@bobbykim/manguito-cms-api 0.1.1 → 0.3.0

package/dist/index.js

@@ -5,6 +5,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -27,12 +30,868 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/relations.ts
+function quoteIdent(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+function paragraphMediaFieldNames(pType) {
+  return new Set(
+    pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name)
+  );
+}
+async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
+  const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
+  if (mediaColumns.length === 0) return [];
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  const cols = import_drizzle_orm2.sql.join(mediaColumns.map((c) => import_drizzle_orm2.sql.raw(quoteIdent(c))), import_drizzle_orm2.sql`, `);
+  const result = await db.execute(
+    import_drizzle_orm2.sql`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
+  );
+  const ids = [];
+  for (const row of result.rows) {
+    for (const col of mediaColumns) {
+      const v = row[col];
+      if (typeof v === "string" && v !== "") ids.push(v);
+    }
+  }
+  return ids;
+}
+async function persistParagraphField(db, itemId, parentType, fieldName, pType, items) {
+  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  const mediaFieldNames = paragraphMediaFieldNames(pType);
+  const added = [];
+  for (let i = 0; i < items.length; i++) {
+    const pItem = items[i];
+    const data = {
+      id: import_node_crypto.default.randomUUID(),
+      parent_id: itemId,
+      parent_type: parentType,
+      parent_field: fieldName,
+      order: i,
+      created_at: /* @__PURE__ */ new Date(),
+      updated_at: /* @__PURE__ */ new Date()
+    };
+    for (const pf of pType.fields) {
+      if (!pf.db_column || pf.db_column.junction) continue;
+      data[pf.db_column.column_name] = pItem[pf.name] ?? null;
+    }
+    const cols = import_drizzle_orm2.sql.join(Object.keys(data).map((k) => import_drizzle_orm2.sql.raw(quoteIdent(k))), import_drizzle_orm2.sql`, `);
+    const vals = import_drizzle_orm2.sql.join(Object.values(data).map((v) => import_drizzle_orm2.sql`${v}`), import_drizzle_orm2.sql`, `);
+    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
+    for (const name of mediaFieldNames) {
+      const val = pItem[name];
+      if (typeof val === "string" && val !== "") added.push(val);
+    }
+  }
+  return { added, removed };
+}
+async function deleteParagraphField(db, itemId, fieldName, pType) {
+  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
+  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
+  return { added: [], removed };
+}
+async function persistJunctionField(db, itemId, junction, relatedIds) {
+  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(junction.table_name));
+  const left = import_drizzle_orm2.sql.raw(quoteIdent(junction.left_column));
+  const right = import_drizzle_orm2.sql.raw(quoteIdent(junction.right_column));
+  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
+  for (const rid of relatedIds) {
+    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
+  }
+}
+function buildRelationsMap(fields, registry) {
+  const relations = {};
+  for (const field of fields) {
+    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
+      if (!field.db_column) continue;
+      relations[field.name] = { type: "media", fk_column: field.db_column.column_name };
+    } else if (field.field_type === "paragraph") {
+      const ref = field.ui_component.ref;
+      const pType = ref ? registry.paragraph_types[ref] : void 0;
+      if (!pType) continue;
+      relations[field.name] = { type: "paragraph", table: pType.db.table_name };
+    } else if (field.field_type === "reference") {
+      if (!field.db_column) continue;
+      if (field.db_column.junction) {
+        const j = field.db_column.junction;
+        relations[field.name] = {
+          type: "junction",
+          table: j.right_table,
+          junction_table: j.table_name,
+          left_column: j.left_column,
+          right_column: j.right_column,
+          order_column: j.order_column
+        };
+      } else if (field.db_column.foreign_key) {
+        relations[field.name] = {
+          type: "reference",
+          table: field.db_column.foreign_key.table,
+          fk_column: field.db_column.column_name
+        };
+      }
+    }
+  }
+  return relations;
+}
+function groupBy(items, key) {
+  const result = {};
+  for (const item of items) {
+    const k = String(item[key]);
+    if (!result[k]) result[k] = [];
+    result[k].push(item);
+  }
+  return result;
+}
+async function resolveRelationField(db, rows, fieldName, rel, cache, publishedOnly = false) {
+  if (rows.length === 0) return;
+  if (rel.type === "paragraph") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const result = await db.execute(
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
+    );
+    const byParent = groupBy(result.rows, "parent_id");
+    for (const row of rows) {
+      row[fieldName] = byParent[row["id"]] ?? [];
+    }
+  } else if (rel.type === "reference") {
+    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
+    if (fkValues.length === 0) {
+      for (const row of rows) row[fieldName] = null;
+      return;
+    }
+    const unique = [...new Set(fkValues)];
+    const uncached = unique.filter((id) => !cache.has(`${rel.table}:${id}`));
+    if (uncached.length > 0) {
+      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+      const publishedCond = publishedOnly ? import_drizzle_orm2.sql` AND published = true` : import_drizzle_orm2.sql``;
+      const result = await db.execute(
+        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${inList})${publishedCond}`
+      );
+      for (const item of result.rows) {
+        cache.set(`${rel.table}:${item["id"]}`, item);
+      }
+    }
+    for (const row of rows) {
+      const fkVal = row[rel.fk_column];
+      row[fieldName] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
+    }
+  } else if (rel.type === "junction") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const orderBy = rel.order_column ? import_drizzle_orm2.sql` ORDER BY "order" ASC` : import_drizzle_orm2.sql``;
+    const junctionResult = await db.execute(
+      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
+    );
+    const jRows = junctionResult.rows;
+    const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
+    const uncached = rightIds.filter((id) => !cache.has(`${rel.table}:${id}`));
+    if (uncached.length > 0) {
+      const rightInList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+      const publishedCond = publishedOnly ? import_drizzle_orm2.sql` AND published = true` : import_drizzle_orm2.sql``;
+      const entitiesResult = await db.execute(
+        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})${publishedCond}`
+      );
+      for (const item of entitiesResult.rows) {
+        cache.set(`${rel.table}:${item["id"]}`, item);
+      }
+    }
+    const byLeft = groupBy(jRows, rel.left_column);
+    for (const row of rows) {
+      const jEntries = byLeft[row["id"]] ?? [];
+      row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
+    }
+  } else if (rel.type === "media") {
+    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
+    if (fkValues.length === 0) {
+      for (const row of rows) row[fieldName] = null;
+      return;
+    }
+    const unique = [...new Set(fkValues)];
+    const uncached = unique.filter((id) => !cache.has(`media:${id}`));
+    if (uncached.length > 0) {
+      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+      const result = await db.execute(import_drizzle_orm2.sql`SELECT * FROM "media" WHERE id IN (${inList})`);
+      for (const item of result.rows) {
+        cache.set(`media:${item["id"]}`, item);
+      }
+    }
+    for (const row of rows) {
+      const fkVal = row[rel.fk_column];
+      row[fieldName] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
+    }
+  }
+}
+async function resolveRelationBareIds(db, rows, fieldName, rel) {
+  if (rows.length === 0) return;
+  if (rel.type === "paragraph") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const result = await db.execute(
+      import_drizzle_orm2.sql`SELECT id, parent_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
+    );
+    const byParent = groupBy(result.rows, "parent_id");
+    for (const row of rows) {
+      row[fieldName] = (byParent[row["id"]] ?? []).map((r) => r["id"]);
+    }
+  } else if (rel.type === "junction") {
+    const parentIds = rows.map((r) => r["id"]);
+    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
+    const result = await db.execute(
+      import_drizzle_orm2.sql`SELECT ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} AS left_id, ${import_drizzle_orm2.sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})`
+    );
+    const byLeft = groupBy(result.rows, "left_id");
+    for (const row of rows) {
+      row[fieldName] = (byLeft[row["id"]] ?? []).map((r) => r["right_id"]);
+    }
+  }
+}
+var import_node_crypto, import_drizzle_orm2;
+var init_relations = __esm({
+  "src/relations.ts"() {
+    "use strict";
+    import_node_crypto = __toESM(require("crypto"));
+    import_drizzle_orm2 = require("drizzle-orm");
+  }
+});
+
+// src/graphql/scalars.ts
+var import_graphql, DateTimeScalar, JSONScalar;
+var init_scalars = __esm({
+  "src/graphql/scalars.ts"() {
+    "use strict";
+    import_graphql = require("graphql");
+    DateTimeScalar = new import_graphql.GraphQLScalarType({
+      name: "DateTime",
+      description: "ISO-8601 date-time string",
+      serialize(value) {
+        if (value instanceof Date) return value.toISOString();
+        if (typeof value === "string") return value;
+        if (typeof value === "number") return new Date(value).toISOString();
+        throw new TypeError(`DateTime cannot serialize value: ${String(value)}`);
+      },
+      parseValue(value) {
+        if (typeof value !== "string") throw new TypeError("DateTime must be a string");
+        return value;
+      },
+      parseLiteral(ast) {
+        if (ast.kind !== import_graphql.Kind.STRING) throw new TypeError("DateTime must be a string");
+        return ast.value;
+      }
+    });
+    JSONScalar = new import_graphql.GraphQLScalarType({
+      name: "JSON",
+      description: "Arbitrary JSON value",
+      serialize: (value) => value,
+      parseValue: (value) => value,
+      parseLiteral: (ast, variables) => (0, import_graphql.valueFromASTUntyped)(ast, variables ?? void 0)
+    });
+  }
+});
+
+// src/graphql/type-mapping.ts
+function scalarOutputType(fieldType) {
+  switch (fieldType) {
+    case "text/plain":
+    case "text/rich":
+      return import_graphql2.GraphQLString;
+    case "integer":
+      return import_graphql2.GraphQLInt;
+    case "float":
+      return import_graphql2.GraphQLFloat;
+    case "boolean":
+      return import_graphql2.GraphQLBoolean;
+    case "date":
+      return DateTimeScalar;
+    case "programmatic":
+      return JSONScalar;
+    default:
+      return null;
+  }
+}
+var import_graphql2;
+var init_type_mapping = __esm({
+  "src/graphql/type-mapping.ts"() {
+    "use strict";
+    import_graphql2 = require("graphql");
+    init_scalars();
+  }
+});
+
+// src/graphql/naming.ts
+function schemaSegment(machineName) {
+  const idx = machineName.indexOf("--");
+  return idx === -1 ? machineName : machineName.slice(idx + 2);
+}
+function words(input) {
+  return input.split(/[_\s-]+/).filter(Boolean);
+}
+function toPascalCase(input) {
+  return words(input).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+}
+function toCamelCase(input) {
+  const pascal = toPascalCase(input);
+  return pascal.charAt(0).toLowerCase() + pascal.slice(1);
+}
+function pluralize(word) {
+  if (/[^aeiou]y$/.test(word)) return word.slice(0, -1) + "ies";
+  if (/(s|x|z|ch|sh)$/.test(word)) return word + "es";
+  return word + "s";
+}
+function isValidGraphQLName(name) {
+  return GRAPHQL_NAME.test(name);
+}
+function graphqlTypeName(machineName) {
+  return toPascalCase(schemaSegment(machineName));
+}
+function singleQueryName(machineName) {
+  return toCamelCase(schemaSegment(machineName));
+}
+function collectionQueryName(machineName) {
+  return pluralize(singleQueryName(machineName));
+}
+function buildFieldNameMap(schemaNames) {
+  const toG = /* @__PURE__ */ new Map();
+  const toS = /* @__PURE__ */ new Map();
+  for (const name of schemaNames) {
+    const g = toCamelCase(name);
+    toG.set(name, g);
+    toS.set(g, name);
+  }
+  return {
+    toGraphql: (schemaName) => toG.get(schemaName) ?? toCamelCase(schemaName),
+    toSchema: (graphqlName) => toS.get(graphqlName) ?? graphqlName
+  };
+}
+var GRAPHQL_NAME;
+var init_naming = __esm({
+  "src/graphql/naming.ts"() {
+    "use strict";
+    GRAPHQL_NAME = /^[_A-Za-z][_0-9A-Za-z]*$/;
+  }
+});
+
+// src/graphql/filters.ts
+function buildSortFieldEnum(typeName) {
+  return new import_graphql3.GraphQLEnumType({
+    name: `${typeName}SortField`,
+    values: Object.fromEntries(SORTABLE.map((s) => [s.gql, { value: s.column }]))
+  });
+}
+function comparableFilterInput(name, scalar) {
+  return new import_graphql3.GraphQLInputObjectType({
+    name,
+    fields: {
+      eq: { type: scalar },
+      in: { type: new import_graphql3.GraphQLList(new import_graphql3.GraphQLNonNull(scalar)) },
+      gt: { type: scalar },
+      gte: { type: scalar },
+      lt: { type: scalar },
+      lte: { type: scalar }
+    }
+  });
+}
+function equalityFilterInput(name, scalar) {
+  return new import_graphql3.GraphQLInputObjectType({
+    name,
+    fields: {
+      eq: { type: scalar },
+      in: { type: new import_graphql3.GraphQLList(new import_graphql3.GraphQLNonNull(scalar)) }
+    }
+  });
+}
+function filterInputForField(fieldType) {
+  const scalar = scalarOutputType(fieldType);
+  if (fieldType === "boolean") return BooleanFilter;
+  if (fieldType === "date") return DateTimeFilter;
+  if (fieldType === "integer") return IntFilter;
+  if (fieldType === "float") return FloatFilter;
+  if (fieldType === "reference") return IDFilter;
+  if (scalar === null) return null;
+  return StringFilter;
+}
+function buildFilterInputType(type) {
+  const fields = {};
+  fields["id"] = { type: IDFilter };
+  fields["published"] = { type: BooleanFilter };
+  fields["createdAt"] = { type: DateTimeFilter };
+  fields["updatedAt"] = { type: DateTimeFilter };
+  if (type.schema_type === "content-type") fields["slug"] = { type: StringFilter };
+  for (const f of type.fields) {
+    if (f.field_type === "programmatic" || f.field_type === "paragraph") continue;
+    if (f.field_type === "image" || f.field_type === "video" || f.field_type === "file") continue;
+    const input = filterInputForField(f.field_type);
+    if (input) fields[buildFieldNameMap([f.name]).toGraphql(f.name)] = { type: input };
+  }
+  if (Object.keys(fields).length === 0) return null;
+  return new import_graphql3.GraphQLInputObjectType({ name: `${graphqlTypeName(type.name)}Filter`, fields });
+}
+function translateFilters(input, nameMap) {
+  const out = {};
+  if (!input) return out;
+  for (const [gqlField, raw] of Object.entries(input)) {
+    if (raw === null || typeof raw !== "object") continue;
+    const column = nameMap.toSchema(gqlField);
+    const spec = raw;
+    if (spec["eq"] !== void 0) {
+      out[column] = spec["eq"];
+    } else if (Array.isArray(spec["in"])) {
+      out[column] = spec["in"];
+    } else {
+      const op = {};
+      for (const k of ["gt", "gte", "lt", "lte"]) {
+        if (spec[k] !== void 0) op[k] = spec[k];
+      }
+      if (Object.keys(op).length > 0) out[column] = op;
+    }
+  }
+  return out;
+}
+var import_graphql3, SortOrderEnum, SORTABLE, StringFilter, BooleanFilter, DateTimeFilter, IDFilter, IntFilter, FloatFilter;
+var init_filters = __esm({
+  "src/graphql/filters.ts"() {
+    "use strict";
+    import_graphql3 = require("graphql");
+    init_naming();
+    init_type_mapping();
+    init_scalars();
+    SortOrderEnum = new import_graphql3.GraphQLEnumType({
+      name: "SortOrder",
+      values: { ASC: { value: "asc" }, DESC: { value: "desc" } }
+    });
+    SORTABLE = [
+      { gql: "title", column: "title" },
+      { gql: "createdAt", column: "created_at" },
+      { gql: "updatedAt", column: "updated_at" }
+    ];
+    StringFilter = equalityFilterInput("StringFilter", import_graphql3.GraphQLString);
+    BooleanFilter = new import_graphql3.GraphQLInputObjectType({
+      name: "BooleanFilter",
+      fields: { eq: { type: import_graphql3.GraphQLBoolean } }
+    });
+    DateTimeFilter = comparableFilterInput("DateTimeFilter", DateTimeScalar);
+    IDFilter = equalityFilterInput("IDFilter", import_graphql3.GraphQLString);
+    IntFilter = comparableFilterInput("IntFilter", import_graphql3.GraphQLInt);
+    FloatFilter = comparableFilterInput("FloatFilter", import_graphql3.GraphQLFloat);
+  }
+});
+
+// src/graphql/resolvers.ts
+function codeError2(code, message) {
+  return new import_graphql4.GraphQLError(message, { extensions: { code } });
+}
+function isPublished2(item) {
+  return !!item && item["published"] === true;
+}
+function scalarFieldResolver(schemaName) {
+  return (parent) => parent[schemaName];
+}
+function relationFieldResolver(typeName, schemaFieldName) {
+  return (parent, _args, ctx) => ctx.loaders.load(typeName, schemaFieldName, parent);
+}
+function programmaticFieldResolver(typeName, schemaFieldName) {
+  return async (parent, _args, ctx) => {
+    let p = ctx.programmaticMemo.get(parent);
+    if (!p) {
+      p = ctx.resolver.resolveItem(typeName, parent);
+      ctx.programmaticMemo.set(parent, p);
+    }
+    return (await p)[schemaFieldName];
+  };
+}
+function collectionResolver(typeName, nameMap) {
+  return async (_root, args, ctx) => {
+    const page = args.page ?? 1;
+    const perPage = args.perPage ?? 10;
+    if (!Number.isInteger(page) || page < 1) {
+      throw codeError2("INVALID_PAGINATION", "page must be \u2265 1");
+    }
+    if (!Number.isInteger(perPage) || perPage < 1 || perPage > 100) {
+      throw codeError2("INVALID_PAGINATION", "perPage must be between 1 and 100");
+    }
+    const repo = ctx.repos[typeName];
+    const result = await repo.findMany({
+      published_only: true,
+      page,
+      per_page: perPage,
+      sort_by: args.sortBy ?? "created_at",
+      sort_order: args.sortOrder ?? "asc",
+      filters: translateFilters(args.filter, nameMap)
+    });
+    return { data: result.data, meta: result.meta };
+  };
+}
+function singleBySlugResolver(typeName) {
+  return async (_root, args, ctx) => {
+    const repo = ctx.repos[typeName];
+    const item = await repo.findBySlug(args.slug);
+    return isPublished2(item) ? item : null;
+  };
+}
+function singletonResolver(typeName) {
+  return async (_root, _args, ctx) => {
+    const repo = ctx.repos[typeName];
+    const result = await repo.findMany({ published_only: true, page: 1, per_page: 1 });
+    return result.data[0] ?? null;
+  };
+}
+function taxonomySingleResolver(typeName) {
+  return async (_root, args, ctx) => {
+    const repo = ctx.repos[typeName];
+    const item = await repo.findOne(args.id);
+    return isPublished2(item) ? item : null;
+  };
+}
+var import_graphql4;
+var init_resolvers = __esm({
+  "src/graphql/resolvers.ts"() {
+    "use strict";
+    import_graphql4 = require("graphql");
+    init_filters();
+  }
+});
+
+// src/graphql/schema.ts
+function buildGraphQLSchema(registry) {
+  const objectTypes = /* @__PURE__ */ new Map();
+  const enumTypes = /* @__PURE__ */ new Map();
+  for (const [name, enumType] of Object.entries(registry.enum_types)) {
+    if (enumType.values.every(isValidGraphQLName)) {
+      enumTypes.set(
+        name,
+        new import_graphql5.GraphQLEnumType({
+          name: graphqlTypeName(name),
+          values: Object.fromEntries(enumType.values.map((v) => [v, { value: v }]))
+        })
+      );
+    } else {
+      process.stderr.write(
+        `\u26A0 enum '${name}' has values that aren't valid GraphQL identifiers; exposing as String
+`
+      );
+    }
+  }
+  function outputTypeForField(field) {
+    const scalar = scalarOutputType(field.field_type);
+    if (scalar) return field.required ? new import_graphql5.GraphQLNonNull(scalar) : scalar;
+    if (field.field_type === "enum") {
+      const ref = field.ui_component.component === "select" ? field.ui_component.enum_ref : void 0;
+      const et = ref ? enumTypes.get(ref) : void 0;
+      const t = et ?? import_graphql5.GraphQLString;
+      return field.required ? new import_graphql5.GraphQLNonNull(t) : t;
+    }
+    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
+      return MEDIA;
+    }
+    if (field.field_type === "paragraph") {
+      const ref = field.ui_component.component === "paragraph-embed" ? field.ui_component.ref : void 0;
+      const target = ref ? objectTypes.get(ref) : void 0;
+      if (ref && !target) {
+        process.stderr.write(
+          `\u26A0 paragraph field '${field.name}' targets unknown paragraph type '${ref}'; exposing as Media
+`
+        );
+      }
+      return new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(target ?? MEDIA));
+    }
+    if (field.field_type === "reference") {
+      const ref = field.ui_component.component === "typeahead-select" ? field.ui_component.ref : void 0;
+      const target = ref ? objectTypes.get(ref) : void 0;
+      if (ref && !target) {
+        process.stderr.write(`\u26A0 reference field '${field.name}' targets unknown type '${ref}'; exposing as Media
+`);
+      }
+      const rel = field.ui_component.component === "typeahead-select" ? field.ui_component.rel : void 0;
+      const isMany = rel === "many-to-many" || rel === "one-to-many";
+      const t = target ?? MEDIA;
+      return isMany ? new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(t)) : t;
+    }
+    return import_graphql5.GraphQLString;
+  }
+  function buildObjectType(machineName, type) {
+    return new import_graphql5.GraphQLObjectType({
+      name: graphqlTypeName(machineName),
+      fields: () => {
+        const fields = {};
+        fields["id"] = { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLID), resolve: (p) => p["id"] };
+        if (type.schema_type !== "paragraph-type") {
+          fields["published"] = { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLBoolean), resolve: (p) => p["published"] };
+        }
+        if (type.schema_type === "content-type") {
+          fields["slug"] = { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (p) => p["slug"] };
+        }
+        fields["createdAt"] = { type: new import_graphql5.GraphQLNonNull(DateTimeScalar), resolve: (p) => p["created_at"] };
+        fields["updatedAt"] = { type: new import_graphql5.GraphQLNonNull(DateTimeScalar), resolve: (p) => p["updated_at"] };
+        for (const field of type.fields) {
+          const gqlName = toCamelCase(field.name);
+          const outType = outputTypeForField(field);
+          let resolve;
+          if (field.field_type === "programmatic") {
+            resolve = programmaticFieldResolver(machineName, field.name);
+          } else if (field.field_type === "reference" || field.field_type === "paragraph" || field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
+            resolve = relationFieldResolver(machineName, field.name);
+          } else {
+            resolve = scalarFieldResolver(field.name);
+          }
+          fields[gqlName] = { type: outType, resolve };
+        }
+        return fields;
+      }
+    });
+  }
+  const typeNameOwners = /* @__PURE__ */ new Map();
+  function registerTypeName(machineName) {
+    const gqlName = graphqlTypeName(machineName);
+    const owner = typeNameOwners.get(gqlName);
+    if (owner !== void 0 && owner !== machineName) {
+      throw new Error(
+        `GraphQL type name collision: '${gqlName}' is produced by both '${owner}' and '${machineName}'. Rename one schema's machine name segment so their GraphQL type names differ.`
+      );
+    }
+    typeNameOwners.set(gqlName, machineName);
+  }
+  for (const [name, ct] of Object.entries(registry.content_types)) {
+    registerTypeName(name);
+    objectTypes.set(name, buildObjectType(name, ct));
+  }
+  for (const [name, tt] of Object.entries(registry.taxonomy_types)) {
+    registerTypeName(name);
+    objectTypes.set(name, buildObjectType(name, tt));
+  }
+  for (const [name, pt] of Object.entries(registry.paragraph_types)) {
+    registerTypeName(name);
+    objectTypes.set(name, buildObjectType(name, pt));
+  }
+  const queryFields = {};
+  for (const [name, ct] of Object.entries(registry.content_types)) {
+    const objType = objectTypes.get(name);
+    const nameMap = buildFieldNameMap(ct.fields.map((f) => f.name));
+    if (ct.only_one) {
+      queryFields[singleQueryName(name)] = { type: objType, resolve: singletonResolver(name) };
+      continue;
+    }
+    const listType = new import_graphql5.GraphQLObjectType({
+      name: `${graphqlTypeName(name)}List`,
+      fields: {
+        data: { type: new import_graphql5.GraphQLNonNull(new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(objType))), resolve: (r) => r.data },
+        meta: { type: new import_graphql5.GraphQLNonNull(PAGE_META), resolve: (r) => r.meta }
+      }
+    });
+    const filterType = buildFilterInputType(ct);
+    queryFields[collectionQueryName(name)] = {
+      type: new import_graphql5.GraphQLNonNull(listType),
+      args: {
+        page: { type: import_graphql5.GraphQLInt },
+        perPage: { type: import_graphql5.GraphQLInt },
+        sortBy: { type: buildSortFieldEnum(graphqlTypeName(name)) },
+        sortOrder: { type: SortOrderEnum },
+        ...filterType ? { filter: { type: filterType } } : {}
+      },
+      resolve: collectionResolver(name, nameMap)
+    };
+    queryFields[singleQueryName(name)] = {
+      type: objType,
+      args: { slug: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString) } },
+      resolve: singleBySlugResolver(name)
+    };
+  }
+  for (const [name, tt] of Object.entries(registry.taxonomy_types)) {
+    const objType = objectTypes.get(name);
+    const listType = new import_graphql5.GraphQLObjectType({
+      name: `${graphqlTypeName(name)}List`,
+      fields: {
+        data: { type: new import_graphql5.GraphQLNonNull(new import_graphql5.GraphQLList(new import_graphql5.GraphQLNonNull(objType))), resolve: (r) => r.data },
+        meta: { type: new import_graphql5.GraphQLNonNull(PAGE_META), resolve: (r) => r.meta }
+      }
+    });
+    queryFields[collectionQueryName(name)] = {
+      type: new import_graphql5.GraphQLNonNull(listType),
+      args: { page: { type: import_graphql5.GraphQLInt }, perPage: { type: import_graphql5.GraphQLInt } },
+      resolve: collectionResolver(name, buildFieldNameMap(tt.fields.map((f) => f.name)))
+    };
+    queryFields[singleQueryName(name)] = {
+      type: objType,
+      args: { id: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLID) } },
+      resolve: taxonomySingleResolver(name)
+    };
+  }
+  return new import_graphql5.GraphQLSchema({
+    query: new import_graphql5.GraphQLObjectType({ name: "Query", fields: queryFields })
+  });
+}
+var import_graphql5, PAGE_META, MEDIA;
+var init_schema = __esm({
+  "src/graphql/schema.ts"() {
+    "use strict";
+    import_graphql5 = require("graphql");
+    init_scalars();
+    init_type_mapping();
+    init_naming();
+    init_filters();
+    init_resolvers();
+    PAGE_META = new import_graphql5.GraphQLObjectType({
+      name: "PageMeta",
+      fields: {
+        total: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.total },
+        page: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.page },
+        perPage: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.per_page },
+        totalPages: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLInt), resolve: (m) => m.total_pages },
+        hasNext: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLBoolean), resolve: (m) => m.has_next },
+        hasPrev: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLBoolean), resolve: (m) => m.has_prev }
+      }
+    });
+    MEDIA = new import_graphql5.GraphQLObjectType({
+      name: "Media",
+      fields: {
+        id: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLID), resolve: (m) => m.id },
+        type: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (m) => m.type },
+        url: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (m) => m.url },
+        mimeType: { type: new import_graphql5.GraphQLNonNull(import_graphql5.GraphQLString), resolve: (m) => m.mime_type },
+        alt: { type: import_graphql5.GraphQLString, resolve: (m) => m.alt },
+        fileSize: { type: import_graphql5.GraphQLInt, resolve: (m) => m.file_size },
+        width: { type: import_graphql5.GraphQLInt, resolve: (m) => m.width },
+        height: { type: import_graphql5.GraphQLInt, resolve: (m) => m.height },
+        duration: { type: import_graphql5.GraphQLInt, resolve: (m) => m.duration }
+      }
+    });
+  }
+});
+
+// src/graphql/dataloaders.ts
+function createRelationLoaders(db, registry) {
+  const relMaps = /* @__PURE__ */ new Map();
+  const loaders = /* @__PURE__ */ new Map();
+  const cache = /* @__PURE__ */ new Map();
+  function relationsFor(typeName) {
+    let m = relMaps.get(typeName);
+    if (!m) {
+      const type = registry.content_types[typeName] ?? registry.taxonomy_types[typeName] ?? registry.paragraph_types[typeName];
+      m = type ? buildRelationsMap(type.fields, registry) : {};
+      relMaps.set(typeName, m);
+    }
+    return m;
+  }
+  function loaderFor(typeName, fieldName, rel) {
+    const key = `${typeName}:${fieldName}`;
+    let dl = loaders.get(key);
+    if (!dl) {
+      dl = new import_dataloader.default(
+        async (parents) => {
+          const rows = parents;
+          await resolveRelationField(db, rows, fieldName, rel, cache, true);
+          return rows.map((r) => r[fieldName]);
+        },
+        // Batch within a tick; do not memoize by parent identity (rows are mutated
+        // and may recur across nesting levels).
+        { cache: false }
+      );
+      loaders.set(key, dl);
+    }
+    return dl;
+  }
+  return {
+    async load(typeName, fieldName, parent) {
+      const rel = relationsFor(typeName)[fieldName];
+      if (!rel) return null;
+      return loaderFor(typeName, fieldName, rel).load(parent);
+    }
+  };
+}
+var import_dataloader;
+var init_dataloaders = __esm({
+  "src/graphql/dataloaders.ts"() {
+    "use strict";
+    import_dataloader = __toESM(require("dataloader"));
+    init_relations();
+  }
+});
+
+// src/graphql/security.ts
+function buildArmorPlugin(options) {
+  const armor = new import_graphql_armor.EnvelopArmor({
+    maxDepth: { n: options.maxDepth },
+    costLimit: { maxCost: options.maxComplexity },
+    maxAliases: { n: 15 },
+    maxDirectives: { n: 50 },
+    blockFieldSuggestion: { enabled: true }
+    // maxTokens is intentionally left at Armor's secure default (n=1000) to bound
+    // GraphQL document token count at parse time, a layer the depth/cost/alias/directive
+    // limits do not cover.
+  });
+  return armor.protect();
+}
+function introspectionPlugin(enabled) {
+  return {
+    onValidate({ addValidationRule }) {
+      if (!enabled) addValidationRule(import_graphql6.NoSchemaIntrospectionCustomRule);
+    }
+  };
+}
+var import_graphql_armor, import_graphql6;
+var init_security = __esm({
+  "src/graphql/security.ts"() {
+    "use strict";
+    import_graphql_armor = require("@escape.tech/graphql-armor");
+    import_graphql6 = require("graphql");
+  }
+});
+
+// src/graphql/handler.ts
+var handler_exports = {};
+__export(handler_exports, {
+  createGraphQLHandler: () => createGraphQLHandler
+});
+function createGraphQLHandler(registry, repos, resolver, db, options) {
+  const schema = buildGraphQLSchema(registry);
+  const { plugins } = buildArmorPlugin({
+    maxDepth: options.maxDepth,
+    maxComplexity: options.maxComplexity
+  });
+  const yoga = (0, import_graphql_yoga.createYoga)({
+    schema,
+    graphqlEndpoint: "/graphql",
+    graphiql: options.graphiql,
+    landingPage: false,
+    // buildArmorPlugin's return type is `unknown[]` (see security.ts) since Armor's
+    // plugin shapes aren't part of its public typings; Yoga's `plugins` option only
+    // accepts its own `Plugin` type, so the cast bridges the two.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    plugins: [...plugins, introspectionPlugin(options.introspection)],
+    context: () => ({
+      db,
+      registry,
+      repos,
+      resolver,
+      loaders: createRelationLoaders(db, registry),
+      programmaticMemo: /* @__PURE__ */ new WeakMap()
+    })
+  });
+  return (c) => yoga.fetch(c.req.raw, {});
+}
+var import_graphql_yoga;
+var init_handler = __esm({
+  "src/graphql/handler.ts"() {
+    "use strict";
+    import_graphql_yoga = require("graphql-yoga");
+    init_schema();
+    init_dataloaders();
+    init_security();
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
   createAPIAdapter: () => createAPIAdapter,
   createCmsApp: () => createCmsApp,
-  createServer: () => createServer
+  createProgrammaticResolver: () => createProgrammaticResolver,
+  createServer: () => createServer,
+  resolverKey: () => resolverKey,
+  validateResolverBindings: () => validateResolverBindings
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -69,26 +928,43 @@ function createCorsMiddleware(corsConfig) {
 }
 
 // src/middleware/security-headers.ts
+var GRAPHIQL_CDN = "https://unpkg.com";
 function createSecurityHeadersMiddleware(options = {}) {
   const connectSrc = ["'self'", ...options.connectSrc ?? []].join(" ");
-  const csp = [
-    "default-src 'self'",
-    "img-src 'self' data: https:",
-    "media-src 'self' https:",
-    "style-src 'self' 'unsafe-inline'",
-    "script-src 'self'",
-    "font-src 'self' data:",
-    `connect-src ${connectSrc}`,
-    "frame-ancestors 'none'",
-    "base-uri 'self'",
-    "form-action 'self'"
-  ].join("; ");
+  function buildCsp(parts) {
+    return [
+      "default-src 'self'",
+      "img-src 'self' data: https:",
+      "media-src 'self' https:",
+      `style-src ${parts.styleSrc}`,
+      `script-src ${parts.scriptSrc}`,
+      "font-src 'self' data:",
+      `connect-src ${parts.connectSrc}`,
+      ...parts.workerSrc ? [`worker-src ${parts.workerSrc}`] : [],
+      "frame-ancestors 'none'",
+      "base-uri 'self'",
+      "form-action 'self'"
+    ].join("; ");
+  }
+  const csp = buildCsp({
+    scriptSrc: "'self'",
+    styleSrc: "'self' 'unsafe-inline'",
+    connectSrc
+  });
+  const graphiqlCsp = buildCsp({
+    scriptSrc: `'self' 'unsafe-inline' ${GRAPHIQL_CDN}`,
+    styleSrc: `'self' 'unsafe-inline' ${GRAPHIQL_CDN}`,
+    connectSrc: `${connectSrc} ${GRAPHIQL_CDN}`,
+    workerSrc: "'self' blob:"
+  });
+  const graphiqlPath = options.graphiqlPath;
   return async function securityHeaders(c, next) {
     await next();
     c.res.headers.set("X-Content-Type-Options", "nosniff");
     c.res.headers.set("X-Frame-Options", "DENY");
     c.res.headers.set("Referrer-Policy", "no-referrer");
-    c.res.headers.set("Content-Security-Policy", csp);
+    const isGraphiql = graphiqlPath !== void 0 && c.req.path === graphiqlPath;
+    c.res.headers.set("Content-Security-Policy", isGraphiql ? graphiqlCsp : csp);
   };
 }
 
@@ -455,12 +1331,146 @@ function validateRoles(roles) {
         `Fatal: roles registry failed to build \u2014 duplicate role name "${role.name}". Run \`manguito validate\` to check your roles schema.`
       );
     }
-    namesSeen.add(role.name);
+    namesSeen.add(role.name);
+  }
+}
+function buildRolesRegistry(roles) {
+  validateRoles(roles);
+  return Object.fromEntries(roles.map((r) => [r.name, r]));
+}
+
+// src/programmatic/resolve.ts
+var DEFAULT_TIMEOUT_MS = 5e3;
+var LIST_CONCURRENCY = 10;
+function resolverKey(schema, field) {
+  return `${schema}::${field}`;
+}
+function validateResolverBindings(registry, resolvers) {
+  const declared = /* @__PURE__ */ new Set();
+  const schemas = [
+    ...Object.values(registry.content_types),
+    ...Object.values(registry.taxonomy_types)
+  ];
+  for (const schema of schemas) {
+    for (const field of schema.fields) {
+      if (field.field_type === "programmatic") {
+        declared.add(resolverKey(schema.name, field.name));
+      }
+    }
+  }
+  const missing = [];
+  for (const key of declared) if (!resolvers.has(key)) missing.push(key);
+  const orphans = [];
+  for (const key of resolvers.keys()) if (!declared.has(key)) orphans.push(key);
+  if (missing.length === 0 && orphans.length === 0) return;
+  const lines = ["\u2717 Programmatic field resolver bindings are invalid."];
+  if (missing.length > 0) {
+    lines.push("", '  Declared as `type: "programmatic"` but no resolver found:');
+    for (const k of missing) lines.push(`    - ${k}  (add a programmaticField in src/programmatic)`);
+  }
+  if (orphans.length > 0) {
+    lines.push("", "  Resolver has no matching programmatic field in the schema:");
+    for (const k of orphans) lines.push(`    - ${k}`);
+  }
+  lines.push("", "Exiting.");
+  throw new Error(lines.join("\n"));
+}
+function buildContext(row) {
+  return {
+    get: (name) => row[name],
+    record: row
+  };
+}
+async function withTimeout(p, ms) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error("resolver timeout")), ms);
+  });
+  try {
+    return await Promise.race([p, timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function runOne(def, row, onError) {
+  const fallback = def.fallback ?? null;
+  try {
+    const result = await withTimeout(
+      Promise.resolve(def.resolve(buildContext(row))),
+      def.timeout ?? DEFAULT_TIMEOUT_MS
+    );
+    return { value: result === void 0 ? null : result, failed: false };
+  } catch (err) {
+    onError(
+      `\u26A0 programmatic field ${resolverKey(def.schema, def.field)} failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return { value: fallback, failed: true };
+  }
+}
+async function runPool(items, limit, fn) {
+  let i = 0;
+  async function worker() {
+    while (i < items.length) {
+      const idx = i++;
+      await fn(items[idx]);
+    }
   }
+  const workers = Array.from({ length: Math.min(limit, items.length) }, worker);
+  await Promise.all(workers);
 }
-function buildRolesRegistry(roles) {
-  validateRoles(roles);
-  return Object.fromEntries(roles.map((r) => [r.name, r]));
+function createProgrammaticResolver(resolvers, options) {
+  const onError = options?.onError ?? ((message) => {
+    process.stderr.write(message + "\n");
+  });
+  const bySchema = /* @__PURE__ */ new Map();
+  for (const def of resolvers.values()) {
+    const arr = bySchema.get(def.schema) ?? [];
+    arr.push(def);
+    bySchema.set(def.schema, arr);
+  }
+  const cache = /* @__PURE__ */ new Map();
+  async function resolveField(def, row) {
+    const itemId = row["id"] !== void 0 ? String(row["id"]) : "";
+    if (def.cache && itemId) {
+      const key = `${resolverKey(def.schema, def.field)}::${itemId}`;
+      const now = Date.now();
+      const hit = cache.get(key);
+      if (hit && hit.expires > now) return hit.value;
+      const { value: value2, failed } = await runOne(def, row, onError);
+      if (!failed) cache.set(key, { value: value2, expires: now + def.cache.ttl * 1e3 });
+      return value2;
+    }
+    const { value } = await runOne(def, row, onError);
+    return value;
+  }
+  async function resolveItem(schema, row) {
+    const defs = bySchema.get(schema);
+    if (!defs || defs.length === 0) return { ...row };
+    const out = { ...row };
+    await Promise.all(
+      defs.map(async (def) => {
+        out[def.field] = await resolveField(def, row);
+      })
+    );
+    return out;
+  }
+  async function resolveList(schema, rows) {
+    const defs = (bySchema.get(schema) ?? []).filter((d) => d.on_list === true);
+    if (defs.length === 0) return rows.map((r) => ({ ...r }));
+    const out = rows.map((r) => ({ ...r }));
+    const tasks = [];
+    for (let i = 0; i < rows.length; i++) {
+      for (const def of defs) tasks.push({ rowIndex: i, def });
+    }
+    await runPool(tasks, LIST_CONCURRENCY, async ({ rowIndex, def }) => {
+      out[rowIndex][def.field] = await resolveField(def, rows[rowIndex]);
+    });
+    return out;
+  }
+  function hasSchema(schema) {
+    return bySchema.has(schema);
+  }
+  return { resolveItem, resolveList, hasSchema };
 }
 
 // src/routes/query-params.ts
@@ -514,7 +1524,7 @@ function parseFilters(url, validFields) {
 function isPublished(item) {
   return item["published"] === true;
 }
-function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
+function registerPublicContentRoutes(app, registry, repos, listRateLimit, resolver) {
   function registerListRoute(path, handler) {
     if (listRateLimit) {
       app.get(path, listRateLimit, handler);
@@ -541,13 +1551,13 @@ function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
     const basePath = contentType.default_base_path;
     const repo = repos[typeName];
     if (!repo) continue;
-    const schemaFieldNames = /* @__PURE__ */ new Set([
-      ...contentType.fields.map((f) => f.name),
-      ...contentType.system_fields.map((f) => f.name)
-    ]);
     const relationFieldNames = new Set(
       contentType.fields.filter((f) => RELATION_FIELD_TYPES.has(f.field_type)).map((f) => f.name)
     );
+    const filterableFieldNames = /* @__PURE__ */ new Set([
+      ...contentType.fields.filter((f) => f.field_type !== "programmatic").map((f) => f.name),
+      ...contentType.system_fields.map((f) => f.name)
+    ]);
     if (contentType.only_one) {
       app.get(`/api/${basePath}`, async (c) => {
         const result = await repo.findMany({ published_only: true, page: 1, per_page: 1 });
@@ -557,7 +1567,9 @@ function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
             404
           );
         }
-        return c.json({ ok: true, data: result.data[0] });
+        let data = result.data[0];
+        if (resolver?.hasSchema(typeName)) data = await resolver.resolveItem(typeName, data);
+        return c.json({ ok: true, data });
       });
     } else {
       registerListRoute(`/api/${basePath}`, async (c) => {
@@ -600,7 +1612,7 @@ function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
             400
           );
         }
-        const filtersResult = parseFilters(c.req.url, schemaFieldNames);
+        const filtersResult = parseFilters(c.req.url, filterableFieldNames);
         if (!filtersResult.ok) {
           return c.json(
             {
@@ -637,6 +1649,10 @@ function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
           filters: filtersResult.filters,
           include
         });
+        if (resolver?.hasSchema(typeName)) {
+          const resolved = await resolver.resolveList(typeName, result.data);
+          return c.json({ ...result, data: resolved });
+        }
         return c.json(result);
       });
       app.get(`/api/${basePath}/:slug`, async (c) => {
@@ -666,7 +1682,9 @@ function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
             404
           );
         }
-        return c.json({ ok: true, data: item });
+        let data = item;
+        if (resolver?.hasSchema(typeName)) data = await resolver.resolveItem(typeName, data);
+        return c.json({ ok: true, data });
       });
     }
   }
@@ -692,6 +1710,10 @@ function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
         page: pagination.page,
         per_page: pagination.per_page
       });
+      if (resolver?.hasSchema(typeName)) {
+        const resolved = await resolver.resolveList(typeName, result.data);
+        return c.json({ ...result, data: resolved });
+      }
       return c.json(result);
     });
     app.get(`/api/taxonomy/${typeName}/:id`, async (c) => {
@@ -706,7 +1728,9 @@ function registerPublicContentRoutes(app, registry, repos, listRateLimit) {
           404
         );
       }
-      return c.json({ ok: true, data: item });
+      let data = item;
+      if (resolver?.hasSchema(typeName)) data = await resolver.resolveItem(typeName, data);
+      return c.json({ ok: true, data });
     });
   }
 }
@@ -811,228 +1835,8 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
   if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
 }
 
-// src/relations.ts
-var import_node_crypto = __toESM(require("crypto"));
-var import_drizzle_orm2 = require("drizzle-orm");
-function quoteIdent(name) {
-  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
-  return `"${name}"`;
-}
-function paragraphMediaFieldNames(pType) {
-  return new Set(
-    pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name)
-  );
-}
-async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
-  const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
-  if (mediaColumns.length === 0) return [];
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  const cols = import_drizzle_orm2.sql.join(mediaColumns.map((c) => import_drizzle_orm2.sql.raw(quoteIdent(c))), import_drizzle_orm2.sql`, `);
-  const result = await db.execute(
-    import_drizzle_orm2.sql`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
-  );
-  const ids = [];
-  for (const row of result.rows) {
-    for (const col of mediaColumns) {
-      const v = row[col];
-      if (typeof v === "string" && v !== "") ids.push(v);
-    }
-  }
-  return ids;
-}
-async function persistParagraphField(db, itemId, parentType, fieldName, pType, items) {
-  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
-  const mediaFieldNames = paragraphMediaFieldNames(pType);
-  const added = [];
-  for (let i = 0; i < items.length; i++) {
-    const pItem = items[i];
-    const data = {
-      id: import_node_crypto.default.randomUUID(),
-      parent_id: itemId,
-      parent_type: parentType,
-      parent_field: fieldName,
-      order: i,
-      created_at: /* @__PURE__ */ new Date(),
-      updated_at: /* @__PURE__ */ new Date()
-    };
-    for (const pf of pType.fields) {
-      if (!pf.db_column || pf.db_column.junction) continue;
-      data[pf.db_column.column_name] = pItem[pf.name] ?? null;
-    }
-    const cols = import_drizzle_orm2.sql.join(Object.keys(data).map((k) => import_drizzle_orm2.sql.raw(quoteIdent(k))), import_drizzle_orm2.sql`, `);
-    const vals = import_drizzle_orm2.sql.join(Object.values(data).map((v) => import_drizzle_orm2.sql`${v}`), import_drizzle_orm2.sql`, `);
-    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
-    for (const name of mediaFieldNames) {
-      const val = pItem[name];
-      if (typeof val === "string" && val !== "") added.push(val);
-    }
-  }
-  return { added, removed };
-}
-async function deleteParagraphField(db, itemId, fieldName, pType) {
-  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(pType.db.table_name));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
-  return { added: [], removed };
-}
-async function persistJunctionField(db, itemId, junction, relatedIds) {
-  const tbl = import_drizzle_orm2.sql.raw(quoteIdent(junction.table_name));
-  const left = import_drizzle_orm2.sql.raw(quoteIdent(junction.left_column));
-  const right = import_drizzle_orm2.sql.raw(quoteIdent(junction.right_column));
-  await db.execute(import_drizzle_orm2.sql`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
-  for (const rid of relatedIds) {
-    await db.execute(import_drizzle_orm2.sql`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
-  }
-}
-function buildRelationsMap(fields, registry) {
-  const relations = {};
-  for (const field of fields) {
-    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
-      if (!field.db_column) continue;
-      relations[field.name] = { type: "media", fk_column: field.db_column.column_name };
-    } else if (field.field_type === "paragraph") {
-      const ref = field.ui_component.ref;
-      const pType = ref ? registry.paragraph_types[ref] : void 0;
-      if (!pType) continue;
-      relations[field.name] = { type: "paragraph", table: pType.db.table_name };
-    } else if (field.field_type === "reference") {
-      if (!field.db_column) continue;
-      if (field.db_column.junction) {
-        const j = field.db_column.junction;
-        relations[field.name] = {
-          type: "junction",
-          table: j.right_table,
-          junction_table: j.table_name,
-          left_column: j.left_column,
-          right_column: j.right_column,
-          order_column: j.order_column
-        };
-      } else if (field.db_column.foreign_key) {
-        relations[field.name] = {
-          type: "reference",
-          table: field.db_column.foreign_key.table,
-          fk_column: field.db_column.column_name
-        };
-      }
-    }
-  }
-  return relations;
-}
-function groupBy(items, key) {
-  const result = {};
-  for (const item of items) {
-    const k = String(item[key]);
-    if (!result[k]) result[k] = [];
-    result[k].push(item);
-  }
-  return result;
-}
-async function resolveRelationField(db, rows, fieldName, rel, cache) {
-  if (rows.length === 0) return;
-  if (rel.type === "paragraph") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
-    );
-    const byParent = groupBy(result.rows, "parent_id");
-    for (const row of rows) {
-      row[fieldName] = byParent[row["id"]] ?? [];
-    }
-  } else if (rel.type === "reference") {
-    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
-    if (fkValues.length === 0) {
-      for (const row of rows) row[fieldName] = null;
-      return;
-    }
-    const unique = [...new Set(fkValues)];
-    const uncached = unique.filter((id) => !cache.has(`${rel.table}:${id}`));
-    if (uncached.length > 0) {
-      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const result = await db.execute(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${inList})`
-      );
-      for (const item of result.rows) {
-        cache.set(`${rel.table}:${item["id"]}`, item);
-      }
-    }
-    for (const row of rows) {
-      const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
-    }
-  } else if (rel.type === "junction") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const orderBy = rel.order_column ? import_drizzle_orm2.sql` ORDER BY "order" ASC` : import_drizzle_orm2.sql``;
-    const junctionResult = await db.execute(
-      import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
-    );
-    const jRows = junctionResult.rows;
-    const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
-    const uncached = rightIds.filter((id) => !cache.has(`${rel.table}:${id}`));
-    if (uncached.length > 0) {
-      const rightInList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const entitiesResult = await db.execute(
-        import_drizzle_orm2.sql`SELECT * FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})`
-      );
-      for (const item of entitiesResult.rows) {
-        cache.set(`${rel.table}:${item["id"]}`, item);
-      }
-    }
-    const byLeft = groupBy(jRows, rel.left_column);
-    for (const row of rows) {
-      const jEntries = byLeft[row["id"]] ?? [];
-      row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
-    }
-  } else if (rel.type === "media") {
-    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
-    if (fkValues.length === 0) {
-      for (const row of rows) row[fieldName] = null;
-      return;
-    }
-    const unique = [...new Set(fkValues)];
-    const uncached = unique.filter((id) => !cache.has(`media:${id}`));
-    if (uncached.length > 0) {
-      const inList = import_drizzle_orm2.sql.join(uncached.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-      const result = await db.execute(import_drizzle_orm2.sql`SELECT * FROM "media" WHERE id IN (${inList})`);
-      for (const item of result.rows) {
-        cache.set(`media:${item["id"]}`, item);
-      }
-    }
-    for (const row of rows) {
-      const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
-    }
-  }
-}
-async function resolveRelationBareIds(db, rows, fieldName, rel) {
-  if (rows.length === 0) return;
-  if (rel.type === "paragraph") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT id, parent_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
-    );
-    const byParent = groupBy(result.rows, "parent_id");
-    for (const row of rows) {
-      row[fieldName] = (byParent[row["id"]] ?? []).map((r) => r["id"]);
-    }
-  } else if (rel.type === "junction") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = import_drizzle_orm2.sql.join(parentIds.map((id) => import_drizzle_orm2.sql`${id}`), import_drizzle_orm2.sql`, `);
-    const result = await db.execute(
-      import_drizzle_orm2.sql`SELECT ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} AS left_id, ${import_drizzle_orm2.sql.raw(quoteIdent(rel.right_column))} AS right_id FROM ${import_drizzle_orm2.sql.raw(quoteIdent(rel.junction_table))} WHERE ${import_drizzle_orm2.sql.raw(quoteIdent(rel.left_column))} IN (${inList})`
-    );
-    const byLeft = groupBy(result.rows, "left_id");
-    for (const row of rows) {
-      row[fieldName] = (byLeft[row["id"]] ?? []).map((r) => r["right_id"]);
-    }
-  }
-}
-
 // src/routes/admin/content.ts
+init_relations();
 function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
@@ -2662,7 +3466,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 var import_drizzle_orm6 = require("drizzle-orm");
 var API_VERSION = (() => {
   try {
-    return "0.1.1";
+    return "0.3.0";
   } catch {
     return "0.0.0";
   }
@@ -2769,6 +3573,7 @@ function registerSchemaRoute(app, registry, db) {
 // src/repositories/content.ts
 var import_node_crypto3 = __toESM(require("crypto"));
 var import_drizzle_orm8 = require("drizzle-orm");
+init_relations();
 var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
 function codeError(code, message) {
   const err = new Error(message);
@@ -2824,7 +3629,7 @@ function whereFragment(conds) {
   return conds.length > 0 ? import_drizzle_orm8.sql` WHERE ${import_drizzle_orm8.sql.join(conds, import_drizzle_orm8.sql` AND `)}` : import_drizzle_orm8.sql``;
 }
 function createDrizzleContentRepository(db, tableName, options = {}) {
-  const { relations = {} } = options;
+  const { relations = {}, publishedRelations = false } = options;
   function tableRaw() {
     return import_drizzle_orm8.sql.raw(quoteIdent3(tableName));
   }
@@ -2837,7 +3642,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     }
     for (const [fieldName, rel] of Object.entries(relations)) {
       if (rel.type === "media") {
-        await resolveRelationField(db, rows, fieldName, rel, cache);
+        await resolveRelationField(db, rows, fieldName, rel, cache, publishedRelations);
       } else if (!include.includes(fieldName)) {
         await resolveRelationBareIds(db, rows, fieldName, rel);
       }
@@ -2845,7 +3650,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     for (const fieldName of include) {
       const rel = relations[fieldName];
       if (rel.type !== "media") {
-        await resolveRelationField(db, rows, fieldName, rel, cache);
+        await resolveRelationField(db, rows, fieldName, rel, cache, publishedRelations);
       }
     }
     return rows;
@@ -2966,6 +3771,9 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
   };
 }
 
+// src/app.ts
+init_relations();
+
 // src/repositories/media.ts
 var import_node_crypto4 = __toESM(require("crypto"));
 var import_drizzle_orm9 = require("drizzle-orm");
@@ -3078,9 +3886,19 @@ function createCmsApp(options) {
   const cmsName = options.name ?? "Manguito CMS";
   const maxFileSize = media?.max_file_size;
   const rolesRegistry = buildRolesRegistry(registry.roles.roles);
+  const resolverMap = options.resolvers ?? /* @__PURE__ */ new Map();
+  validateResolverBindings(registry, resolverMap);
+  const programmaticResolver = createProgrammaticResolver(resolverMap);
   const app = new import_hono.Hono();
   const uploadOrigins = storage.getUploadOrigins?.() ?? [];
-  app.use("*", createSecurityHeadersMiddleware({ connectSrc: uploadOrigins }));
+  const graphiqlEnabled = options.graphql?.enabled === true && options.graphql.graphiql === true;
+  app.use(
+    "*",
+    createSecurityHeadersMiddleware({
+      connectSrc: uploadOrigins,
+      ...graphiqlEnabled && { graphiqlPath: "/graphql" }
+    })
+  );
   app.use("*", createCorsMiddleware(cors ?? { origin: "*", enabled: true }));
   app.onError(errorHandler);
   const listRateLimit = resolveListRateLimit(rateLimit);
@@ -3115,7 +3933,8 @@ function createCmsApp(options) {
     Object.entries(registry.content_types).map(([typeName, ct]) => [
       typeName,
       createDrizzleContentRepository(db, ct.db.table_name, {
-        relations: buildRelationsMap(ct.fields, registry)
+        relations: buildRelationsMap(ct.fields, registry),
+        publishedRelations: true
       })
     ])
   );
@@ -3123,7 +3942,8 @@ function createCmsApp(options) {
     Object.entries(registry.taxonomy_types).map(([typeName, tt]) => [
       typeName,
       createDrizzleContentRepository(db, tt.db.table_name, {
-        relations: buildRelationsMap(tt.fields, registry)
+        relations: buildRelationsMap(tt.fields, registry),
+        publishedRelations: true
       })
     ])
   );
@@ -3162,8 +3982,37 @@ function createCmsApp(options) {
       paths: {}
     })
   );
-  registerPublicContentRoutes(app, registry, publicRepos, listRateLimit);
+  registerPublicContentRoutes(app, registry, publicRepos, listRateLimit, programmaticResolver);
   registerPublicMediaRoutes(app, mediaRepo, listRateLimit);
+  if (options.graphql?.enabled) {
+    const gqlOptions = options.graphql;
+    let gqlHandler = null;
+    let initError = null;
+    const ready = Promise.resolve().then(() => (init_handler(), handler_exports)).then(({ createGraphQLHandler: createGraphQLHandler2 }) => {
+      gqlHandler = createGraphQLHandler2(registry, publicRepos, programmaticResolver, db, gqlOptions);
+    }).catch((err) => {
+      initError = err;
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`\u2717 GraphQL schema failed to initialize; /graphql will return 500. ${message}
+`);
+    });
+    const invokeGraphQL = async (c) => {
+      if (!gqlHandler && !initError) await ready;
+      if (!gqlHandler) {
+        return c.json(
+          { ok: false, error: { code: "GRAPHQL_INIT_FAILED", message: "GraphQL schema failed to initialize" } },
+          500
+        );
+      }
+      return gqlHandler(c, async () => {
+      });
+    };
+    if (listRateLimit) {
+      app.all("/graphql", listRateLimit, invokeGraphQL);
+    } else {
+      app.all("/graphql", invokeGraphQL);
+    }
+  }
   registerConfigRoute(
     app,
     {
@@ -3210,19 +4059,33 @@ function createServer(options = {}) {
 }
 
 // src/index.ts
+function resolveGraphQL(cfg) {
+  const devDefault = process.env["NODE_ENV"] !== "production";
+  return {
+    enabled: cfg.enabled ?? false,
+    maxDepth: cfg.maxDepth ?? 8,
+    maxComplexity: cfg.maxComplexity ?? 1e3,
+    graphiql: cfg.graphiql ?? devDefault,
+    introspection: cfg.introspection ?? cfg.graphiql ?? devDefault
+  };
+}
 function createAPIAdapter(options = {}) {
   const prefix = options.prefix ?? "/api";
   const media = options.media?.max_file_size !== void 0 ? { max_file_size: options.media.max_file_size } : void 0;
   return {
     prefix,
     ...media !== void 0 && { media },
-    ...options.rateLimit !== void 0 && { rateLimit: options.rateLimit }
+    ...options.rateLimit !== void 0 && { rateLimit: options.rateLimit },
+    ...options.graphql !== void 0 && { graphql: resolveGraphQL(options.graphql) }
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createAPIAdapter,
   createCmsApp,
-  createServer
+  createProgrammaticResolver,
+  createServer,
+  resolverKey,
+  validateResolverBindings
 });
 //# sourceMappingURL=index.js.map