersResult.filters,
+          include
+        });
+        return c.json(result);
+      });
+      app.get(`/api/${basePath}/:slug`, async (c) => {
+        const slug = c.req.param("slug");
+        const include = parseInclude(c.req.query("include"));
+        for (const field of include) {
+          if (!relationFieldNames.has(field)) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "INVALID_INCLUDE_FIELD",
+                  message: `'${field}' is not a valid relation field`
+                }
+              },
+              400
+            );
+          }
+        }
+        const item = await repo.findBySlug(slug, include);
+        if (!item || !isPublished(item)) {
+          return c.json(
+            {
+              ok: false,
+              error: { code: "SLUG_NOT_FOUND", message: `No item found with slug '${slug}'` }
+            },
+            404
+          );
+        }
+        return c.json({ ok: true, data: item });
+      });
+    }
+  }
+  for (const [typeName] of Object.entries(registry.taxonomy_types)) {
+    const repo = repos[typeName];
+    if (!repo) continue;
+    registerListRoute(`/api/taxonomy/${typeName}`, async (c) => {
+      const pagination = parsePagination(c.req.query("page"), c.req.query("per_page"));
+      if (!pagination.ok) {
+        return c.json(
+          {
+            ok: false,
+            error: {
+              code: "INVALID_PAGINATION",
+              message: "page must be \u2265 1 and per_page must be between 1 and 100"
+            }
+          },
+          400
+        );
+      }
+      const result = await repo.findMany({
+        published_only: true,
+        page: pagination.page,
+        per_page: pagination.per_page
+      });
+      return c.json(result);
+    });
+    app.get(`/api/taxonomy/${typeName}/:id`, async (c) => {
+      const id = c.req.param("id");
+      const item = await repo.findOne(id);
+      if (!item || !isPublished(item)) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "NOT_FOUND", message: "Taxonomy term not found" }
+          },
+          404
+        );
+      }
+      return c.json({ ok: true, data: item });
+    });
+  }
+}
+
+// src/routes/media.ts
+var VALID_MEDIA_TYPES = /* @__PURE__ */ new Set(["image", "video", "file"]);
+function parsePagination2(pageStr, perPageStr) {
+  const page = pageStr !== void 0 ? Number(pageStr) : 1;
+  const per_page = perPageStr !== void 0 ? Number(perPageStr) : 10;
+  if (!Number.isInteger(page) || page < 1) return { ok: false };
+  if (!Number.isInteger(per_page) || per_page < 1 || per_page > 100) return { ok: false };
+  return { ok: true, page, per_page };
+}
+function registerPublicMediaRoutes(app, mediaRepo, listRateLimit) {
+  const mediaListHandler = async (c) => {
+    const pagination = parsePagination2(c.req.query("page"), c.req.query("per_page"));
+    if (!pagination.ok) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "INVALID_PAGINATION",
+            message: "page must be \u2265 1 and per_page must be between 1 and 100"
+          }
+        },
+        400
+      );
+    }
+    const typeParam = c.req.query("type");
+    if (typeParam !== void 0 && !VALID_MEDIA_TYPES.has(typeParam)) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "VALIDATION_ERROR",
+            message: `type must be one of: image, video, file`
+          }
+        },
+        422
+      );
+    }
+    const opts = {
+      page: pagination.page,
+      per_page: pagination.per_page
+    };
+    if (typeParam !== void 0) {
+      opts.type = typeParam;
+    }
+    const result = await mediaRepo.findMany(opts);
+    return c.json(result);
+  };
+  if (listRateLimit) {
+    app.get("/api/media", listRateLimit, mediaListHandler);
+  } else {
+    app.get("/api/media", mediaListHandler);
+  }
+  app.get("/api/media/:id", async (c) => {
+    const id = c.req.param("id");
+    const item = await mediaRepo.findOne(id);
+    if (!item) {
+      return c.json(
+        { ok: false, error: { code: "NOT_FOUND", message: "Media item not found" } },
+        404
+      );
+    }
+    return c.json({ ok: true, data: item });
+  });
+}
+
+// src/routes/admin/content.ts
+import { sql as sql3 } from "drizzle-orm";
+
+// src/media-references.ts
+function extractMediaId(value) {
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function topLevelMediaDelta(mediaFields, before, after) {
+  const added = [];
+  const removed = [];
+  for (const f of mediaFields) {
+    if (after !== null && !(f.name in after)) continue;
+    const oldId = before ? extractMediaId(before[f.name]) : null;
+    const newId = after ? extractMediaId(after[f.name]) : null;
+    if (newId === oldId) continue;
+    if (oldId) removed.push(oldId);
+    if (newId) added.push(newId);
+  }
+  return { added, removed };
+}
+function mergeMediaDeltas(...deltas) {
+  return {
+    added: deltas.flatMap((d) => d.added),
+    removed: deltas.flatMap((d) => d.removed)
+  };
+}
+async function applyMediaReferenceDelta(delta, mediaRepo) {
+  const added = new Set(delta.added);
+  const removed = new Set(delta.removed);
+  const netAdd = [...added].filter((id) => !removed.has(id));
+  const netRemove = [...removed].filter((id) => !added.has(id));
+  if (netAdd.length > 0) await mediaRepo.incrementReferenceCount(netAdd);
+  if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
+}
+
+// src/relations.ts
+import crypto from "crypto";
+import { sql as sql2 } from "drizzle-orm";
+function quoteIdent(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+function paragraphMediaFieldNames(pType) {
+  return new Set(
+    pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name)
+  );
+}
+async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
+  const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
+  if (mediaColumns.length === 0) return [];
+  const tbl = sql2.raw(quoteIdent(pType.db.table_name));
+  const cols = sql2.join(mediaColumns.map((c) => sql2.raw(quoteIdent(c))), sql2`, `);
+  const result = await db.execute(
+    sql2`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
+  );
+  const ids = [];
+  for (const row of result.rows) {
+    for (const col of mediaColumns) {
+      const v = row[col];
+      if (typeof v === "string" && v !== "") ids.push(v);
+    }
+  }
+  return ids;
+}
+async function persistParagraphField(db, itemId, parentType, fieldName, pType, items) {
+  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
+  const tbl = sql2.raw(quoteIdent(pType.db.table_name));
+  await db.execute(sql2`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  const mediaFieldNames = paragraphMediaFieldNames(pType);
+  const added = [];
+  for (let i = 0; i < items.length; i++) {
+    const pItem = items[i];
+    const data = {
+      id: crypto.randomUUID(),
+      parent_id: itemId,
+      parent_type: parentType,
+      parent_field: fieldName,
+      order: i,
+      created_at: /* @__PURE__ */ new Date(),
+      updated_at: /* @__PURE__ */ new Date()
+    };
+    for (const pf of pType.fields) {
+      if (!pf.db_column || pf.db_column.junction) continue;
+      data[pf.db_column.column_name] = pItem[pf.name] ?? null;
+    }
+    const cols = sql2.join(Object.keys(data).map((k) => sql2.raw(quoteIdent(k))), sql2`, `);
+    const vals = sql2.join(Object.values(data).map((v) => sql2`${v}`), sql2`, `);
+    await db.execute(sql2`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
+    for (const name of mediaFieldNames) {
+      const val = pItem[name];
+      if (typeof val === "string" && val !== "") added.push(val);
+    }
+  }
+  return { added, removed };
+}
+async function deleteParagraphField(db, itemId, fieldName, pType) {
+  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
+  const tbl = sql2.raw(quoteIdent(pType.db.table_name));
+  await db.execute(sql2`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  return { added: [], removed };
+}
+async function persistJunctionField(db, itemId, junction, relatedIds) {
+  const tbl = sql2.raw(quoteIdent(junction.table_name));
+  const left = sql2.raw(quoteIdent(junction.left_column));
+  const right = sql2.raw(quoteIdent(junction.right_column));
+  await db.execute(sql2`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
+  for (const rid of relatedIds) {
+    await db.execute(sql2`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
+  }
+}
+function buildRelationsMap(fields, registry) {
+  const relations = {};
+  for (const field of fields) {
+    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
+      if (!field.db_column) continue;
+      relations[field.name] = { type: "media", fk_column: field.db_column.column_name };
+    } else if (field.field_type === "paragraph") {
+      const ref = field.ui_component.ref;
+      const pType = ref ? registry.paragraph_types[ref] : void 0;
+      if (!pType) continue;
+      relations[field.name] = { type: "paragraph", table: pType.db.table_name };
+    } else if (field.field_type === "reference") {
+      if (!field.db_column) continue;
+      if (field.db_column.junction) {
+        const j = field.db_column.junction;
+        relations[field.name] = {
+          type: "junction",
+          table: j.right_table,
+          junction_table: j.table_name,
+          left_column: j.left_column,
+          right_column: j.right_column,
+          order_column: j.order_column
+        };
+      } else if (field.db_column.foreign_key) {
+        relations[field.name] = {
+          type: "reference",
+          table: field.db_column.foreign_key.table,
+          fk_column: field.db_column.column_name
+        };
+      }
+    }
+  }
+  return relations;
+}
+function groupBy(items, key) {
+  const result = {};
+  for (const item of items) {
+    const k = String(item[key]);
+    if (!result[k]) result[k] = [];
+    result[k].push(item);
+  }
+  return result;
+}
+async function resolveRelationField(db, rows, fieldName, rel, cache) {
+  if (rows.length === 0) return;
+  if (rel.type === "paragraph") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
+    const result = await db.execute(
+      sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
+    );
+    const byParent = groupBy(result.rows, "parent_id");
+    for (const row of rows) {
+      row[fieldName] = byParent[row["id"]] ?? [];
+    }
+  } else if (rel.type === "reference") {
+    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
+    if (fkValues.length === 0) {
+      for (const row of rows) row[fieldName] = null;
+      return;
+    }
+    const unique = [...new Set(fkValues)];
+    const uncached = unique.filter((id) => !cache.has(`${rel.table}:${id}`));
+    if (uncached.length > 0) {
+      const inList = sql2.join(uncached.map((id) => sql2`${id}`), sql2`, `);
+      const result = await db.execute(
+        sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.table))} WHERE id IN (${inList})`
+      );
+      for (const item of result.rows) {
+        cache.set(`${rel.table}:${item["id"]}`, item);
+      }
+    }
+    for (const row of rows) {
+      const fkVal = row[rel.fk_column];
+      row[fieldName] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
+    }
+  } else if (rel.type === "junction") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
+    const orderBy = rel.order_column ? sql2` ORDER BY "order" ASC` : sql2``;
+    const junctionResult = await db.execute(
+      sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.junction_table))} WHERE ${sql2.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
+    );
+    const jRows = junctionResult.rows;
+    const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
+    const uncached = rightIds.filter((id) => !cache.has(`${rel.table}:${id}`));
+    if (uncached.length > 0) {
+      const rightInList = sql2.join(uncached.map((id) => sql2`${id}`), sql2`, `);
+      const entitiesResult = await db.execute(
+        sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})`
+      );
+      for (const item of entitiesResult.rows) {
+        cache.set(`${rel.table}:${item["id"]}`, item);
+      }
+    }
+    const byLeft = groupBy(jRows, rel.left_column);
+    for (const row of rows) {
+      const jEntries = byLeft[row["id"]] ?? [];
+      row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
+    }
+  } else if (rel.type === "media") {
+    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
+    if (fkValues.length === 0) {
+      for (const row of rows) row[fieldName] = null;
+      return;
+    }
+    const unique = [...new Set(fkValues)];
+    const uncached = unique.filter((id) => !cache.has(`media:${id}`));
+    if (uncached.length > 0) {
+      const inList = sql2.join(uncached.map((id) => sql2`${id}`), sql2`, `);
+      const result = await db.execute(sql2`SELECT * FROM "media" WHERE id IN (${inList})`);
+      for (const item of result.rows) {
+        cache.set(`media:${item["id"]}`, item);
+      }
+    }
+    for (const row of rows) {
+      const fkVal = row[rel.fk_column];
+      row[fieldName] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
+    }
+  }
+}
+async function resolveRelationBareIds(db, rows, fieldName, rel) {
+  if (rows.length === 0) return;
+  if (rel.type === "paragraph") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
+    const result = await db.execute(
+      sql2`SELECT id, parent_id FROM ${sql2.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
+    );
+    const byParent = groupBy(result.rows, "parent_id");
+    for (const row of rows) {
+      row[fieldName] = (byParent[row["id"]] ?? []).map((r) => r["id"]);
+    }
+  } else if (rel.type === "junction") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
+    const result = await db.execute(
+      sql2`SELECT ${sql2.raw(quoteIdent(rel.left_column))} AS left_id, ${sql2.raw(quoteIdent(rel.right_column))} AS right_id FROM ${sql2.raw(quoteIdent(rel.junction_table))} WHERE ${sql2.raw(quoteIdent(rel.left_column))} IN (${inList})`
+    );
+    const byLeft = groupBy(result.rows, "left_id");
+    for (const row of rows) {
+      row[fieldName] = (byLeft[row["id"]] ?? []).map((r) => r["right_id"]);
+    }
+  }
+}
+
+// src/routes/admin/content.ts
+function quoteIdent2(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+async function lookupBasePathId(db, pathOrName) {
+  const r = await db.execute(
+    sql3`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
+  );
+  return r.rows[0]?.id ?? null;
+}
+var SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isEmpty(value) {
+  if (value === null || value === void 0) return true;
+  if (typeof value === "string" && value.trim() === "") return true;
+  if (Array.isArray(value) && value.length === 0) return true;
+  return false;
+}
+function checkRequiredFields(fields, data) {
+  return fields.filter((f) => f.required && isEmpty(data[f.name])).map((f) => ({ field: f.name, message: `${f.label} is required` }));
+}
+function parseListQuery(url, schemaFieldNames, relationFieldNames) {
+  const searchParams = new URL(url).searchParams;
+  const pagination = parsePagination(
+    searchParams.get("page") ?? void 0,
+    searchParams.get("per_page") ?? void 0
+  );
+  if (!pagination.ok) {
+    return {
+      ok: false,
+      response: {
+        code: "INVALID_PAGINATION",
+        message: "page must be \u2265 1 and per_page must be between 1 and 100"
+      },
+      status: 400
+    };
+  }
+  const sortBy = searchParams.get("sort_by") ?? "created_at";
+  if (!SORTABLE_FIELDS.has(sortBy)) {
+    return {
+      ok: false,
+      response: {
+        code: "INVALID_SORT_FIELD",
+        message: `'${sortBy}' is not sortable. Allowed: title, created_at, updated_at`
+      },
+      status: 400
+    };
+  }
+  const sortOrder = searchParams.get("sort_order") ?? "asc";
+  if (sortOrder !== "asc" && sortOrder !== "desc") {
+    return {
+      ok: false,
+      response: { code: "INVALID_SORT_FIELD", message: `sort_order must be 'asc' or 'desc'` },
+      status: 400
+    };
+  }
+  const filtersResult = parseFilters(url, schemaFieldNames);
+  if (!filtersResult.ok) {
+    return {
+      ok: false,
+      response: {
+        code: "INVALID_FILTER_FIELD",
+        message: `Filter field '${filtersResult.invalidField}' does not exist on this schema`
+      },
+      status: 400
+    };
+  }
+  const include = parseInclude(searchParams.get("include") ?? void 0);
+  for (const field of include) {
+    if (!relationFieldNames.has(field)) {
+      return {
+        ok: false,
+        response: { code: "INVALID_INCLUDE_FIELD", message: `'${field}' is not a valid relation field` },
+        status: 400
+      };
+    }
+  }
+  const search = (searchParams.get("search") ?? "").trim();
+  return {
+    ok: true,
+    pagination,
+    sortBy,
+    sortOrder,
+    filters: filtersResult.filters,
+    include,
+    search
+  };
+}
+function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePermission, db) {
+  for (const [typeName, contentType] of Object.entries(registry.content_types)) {
+    const basePath = `content/${typeName}`;
+    const repo = repos[typeName];
+    if (!repo) continue;
+    const schemaFieldNames = /* @__PURE__ */ new Set([
+      ...contentType.fields.map((f) => f.name),
+      ...contentType.system_fields.map((f) => f.name)
+    ]);
+    const relationFieldNames = new Set(
+      contentType.fields.filter((f) => RELATION_FIELD_TYPES.has(f.field_type)).map((f) => f.name)
+    );
+    const requiredFields = contentType.fields.filter((f) => f.required);
+    const mediaFields = contentType.fields.filter(
+      (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
+    );
+    const paragraphFieldDefs = contentType.fields.filter((f) => f.db_column === null);
+    const searchableColumns = [
+      ...contentType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
+      ...contentType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
+    ];
+    app.get(
+      `/admin/api/${basePath}`,
+      requirePermission("content:read"),
+      async (c) => {
+        const parsed = parseListQuery(c.req.url, schemaFieldNames, relationFieldNames);
+        if (!parsed.ok) {
+          return c.json({ ok: false, error: parsed.response }, parsed.status);
+        }
+        const publishedParam = c.req.query("published");
+        const extraFilters = {};
+        if (publishedParam === "false") extraFilters["published"] = false;
+        const findOpts = {
+          page: parsed.pagination.page,
+          per_page: parsed.pagination.per_page,
+          sort_by: parsed.sortBy,
+          sort_order: parsed.sortOrder,
+          filters: { ...parsed.filters, ...extraFilters },
+          include: parsed.include
+        };
+        if (publishedParam === "true") findOpts.published_only = true;
+        if (parsed.search !== "" && searchableColumns.length > 0) {
+          findOpts.search = { term: parsed.search, columns: searchableColumns };
+        }
+        const result = await repo.findMany(findOpts);
+        return c.json(result);
+      }
+    );
+    app.get(
+      `/admin/api/${basePath}/:id`,
+      requirePermission("content:read"),
+      async (c) => {
+        const id = c.req.param("id");
+        const item = await repo.findOne(id);
+        if (!item) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Not found" } },
+            404
+          );
+        }
+        if (db) {
+          const row = item;
+          for (const f of contentType.fields) {
+            if (f.db_column === null) {
+              const comp = f.ui_component;
+              if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+              const pType = registry.paragraph_types[comp.ref];
+              if (!pType) continue;
+              const r = await db.execute(
+                sql3`SELECT * FROM ${sql3.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${id} AND parent_field = ${f.name} ORDER BY "order" ASC`
+              );
+              row[f.name] = r.rows;
+            } else if (f.db_column.junction) {
+              const j = f.db_column.junction;
+              const r = await db.execute(
+                sql3`SELECT ${sql3.raw(quoteIdent2(j.right_column))} FROM ${sql3.raw(quoteIdent2(j.table_name))} WHERE ${sql3.raw(quoteIdent2(j.left_column))} = ${id}`
+              );
+              row[f.name] = r.rows.map(
+                (row2) => row2[j.right_column]
+              );
+            }
+          }
+        }
+        return c.json({ ok: true, data: item });
+      }
+    );
+    app.post(
+      `/admin/api/${basePath}`,
+      requirePermission("content:create"),
+      async (c) => {
+        const body = await c.req.json();
+        if (contentType.only_one) {
+          const existing = await repo.findMany({ page: 1, per_page: 1 });
+          if (existing.meta.total > 0) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "SINGLETON_ALREADY_EXISTS",
+                  message: `Only one instance of '${contentType.label}' is allowed`
+                }
+              },
+              409
+            );
+          }
+        } else {
+          const slug = body["slug"];
+          if (typeof slug !== "string" || slug.trim() === "") {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "VALIDATION_ERROR",
+                  message: "Required fields are missing",
+                  details: [{ field: "slug", message: "Slug is required" }]
+                }
+              },
+              422
+            );
+          }
+          if (!SLUG_PATTERN.test(slug)) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "INVALID_SLUG_FORMAT",
+                  message: "Slug must be lowercase alphanumeric with hyphens only \u2014 no leading or trailing hyphens"
+                }
+              },
+              422
+            );
+          }
+          const conflict = await repo.findBySlug(slug);
+          if (conflict) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "SLUG_CONFLICT",
+                  message: `Slug '${slug}' already exists for this content type`
+                }
+              },
+              409
+            );
+          }
+        }
+        const fieldErrors = checkRequiredFields(requiredFields, body);
+        if (fieldErrors.length > 0) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "VALIDATION_ERROR",
+                message: "Required fields are missing",
+                details: fieldErrors
+              }
+            },
+            422
+          );
+        }
+        if (body["published"] === true) {
+          const publishDeny = await requirePermission("content:edit")(c, async () => {
+          });
+          if (publishDeny) return publishDeny;
+        }
+        const paragraphFields = contentType.fields.filter((f) => f.db_column === null);
+        const junctionFields = contentType.fields.filter(
+          (f) => f.db_column !== null && f.db_column.junction !== void 0
+        );
+        const columnFields = contentType.fields.filter(
+          (f) => f.db_column !== null && f.db_column.junction === void 0
+        );
+        const columnData = {
+          published: body["published"] ?? false
+        };
+        if (contentType.only_one) {
+          columnData["slug"] = typeName;
+        } else {
+          columnData["slug"] = body["slug"];
+        }
+        for (const f of columnFields) {
+          const val = body[f.name];
+          columnData[f.db_column.column_name] = val !== void 0 ? val : null;
+        }
+        if (db) {
+          const basePathId = await lookupBasePathId(db, contentType.default_base_path);
+          if (!basePathId) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "BASE_PATH_NOT_FOUND",
+                  message: `Base path '${contentType.default_base_path}' not found \u2014 run manguito migrate`
+                }
+              },
+              500
+            );
+          }
+          columnData["base_path_id"] = basePathId;
+        }
+        const item = await repo.create(columnData);
+        const itemId = item["id"];
+        const mediaDeltas = [topLevelMediaDelta(mediaFields, null, body)];
+        if (db) {
+          for (const f of paragraphFields) {
+            const comp = f.ui_component;
+            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+            const pType = registry.paragraph_types[comp.ref];
+            if (!pType) continue;
+            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            mediaDeltas.push(await persistParagraphField(db, itemId, contentType.db.table_name, f.name, pType, items));
+          }
+          for (const f of junctionFields) {
+            const junction = f.db_column.junction;
+            const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
+            await persistJunctionField(db, itemId, junction, relatedIds);
+          }
+        }
+        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+        return c.json({ ok: true, data: item }, 201);
+      }
+    );
+    app.patch(
+      `/admin/api/${basePath}/:id`,
+      requirePermission("content:edit"),
+      async (c) => {
+        const id = c.req.param("id");
+        const body = await c.req.json();
+        const existing = await repo.findOne(id);
+        if (!existing) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Not found" } },
+            404
+          );
+        }
+        if (!contentType.only_one && "slug" in body) {
+          const slug = body["slug"];
+          if (typeof slug !== "string" || slug.trim() === "") {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "VALIDATION_ERROR",
+                  message: "Required fields are missing",
+                  details: [{ field: "slug", message: "Slug cannot be empty" }]
+                }
+              },
+              422
+            );
+          }
+          if (!SLUG_PATTERN.test(slug)) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "INVALID_SLUG_FORMAT",
+                  message: "Slug must be lowercase alphanumeric with hyphens only \u2014 no leading or trailing hyphens"
+                }
+              },
+              422
+            );
+          }
+          const conflict = await repo.findBySlug(slug);
+          if (conflict && conflict["id"] !== id) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "SLUG_CONFLICT",
+                  message: `Slug '${slug}' already exists for this content type`
+                }
+              },
+              409
+            );
+          }
+        }
+        if (body["published"] === true) {
+          const publishDeny = await requirePermission("content:edit")(c, async () => {
+          });
+          if (publishDeny) return publishDeny;
+          const merged = { ...existing, ...body };
+          const fieldErrors = checkRequiredFields(requiredFields, merged);
+          if (fieldErrors.length > 0) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "PUBLISH_VALIDATION_ERROR",
+                  message: "Cannot publish \u2014 required fields are missing",
+                  details: fieldErrors
+                }
+              },
+              422
+            );
+          }
+        }
+        const patchParagraphFields = contentType.fields.filter((f) => f.db_column === null);
+        const patchJunctionFields = contentType.fields.filter(
+          (f) => f.db_column !== null && f.db_column.junction !== void 0
+        );
+        const patchColumnFields = contentType.fields.filter(
+          (f) => f.db_column !== null && f.db_column.junction === void 0
+        );
+        const patchData = {};
+        if (!contentType.only_one && "slug" in body) patchData["slug"] = body["slug"];
+        if ("published" in body) patchData["published"] = body["published"];
+        for (const f of patchColumnFields) {
+          if (f.name in body) {
+            const val = body[f.name];
+            patchData[f.db_column.column_name] = val !== void 0 ? val : null;
+          }
+        }
+        const updated = await repo.update(id, patchData);
+        if (!updated) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Not found" } },
+            404
+          );
+        }
+        const mediaDeltas = [
+          topLevelMediaDelta(mediaFields, existing, body)
+        ];
+        if (db) {
+          for (const f of patchParagraphFields) {
+            const comp = f.ui_component;
+            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+            const pType = registry.paragraph_types[comp.ref];
+            if (!pType) continue;
+            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            mediaDeltas.push(await persistParagraphField(db, id, contentType.db.table_name, f.name, pType, items));
+          }
+          for (const f of patchJunctionFields) {
+            const junction = f.db_column.junction;
+            const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
+            await persistJunctionField(db, id, junction, relatedIds);
+          }
+        }
+        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+        return c.json({ ok: true, data: updated });
+      }
+    );
+    app.delete(
+      `/admin/api/${basePath}/:id`,
+      requirePermission("content:delete"),
+      async (c) => {
+        const id = c.req.param("id");
+        const item = await repo.findOne(id);
+        if (!item) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Not found" } },
+            404
+          );
+        }
+        const mediaDeltas = [
+          topLevelMediaDelta(mediaFields, item, null)
+        ];
+        if (db) {
+          for (const f of paragraphFieldDefs) {
+            const comp = f.ui_component;
+            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+            const pType = registry.paragraph_types[comp.ref];
+            if (!pType) continue;
+            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType));
+          }
+        }
+        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+        await repo.delete(id);
+        return c.json({ ok: true });
+      }
+    );
+  }
+  for (const [typeName, taxonomyType] of Object.entries(registry.taxonomy_types)) {
+    const repo = repos[typeName];
+    if (!repo) continue;
+    const schemaFieldNames = /* @__PURE__ */ new Set([
+      ...taxonomyType.fields.map((f) => f.name),
+      ...taxonomyType.system_fields.map((f) => f.name)
+    ]);
+    const relationFieldNames = new Set(
+      taxonomyType.fields.filter((f) => RELATION_FIELD_TYPES.has(f.field_type)).map((f) => f.name)
+    );
+    const requiredFields = taxonomyType.fields.filter((f) => f.required);
+    const mediaFields = taxonomyType.fields.filter(
+      (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
+    );
+    const paragraphFieldDefs = taxonomyType.fields.filter((f) => f.db_column === null);
+    const searchableColumns = [
+      ...taxonomyType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
+      ...taxonomyType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
+    ];
+    app.get(
+      `/admin/api/taxonomy/${typeName}`,
+      requirePermission("content:read"),
+      async (c) => {
+        const parsed = parseListQuery(c.req.url, schemaFieldNames, relationFieldNames);
+        if (!parsed.ok) {
+          return c.json({ ok: false, error: parsed.response }, parsed.status);
+        }
+        const publishedParam = c.req.query("published");
+        const extraFilters = {};
+        if (publishedParam === "false") extraFilters["published"] = false;
+        const findOpts = {
+          page: parsed.pagination.page,
+          per_page: parsed.pagination.per_page,
+          sort_by: parsed.sortBy,
+          sort_order: parsed.sortOrder,
+          filters: { ...parsed.filters, ...extraFilters },
+          include: parsed.include
+        };
+        if (publishedParam === "true") findOpts.published_only = true;
+        if (parsed.search !== "" && searchableColumns.length > 0) {
+          findOpts.search = { term: parsed.search, columns: searchableColumns };
+        }
+        const result = await repo.findMany(findOpts);
+        return c.json(result);
+      }
+    );
+    app.get(
+      `/admin/api/taxonomy/${typeName}/:id`,
+      requirePermission("content:read"),
+      async (c) => {
+        const id = c.req.param("id");
+        const item = await repo.findOne(id);
+        if (!item) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Taxonomy term not found" } },
+            404
+          );
+        }
+        return c.json({ ok: true, data: item });
+      }
+    );
+    app.post(
+      `/admin/api/taxonomy/${typeName}`,
+      requirePermission("content:create"),
+      async (c) => {
+        const body = await c.req.json();
+        const fieldErrors = checkRequiredFields(requiredFields, body);
+        if (fieldErrors.length > 0) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "VALIDATION_ERROR",
+                message: "Required fields are missing",
+                details: fieldErrors
+              }
+            },
+            422
+          );
+        }
+        if (body["published"] === true) {
+          const publishDeny = await requirePermission("content:edit")(c, async () => {
+          });
+          if (publishDeny) return publishDeny;
+        }
+        const taxColumnFields = taxonomyType.fields.filter(
+          (f) => f.db_column !== null && f.db_column.junction === void 0
+        );
+        const taxParagraphFields = taxonomyType.fields.filter((f) => f.db_column === null);
+        const taxColumnData = {
+          published: body["published"] ?? false
+        };
+        for (const f of taxColumnFields) {
+          const val = body[f.name];
+          taxColumnData[f.db_column.column_name] = val !== void 0 ? val : null;
+        }
+        const item = await repo.create(taxColumnData);
+        const taxItemId = item["id"];
+        const mediaDeltas = [topLevelMediaDelta(mediaFields, null, body)];
+        if (db) {
+          for (const f of taxParagraphFields) {
+            const comp = f.ui_component;
+            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+            const pType = registry.paragraph_types[comp.ref];
+            if (!pType) continue;
+            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            mediaDeltas.push(await persistParagraphField(db, taxItemId, taxonomyType.db.table_name, f.name, pType, items));
+          }
+        }
+        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+        return c.json({ ok: true, data: item }, 201);
+      }
+    );
+    app.patch(
+      `/admin/api/taxonomy/${typeName}/:id`,
+      requirePermission("content:edit"),
+      async (c) => {
+        const id = c.req.param("id");
+        const body = await c.req.json();
+        const existing = await repo.findOne(id);
+        if (!existing) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Taxonomy term not found" } },
+            404
+          );
+        }
+        if (body["published"] === true) {
+          const publishDeny = await requirePermission("content:edit")(c, async () => {
+          });
+          if (publishDeny) return publishDeny;
+          const merged = { ...existing, ...body };
+          const fieldErrors = checkRequiredFields(requiredFields, merged);
+          if (fieldErrors.length > 0) {
+            return c.json(
+              {
+                ok: false,
+                error: {
+                  code: "PUBLISH_VALIDATION_ERROR",
+                  message: "Cannot publish \u2014 required fields are missing",
+                  details: fieldErrors
+                }
+              },
+              422
+            );
+          }
+        }
+        const taxPatchColumnFields = taxonomyType.fields.filter(
+          (f) => f.db_column !== null && f.db_column.junction === void 0
+        );
+        const taxPatchParagraphFields = taxonomyType.fields.filter((f) => f.db_column === null);
+        const taxPatchData = {};
+        if ("published" in body) taxPatchData["published"] = body["published"];
+        for (const f of taxPatchColumnFields) {
+          if (f.name in body) {
+            const val = body[f.name];
+            taxPatchData[f.db_column.column_name] = val !== void 0 ? val : null;
+          }
+        }
+        const updated = await repo.update(id, taxPatchData);
+        if (!updated) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Taxonomy term not found" } },
+            404
+          );
+        }
+        const mediaDeltas = [
+          topLevelMediaDelta(mediaFields, existing, body)
+        ];
+        if (db) {
+          for (const f of taxPatchParagraphFields) {
+            const comp = f.ui_component;
+            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+            const pType = registry.paragraph_types[comp.ref];
+            if (!pType) continue;
+            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            mediaDeltas.push(await persistParagraphField(db, id, taxonomyType.db.table_name, f.name, pType, items));
+          }
+        }
+        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+        return c.json({ ok: true, data: updated });
+      }
+    );
+    app.delete(
+      `/admin/api/taxonomy/${typeName}/:id`,
+      requirePermission("content:delete"),
+      async (c) => {
+        const id = c.req.param("id");
+        const item = await repo.findOne(id);
+        if (!item) {
+          return c.json(
+            { ok: false, error: { code: "NOT_FOUND", message: "Taxonomy term not found" } },
+            404
+          );
+        }
+        const mediaDeltas = [
+          topLevelMediaDelta(mediaFields, item, null)
+        ];
+        if (db) {
+          for (const f of paragraphFieldDefs) {
+            const comp = f.ui_component;
+            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+            const pType = registry.paragraph_types[comp.ref];
+            if (!pType) continue;
+            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType));
+          }
+        }
+        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
+        await repo.delete(id);
+        return c.json({ ok: true });
+      }
+    );
+  }
+  app.get("/admin/api/config", (c) => {
+    return c.json({
+      ok: true,
+      data: {
+        content_types: Object.values(registry.content_types).map((ct) => ({
+          name: ct.name,
+          label: ct.label,
+          only_one: ct.only_one,
+          default_base_path: ct.default_base_path,
+          fields: ct.fields,
+          system_fields: ct.system_fields
+        })),
+        taxonomy_types: Object.values(registry.taxonomy_types).map((tt) => ({
+          name: tt.name,
+          label: tt.label,
+          fields: tt.fields,
+          system_fields: tt.system_fields
+        })),
+        enum_types: Object.values(registry.enum_types).map((et) => ({
+          name: et.name,
+          label: et.label,
+          values: et.values
+        }))
+      }
+    });
+  });
+}
+
+// src/routes/admin/media.ts
+import { sign as sign2, verify } from "hono/jwt";
+var IMAGE_MIME_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/gif"
+]);
+var VIDEO_MIME_TYPES = /* @__PURE__ */ new Set(["video/mp4", "video/webm", "video/quicktime"]);
+var FILE_MIME_TYPES = /* @__PURE__ */ new Set(["application/pdf"]);
+function authSecret() {
+  const secret = process.env["AUTH_SECRET"];
+  if (!secret) throw new Error("AUTH_SECRET environment variable is not set");
+  return secret;
+}
+async function signPendingUpload(data, expiresAt) {
+  return sign2({ ...data, exp: expiresAt }, authSecret());
+}
+async function verifyPendingUpload(token) {
+  try {
+    const p = await verify(token, authSecret(), "HS256");
+    return { key: p.key, folder: p.folder, mime_type: p.mime_type };
+  } catch {
+    return null;
+  }
+}
+async function handleDirectUpload(folder, acceptedTypes, mediaRepo, storage, c, altRequired, maxFileSize) {
+  if (maxFileSize !== void 0) {
+    const contentLength = Number(c.req.header("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > maxFileSize) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "FILE_TOO_LARGE",
+            message: `Upload exceeds the maximum size of ${maxFileSize} bytes`
+          }
+        },
+        413
+      );
+    }
+  }
+  let formData;
+  try {
+    formData = await c.req.formData();
+  } catch {
+    return c.json(
+      { ok: false, error: { code: "VALIDATION_ERROR", message: "Expected multipart/form-data" } },
+      422
+    );
+  }
+  const fileField = formData.get("file");
+  if (!(fileField instanceof File)) {
+    return c.json(
+      { ok: false, error: { code: "VALIDATION_ERROR", message: "file field is required" } },
+      422
+    );
+  }
+  if (maxFileSize !== void 0 && fileField.size > maxFileSize) {
+    return c.json(
+      {
+        ok: false,
+        error: {
+          code: "FILE_TOO_LARGE",
+          message: `File exceeds the maximum size of ${maxFileSize} bytes`
+        }
+      },
+      413
+    );
+  }
+  const mimeType = fileField.type;
+  if (!acceptedTypes.has(mimeType)) {
+    return c.json(
+      {
+        ok: false,
+        error: {
+          code: "UNSUPPORTED_MIME_TYPE",
+          message: `MIME type '${mimeType}' is not accepted by this endpoint`
+        }
+      },
+      415
+    );
+  }
+  const altValue = formData.get("alt");
+  const alt = typeof altValue === "string" && altValue.trim() !== "" ? altValue.trim() : void 0;
+  if (altRequired && !alt) {
+    return c.json(
+      {
+        ok: false,
+        error: {
+          code: "VALIDATION_ERROR",
+          message: "alt is required for this media type",
+          details: [{ field: "alt", message: "alt is required" }]
+        }
+      },
+      422
+    );
+  }
+  let presigned;
+  try {
+    presigned = await storage.getPresignedUploadUrl({
+      folder,
+      filename: fileField.name,
+      mime_type: mimeType
+    });
+  } catch {
+    return c.json(
+      { ok: false, error: { code: "STORAGE_ERROR", message: "Failed to generate upload URL" } },
+      502
+    );
+  }
+  if (storage.upload) {
+    try {
+      const bytes = new Uint8Array(await fileField.arrayBuffer());
+      await storage.upload(presigned.key, bytes, mimeType);
+    } catch (err) {
+      console.error("[media] storage.upload error:", err);
+      return c.json(
+        { ok: false, error: { code: "STORAGE_ERROR", message: "Storage upload failed" } },
+        502
+      );
+    }
+  }
+  const url = storage.getUrl(presigned.key);
+  const fileSize = fileField.size;
+  const item = await mediaRepo.create({
+    type: folder,
+    url,
+    mime_type: mimeType,
+    ...alt !== void 0 && { alt },
+    file_size: fileSize
+  });
+  return c.json({ ok: true, data: item }, 201);
+}
+function registerAdminMediaRoutes(app, mediaRepo, storage, requirePermission, maxFileSize) {
+  app.post(
+    "/admin/api/media/image",
+    requirePermission("media:create"),
+    async (c) => {
+      return handleDirectUpload("image", IMAGE_MIME_TYPES, mediaRepo, storage, c, false, maxFileSize);
+    }
+  );
+  app.post(
+    "/admin/api/media/video",
+    requirePermission("media:create"),
+    async (c) => {
+      return handleDirectUpload("video", VIDEO_MIME_TYPES, mediaRepo, storage, c, true, maxFileSize);
+    }
+  );
+  app.post(
+    "/admin/api/media/file",
+    requirePermission("media:create"),
+    async (c) => {
+      return handleDirectUpload("file", FILE_MIME_TYPES, mediaRepo, storage, c, true, maxFileSize);
+    }
+  );
+  app.get("/admin/api/media/presigned-url", requirePermission("media:create"), async (c) => {
+    const type = c.req.query("type");
+    const filename = c.req.query("filename");
+    const mimeType = c.req.query("mime_type");
+    if (!type || !["image", "video", "file"].includes(type)) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "VALIDATION_ERROR",
+            message: "type must be one of: image, video, file",
+            details: [{ field: "type", message: "type is required" }]
+          }
+        },
+        422
+      );
+    }
+    if (!filename || filename.trim() === "") {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "VALIDATION_ERROR",
+            message: "filename is required",
+            details: [{ field: "filename", message: "filename is required" }]
+          }
+        },
+        422
+      );
+    }
+    if (!mimeType || mimeType.trim() === "") {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "VALIDATION_ERROR",
+            message: "mime_type is required",
+            details: [{ field: "mime_type", message: "mime_type is required" }]
+          }
+        },
+        422
+      );
+    }
+    const accepted = type === "image" ? IMAGE_MIME_TYPES : type === "video" ? VIDEO_MIME_TYPES : FILE_MIME_TYPES;
+    if (!accepted.has(mimeType)) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "UNSUPPORTED_MIME_TYPE",
+            message: `MIME type '${mimeType}' is not accepted for ${type} uploads`
+          }
+        },
+        415
+      );
+    }
+    let presigned;
+    try {
+      presigned = await storage.getPresignedUploadUrl({
+        folder: type,
+        filename,
+        mime_type: mimeType
+      });
+    } catch {
+      return c.json(
+        { ok: false, error: { code: "STORAGE_ERROR", message: "Failed to generate upload URL" } },
+        502
+      );
+    }
+    const media_id = await signPendingUpload(
+      { key: presigned.key, folder: type, mime_type: mimeType },
+      presigned.expires_at
+    );
+    return c.json({
+      ok: true,
+      data: {
+        upload_url: presigned.upload_url,
+        // Signed, self-contained token the client posts back to /confirm/:id.
+        media_id,
+        expires_at: presigned.expires_at,
+        // Present for storages that need a multipart POST with signed fields
+        // (Cloudinary); absent for a raw PUT (S3).
+        ...presigned.method && { method: presigned.method },
+        ...presigned.fields && { fields: presigned.fields }
+      }
+    });
+  });
+  app.post("/admin/api/media/confirm/:id", requirePermission("media:create"), async (c) => {
+    const id = c.req.param("id");
+    const pending = await verifyPendingUpload(id);
+    if (!pending) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "PRESIGNED_URL_EXPIRED",
+            message: "Presigned upload not found or has expired"
+          }
+        },
+        410
+      );
+    }
+    const body = await c.req.json().catch(() => ({}));
+    const altValue = typeof body["alt"] === "string" ? body["alt"].trim() : void 0;
+    const altRequired = pending.folder === "video" || pending.folder === "file";
+    if (altRequired && !altValue) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "VALIDATION_ERROR",
+            message: "alt is required for video and file uploads",
+            details: [{ field: "alt", message: "alt is required" }]
+          }
+        },
+        422
+      );
+    }
+    let fileSize = 0;
+    if (storage.stat) {
+      const meta = await storage.stat(pending.key);
+      if (!meta) {
+        return c.json(
+          { ok: false, error: { code: "STORAGE_ERROR", message: "Uploaded object not found" } },
+          502
+        );
+      }
+      const accepted = pending.folder === "image" ? IMAGE_MIME_TYPES : pending.folder === "video" ? VIDEO_MIME_TYPES : FILE_MIME_TYPES;
+      if (meta.content_type && !accepted.has(meta.content_type)) {
+        await storage.delete(pending.key);
+        return c.json(
+          { ok: false, error: { code: "UNSUPPORTED_MIME_TYPE", message: `Stored object type '${meta.content_type}' is not accepted` } },
+          415
+        );
+      }
+      if (maxFileSize !== void 0 && meta.size > maxFileSize) {
+        await storage.delete(pending.key);
+        return c.json(
+          { ok: false, error: { code: "FILE_TOO_LARGE", message: `Uploaded file exceeds the ${maxFileSize} byte limit` } },
+          413
+        );
+      }
+      fileSize = meta.size;
+    }
+    const url = storage.getUrl(pending.key);
+    const item = await mediaRepo.create({
+      type: pending.folder,
+      url,
+      mime_type: pending.mime_type,
+      ...altValue !== void 0 && { alt: altValue },
+      file_size: fileSize
+    });
+    return c.json({ ok: true, data: item }, 201);
+  });
+  app.patch(
+    "/admin/api/media/:id",
+    requirePermission("media:edit"),
+    async (c) => {
+      const id = c.req.param("id");
+      const existing = await mediaRepo.findOne(id);
+      if (!existing) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "Media item not found" } },
+          404
+        );
+      }
+      const body = await c.req.json();
+      const alt = typeof body["alt"] === "string" ? body["alt"].trim() : void 0;
+      const updateData = {};
+      if (alt !== void 0) updateData.alt = alt;
+      const updated = await mediaRepo.update(id, updateData);
+      if (!updated) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "Media item not found" } },
+          404
+        );
+      }
+      return c.json({ ok: true, data: updated });
+    }
+  );
+  app.delete(
+    "/admin/api/media/:id",
+    requirePermission("media:delete"),
+    async (c) => {
+      const id = c.req.param("id");
+      const item = await mediaRepo.findOne(id);
+      if (!item) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "Media item not found" } },
+          404
+        );
+      }
+      if (item.reference_count > 0) {
+        return c.json(
+          {
+            ok: false,
+            error: {
+              code: "MEDIA_IN_USE",
+              message: "Cannot delete media that is referenced by content items"
+            }
+          },
+          409
+        );
+      }
+      const pathname = new URL(item.url).pathname;
+      const uploadIdx = pathname.indexOf("/upload/");
+      const key = uploadIdx >= 0 ? pathname.slice(uploadIdx + "/upload/".length) : pathname.replace(/^\//, "");
+      try {
+        await storage.delete(key);
+      } catch (err) {
+        console.error("[media] storage.delete error:", err);
+        return c.json(
+          {
+            ok: false,
+            error: { code: "STORAGE_ERROR", message: "Failed to delete file from storage" }
+          },
+          502
+        );
+      }
+      await mediaRepo.delete(id);
+      return c.json({ ok: true });
+    }
+  );
+  app.get("/admin/api/media", requirePermission("media:read"), async (c) => {
+    const pageStr = c.req.query("page");
+    const perPageStr = c.req.query("per_page");
+    const page = pageStr !== void 0 ? Number(pageStr) : 1;
+    const per_page = perPageStr !== void 0 ? Number(perPageStr) : 10;
+    if (!Number.isInteger(page) || page < 1 || !Number.isInteger(per_page) || per_page < 1 || per_page > 100) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "INVALID_PAGINATION",
+            message: "page must be \u2265 1 and per_page must be between 1 and 100"
+          }
+        },
+        400
+      );
+    }
+    const typeParam = c.req.query("type");
+    if (typeParam !== void 0 && !["image", "video", "file"].includes(typeParam)) {
+      return c.json(
+        {
+          ok: false,
+          error: { code: "VALIDATION_ERROR", message: "type must be one of: image, video, file" }
+        },
+        422
+      );
+    }
+    const orphanedParam = c.req.query("orphaned");
+    const orphaned = orphanedParam === "true" ? true : orphanedParam === "false" ? false : void 0;
+    const opts = { page, per_page };
+    if (typeParam !== void 0) opts.type = typeParam;
+    if (orphaned !== void 0) opts.orphaned = orphaned;
+    const result = await mediaRepo.findMany(opts);
+    return c.json(result);
+  });
+  app.get("/admin/api/media/:id", requirePermission("media:read"), async (c) => {
+    const id = c.req.param("id");
+    const item = await mediaRepo.findOne(id);
+    if (!item) {
+      return c.json(
+        { ok: false, error: { code: "NOT_FOUND", message: "Media item not found" } },
+        404
+      );
+    }
+    return c.json({ ok: true, data: item });
+  });
+}
+
+// src/routes/admin/auth.ts
+import { getCookie as getCookie2 } from "hono/cookie";
+import { sql as sql4 } from "drizzle-orm";
+
+// src/auth/password.ts
+import { hashPassword, verifyPassword } from "@bobbykim/manguito-cms-core";
+
+// src/routes/admin/auth.ts
+var loginAttempts = /* @__PURE__ */ new Map();
+var globalLoginAttempts = [];
+var RATE_LIMIT_MAX = 10;
+var RATE_LIMIT_WINDOW_MS = 15 * 60 * 1e3;
+var GLOBAL_LOGIN_MAX = 100;
+var DUMMY_PASSWORD_HASH = "$2a$12$y.MZw/Q4Ceg3x1y3xrRaeuTaM09zSDx1nn78guO3bqc9vgOqGda42";
+function checkRateLimit(key) {
+  const now = Date.now();
+  const windowStart = now - RATE_LIMIT_WINDOW_MS;
+  while (globalLoginAttempts.length > 0 && globalLoginAttempts[0] <= windowStart) {
+    globalLoginAttempts.shift();
+  }
+  if (globalLoginAttempts.length >= GLOBAL_LOGIN_MAX) {
+    const retryAfterSeconds = Math.ceil((globalLoginAttempts[0] + RATE_LIMIT_WINDOW_MS - now) / 1e3);
+    return { allowed: false, retryAfterSeconds };
+  }
+  const attempts = (loginAttempts.get(key) ?? []).filter((t) => t > windowStart);
+  attempts.push(now);
+  loginAttempts.set(key, attempts);
+  globalLoginAttempts.push(now);
+  if (attempts.length > RATE_LIMIT_MAX) {
+    const oldestInWindow = attempts[0];
+    const retryAfterSeconds = Math.ceil((oldestInWindow + RATE_LIMIT_WINDOW_MS - now) / 1e3);
+    return { allowed: false, retryAfterSeconds };
+  }
+  return { allowed: true, retryAfterSeconds: 0 };
+}
+function registerAuthRoutes(app, db) {
+  const invalidCredentials = {
+    ok: false,
+    error: { code: "INVALID_CREDENTIALS", message: "Invalid email or password." }
+  };
+  app.post("/admin/api/auth/login", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json(invalidCredentials, 401);
+    }
+    const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
+    const password = typeof body.password === "string" ? body.password : null;
+    if (!email || !password) {
+      return c.json(invalidCredentials, 401);
+    }
+    const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
+    const rateCheck = checkRateLimit(`${ip}:${email}`);
+    if (!rateCheck.allowed) {
+      c.header("Retry-After", String(rateCheck.retryAfterSeconds));
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "RATE_LIMITED",
+            message: "Too many login attempts. Please try again later."
+          }
+        },
+        429
+      );
+    }
+    const userResult = await db.execute(
+      sql4`SELECT id, email, password_hash, role_id, token_version
+          FROM users WHERE email = ${email} LIMIT 1`
+    );
+    const user = userResult.rows[0];
+    if (!user) {
+      await verifyPassword(password, DUMMY_PASSWORD_HASH);
+      return c.json(invalidCredentials, 401);
+    }
+    const passwordValid = await verifyPassword(password, user.password_hash);
+    if (!passwordValid) {
+      return c.json(invalidCredentials, 401);
+    }
+    const roleResult = await db.execute(
+      sql4`SELECT r.name AS name, u.must_change_password
+          FROM roles r
+          JOIN users u ON u.role_id = r.id
+          WHERE r.id = ${user.role_id} AND u.id = ${user.id}
+          LIMIT 1`
+    );
+    const roleRow = roleResult.rows[0];
+    if (!roleRow) {
+      return c.json(
+        { ok: false, error: { code: "INVALID_ROLE", message: "User role not found." } },
+        500
+      );
+    }
+    const [authToken, refreshToken] = await Promise.all([
+      signToken(
+        { user_id: user.id, role: roleRow.name, token_version: user.token_version },
+        AUTH_TOKEN_TTL
+      ),
+      signToken(
+        { user_id: user.id, role: roleRow.name, token_version: user.token_version },
+        REFRESH_TOKEN_TTL
+      )
+    ]);
+    setAuthCookie(c, "auth_token", authToken, { path: "/" });
+    setAuthCookie(c, "refresh_token", refreshToken, { path: "/admin/api/auth" });
+    return c.json({
+      ok: true,
+      data: {
+        id: user.id,
+        email: user.email,
+        role: roleRow.name,
+        must_change_password: roleRow.must_change_password
+      }
+    });
+  });
+  app.post("/admin/api/auth/refresh", async (c) => {
+    const token = getCookie2(c, "refresh_token");
+    if (!token) {
+      return c.json(
+        { ok: false, error: { code: "UNAUTHORIZED", message: "Authentication required." } },
+        401
+      );
+    }
+    let payload;
+    try {
+      payload = await verifyToken(token);
+    } catch (err) {
+      const code = err.code;
+      if (code === "TOKEN_EXPIRED") {
+        return c.json(
+          { ok: false, error: { code: "TOKEN_EXPIRED", message: "Token has expired." } },
+          401
+        );
+      }
+      return c.json(
+        { ok: false, error: { code: "TOKEN_INVALID", message: "Token signature is invalid." } },
+        401
+      );
+    }
+    const rowResult = await db.execute(
+      sql4`SELECT u.token_version, r.name AS role
+          FROM users u
+          JOIN roles r ON r.id = u.role_id
+          WHERE u.id = ${payload.user_id}
+          LIMIT 1`
+    );
+    const row = rowResult.rows[0];
+    if (!row || payload.token_version !== row.token_version) {
+      return c.json(
+        { ok: false, error: { code: "TOKEN_INVALID", message: "Token has been invalidated." } },
+        401
+      );
+    }
+    const newAuthToken = await signToken(
+      { user_id: payload.user_id, role: row.role, token_version: row.token_version },
+      AUTH_TOKEN_TTL
+    );
+    setAuthCookie(c, "auth_token", newAuthToken, { path: "/" });
+    return c.json({ ok: true });
+  });
+  const authMiddleware = createAuthMiddleware(db);
+  app.post("/admin/api/auth/logout", authMiddleware, async (c) => {
+    const user = c.get("user");
+    await db.execute(
+      sql4`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
+    );
+    clearAuthCookie(c, "auth_token");
+    clearAuthCookie(c, "refresh_token", "/admin/api/auth");
+    return c.json({ ok: true });
+  });
+}
+
+// src/routes/admin/users.ts
+import { sql as sql5 } from "drizzle-orm";
+import { randomBytes } from "crypto";
+function getActingUser(c) {
+  return c.get("user");
+}
+function generateTempPassword() {
+  return randomBytes(8).toString("base64url");
+}
+function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
+  app.post("/admin/api/users/change-password", async (c) => {
+    const actingUser = getActingUser(c);
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json(
+        { ok: false, error: { code: "INVALID_CREDENTIALS", message: "Invalid credentials." } },
+        401
+      );
+    }
+    const currentPassword = typeof body.current_password === "string" ? body.current_password : null;
+    const newPassword = typeof body.new_password === "string" ? body.new_password : null;
+    if (!currentPassword || !newPassword) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "VALIDATION_ERROR",
+            message: "current_password and new_password are required."
+          }
+        },
+        422
+      );
+    }
+    const hashResult = await db.execute(
+      sql5`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
+    );
+    const hashRow = hashResult.rows[0];
+    if (!hashRow || !await verifyPassword(currentPassword, hashRow.password_hash)) {
+      return c.json(
+        { ok: false, error: { code: "INVALID_CREDENTIALS", message: "Invalid credentials." } },
+        401
+      );
+    }
+    const newHash = await hashPassword(newPassword);
+    await db.execute(
+      sql5`UPDATE users
+          SET password_hash       = ${newHash},
+              must_change_password = false,
+              token_version        = token_version + 1,
+              updated_at           = NOW()
+          WHERE id = ${actingUser.id}`
+    );
+    return c.json({ ok: true });
+  });
+  app.get("/admin/api/users", requirePermission("users:read"), async (c) => {
+    const result = await db.execute(
+      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+                 u.created_at, u.updated_at
+          FROM users u
+          JOIN roles r ON r.id = u.role_id
+          ORDER BY u.created_at ASC`
+    );
+    return c.json({ ok: true, data: result.rows });
+  });
+  app.get("/admin/api/users/:id", requirePermission("users:read"), async (c) => {
+    const id = c.req.param("id");
+    const result = await db.execute(
+      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+                 u.created_at, u.updated_at
+          FROM users u
+          JOIN roles r ON r.id = u.role_id
+          WHERE u.id = ${id}
+          LIMIT 1`
+    );
+    const row = result.rows[0];
+    if (!row) {
+      return c.json(
+        { ok: false, error: { code: "NOT_FOUND", message: "User not found." } },
+        404
+      );
+    }
+    return c.json({ ok: true, data: row });
+  });
+  app.post(
+    "/admin/api/users",
+    requirePermission("users:create"),
+    requireHierarchy(),
+    async (c) => {
+      let body;
+      try {
+        body = await c.req.json();
+      } catch {
+        return c.json(
+          { ok: false, error: { code: "VALIDATION_ERROR", message: "Request body is required." } },
+          422
+        );
+      }
+      const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : null;
+      const roleName = typeof body.role === "string" ? body.role : null;
+      if (!email) {
+        return c.json(
+          { ok: false, error: { code: "VALIDATION_ERROR", message: "email is required." } },
+          422
+        );
+      }
+      if (!roleName) {
+        return c.json(
+          { ok: false, error: { code: "INVALID_ROLE", message: "role is required." } },
+          400
+        );
+      }
+      const roleResult = await db.execute(
+        sql5`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
+      );
+      const roleRow = roleResult.rows[0];
+      if (!roleRow) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INVALID_ROLE", message: `Role "${roleName}" does not exist.` }
+          },
+          400
+        );
+      }
+      const tempPassword = generateTempPassword();
+      const passwordHash = await hashPassword(tempPassword);
+      const insertResult = await db.execute(
+        sql5`INSERT INTO users
+              (id, email, password_hash, role_id, must_change_password, token_version,
+               created_at, updated_at)
+            VALUES
+              (gen_random_uuid(), ${email}, ${passwordHash}, ${roleRow.id},
+               true, 0, NOW(), NOW())
+            RETURNING id, email, must_change_password, created_at, updated_at`
+      );
+      const newUser = insertResult.rows[0];
+      if (!newUser) {
+        return c.json(
+          { ok: false, error: { code: "INTERNAL_ERROR", message: "Failed to create user." } },
+          500
+        );
+      }
+      return c.json(
+        {
+          ok: true,
+          data: {
+            id: newUser.id,
+            email: newUser.email,
+            role: roleName,
+            must_change_password: newUser.must_change_password,
+            temporary_password: tempPassword,
+            created_at: newUser.created_at,
+            updated_at: newUser.updated_at
+          }
+        },
+        201
+      );
+    }
+  );
+  app.patch(
+    "/admin/api/users/:id",
+    requirePermission("users:edit"),
+    requireHierarchy(),
+    async (c) => {
+      const id = c.req.param("id");
+      const actingUser = getActingUser(c);
+      let body;
+      try {
+        body = await c.req.json();
+      } catch {
+        body = {};
+      }
+      if (actingUser.id === id && body.role !== void 0) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "INSUFFICIENT_PRIVILEGE", message: "You cannot change your own role." }
+          },
+          403
+        );
+      }
+      const existingResult = await db.execute(
+        sql5`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
+      );
+      const existing = existingResult.rows[0];
+      if (!existing) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "User not found." } },
+          404
+        );
+      }
+      const newEmail = typeof body.email === "string" ? body.email.trim().toLowerCase() : existing.email;
+      let newRoleId = existing.role_id;
+      let changeRole = false;
+      if (typeof body.role === "string" && body.role) {
+        const roleResult = await db.execute(
+          sql5`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
+        );
+        const roleRow = roleResult.rows[0];
+        if (!roleRow) {
+          return c.json(
+            {
+              ok: false,
+              error: {
+                code: "INVALID_ROLE",
+                message: `Role "${body.role}" does not exist.`
+              }
+            },
+            400
+          );
+        }
+        newRoleId = roleRow.id;
+        changeRole = true;
+      }
+      if (changeRole) {
+        await db.execute(
+          sql5`UPDATE users
+              SET email         = ${newEmail},
+                  role_id       = ${newRoleId},
+                  token_version = token_version + 1,
+                  updated_at    = NOW()
+              WHERE id = ${id}`
+        );
+      } else {
+        await db.execute(
+          sql5`UPDATE users
+              SET email      = ${newEmail},
+                  role_id    = ${newRoleId},
+                  updated_at = NOW()
+              WHERE id = ${id}`
+        );
+      }
+      const updatedResult = await db.execute(
+        sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+                   u.created_at, u.updated_at
+            FROM users u
+            JOIN roles r ON r.id = u.role_id
+            WHERE u.id = ${id}
+            LIMIT 1`
+      );
+      const updated = updatedResult.rows[0];
+      if (!updated) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "User not found." } },
+          404
+        );
+      }
+      return c.json({ ok: true, data: updated });
+    }
+  );
+  app.delete(
+    "/admin/api/users/:id",
+    requirePermission("users:delete"),
+    requireHierarchy(),
+    async (c) => {
+      const id = c.req.param("id");
+      const actingUser = getActingUser(c);
+      if (actingUser.id === id) {
+        return c.json(
+          {
+            ok: false,
+            error: {
+              code: "INSUFFICIENT_PRIVILEGE",
+              message: "You cannot delete your own account."
+            }
+          },
+          403
+        );
+      }
+      const result = await db.execute(
+        sql5`DELETE FROM users WHERE id = ${id} RETURNING id`
+      );
+      if (result.rows.length === 0) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "User not found." } },
+          404
+        );
+      }
+      return c.json({ ok: true });
+    }
+  );
+  app.post(
+    "/admin/api/users/:id/reset-password",
+    requirePermission("users:edit"),
+    requireHierarchy(),
+    async (c) => {
+      const id = c.req.param("id");
+      const actingUser = getActingUser(c);
+      if (actingUser.id === id) {
+        return c.json(
+          {
+            ok: false,
+            error: {
+              code: "INSUFFICIENT_PRIVILEGE",
+              message: "You cannot reset your own password via this endpoint."
+            }
+          },
+          403
+        );
+      }
+      const existingResult = await db.execute(
+        sql5`SELECT id FROM users WHERE id = ${id} LIMIT 1`
+      );
+      const existing = existingResult.rows[0];
+      if (!existing) {
+        return c.json(
+          { ok: false, error: { code: "NOT_FOUND", message: "User not found." } },
+          404
+        );
+      }
+      const tempPassword = generateTempPassword();
+      const passwordHash = await hashPassword(tempPassword);
+      await db.execute(
+        sql5`UPDATE users
+            SET password_hash        = ${passwordHash},
+                must_change_password = true,
+                token_version        = token_version + 1,
+                updated_at           = NOW()
+            WHERE id = ${id}`
+      );
+      return c.json({ ok: true, data: { temporary_password: tempPassword } });
+    }
+  );
+}
+
+// src/routes/admin/config.ts
+import { sql as sql6 } from "drizzle-orm";
+var API_VERSION = (() => {
+  try {
+    return "0.1.0";
+  } catch {
+    return "0.0.0";
+  }
+})();
+function registerConfigRoute(app, config, registry, db) {
+  app.get("/admin/api/config", async (c) => {
+    const actingUser = c.get("user");
+    const actingRole = registry[actingUser.role];
+    const actingLevel = actingRole?.hierarchy_level ?? Infinity;
+    const roles = Object.values(registry).filter((r) => r.name !== "admin" && r.hierarchy_level > actingLevel).sort((a, b) => a.hierarchy_level - b.hierarchy_level).map((r) => ({ name: r.name, label: r.label, hierarchy_level: r.hierarchy_level }));
+    const all_roles = Object.values(registry).sort((a, b) => a.hierarchy_level - b.hierarchy_level).map((r) => ({
+      name: r.name,
+      label: r.label,
+      hierarchy_level: r.hierarchy_level,
+      is_system: r.is_system,
+      permissions: r.permissions
+    }));
+    const userResult = await db.execute(
+      sql6`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
+    );
+    const userRow = userResult.rows[0];
+    return c.json({
+      ok: true,
+      data: {
+        cms_name: config.name ?? "Manguito CMS",
+        version: API_VERSION,
+        roles,
+        all_roles,
+        user: {
+          id: actingUser.id,
+          email: userRow?.email ?? "",
+          role: actingUser.role,
+          must_change_password: userRow?.must_change_password ?? false
+        },
+        media: {
+          max_file_size: config.maxFileSize ?? null,
+          presigned_uploads: config.presignedUploads ?? false
+        }
+      }
+    });
+  });
+}
+
+// src/routes/admin/schema.ts
+import { sql as sql7 } from "drizzle-orm";
+function registerSchemaRoute(app, registry, db) {
+  app.get("/admin/api/schema", (c) => {
+    const content_types = Object.values(registry.content_types).map((ct) => ({
+      name: ct.name,
+      label: ct.label,
+      only_one: ct.only_one,
+      ui: ct.ui,
+      system_fields: ct.system_fields,
+      fields: ct.fields
+    }));
+    const taxonomy_types = Object.values(registry.taxonomy_types).map((tt) => ({
+      name: tt.name,
+      label: tt.label,
+      system_fields: tt.system_fields,
+      fields: tt.fields
+    }));
+    const paragraph_types = Object.values(registry.paragraph_types).map((pt) => ({
+      name: pt.name,
+      label: pt.label,
+      system_fields: pt.system_fields,
+      fields: pt.fields
+    }));
+    const enum_types = Object.values(registry.enum_types).map((et) => ({
+      name: et.name,
+      label: et.label,
+      values: et.values
+    }));
+    return c.json({
+      ok: true,
+      data: { content_types, taxonomy_types, paragraph_types, enum_types }
+    });
+  });
+  app.get("/admin/api/content", async (c) => {
+    const data = await Promise.all(
+      Object.values(registry.content_types).map(async (ct) => {
+        const result = await db.execute(
+          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${ct.db.table_name}"`)}`
+        );
+        const count = Number(result.rows[0].count);
+        return { name: ct.name, label: ct.label, only_one: ct.only_one, count };
+      })
+    );
+    return c.json({ ok: true, data });
+  });
+  app.get("/admin/api/taxonomy", async (c) => {
+    const data = await Promise.all(
+      Object.values(registry.taxonomy_types).map(async (tt) => {
+        const result = await db.execute(
+          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${tt.db.table_name}"`)}`
+        );
+        const count = Number(result.rows[0].count);
+        return { name: tt.name, label: tt.label, count };
+      })
+    );
+    return c.json({ ok: true, data });
+  });
+}
+
+// src/repositories/content.ts
+import crypto2 from "crypto";
+import { sql as sql8 } from "drizzle-orm";
+var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
+function codeError(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+function quoteIdent3(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
+    throw new Error(`Unsafe SQL identifier: ${name}`);
+  }
+  return `"${name.replace(/"/g, '""')}"`;
+}
+function quoteField(name) {
+  if (!/^[a-z][a-z0-9_]*$/.test(name)) {
+    throw codeError("INVALID_FILTER_FIELD", `Invalid filter field name: ${name}`);
+  }
+  return `"${name}"`;
+}
+function buildConditions(published_only, filters, search) {
+  const conds = [];
+  if (published_only) {
+    conds.push(sql8`published = true`);
+  }
+  if (search && search.term.trim() !== "" && search.columns.length > 0) {
+    const pattern = `%${search.term.trim()}%`;
+    const orConds = search.columns.map((col) => sql8`${sql8.raw(quoteField(col))} ILIKE ${pattern}`);
+    conds.push(sql8`(${sql8.join(orConds, sql8` OR `)})`);
+  }
+  if (filters) {
+    for (const [field, value] of Object.entries(filters)) {
+      const col = sql8.raw(quoteField(field));
+      if (Array.isArray(value)) {
+        if (value.length === 0) continue;
+        const inList = sql8.join(
+          value.map((v) => sql8`${v}`),
+          sql8`, `
+        );
+        conds.push(sql8`${col} IN (${inList})`);
+      } else if (typeof value === "object" && value !== null) {
+        const op = value;
+        if (op.gt !== void 0) conds.push(sql8`${col} > ${op.gt}`);
+        if (op.gte !== void 0) conds.push(sql8`${col} >= ${op.gte}`);
+        if (op.lt !== void 0) conds.push(sql8`${col} < ${op.lt}`);
+        if (op.lte !== void 0) conds.push(sql8`${col} <= ${op.lte}`);
+      } else {
+        conds.push(sql8`${col} = ${value}`);
+      }
+    }
+  }
+  return conds;
+}
+function whereFragment(conds) {
+  return conds.length > 0 ? sql8` WHERE ${sql8.join(conds, sql8` AND `)}` : sql8``;
+}
+function createDrizzleContentRepository(db, tableName, options = {}) {
+  const { relations = {} } = options;
+  function tableRaw() {
+    return sql8.raw(quoteIdent3(tableName));
+  }
+  async function resolveRows(rows, include, cache) {
+    if (rows.length === 0) return rows;
+    for (const fieldName of include) {
+      if (!relations[fieldName]) {
+        throw codeError("INVALID_INCLUDE_FIELD", `'${fieldName}' is not a valid relation field`);
+      }
+    }
+    for (const [fieldName, rel] of Object.entries(relations)) {
+      if (rel.type === "media") {
+        await resolveRelationField(db, rows, fieldName, rel, cache);
+      } else if (!include.includes(fieldName)) {
+        await resolveRelationBareIds(db, rows, fieldName, rel);
+      }
+    }
+    for (const fieldName of include) {
+      const rel = relations[fieldName];
+      if (rel.type !== "media") {
+        await resolveRelationField(db, rows, fieldName, rel, cache);
+      }
+    }
+    return rows;
+  }
+  return {
+    async findMany(opts) {
+      const {
+        page = 1,
+        per_page = 10,
+        include = [],
+        published_only,
+        filters,
+        sort_by = "created_at",
+        sort_order = "asc",
+        search
+      } = opts;
+      if (!SORTABLE_FIELDS2.has(sort_by)) {
+        throw codeError("INVALID_SORT_FIELD", `'${sort_by}' is not sortable. Allowed: title, created_at, updated_at`);
+      }
+      const offset = (page - 1) * per_page;
+      const conds = buildConditions(published_only, filters, search);
+      const where = whereFragment(conds);
+      const sortCol = sql8.raw(quoteIdent3(sort_by));
+      const sortDir = sql8.raw(sort_order === "desc" ? "DESC" : "ASC");
+      const countResult = await db.execute(
+        sql8`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
+      );
+      const total = Number(countResult.rows[0]?.["total"] ?? 0);
+      const dataResult = await db.execute(
+        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
+      );
+      const rows = dataResult.rows;
+      const cache = /* @__PURE__ */ new Map();
+      await resolveRows(rows, include, cache);
+      const total_pages = Math.ceil(total / per_page);
+      return {
+        ok: true,
+        data: rows,
+        meta: {
+          total,
+          page,
+          per_page,
+          total_pages,
+          has_next: page < total_pages,
+          has_prev: page > 1
+        }
+      };
+    },
+    async findOne(id, include = []) {
+      const result = await db.execute(
+        sql8`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
+      );
+      if (result.rows.length === 0) return null;
+      const rows = result.rows;
+      const cache = /* @__PURE__ */ new Map();
+      await resolveRows(rows, include, cache);
+      return rows[0];
+    },
+    async findBySlug(slug, include = []) {
+      const result = await db.execute(
+        sql8`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
+      );
+      if (result.rows.length === 0) return null;
+      const rows = result.rows;
+      const cache = /* @__PURE__ */ new Map();
+      await resolveRows(rows, include, cache);
+      return rows[0];
+    },
+    async create(data) {
+      const record = {
+        ...data,
+        id: crypto2.randomUUID(),
+        created_at: /* @__PURE__ */ new Date(),
+        updated_at: /* @__PURE__ */ new Date()
+      };
+      const entries = Object.entries(record).filter(([, v]) => v !== void 0);
+      const colsSql = sql8.join(entries.map(([k]) => sql8.raw(quoteIdent3(k))), sql8`, `);
+      const valsSql = sql8.join(entries.map(([, v]) => sql8`${v}`), sql8`, `);
+      const result = await db.execute(
+        sql8`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+      );
+      return result.rows[0];
+    },
+    async update(id, data) {
+      const record = {
+        ...data,
+        updated_at: /* @__PURE__ */ new Date()
+      };
+      const entries = Object.entries(record).filter(([k, v]) => k !== "id" && v !== void 0);
+      if (entries.length === 0) {
+        return this.findOne(id);
+      }
+      const setClauses = sql8.join(
+        entries.map(([k, v]) => sql8`${sql8.raw(quoteIdent3(k))} = ${v}`),
+        sql8`, `
+      );
+      const result = await db.execute(
+        sql8`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
+      );
+      if (result.rows.length === 0) return null;
+      return result.rows[0];
+    },
+    async delete(id) {
+      await db.execute(sql8`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
+    },
+    async findAll(opts = {}) {
+      const { include = [], published_only } = opts;
+      const conds = buildConditions(published_only, void 0, void 0);
+      const where = whereFragment(conds);
+      const result = await db.execute(
+        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
+      );
+      const rows = result.rows;
+      const cache = /* @__PURE__ */ new Map();
+      await resolveRows(rows, include, cache);
+      return rows;
+    }
+  };
+}
+
+// src/repositories/media.ts
+import crypto3 from "crypto";
+import { sql as sql9 } from "drizzle-orm";
+function createMediaRepository(db) {
+  const TABLE = sql9.raw('"media"');
+  return {
+    async findMany(opts = {}) {
+      const { page = 1, per_page = 10, type, orphaned } = opts;
+      const offset = (page - 1) * per_page;
+      const conds = [];
+      if (type) conds.push(sql9`type = ${type}`);
+      if (orphaned) conds.push(sql9`reference_count = 0`);
+      const where = conds.length > 0 ? sql9` WHERE ${sql9.join(conds, sql9` AND `)}` : sql9``;
+      const countResult = await db.execute(sql9`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
+      const total = Number(
+        countResult.rows[0]?.["total"] ?? 0
+      );
+      const dataResult = await db.execute(
+        sql9`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
+      );
+      const total_pages = Math.ceil(total / per_page);
+      return {
+        ok: true,
+        data: dataResult.rows,
+        meta: {
+          total,
+          page,
+          per_page,
+          total_pages,
+          has_next: page < total_pages,
+          has_prev: page > 1
+        }
+      };
+    },
+    async findOne(id) {
+      const result = await db.execute(
+        sql9`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
+      );
+      if (result.rows.length === 0) return null;
+      return result.rows[0];
+    },
+    async create(data) {
+      const record = {
+        ...data,
+        id: crypto3.randomUUID(),
+        reference_count: 0,
+        created_at: /* @__PURE__ */ new Date(),
+        updated_at: /* @__PURE__ */ new Date()
+      };
+      const entries = Object.entries(record).filter(([, v]) => v !== void 0);
+      const colsSql = sql9.join(entries.map(([k]) => sql9.raw(`"${k}"`)), sql9`, `);
+      const valsSql = sql9.join(entries.map(([, v]) => sql9`${v}`), sql9`, `);
+      const result = await db.execute(
+        sql9`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+      );
+      return result.rows[0];
+    },
+    async update(id, data) {
+      const record = { ...data, updated_at: /* @__PURE__ */ new Date() };
+      const entries = Object.entries(record).filter(
+        ([k, v]) => k !== "id" && v !== void 0
+      );
+      if (entries.length === 0) return this.findOne(id);
+      const setClauses = sql9.join(
+        entries.map(([k, v]) => sql9`${sql9.raw(`"${k}"`)} = ${v}`),
+        sql9`, `
+      );
+      const result = await db.execute(
+        sql9`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
+      );
+      if (result.rows.length === 0) return null;
+      return result.rows[0];
+    },
+    async delete(id) {
+      await db.execute(sql9`DELETE FROM ${TABLE} WHERE id = ${id}`);
+    },
+    async incrementReferenceCount(ids) {
+      if (ids.length === 0) return;
+      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
+      await db.execute(
+        sql9`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
+      );
+    },
+    async decrementReferenceCount(ids) {
+      if (ids.length === 0) return;
+      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
+      await db.execute(
+        sql9`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
+      );
+    }
+  };
+}
+
+// src/app.ts
+var MISSING_STORAGE_ERROR = `\u2717 api.storage is required but not configured.
+  Add a storage adapter to your manguito.config.ts:
+
+  api: createAPIAdapter({
+    storage: createLocalAdapter(),   // dev
+    // storage: createS3Adapter({ bucket: '...', region: '...' })  // production
+  })
+
+Exiting.`;
+function createCmsApp(options) {
+  if (!options.storage) {
+    throw new Error(MISSING_STORAGE_ERROR);
+  }
+  const prefix = options.prefix ?? "/api";
+  const { storage, registry, db, rateLimit, media, cors } = options;
+  const cmsName = options.name ?? "Manguito CMS";
+  const maxFileSize = media?.max_file_size;
+  const rolesRegistry = buildRolesRegistry(registry.roles.roles);
+  const app = new Hono();
+  const uploadOrigins = storage.getUploadOrigins?.() ?? [];
+  app.use("*", createSecurityHeadersMiddleware({ connectSrc: uploadOrigins }));
+  app.use("*", createCorsMiddleware(cors ?? { origin: "*", enabled: true }));
+  app.onError(errorHandler);
+  const listRateLimit = resolveListRateLimit(rateLimit);
+  const authMiddleware = createAuthMiddleware(db);
+  const requirePermission = createPermissionMiddleware(rolesRegistry);
+  const getUserRole = async (userId) => {
+    const result = await db.execute(
+      sql10`SELECT r.name AS role
+          FROM users u
+          JOIN roles r ON r.id = u.role_id
+          WHERE u.id = ${userId}
+          LIMIT 1`
+    );
+    return result.rows[0]?.role ?? null;
+  };
+  const requireHierarchy = createHierarchyMiddleware(rolesRegistry, getUserRole);
+  const contentRepos = Object.fromEntries(
+    Object.entries(registry.content_types).map(([typeName, ct]) => [
+      typeName,
+      createDrizzleContentRepository(db, ct.db.table_name)
+    ])
+  );
+  const taxonomyRepos = Object.fromEntries(
+    Object.entries(registry.taxonomy_types).map(([typeName, tt]) => [
+      typeName,
+      createDrizzleContentRepository(db, tt.db.table_name)
+    ])
+  );
+  const repos = { ...contentRepos, ...taxonomyRepos };
+  const mediaRepo = createMediaRepository(db);
+  const publicContentRepos = Object.fromEntries(
+    Object.entries(registry.content_types).map(([typeName, ct]) => [
+      typeName,
+      createDrizzleContentRepository(db, ct.db.table_name, {
+        relations: buildRelationsMap(ct.fields, registry)
+      })
+    ])
+  );
+  const publicTaxonomyRepos = Object.fromEntries(
+    Object.entries(registry.taxonomy_types).map(([typeName, tt]) => [
+      typeName,
+      createDrizzleContentRepository(db, tt.db.table_name, {
+        relations: buildRelationsMap(tt.fields, registry)
+      })
+    ])
+  );
+  const publicRepos = { ...publicContentRepos, ...publicTaxonomyRepos };
+  registerAuthRoutes(app, db);
+  app.use("/admin/api/*", authMiddleware);
+  app.use("/admin/api/*", mustChangePasswordCheck);
+  app.get("/api/openapi.json", (c) => {
+    const paths = {};
+    for (const ct of Object.values(registry.content_types)) {
+      const base = ct.default_base_path;
+      if (ct.only_one) {
+        paths[`/api/${base}`] = { get: { summary: `Get ${ct.label}`, tags: [ct.label] } };
+      } else {
+        paths[`/api/${base}`] = { get: { summary: `List published ${ct.label}`, tags: [ct.label] } };
+        paths[`/api/${base}/{slug}`] = { get: { summary: `Get ${ct.label} by slug`, tags: [ct.label] } };
+      }
+    }
+    for (const tt of Object.values(registry.taxonomy_types)) {
+      paths[`/api/taxonomy/${tt.name}`] = { get: { summary: `List published ${tt.label}`, tags: [tt.label] } };
+      paths[`/api/taxonomy/${tt.name}/{id}`] = { get: { summary: `Get ${tt.label} by id`, tags: [tt.label] } };
+    }
+    paths["/api/media"] = { get: { summary: "List media items", tags: ["Media"] } };
+    paths["/api/media/{id}"] = { get: { summary: "Get media item by id", tags: ["Media"] } };
+    return c.json({
+      openapi: "3.0.3",
+      info: { title: "Manguito CMS Public API", version: "1.0.0" },
+      paths
+    });
+  });
+  app.get(
+    "/admin/api/openapi.json",
+    (c) => c.json({
+      openapi: "3.0.3",
+      info: { title: "Manguito CMS Admin API", version: "1.0.0" },
+      paths: {}
+    })
+  );
+  registerPublicContentRoutes(app, registry, publicRepos, listRateLimit);
+  registerPublicMediaRoutes(app, mediaRepo, listRateLimit);
+  registerConfigRoute(
+    app,
+    {
+      name: cmsName,
+      ...maxFileSize !== void 0 && { maxFileSize },
+      // Cloud storage (s3/cloudinary) issues real presigned URLs, so the admin
+      // uploads straight to it — never routing the file through the server
+      // (which breaks on serverless). Local storage has no presigned receiver,
+      // so it uses the direct upload endpoint.
+      presignedUploads: storage.type !== "local"
+    },
+    rolesRegistry,
+    db
+  );
+  registerSchemaRoute(app, registry, db);
+  registerUserRoutes(app, db, requirePermission, requireHierarchy);
+  registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePermission, db);
+  registerAdminMediaRoutes(app, mediaRepo, storage, requirePermission, maxFileSize);
+  return { prefix, app };
+}
+
+// src/server/node.ts
+function createServer(options = {}) {
+  const port = options.port ?? Number(process.env["PORT"] ?? 3e3);
+  const _base_url = options.base_url ?? `http://localhost:${port}`;
+  const cors = {
+    origin: options.cors?.origin ?? (process.env["ALLOWED_ORIGIN"] ?? "*"),
+    methods: options.cors?.methods ?? [
+      "GET",
+      "POST",
+      "PUT",
+      "PATCH",
+      "DELETE"
+    ],
+    credentials: options.cors?.credentials ?? true
+  };
+  return {
+    type: "node",
+    cors,
+    getEntryPoint() {
+      return "node";
+    }
+  };
+}
+
+// src/index.ts
+function createAPIAdapter(options = {}) {
+  const prefix = options.prefix ?? "/api";
+  const media = options.media?.max_file_size !== void 0 ? { max_file_size: options.media.max_file_size } : void 0;
+  return {
+    prefix,
+    ...media !== void 0 && { media },
+    ...options.rateLimit !== void 0 && { rateLimit: options.rateLimit }
+  };
+}
+export {
+  createAPIAdapter,
+  createCmsApp,
+  createServer
+};
+//# sourceMappingURL=index.mjs.map